Subject: CVS commit: pkgsrc/www/py-django3
From: Adam Ciarcinski
Date: 2020-03-12 17:18:54
Message id: 20200312161854.3B9FBFB27@cvs.NetBSD.org

Log Message:
py-django3: updated to 3.0.4

Django 3.0.4 fixes a security issue and several bugs in 3.0.3.

CVE-2020-9402: Potential SQL injection via tolerance parameter in GIS functions \ 
and aggregates on Oracle

GIS functions and aggregates on Oracle were subject to SQL injection, using a \ 
suitably crafted tolerance.

Bugfixes

Fixed a data loss possibility when using caching from async code.
Fixed a regression in Django 3.0 that caused a file response using a temporary \ 
file to be closed incorrectly.
Fixed a data loss possibility in the select_for_update(). When using related \ 
fields or parent link fields with Multi-table inheritance in the of argument, \ 
the corresponding models were not locked.
Fixed a regression in Django 3.0 that caused misplacing parameters in logged SQL \ 
queries on Oracle.
Fixed a regression in Django 3.0.3 that caused misplacing parameters of SQL \ 
queries when subtracting DateField or DateTimeField expressions on MySQL.
Fixed a regression in Django 3.0 that didn’t include subqueries spanning \ 
multivalued relations in the GROUP BY clause

Files:
RevisionActionfile
1.2modifypkgsrc/www/py-django3/Makefile
1.2modifypkgsrc/www/py-django3/distinfo