Stable/2.2.x #1

sp576 · 2021-03-12T18:11:53Z

Version 2.2.20 upgrade

Backport of 7fc07b9 from master

…ning with xgettext 0.21+. "format string with unnamed arguments cannot be properly localized" warning is not raised in xgettext 0.21+. This patch uses a message that causes an xgettext warning regardless of the version. Backport of 07a30f5 from master

Backport of 656b331 from master

…database. Backport of 135c800 from master

…a archive.extract(). Thanks Florian Apolloner, Shai Berger, and Simon Charette for reviews. Thanks Wang Baohua for the report. Backport of 05413af from master.

Backport of f749148 from master

Backport of d02d60e from master

…utils.http.limited_parse_qsl().

Backport of ab58f07 from master

…ia uploaded files. Thanks Claude Paroz for the initial patch. Thanks Dennis Brinkrolf for the report. Backport of d4d800c from main.

Backport of 1eac846 from main

… in file uploads.

Backport of 607ebbf and 62b2e8b from main

The validate_file_name() sanitation introduced in 0b79eb3 correctly rejects the example file name as containing path elements on Windows. This breaks the test introduced in 914c72b to allow path components for storages that may allow them. Test is skipped pending a discussed storage refactoring to support this use-case. Backport of a708f39 from main

…tabs from being accepted in URLValidator on Python 3.9.5+. In Python 3.9.5+ urllib.parse() automatically removes ASCII newlines and tabs from URLs [1, 2]. Unfortunately it created an issue in the URLValidator. URLValidator uses urllib.urlsplit() and urllib.urlunsplit() for creating a URL variant with Punycode which no longer contains newlines and tabs in Python 3.9.5+. As a consequence, the regular expression matched the URL (without unsafe characters) and the source value (with unsafe characters) was considered valid. [1] https://bugs.python.org/issue43882 and [2] python/cpython@76cd81d Backport of e1e81aa from main.

Backport of efebcc4 from main

Backport of d1f1417 from main.

- Validate filename returned by FileField.upload_to() not a filename passed to the FileField.generate_filename() (upload_to() may completely ignored passed filename). - Allow relative paths (without dot segments) in the generated filename. Thanks to Jakub Kleň for the report and review. Thanks to all folks for checking this patch on existing projects. Thanks Florian Apolloner and Markus Holtermann for the discussion and implementation idea. Regression in 0b79eb3. Backport of b556999 from main.

See sphinx-doc/sphinx@dd2ff3e. Backport of f0480dd from main

Backport of ae4077e from main.

Backport of 0cf2d48 from stable/3.2.x.

@te3t123

…upstream access control based on URL paths. Thanks Sjoerd Job Postmus and TengMA(@te3t123) for reports. Backport of d4dcd5b from main.

Backport of 8747052 from main

…n Django 2.2.25, 3.1.14, and 3.2.10. Follow up to d4dcd5b. Backport of 5de12a3 from main

…SimilarityValidator. Thanks Chris Bailey for the report. Co-authored-by: Adam Johnson <me@adamj.eu>

…e in dictsort template filter. Thanks to Dennis Brinkrolf for the report. Co-authored-by: Adam Johnson <me@adamj.eu>

…rage subsystem. Thanks to Dennis Brinkrolf for the report.

…ecurity archive. Backport of 63869ab from main

Backport of eeca934 from main.

…mplate tag. Thanks Keryn Knight for the report. Backport of 394517f from main. Co-authored-by: Adam Johnson <me@adamj.eu>

Thanks Alan Ryan for the report and initial patch. Backport of fc18f36 from main.

Backport of 9e0df0d from main

Backport of 770d3e6 from main.

See pallets/jinja#1621. Backport of 1d9d082 from main

….1.0+." This reverts commit 1d9d082. Backport of abfdb4d from main

Backport of 78277fa from main

…ate(), and extra() against SQL injection in column aliases. Thanks Splunk team: Preston Elder, Jacob Davis, Jacob Moore, Matt Hanson, David Briggs, and a security researcher: Danylo Dmytriiev (DDV_UA) for the report. Backport of 93cae5c from main.

… against SQL injection on PostgreSQL. Backport of 6723a26 from main.

Backport of 78eeff8 from main

carltongibson and others added 30 commits November 2, 2020 08:39

[2.2.x] Set release date for 2.2.17.

3db9a7a

Backport of 7fc07b9 from master

[2.2.x] Bumped version for 2.2.17 release.

c769f65

[2.2.x] Post-release version bump.

3da29a3

[2.2.x] Updated CVE URL.

e8e28e7

Backport of 656b331 from master

[2.2.x] Fixed GeoIPTest.test04_city() failure with the latest GeoIP2 …

ee9d623

…database. Backport of 135c800 from master

[2.2.x] Fixed CVE-2021-3281 -- Fixed potential directory-traversal vi…

21e7622

…a archive.extract(). Thanks Florian Apolloner, Shai Berger, and Simon Charette for reviews. Thanks Wang Baohua for the report. Backport of 05413af from master.

[2.2.x] Bumped version for 2.2.18 release.

fc0c8cf

[2.2.x] Post-release version bump.

06ae7e0

[2.2.x] Added CVE-2021-3281 to security archive.

34010d8

Backport of f749148 from master

[2.2.x] Added documentation extlink for bugs.python.org.

226d831

Backport of d02d60e from master

[2.2.x] Fixed CVE-2021-23336 -- Fixed web cache poisoning via django.…

fd6b6af

…utils.http.limited_parse_qsl().

[2.2.x] Bumped version for 2.2.19 release.

21a5547

[2.2.x] Post-release version bump.

1fb4628

[2.2.x] Added CVE-2021-23336 to security archive.

6e58828

Backport of ab58f07 from master

[2.2.x] Fixed CVE-2021-28658 -- Fixed potential directory-traversal v…

4036d62

…ia uploaded files. Thanks Claude Paroz for the initial patch. Thanks Dennis Brinkrolf for the report. Backport of d4d800c from main.

[2.2.x] Bumped version for 2.2.20 release.

ad9fa56

[2.2.x] Post-release version bump.

e95fbb6

[2.2.x] Added CVE-2021-28658 to security archive.

7f1b088

Backport of 1eac846 from main

[2.2.x] Fixed CVE-2021-31542 -- Tightened path & file name sanitation…

04ac162

… in file uploads.

[2.2.x] Bumped version for 2.2.21 release.

ff1385a

[2.2.x] Post-release version bump.

3931dc7

[2.2.x] Added CVE-2021-31542 to security archive.

bcafd9b

Backport of 607ebbf and 62b2e8b from main

[2.2.x] Bumped version for 2.2.22 release.

df9fd46

[2.2.x] Post-release version bump.

7ada1f9

[2.2.x] Added CVE-2021-32052 to security archive.

88d9b28

Backport of efebcc4 from main

[2.2.x] Refs #32718 -- Corrected CVE-2021-31542 release notes.

3ba089a

Backport of d1f1417 from main.

felixxm and others added 30 commits November 18, 2021 13:33

[2.2.x] Fixed crash building HTML docs since Sphinx 4.3.

4bc10b7

See sphinx-doc/sphinx@dd2ff3e. Backport of f0480dd from main

[2.2.x] Added stub release notes for 2.2.25.

fac0fdd

Backport of ae4077e from main.

[2.2.x] Added requirements.txt to files ignored by Sphinx builds.

0007a5f

Backport of 0cf2d48 from stable/3.2.x.

[2.2.x] Fixed #30530, CVE-2021-44420 -- Fixed potential bypass of an …

7cf7d74

…upstream access control based on URL paths. Thanks Sjoerd Job Postmus and TengMA(@te3t123) for reports. Backport of d4dcd5b from main.

[2.2.x] Bumped version for 2.2.25 release.

79d8dce

[2.2.x] Post-release version bump.

8439938

[2.2.x] Added CVE-2021-44420 to security archive.

573e70e

Backport of 8747052 from main

[2.2.x] Refs #33365, Refs #30530 -- Doc'd re_path() behavior change i…

b878206

…n Django 2.2.25, 3.1.14, and 3.2.10. Follow up to d4dcd5b. Backport of 5de12a3 from main

[2.2.x] Added stub release notes for 2.2.26 release.

03b733d

[2.2.x] Fixed CVE-2021-45115 -- Prevented DoS vector in UserAttribute…

2135637

…SimilarityValidator. Thanks Chris Bailey for the report. Co-authored-by: Adam Johnson <me@adamj.eu>

[2.2.x] Fixed CVE-2021-45116 -- Fixed potential information disclosur…

c9f648c

…e in dictsort template filter. Thanks to Dennis Brinkrolf for the report. Co-authored-by: Adam Johnson <me@adamj.eu>

[2.2.x] Fixed CVE-2021-45452 -- Fixed potential path traversal in sto…

4cb35b3

…rage subsystem. Thanks to Dennis Brinkrolf for the report.

2.2.x] Bumped version for 2.2.26 release.

44e7cca

[2.2.x] Post-release version bump.

e085d46

[2.2.x] Added CVE-2021-45115, CVE-2021-45116, and CVE-2021-45452 to s…

77d0fe5

…ecurity archive. Backport of 63869ab from main

[2.2.x] Added stub release notes 2.2.27.

4cafd3a

Backport of eeca934 from main.

[2.2.x] Fixed CVE-2022-22818 -- Fixed possible XSS via {% debug %} te…

c27a7eb

…mplate tag. Thanks Keryn Knight for the report. Backport of 394517f from main. Co-authored-by: Adam Johnson <me@adamj.eu>

[2.2.x] Fixed CVE-2022-23833 -- Fixed DoS possiblity in file uploads.

c477b76

Thanks Alan Ryan for the report and initial patch. Backport of fc18f36 from main.

[2.2.x] Bumped version for 2.2.27 release.

e541f2d

[2.2.x] Post-release version bump.

2427b2f

[2.2.x] Added CVE-2022-22818 and CVE-2022-23833 to security archive.

047ece3

Backport of 9e0df0d from main

[2.2.x] Fixed typo in release notes.

9d13d8c

Backport of 770d3e6 from main.

[2.2.x] Fixed forms_tests.tests.test_renderers with Jinja 3.1.0+.

e03648f

See pallets/jinja#1621. Backport of 1d9d082 from main

[2.2.x] Reverted "Fixed forms_tests.tests.test_renderers with Jinja 3…

2801f29

….1.0+." This reverts commit 1d9d082. Backport of abfdb4d from main

[2.2.x] Added stub release notes for 2.2.28.

8352b98

Backport of 78277fa from main

[2.2.x] Fixed CVE-2022-28347 -- Protected QuerySet.explain(**options)…

29a6c98

… against SQL injection on PostgreSQL. Backport of 6723a26 from main.

[2.2.x] Bumped version for 2.2.28 release.

5c33000

[2.2.x] Post-release version bump.

d3731c9

[2.2.x] Added CVE-2022-28346 and CVE-2022-28347 to security archive.

2a62cdc

Backport of 78eeff8 from main

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Stable/2.2.x #1

Stable/2.2.x #1

Uh oh!

sp576 commented Mar 12, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants

Stable/2.2.x #1

Are you sure you want to change the base?

Stable/2.2.x #1

Uh oh!

Conversation

sp576 commented Mar 12, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants