Re: [Django] #28581: Pagination topic docs need a little restructuring

[Django]

#28581: Pagination topic docs need a little restructuring
--+
 Reporter:  luto  |Owner:  (none)
 Type:  Cleanup/optimization  |   Status:  new
Component:  Documentation |  Version:  master
 Severity:  Normal|   Resolution:
 Keywords:| Triage Stage:  Accepted
Has patch:  1 |  Needs documentation:  0
  Needs tests:  0 |  Patch needs improvement:  1
Easy pickings:  1 |UI/UX:  0
--+
Changes (by armansabyr):

 * owner:  armansabyr => (none)
 * status:  assigned => new


-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/062.b6847549881ef412b7063a1fc4c46135%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.

Re: [Django] #30286: Model's ID is being overwritten when GenericForeignKey is assigned

[Django]

#30286: Model's ID is being overwritten when GenericForeignKey is assigned
-+-
 Reporter:  Samuel Labrador  |Owner:  nobody
 Type:  New feature  |   Status:  closed
Component:   |  Version:  2.1
  contrib.contenttypes   |
 Severity:  Normal   |   Resolution:  invalid
 Keywords:  GenericForeignKey| Triage Stage:
  Content|  Unreviewed
Has patch:  0|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-
Changes (by Samuel Labrador):

 * status:  new => closed
 * resolution:   => invalid
 * type:  Bug => New feature


Old description:

> When a Model with a GenericForeignKey field is assigned, the model's id
> is overwritten with the GenericForeignKey's id on assignment.
>
> I am using a mySQL database (Ver 14.14 Distrib 5.6.28), Python3(3.7.2),
> and django(2.1.7)
>
> Models:
> {{{
> class Incident(models.Model):
> start_timestamp = models.DateTimeField(auto_now=True)
> class Meta:
> abstract = True
>
> class DailyLog(Incident):
> date = models.DateField(auto_now=True)
> entries = GenericRelation(DailyLogHistory, object_id_field='id',
> content_type_field='incident_type')
>
> class Data(models.Model):
> creator = models.CharField(max_length=255)
> creator_details = models.TextField(blank=True, null=True,
> default=None)
> timestamp = models.DateTimeField(auto_now=True)
> incident_type = models.ForeignKey(ContentType,
> on_delete=models.CASCADE, primary_key=False, unique=False, blank=True,
> null=True)
> incident_object = GenericForeignKey('incident_type', 'id')
> class Meta:
> abstract = True
>
> class DailyLogHistory(Data):
> selections = CSVField(blank=True, null=True, default=None)
>
>  }}}
>
> code that produces the bug:
>
> {{{
> incident = DailyLog.objects.get(id=1)
>
> x = DailyLogHistory(
> selections=['123456'],
> creator='sam',
> )
> x.save()
>
> print(x) # Shows the correct auto-incremented id != 1
> x.incident_object = incident
> print(x) # Shows that id == 1
>
> }}}

New description:

 Not a bug. Stupid error on my part. The GenericForeignKey id is the same
 as that specified in the model.

--

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/072.2b14350c17b4b15d3248f10bf5411290%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.

Re: [Django] #29791: Engine.render_to_string() should honor the autoescape attribute

[Django]

#29791: Engine.render_to_string() should honor the autoescape attribute
-+-
 Reporter:  Claude Paroz |Owner:  Nathan
 |  Gaberel
 Type:  Bug  |   Status:  assigned
Component:  Template system  |  Version:  master
 Severity:  Normal   |   Resolution:
 Keywords:   | Triage Stage:  Accepted
Has patch:  1|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-
Changes (by Nathan Gaberel):

 * owner:  Claude Paroz => Nathan Gaberel
 * has_patch:  0 => 1


Comment:

 I went ahead and wrote a patch for it, hopefully Claude won't mind. :)
 [https://github.com/django/django/pull/9 PR]

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/065.70af32276be831e3a3be167245528745%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.

Re: [Django] #30286: Model's ID is being overwritten when GenericForeignKey is assigned

[Django]

#30286: Model's ID is being overwritten when GenericForeignKey is assigned
-+-
 Reporter:  Samuel Labrador  |Owner:  nobody
 Type:  Bug  |   Status:  new
Component:   |  Version:  2.1
  contrib.contenttypes   |
 Severity:  Normal   |   Resolution:
 Keywords:  GenericForeignKey| Triage Stage:
  Content|  Unreviewed
Has patch:  0|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-
Description changed by Samuel Labrador:

Old description:

> When a Model with a GenericForeignKey field is assigned, the model's id
> is overwritten with the GenericForeignKey's id on assignment.
>
> I am using a mySQL database (Ver 14.14 Distrib 5.6.28), Python3(3.7.2),
> and django(2.1.7)
>
> Models:
> {{{
> class Incident(models.Model):
> start_timestamp = models.DateTimeField(auto_now=True)
> class Meta:
> abstract = True
>
> class DailyLog(Incident):
> date = models.DateField(auto_now=True)
> entries = GenericRelation(DailyLogHistory, object_id_field='id',
> content_type_field='incident_type')
>
> class Data(models.Model):
> creator = models.CharField(max_length=255)
> creator_details = models.TextField(blank=True, null=True,
> default=None)
> timestamp = models.DateTimeField(auto_now=True)
> incident_type = models.ForeignKey(ContentType,
> on_delete=models.CASCADE, primary_key=False, unique=False, blank=True,
> null=True)
> incident_object = GenericForeignKey('incident_type', 'id')
> class Meta:
> abstract = True
>
> class DailyLogHistory(Data):
> selections = CSVField(blank=True, null=True, default=None)
>
>  }}}
>
> code that produces the bug:
>
> {{{
> incident = DailyLog.objects.get(id=1)
>
> x = DailyLogData(
> selections=['123456'],
> creator='sam',
> )
> x.save()
>
> print(x) # Shows the correct auto-incremented id != 1
> x.incident_object = incident
> print(x) # Shows that id == 1
>
> }}}

New description:

 When a Model with a GenericForeignKey field is assigned, the model's id is
 overwritten with the GenericForeignKey's id on assignment.

 I am using a mySQL database (Ver 14.14 Distrib 5.6.28), Python3(3.7.2),
 and django(2.1.7)

 Models:
 {{{
 class Incident(models.Model):
 start_timestamp = models.DateTimeField(auto_now=True)
 class Meta:
 abstract = True

 class DailyLog(Incident):
 date = models.DateField(auto_now=True)
 entries = GenericRelation(DailyLogHistory, object_id_field='id',
 content_type_field='incident_type')

 class Data(models.Model):
 creator = models.CharField(max_length=255)
 creator_details = models.TextField(blank=True, null=True,
 default=None)
 timestamp = models.DateTimeField(auto_now=True)
 incident_type = models.ForeignKey(ContentType,
 on_delete=models.CASCADE, primary_key=False, unique=False, blank=True,
 null=True)
 incident_object = GenericForeignKey('incident_type', 'id')
 class Meta:
 abstract = True

 class DailyLogHistory(Data):
 selections = CSVField(blank=True, null=True, default=None)

  }}}

 code that produces the bug:

 {{{
 incident = DailyLog.objects.get(id=1)

 x = DailyLogHistory(
 selections=['123456'],
 creator='sam',
 )
 x.save()

 print(x) # Shows the correct auto-incremented id != 1
 x.incident_object = incident
 print(x) # Shows that id == 1

 }}}

--

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/072.50005304d3468c65a4e25812212a18bf%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.

Re: [Django] #30286: Model's ID is being overwritten when GenericForeignKey is assigned

[Django]

#30286: Model's ID is being overwritten when GenericForeignKey is assigned
-+-
 Reporter:  Samuel Labrador  |Owner:  nobody
 Type:  Bug  |   Status:  new
Component:   |  Version:  2.1
  contrib.contenttypes   |
 Severity:  Normal   |   Resolution:
 Keywords:  GenericForeignKey| Triage Stage:
  Content|  Unreviewed
Has patch:  0|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-
Description changed by Samuel Labrador:

Old description:

> When a Model with a GenericForeignKey field is assigned, the model's id
> is overwritten with the GenericForeignKey's id on assignment.
>
> I am using a mySQL database (Ver 14.14 Distrib 5.6.28), Python3(3.7.2),
> and django(2.1.7)
>
> Models:
> {{{
> class Incident(models.Model):
> start_timestamp = models.DateTimeField(auto_now=True)
> class Meta:
> abstract = True
>
> class DailyLog(Incident):
> date = models.DateField(auto_now=True)
> entries = GenericRelation(DailyLogData, object_id_field='id',
> content_type_field='incident_type')
>
> class Data(models.Model):
> creator = models.CharField(max_length=255)
> creator_details = models.TextField(blank=True, null=True,
> default=None)
> timestamp = models.DateTimeField(auto_now=True)
> incident_type = models.ForeignKey(ContentType,
> on_delete=models.CASCADE, primary_key=False, unique=False, blank=True,
> null=True)
> incident_object = GenericForeignKey('incident_type', 'id')
> class Meta:
> abstract = True
>
> class DailyLogHistory(Data):
> selections = CSVField(blank=True, null=True, default=None)
>
>  }}}
>
> code that produces the bug:
>
> {{{
> incident = DailyLog.objects.get(id=1)
>
> x = DailyLogData(
> selections=['123456'],
> creator='sam',
> )
> x.save()
>
> print(x) # Shows the correct auto-incremented id != 1
> x.incident_object = incident
> print(x) # Shows that id == 1
>
> }}}

New description:

 When a Model with a GenericForeignKey field is assigned, the model's id is
 overwritten with the GenericForeignKey's id on assignment.

 I am using a mySQL database (Ver 14.14 Distrib 5.6.28), Python3(3.7.2),
 and django(2.1.7)

 Models:
 {{{
 class Incident(models.Model):
 start_timestamp = models.DateTimeField(auto_now=True)
 class Meta:
 abstract = True

 class DailyLog(Incident):
 date = models.DateField(auto_now=True)
 entries = GenericRelation(DailyLogHistory, object_id_field='id',
 content_type_field='incident_type')

 class Data(models.Model):
 creator = models.CharField(max_length=255)
 creator_details = models.TextField(blank=True, null=True,
 default=None)
 timestamp = models.DateTimeField(auto_now=True)
 incident_type = models.ForeignKey(ContentType,
 on_delete=models.CASCADE, primary_key=False, unique=False, blank=True,
 null=True)
 incident_object = GenericForeignKey('incident_type', 'id')
 class Meta:
 abstract = True

 class DailyLogHistory(Data):
 selections = CSVField(blank=True, null=True, default=None)

  }}}

 code that produces the bug:

 {{{
 incident = DailyLog.objects.get(id=1)

 x = DailyLogData(
 selections=['123456'],
 creator='sam',
 )
 x.save()

 print(x) # Shows the correct auto-incremented id != 1
 x.incident_object = incident
 print(x) # Shows that id == 1

 }}}

--

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/072.83247844b6acc81abcd2be9d98f5c833%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.

[Django] #30286: Model's ID is being overwritten when GenericForeignKey is assigned

[Django]

#30286: Model's ID is being overwritten when GenericForeignKey is assigned
-+-
   Reporter:  Samuel |  Owner:  nobody
  Labrador   |
   Type:  Bug| Status:  new
  Component: |Version:  2.1
  contrib.contenttypes   |   Keywords:  GenericForeignKey
   Severity:  Normal |  Content
   Triage Stage: |  Has patch:  0
  Unreviewed |
Needs documentation:  0  |Needs tests:  0
Patch needs improvement:  0  |  Easy pickings:  0
  UI/UX:  0  |
-+-
 When a Model with a GenericForeignKey field is assigned, the model's id is
 overwritten with the GenericForeignKey's id on assignment.

 I am using a mySQL database (Ver 14.14 Distrib 5.6.28), Python3(3.7.2),
 and django(2.1.7)

 Models:
 {{{
 class Incident(models.Model):
 start_timestamp = models.DateTimeField(auto_now=True)
 class Meta:
 abstract = True

 class DailyLog(Incident):
 date = models.DateField(auto_now=True)
 entries = GenericRelation(DailyLogData, object_id_field='id',
 content_type_field='incident_type')

 class Data(models.Model):
 creator = models.CharField(max_length=255)
 creator_details = models.TextField(blank=True, null=True,
 default=None)
 timestamp = models.DateTimeField(auto_now=True)
 incident_type = models.ForeignKey(ContentType,
 on_delete=models.CASCADE, primary_key=False, unique=False, blank=True,
 null=True)
 incident_object = GenericForeignKey('incident_type', 'id')
 class Meta:
 abstract = True

 class DailyLogHistory(Data):
 selections = CSVField(blank=True, null=True, default=None)

  }}}

 code that produces the bug:

 {{{
 incident = DailyLog.objects.get(id=1)

 x = DailyLogData(
 selections=['123456'],
 creator='sam',
 )
 x.save()

 print(x) # Shows the correct auto-incremented id != 1
 x.incident_object = incident
 print(x) # Shows that id == 1

 }}}

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/057.081b6f80789ba23fefddff755be47895%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.

Re: [Django] #30259: Support the use of admin_order_field on properties in the admin.

[Django]

#30259: Support the use of admin_order_field on properties in the admin.
-+-
 Reporter:  Tobias Wiese |Owner:  Jani
 |  Tiainen
 Type:  New feature  |   Status:  closed
Component:  contrib.admin|  Version:  master
 Severity:  Normal   |   Resolution:  fixed
 Keywords:   | Triage Stage:  Ready for
 |  checkin
Has patch:  1|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  1|UI/UX:  0
-+-
Changes (by Mariusz Felisiak ):

 * status:  assigned => closed
 * resolution:   => fixed


Comment:

 In [changeset:"044cc544203fdcf2601ff200547ecae2e51a5db5" 044cc544]:
 {{{
 #!CommitTicketReference repository=""
 revision="044cc544203fdcf2601ff200547ecae2e51a5db5"
 Fixed #30259 -- Added support for admin_order_field attribute on
 properties in ModelAdmin.list_display.
 }}}

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/069.e58a7d5c7ac64677a1205aed59d89698%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.

Re: [Django] #30259: Support the use of admin_order_field on properties in the admin.

[Django]

#30259: Support the use of admin_order_field on properties in the admin.
-+-
 Reporter:  Tobias Wiese |Owner:  Jani
 |  Tiainen
 Type:  New feature  |   Status:  assigned
Component:  contrib.admin|  Version:  master
 Severity:  Normal   |   Resolution:
 Keywords:   | Triage Stage:  Ready for
 |  checkin
Has patch:  1|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  1|UI/UX:  0
-+-
Changes (by felixxm):

 * type:  Bug => New feature


-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/069.008677d7194a6e45b43e9644401c1a16%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.

Re: [Django] #30236: UsernameField should use autocapitalize="none"

[Django]

#30236: UsernameField should use autocapitalize="none"
-+-
 Reporter:  Clayton Daley|Owner:
 Type:   |  pmisteliac
  Cleanup/optimization   |   Status:  assigned
Component:  contrib.auth |  Version:  2.1
 Severity:  Normal   |   Resolution:
 Keywords:   | Triage Stage:  Accepted
Has patch:  1|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-
Changes (by pmisteliac):

 * has_patch:  0 => 1


Comment:

 PR https://github.com/django/django/pull/7 posted

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/070.e362a57bef1c8a7e407e32188b1d119a%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.

Re: [Django] #28667: Documentation for extending UserCreationForm doesn't work with UserAdmin

[Django]

#28667: Documentation for extending UserCreationForm doesn't work with UserAdmin
-+-
 Reporter:  Nathanael Gordon |Owner:
 Type:   |  armansabyr
  Cleanup/optimization   |   Status:  assigned
Component:  contrib.auth |  Version:  1.11
 Severity:  Normal   |   Resolution:
 Keywords:  add_fieldsets| Triage Stage:  Accepted
  UserAdmin UserCreationForm Custom  |
  Auth User Model|
Has patch:  0|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  1|UI/UX:  0
-+-
Changes (by armansabyr):

 * owner:  (none) => armansabyr
 * status:  new => assigned


-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/066.84c9f7cdb8934ad0539feed4da51d931%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.

Re: [Django] #28581: Pagination topic docs need a little restructuring

[Django]

#28581: Pagination topic docs need a little restructuring
-+-
 Reporter:  luto |Owner:
 Type:   |  armansabyr
  Cleanup/optimization   |   Status:  assigned
Component:  Documentation|  Version:  master
 Severity:  Normal   |   Resolution:
 Keywords:   | Triage Stage:  Accepted
Has patch:  1|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  1
Easy pickings:  1|UI/UX:  0
-+-
Changes (by armansabyr):

 * owner:  (none) => armansabyr
 * status:  new => assigned


-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/062.fac74ab598fc08d25245882c56155fa2%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.

Re: [Django] #30170: Refactor and simplify wrapping variables on Oracle

[Django]

#30170: Refactor and simplify wrapping variables on Oracle
-+-
 Reporter:  felixxm  |Owner:  felixxm
 Type:   |   Status:  assigned
  Cleanup/optimization   |
Component:  Database layer   |  Version:  master
  (models, ORM)  |
 Severity:  Normal   |   Resolution:
 Keywords:  Oracle cx_Oracle | Triage Stage:  Accepted
Has patch:  0|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-

Comment (by Jani Tiainen):

 Note that since latest cx_Oracle versions (6.x+ at least) there is support
 to read and write UDT (User Data Type) directly via cx_Oracle. Current
 parameter handling makes it difficult to pass such types via Django due
 parameter wrapping.

 Practical usage of this scenario is to allow Oracle GIS backend to
 manipulate SDO_GEOMETRY objects directly without doing very slow WKT
 conversions.

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/065.fa2f32f4e7aa7b2d92d0eff60cf5133a%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.

Re: [Django] #30272: get_language_from_path not respecting i18n_patterns prefix_default_language=False

[Django]

#30272: get_language_from_path not respecting i18n_patterns
prefix_default_language=False
-+-
 Reporter:  Stefan Wehrmeyer |Owner:  nobody
 Type:  Bug  |   Status:  new
Component:   |  Version:  2.1
  Internationalization   |
 Severity:  Normal   |   Resolution:
 Keywords:   | Triage Stage:
 |  Unreviewed
Has patch:  0|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-
Changes (by Carlton Gibson):

 * status:  closed => new
 * resolution:  wontfix =>


Comment:

 OK, I'll re-open to have another look. (If you do have that test case,
 that would be super.)

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/065.09d7ee5116dd3394c37c36f570aa8a17%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.

[Django] #30285: The domain in broken link emails can be spoofed

[Django]

#30285: The domain in broken link emails can be spoofed
+
   Reporter:  orlnub123 |  Owner:  nobody
   Type:  Bug   | Status:  new
  Component:  Core (Other)  |Version:  master
   Severity:  Normal|   Keywords:  middleware
   Triage Stage:  Unreviewed|  Has patch:  1
Needs documentation:  0 |Needs tests:  0
Patch needs improvement:  0 |  Easy pickings:  0
  UI/UX:  0 |
+
 When using BrokenLinkEmailsMiddleware, if an incoming request with a
 spoofed HTTP Host header 404s it'll use the spoofed header in the email
 subject.
 This isn't a big issue because the HTTP Host header gets validated against
 settings.ALLOWED_HOSTS, so it's only applicable on sites with multiple
 domains or with multiple settings.ALLOWED_HOSTS values.

 Here's a demo on a site with multiple settings.ALLOWED_HOSTS values:

 ''We start the server.''
 {{{
 [orlnub123@orlnub123 mysite]$ ./manage.py runserver
 Performing system checks...

 System check identified no issues (0 silenced).
 March 24, 2019 - 05:38:46
 Django version 2.1.7, using settings 'mysite.settings'
 Starting development server at http://127.0.0.1:8000/
 Quit the server with CONTROL-C.
 }}}

 ''Then send a normal request. The referer header here is important;
 without it the email won't get sent.''
 {{{
 [orlnub123@orlnub123 mysite]$ curl -H 'Referer:
 http://example.com/referrer' -w '\n' localhost:8000
 Not FoundThe requested resource was not found on this
 server.
 }}}

 ''We get the email; everything looks good.''
 {{{
 Content-Type: text/plain; charset="utf-8"
 MIME-Version: 1.0
 Content-Transfer-Encoding: 7bit
 Subject: [Django] Broken link on localhost:8000
 From: root@localhost
 To: j...@example.com
 Date: Sun, 24 Mar 2019 05:38:49 -
 Message-ID:
 <155340592942.14004.17031704219271235623@orlnub123.localdomain>

 Referrer: http://example.com/referrer
 Requested URL: /
 User agent: curl/7.64.0
 IP address: 127.0.0.1

 ---
 [24/Mar/2019 05:38:49] "GET / HTTP/1.1" 404 77
 }}}

 ''We send another request; this time with a spoofed host header.''
 {{{
 [orlnub123@orlnub123 mysite]$ curl -H 'Referer:
 http://example.com/referrer' -H 'Host: example.com' -w '\n' localhost:8000
 Not FoundThe requested resource was not found on this
 server.
 }}}

 ''Oh no! The subject contains our spoofed header and presents the link as
 an internal one.''
 {{{
 Content-Type: text/plain; charset="utf-8"
 MIME-Version: 1.0
 Content-Transfer-Encoding: 7bit
 Subject: [Django] Broken INTERNAL link on example.com
 From: root@localhost
 To: j...@example.com
 Date: Sun, 24 Mar 2019 05:38:59 -
 Message-ID:
 <155340593990.14004.12227248404736375101@orlnub123.localdomain>

 Referrer: http://example.com/referrer
 Requested URL: /
 User agent: curl/7.64.0
 IP address: 127.0.0.1

 ---
 [24/Mar/2019 05:38:59] "GET / HTTP/1.1" 404 77
 }}}

 I've fixed it by replacing the `request.get_host()` call with
 `get_current_site(request).domain`. This approach falls back to using
 `request.get_host()` internally on sites that don't use the sites
 framework. It isn't perfect, but it replicates what many other components
 do.

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/052.f89411e5085bd05ea6a66ad1483628c6%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.