CVS commit: pkgsrc/www/py-django2

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Thu Dec 19 13:40:36 UTC 2019

Modified Files:
        pkgsrc/www/py-django2: Makefile distinfo

Log Message:
py-django2: updated to 2.2.9

Django 2.2.9 fixes a security issue and a data loss bug in 2.2.8.

CVE-2019-19844: Potential account hijack via password reset form

By submitting a suitably crafted email address making use of Unicode characters, that compared equal to an existing user email when lower-cased for comparison, an attacker could be sent a password 
reset token for the matched account.

In order to avoid this vulnerability, password reset requests now compare the submitted email using the stricter, recommended algorithm for case-insensitive comparison of two identifiers from Unicode 
Technical Report 36, section 2.11.2(B)(2). Upon a match, the email containing the reset token will be sent to the email address on record rather than the submitted address.

Bugfixes
* Fixed a data loss possibility in SplitArrayField. When using with ArrayField(BooleanField()), all values after the first True value were marked as checked instead of preserving passed values


To generate a diff of this commit:
cvs rdiff -u -r1.23 -r1.24 pkgsrc/www/py-django2/Makefile
cvs rdiff -u -r1.21 -r1.22 pkgsrc/www/py-django2/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/py-django2/Makefile
diff -u pkgsrc/www/py-django2/Makefile:1.23 pkgsrc/www/py-django2/Makefile:1.24
--- pkgsrc/www/py-django2/Makefile:1.23 Mon Dec  2 11:46:56 2019
+++ pkgsrc/www/py-django2/Makefile      Thu Dec 19 13:40:36 2019
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.23 2019/12/02 11:46:56 adam Exp $
+# $NetBSD: Makefile,v 1.24 2019/12/19 13:40:36 adam Exp $
 
-DISTNAME=      Django-2.2.8
+DISTNAME=      Django-2.2.9
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME:tl}
 CATEGORIES=    www python
 MASTER_SITES=  https://www.djangoproject.com/m/releases/${PKGVERSION_NOREV:R}/

Index: pkgsrc/www/py-django2/distinfo
diff -u pkgsrc/www/py-django2/distinfo:1.21 pkgsrc/www/py-django2/distinfo:1.22
--- pkgsrc/www/py-django2/distinfo:1.21 Mon Dec  2 11:46:56 2019
+++ pkgsrc/www/py-django2/distinfo      Thu Dec 19 13:40:36 2019
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.21 2019/12/02 11:46:56 adam Exp $
+$NetBSD: distinfo,v 1.22 2019/12/19 13:40:36 adam Exp $
 
-SHA1 (Django-2.2.8.tar.gz) = 0a631fe2237fea6a60cdd5d02b618632b6e49a1b
-RMD160 (Django-2.2.8.tar.gz) = ae25304c6a33c48abaddc4670b8e46de9fe675b3
-SHA512 (Django-2.2.8.tar.gz) = b704c6def495e76651cf8a031ffc2e7bd7d0ac73c68efba903053cd379bcdd7e98f2083d8e1e121bb5a4da7ef8a126d442b12aad33f85f1059b1defcc48d843b
-Size (Django-2.2.8.tar.gz) = 8870662 bytes
+SHA1 (Django-2.2.9.tar.gz) = c5a1c4bec360b4e98e839fcf6088b8eb1599c1ed
+RMD160 (Django-2.2.9.tar.gz) = 3b7ab863a598712df81ce34120ca514482beb509
+SHA512 (Django-2.2.9.tar.gz) = f99c464be8639eb18fe30cf195f7e971c973fa26a0f44d09ab9ad7f331e7e5e1db8d22e1adaf04fe885e8750d38a6d85942e7039f737fe88a617f44514b6fd5b
+Size (Django-2.2.9.tar.gz) = 9006404 bytes