forked from pool/python-Django
Alberto Planas Dominguez
9989555d48
* CVE-2024-45230: Potential denial-of-service vulnerability in
django.utils.html.urlize()
* CVE-2024-45231: Potential user email enumeration via response
status on password reset
* Fixed a regression in Django 5.1 that caused a crash of Window()
when passing an empty sequence to the order_by parameter, and a
crash of Prefetch() for a sliced queryset without ordering
* Fixed a regression in Django 5.1 where a new usable_password field
was included in BaseUserCreationForm (and children). A new
AdminUserCreationForm including this field was added, isolating
the feature to the admin where it was intended
* Adjusted the deprecation warning stacklevel in Model.save() and
Model.asave() to correctly point to the offending call site
* Adjusted the deprecation warning stacklevel when using
OS_OPEN_FLAGS in FileSystemStorage to correctly point to the
offending call site
* Adjusted the deprecation warning stacklevel in
FieldCacheMixin.get_cache_name() to correctly point to the
offending call site
* Restored, following a regression in Django 5.1, the ability to
override the timezone and role setting behavior used within the
init_connection_state method of the PostgreSQL backend
* Fixed a bug in Django 5.1 where variable lookup errors were logged
when rendering admin fieldsets
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=177
41 lines
1.5 KiB
Diff
41 lines
1.5 KiB
Diff
From da2f8e8257d1bea4215381684ca4abfcee333c43 Mon Sep 17 00:00:00 2001
|
|
From: Mariusz Felisiak <felisiak.mariusz@gmail.com>
|
|
Date: Mon, 17 Jul 2023 11:03:36 +0200
|
|
Subject: [PATCH] Refs #34118 -- Improved sanitize_address() error message for
|
|
tuple with empty strings.
|
|
|
|
---
|
|
django/core/mail/message.py | 2 ++
|
|
tests/mail/tests.py | 3 ++-
|
|
2 files changed, 4 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/django/core/mail/message.py b/django/core/mail/message.py
|
|
index f3fe6186c7f5..4f8c93e9e55e 100644
|
|
--- a/django/core/mail/message.py
|
|
+++ b/django/core/mail/message.py
|
|
@@ -97,6 +97,8 @@ def sanitize_address(addr, encoding):
|
|
domain = token.domain or ""
|
|
else:
|
|
nm, address = addr
|
|
+ if "@" not in address:
|
|
+ raise ValueError(f'Invalid address "{address}"')
|
|
localpart, domain = address.rsplit("@", 1)
|
|
|
|
address_parts = nm + localpart + domain
|
|
diff --git a/tests/mail/tests.py b/tests/mail/tests.py
|
|
index 54a136c1a98b..848ee32e9f80 100644
|
|
--- a/tests/mail/tests.py
|
|
+++ b/tests/mail/tests.py
|
|
@@ -1084,9 +1084,10 @@ def test_sanitize_address_invalid(self):
|
|
"@",
|
|
"to@",
|
|
"@example.com",
|
|
+ ("", ""),
|
|
):
|
|
with self.subTest(email_address=email_address):
|
|
- with self.assertRaises(ValueError):
|
|
+ with self.assertRaisesMessage(ValueError, "Invalid address"):
|
|
sanitize_address(email_address, encoding="utf-8")
|
|
|
|
def test_sanitize_address_header_injection(self):
|