CVS commit: pkgsrc/www/py-django

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Wed Dec  4 20:19:44 UTC 2024

Modified Files:
        pkgsrc/www/py-django: Makefile distinfo

Log Message:
py-django: updated to 5.1.4

5.1.4

Django 5.1.4 fixes one security issue with severity “high”, one security issue with severity “moderate”, and several bugs in 5.1.3.

CVE-2024-53907: Denial-of-service possibility in strip_tags()

strip_tags() would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities. The strip_tags() method is used to implement the corresponding striptags 
template filter, which was thus also vulnerable.

strip_tags() now has an upper limit of recursive calls to HTMLParser before raising a SuspiciousOperation exception.

Remember that absolutely NO guarantee is provided about the results of strip_tags() being HTML safe. So NEVER mark safe the result of a strip_tags() call without escaping it first, for example with 
django.utils.html.escape().

CVE-2024-53908: Potential SQL injection via HasKey(lhs, rhs) on Oracle

Direct usage of the django.db.models.fields.json.HasKey lookup on Oracle was subject to SQL injection if untrusted data was used as a lhs value.

Applications that use the has_key lookup through the __ syntax are unaffected.

Bugfixes

Fixed a crash in createsuperuser on Python 3.13+ caused by an unhandled OSError when the username could not be determined

Fixed a regression in Django 5.1 where relational fields were not updated when calling Model.refresh_from_db() on instances with deferred fields


To generate a diff of this commit:
cvs rdiff -u -r1.136 -r1.137 pkgsrc/www/py-django/Makefile
cvs rdiff -u -r1.110 -r1.111 pkgsrc/www/py-django/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/py-django/Makefile
diff -u pkgsrc/www/py-django/Makefile:1.136 pkgsrc/www/py-django/Makefile:1.137
--- pkgsrc/www/py-django/Makefile:1.136 Mon Nov 11 07:29:17 2024
+++ pkgsrc/www/py-django/Makefile       Wed Dec  4 20:19:44 2024
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.136 2024/11/11 07:29:17 wiz Exp $
+# $NetBSD: Makefile,v 1.137 2024/12/04 20:19:44 adam Exp $
 
-DISTNAME=      Django-5.1.3
+DISTNAME=      Django-5.1.4
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME:tl}
 CATEGORIES=    www python
 MASTER_SITES=  https://www.djangoproject.com/m/releases/${PKGVERSION_NOREV:R}/

Index: pkgsrc/www/py-django/distinfo
diff -u pkgsrc/www/py-django/distinfo:1.110 pkgsrc/www/py-django/distinfo:1.111
--- pkgsrc/www/py-django/distinfo:1.110 Tue Nov  5 08:35:58 2024
+++ pkgsrc/www/py-django/distinfo       Wed Dec  4 20:19:44 2024
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.110 2024/11/05 08:35:58 adam Exp $
+$NetBSD: distinfo,v 1.111 2024/12/04 20:19:44 adam Exp $
 
-BLAKE2s (Django-5.1.3.tar.gz) = ce1e2de78a06a8469c1e78770b388ee6ad21f463176280b43cfa8d3f10244d7d
-SHA512 (Django-5.1.3.tar.gz) = 43c7c196c8d34c2354d2c0c3a1e1d4a816841dcdf60ec6277567acce23aae125c502f1afa354838fc4722fd3e665587878e2c57caa056ad5a6130bb5643991be
-Size (Django-5.1.3.tar.gz) = 10698518 bytes
+BLAKE2s (Django-5.1.4.tar.gz) = 6449f91a43f7a7dd769307699f8ccbd2cbfe0c073a2c6c611c3a753a1cf2aabf
+SHA512 (Django-5.1.4.tar.gz) = 252c185b82da60fb8b1be9c284e8912f5f2846f10a314bc5e611a24e499ea31d7dc29b31a4de16ee3329b1e6861d7faf02b65a043e8a2a28328541105a1e7dc3
+Size (Django-5.1.4.tar.gz) = 10716397 bytes