Changelog for python-django-1.6.11-7.1.noarch.rpm :
Mon Oct 12 14:00:00 2015 bwiedemannAATTsuse.com
- add 0002-1.6.x-Fixed-19324-Avoided-creating-a-session-record-.patch
to prevent Denial-of-service possibility by filling session store
(bnc#937522, CVE-2015-5143)
- add 0003-1.6.x-Prevented-newlines-from-being-accepted-in-some.patch
to prevent Header injection possibility (bnc#937523, CVE-2015-5144)

Wed Sep 9 14:00:00 2015 bwiedemannAATTsuse.com
- Add 0001-1.6.x-Fixed-DoS-possiblity-in-contrib.auth.views.log.patch
(bnc#941587, CVE-2015-5963)

Fri Mar 20 13:00:00 2015 bwiedemannAATTsuse.com
- update to 1.6.11

* Made is_safe_url() reject URLs that start with control characters
to mitigate possible XSS attack via user-supplied redirect URLs
(bnc#923176, CVE-2015-2317)

* Fixed an infinite loop possibility in strip_tags()
(bnc#923172, CVE-2015-2316)

Mon Jan 26 13:00:00 2015 dmuellerAATTsuse.com
- update to 1.6.10:

* Content retrieved from the GeoIP library is now properly decoded from its
default ``iso-8859-1`` encoding

* Fixed ``AttributeError`` when using
:meth:`~django.db.models.query.QuerySet.bulk_create` with ``ForeignObject``

* Fixed crash of ``QuerySet``\\s that use ``F() + timedelta()`` when their query
was compiled more once

* Prevented custom ``widget`` class attribute of
:class:`~django.forms.IntegerField` subclasses from being overwritten by the
code in their ``__init__`` method

* Improved :func:`~django.utils.html.strip_tags` accuracy (but it still cannot
guarantee an HTML-safe result, as stated in the documentation).

* Fixed a regression in the :mod:`django.contrib.gis` SQL compiler for
non-concrete fields (`#22250 `_).

* Fixed :attr:`ModelAdmin.preserve_filters
` when running a site with
a URL prefix (`#21795 `_).

* Fixed a crash in the ``find_command`` management utility when the ``PATH``
environment variable wasn\'t set

* Fixed :djadmin:`changepassword` on Windows

* Avoided shadowing deadlock exceptions on MySQL

* Wrapped database exceptions in ``_set_autocommit``

* Fixed atomicity when closing a database connection or when the database server
disconnects (`#21239 `_ and

* Fixed regression in ``prefetch_related`` that caused the related objects
query to include an unnecessary join

* Added backwards compatibility support for the :mod:`django.contrib.messages`
cookie format of Django 1.4 and earlier to facilitate upgrading to 1.6 from
1.4

* Restored the ability to :meth:`~django.core.urlresolvers.reverse` views
created using :func:`functools.partial()`

* Fixed the ``object_id`` of the ``LogEntry`` that\'s created after a user
password change in the admin

* Made the ``year_lookup_bounds_for_datetime_field`` Oracle backend method
Python 3 compatible (`#22551 `_).

* Fixed ``pgettext_lazy`` crash when receiving bytestring content on Python 2

* Fixed the SQL generated when filtering by a negated ``Q`` object that contains
a ``F`` object. (`#22429 `_).

* Avoided overwriting data fetched by ``select_related()`` in certain cases
which could cause minor performance regressions

* Corrected email and URL validation to reject a trailing dash

* Prevented indexes on PostgreSQL virtual fields (:ticket:`22514`).

* Prevented edge case where values of FK fields could be initialized with a
wrong value when an inline model formset is created for a relationship
defined to point to a field other than the PK (:ticket:`13794`).

* Restored ``pre_delete`` signals for ``GenericRelation`` cascade deletion

* Fixed transaction handling when specifying non-default database in
``createcachetable`` and ``flush`` (:ticket:`23089`).

* Fixed the \"ORA-01843: not a valid month\" errors when using Unicode
with older versions of Oracle server (:ticket:`20292`).

* Restored bug fix for sending unicode email with Python 2.6.5 and below

* Prevented ``UnicodeDecodeError`` in ``runserver`` with non-UTF-8 and
non-English locale (:ticket:`23265`).

* Fixed JavaScript errors while editing multi-geometry objects in the OpenLayers
widget (:ticket:`23137`, :ticket:`23293`).

* Prevented a crash on Python 3 with query strings containing unencoded
non-ASCII characters (:ticket:`22996`).

* Allowed inherited and m2m fields to be referenced in the admin

* Fixed a crash when using ``QuerySet.defer()`` with ``select_related()``

* Allowed related many-to-many fields to be referenced in the admin

* Allowed inline and hidden references to admin fields (:ticket:`23431`).

* Fixed a regression with dynamically generated inlines and allowed field
references in the admin (:ticket:`23754`).

* WSGI header spoofing via underscore/dash conflation
(bnc#913053, CVE-2015-0219)

* Mitigated possible XSS attack via user-supplied redirect URLs

* Denial-of-service attack against ``django.views.static.serve``
(bnc#913056, CVE-2015-0221)

* Database denial-of-service with ``ModelMultipleChoiceField``
(bnc#913055, CVE-2015-0222)

Thu Jul 31 14:00:00 2014 dimstarAATTopensuse.org
- Rename rpmlintrc to %{name}-rpmlintrc.
Follow the packaging guidelines.

Wed Jun 11 14:00:00 2014 mciharAATTsuse.cz
- Update to version 1.6.5, sercurity and important changes:
+ Unexpected code execution using reverse()
+ Caching of anonymous pages could reveal CSRF token
+ MySQL typecasting
+ select_for_update() requires a transaction
+ Issue: Caches may incorrectly be allowed to store and serve private data
+ Issue: Malformed redirect URLs from user input not correctly validated

Fri Feb 14 13:00:00 2014 speilickeAATTsuse.com
- Fix update-alternatives

Fri Feb 7 13:00:00 2014 speilickeAATTsuse.com
- Update to version 1.6.2:
+ Prevented the base geometry object of a prepared geometry to be garbage
collected, which could lead to crash Django (#21662).
+ Fixed a crash when executing the changepassword command when the user
object representation contained non-ASCII characters (#21627).
+ The collectstatic command will raise an error rather than default to
using the current working directory if STATIC_ROOT is not set. Combined
with the --clear option, the previous behavior could wipe anything
below the current working directory (#21581).
+ Fixed mail encoding on Python 3.3.3+ (#21093).
+ Fixed an issue where when settings.DATABASES[\'default\'][\'AUTOCOMMIT\'] = False,
the connection wasn’t in autocommit mode but Django pretended it was.
+ Fixed a regression in multiple-table inheritance exclude() queries (#21787).
+ Added missing items to django.utils.timezone.__all__ (#21880).
+ Fixed a field misalignment issue with select_related() and model inheritance (#21413).
+ Fixed join promotion for negated AND conditions (#21748).
+ Oracle database introspection now works with boolean and float fields (#19884).
+ Fixed an issue where lazy objects weren’t actually marked as safe when
passed through mark_safe() and could end up being double-escaped (#21882).

Tue Feb 4 13:00:00 2014 mciharAATTsuse.cz
- Update to version 1.6.1:
- Most bug fixes are minor; you can find a complete list in the Django 1.6.1
release notes.

Tue Nov 19 13:00:00 2013 speilickeAATTsuse.com
- Update-alternatives also for bash-completion

Fri Nov 15 13:00:00 2013 speilickeAATTsuse.com
- Only ghost /etc/alternatives on 12.3 or newer

Thu Nov 7 13:00:00 2013 speilickeAATTsuse.com
- Require python-Pillow for image-related functionality
- Package was renamed from python-django
- Drop Django-1.2-completion-only-for-bash.patch: Useless

Tue Nov 5 13:00:00 2013 alexandreAATTexatati.com.br
- Update to version 1.6:
- Please read the release notes
https://docs.djangoproject.com/en/1.6/releases/1.6
- Removed Patch2 as it is no needed anymore:
Django-1.4-CSRF_COOKIE_HTTPONLY-support.patch

Tue Sep 17 14:00:00 2013 speilickeAATTsuse.com
- Update to version 1.5.4:
+ Fixed denial-of-service via large passwords
- Changes from version 1.5.3:
+ Fixed directory traversal with ssi template tag

Wed Aug 14 14:00:00 2013 alexandreAATTexatati.com.br
- Update to 1.5.2:
- Security release, please check release notes for details:
https://www.djangoproject.com/weblog/2013/aug/13/security-releases-issued

Thu Mar 28 13:00:00 2013 alexandreAATTexatati.com.br
- Update to 1.5.1:
- Memory leak fix, please read release announcement at
https://www.djangoproject.com/weblog/2013/mar/28/django-151.

Tue Feb 26 13:00:00 2013 alexandreAATTexatati.com.br
- Update to 1.5:
- Please read the release notes
https://docs.djangoproject.com/en/1.5/releases/1.5

Tue Dec 11 13:00:00 2012 alexandreAATTexatati.com.br
- Update to 1.4.3:
- Security release:
- Host header poisoning
- Redirect poisoning
- Please check release notes for details:
https://www.djangoproject.com/weblog/2012/dec/10/security

Sat Oct 20 14:00:00 2012 saschpeAATTsuse.de
- Add a symlink from /usr/bin/django-admin.py to /usr/bin/django-admin

Wed Oct 17 14:00:00 2012 alexandreAATTexatati.com.br
- Update to 1.4.2:
- Security release:
- Host header poisoning
- Please check release notes for details:
https://www.djangoproject.com/weblog/2012/oct/17/security

Mon Jul 30 14:00:00 2012 alexandreAATTexatati.com.br
- Update to 1.4.1:
- Security release:
- Cross-site scripting in authentication views
- Denial-of-service in image validation
- Denial-of-service via get_image_dimensions()
- Please check release notes for details:
https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued

Tue Jun 19 14:00:00 2012 saschpeAATTsuse.de
- Add patch to support CSRF_COOKIE_HTTPONLY config

Fri Mar 23 13:00:00 2012 alexandreAATTexatati.com.br
- Update to 1.4:
- Please read the release notes
https://docs.djangoproject.com/en/dev/releases/1.4
- Removed Patch2, it was merged on upstream,

Thu Nov 24 13:00:00 2011 saschpeAATTsuse.de
- Set license to SDPX style (BSD-3-Clause)
- Package AUTHORS, LICENE and README files
- No CFLAGS for noarch package
- Drop runtime dependency on gettext-tools

Sat Sep 10 14:00:00 2011 alexandreAATTexatati.com.br
- Update to 1.3.1 to fix security issues, please read
https://www.djangoproject.com/weblog/2011/sep/09/security-releases-issued.

Thu Mar 31 14:00:00 2011 alexandreAATTexatati.com.br
- Fix build on SLES_9.

Wed Mar 23 13:00:00 2011 alexandreAATTexatati.com.br
- Update to 1.3 final;
- Refresh patch empty-ip-2.diff.

Fri Mar 18 13:00:00 2011 alexandreAATTexatati.com.br
- Update to 1.3-rc1;
- Regenerated spec file with py2pack;
- No more need to fix wrong line endings;
- Refresh patch empty-ip-2.diff with -p0.

Thu Mar 3 13:00:00 2011 saschpeAATTsuse.de
- Spec file cleanup:

* Removed empty lines, package authors from description

* Cleanup duplicates

* Corrected wrong file endings

* Added zero-length rpmlint filter
- Added AUTHORS, LICENSE and doc files

Wed Feb 9 13:00:00 2011 alexandreAATTexatati.com.br
- Update to 1.2.5:
- This is a security update that fix:
- Flaw in CSRF handling;
- Potential XSS in file field rendering.

Thu Dec 23 13:00:00 2010 alexandreAATTexatati.com.br
- Update to 1.2.4:
- Information leakage in Django administrative interface;
- Denial-of-service attack in password-reset mechanism.
- This is a mandatory security update.

Sat Sep 11 14:00:00 2010 alexandreAATTexatati.com.br
- Update to 1.2.3:
- The patch applied for the security issue covered in Django
1.2.2 caused issues with non-ASCII responses using CSRF
tokens. This has been remedied;
- The patch also caused issues with some forms, most notably
the user-editing forms in the Django administrative interface.
This has been remedied.
- The packaging manifest did not contain the full list of
required files. This has been remedied.

Thu Sep 9 14:00:00 2010 alexandreAATTexatati.com.br
- Update to 1.2.2.
- This is a ciritical security update fixing a default XSS bug!

Fri Jul 9 14:00:00 2010 jfunkAATTfunktronics.ca
- Added patch to fix upstream bug 5622: Empty ipaddress raises an error

Mon May 17 14:00:00 2010 alexandreAATTexatati.com.br
- Update to 1.2.1.

Mon May 17 14:00:00 2010 alexandreAATTexatati.com.br
- Update to 1.2.

Thu May 6 14:00:00 2010 alexandreAATTexatati.com.br
- Update to 1.2-rc-1.

Mon Apr 5 14:00:00 2010 alexandreAATTexatati.com.br
- Spec file cleaned with spec-cleaner;
- Minor manual adjusts on spec file.

Thu Mar 18 13:00:00 2010 alexandreAATTexatati.com.br
- Moved autocomplete file path from /etc/profile.d to
/etc/bash_completion.d. Then it works with konsole too.

Mon Mar 15 13:00:00 2010 alexandreAATTexatati.com.br
- Update to 1.2-beta-1;
- Using -q option on prep section of spec file;
- Using INSTALLED_FILES instead of declaring files;
- Removed dummy changelog section of spec file;
- Update completion bash patch.

Sun Oct 11 14:00:00 2009 nixAATTopensuse.org
- Update to 1.1.1 due to security issue described at
http://www.djangoproject.com/weblog/2009/oct/09/security/

Sat Oct 10 14:00:00 2009 alexandreAATTexatati.com.br
- Removed old tarball file (Django-1.1.tar.bz2).

Tue Aug 25 14:00:00 2009 garloffAATTsuse.de
- Fix python version check.

Sat Aug 22 14:00:00 2009 garloffAATTsuse.de
- Don\'t require python-sqlite2 for python >= 2.6.

Fri Aug 21 14:00:00 2009 garloffAATTsuse.de
- Build as noarch on factory.

Wed Aug 19 14:00:00 2009 poemlAATTsuse.de
- don\'t run bash completion on shells other than bash. Avoiding
error messages produced at login when using other shells.

Fri Aug 14 14:00:00 2009 alexandreAATTexatati.com.br
- Added bash auto-complete to openSUSE.

Tue Jul 28 14:00:00 2009 listuserAATTpeternixon.net
- update to version 1.1
- add python-django-rpmlintrc to quiet rpmlint complaints about -lang

Wed Jul 1 14:00:00 2009 poemlAATTsuse.de
- add python-xml to the Requires (./manage.py syncdb crashes
otherwise)