NOTICE: This package has been removed from pkgsrc

./www/py-django2, Django, a high-level Python Web framework

[ CVSweb ] [ Homepage ] [ RSS ] [ Required by ]

Branch: CURRENT, Version: 2.2.28, Package name: py310-django-2.2.28, Maintainer: pkgsrc-users

Django is a high-level Python Web framework that encourages rapid development
and clean, pragmatic design. Django was designed to make common Web-development
tasks fast and easy.


Required to run:
[devel/py-setuptools] [time/py-pytz] [lang/python37]

Required to build:
[pkgtools/cwrappers]

Master sites:

Filesize: 8972.21 KB

Version history: (Expand)

CVS history: (Expand)


   2022-11-09 14:14:32 by Joerg Sonnenberger | Files touched by this commit (223) 
Log message:
Reset MAINTAINER
   2022-04-20 14:28:57 by Adam Ciarcinski | Files touched by this commit (2) | Package updated
Log message:
py-django2: updated to 2.2.28

Django 2.2.28 fixes two security issues with severity “high” in 2.2.27.

CVE-2022-28346: Potential SQL injection in QuerySet.annotate(), aggregate(), and \ 
extra()

QuerySet.annotate(), aggregate(), and extra() methods were subject to SQL \ 
injection in column aliases, using a suitably crafted dictionary, with \ 
dictionary expansion, as the **kwargs passed to these methods.

CVE-2022-28347: Potential SQL injection via QuerySet.explain(**options) on PostgreSQL

QuerySet.explain() method was subject to SQL injection in option names, using a \ 
suitably crafted dictionary, with dictionary expansion, as the **options \ 
argument.
   2022-02-02 11:17:20 by Adam Ciarcinski | Files touched by this commit (2) | Package updated
Log message:
py-django2: updated to 2.2.27

Django 2.2.27 fixes two security issues with severity “medium” in 2.2.26.

CVE-2022-22818: Possible XSS via {% debug %} template tag

CVE-2022-23833: Denial-of-service possibility in file uploads
   2022-01-19 10:48:47 by Adam Ciarcinski | Files touched by this commit (2) | Package updated
Log message:
py-django2: updated to 2.2.26

Django 2.2.26 fixes one security issue with severity “medium” and two \ 
security issues with severity “low” in 2.2.25.
- CVE-2021-45115: Denial-of-service possibility in UserAttributeSimilarityValidator
- CVE-2021-45116: Potential information disclosure in dictsort template filter
- CVE-2021-45452: Potential directory-traversal via Storage.save()
   2022-01-05 16:51:59 by Thomas Klausner | Files touched by this commit (4) 
Log message:
py-django*: switch to USE_PKG_RESOURCES
   2022-01-05 11:09:54 by Thomas Klausner | Files touched by this commit (4) 
Log message:
py-django*: add dependency on py-setuptools

These use pkg_resources.

Noted by joerg.

Bump PKGREVISION.
   2022-01-04 21:55:40 by Thomas Klausner | Files touched by this commit (1595) 
Log message:
*: bump PKGREVISION for egg.mk users

They now have a tool dependency on py-setuptools instead of a DEPENDS
   2021-12-14 09:57:48 by Adam Ciarcinski | Files touched by this commit (2) | Package updated
Log message:
py-django2: updated to 2.2.25

2.2.25:

CVE-2021-44420: Potential bypass of an upstream access control based on URL paths

HTTP requests for URLs with trailing newlines could bypass an upstream access \ 
control based on URL paths.