[pkgsrc/trunk]: pkgsrc/www/py-django3 py-django3: updated to 3.2.3

[adam <adam%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/eb6cce8308b7
branches:  trunk
changeset: 452736:eb6cce8308b7
user:      adam <adam%pkgsrc.org@localhost>
date:      Fri May 14 18:54:38 2021 +0000

description:
py-django3: updated to 3.2.3

Django 3.2.3 fixes several bugs in 3.2.2.

Bugfixes

Prepared for mysqlclient > 2.0.3 support.
Fixed a regression in Django 3.2 that caused the incorrect filtering of querysets combined with the | operator.
Fixed a regression in Django 3.2.1 where saving FileField would raise a SuspiciousFileOperation even when a custom upload_to returns a valid file path.


Django 3.2.2 fixes a security issue and a bug in 3.2.1.

CVE-2021-32052: Header injection possibility since URLValidator accepted newlines in input on Python 3.9.5+

On Python 3.9.5+, URLValidator didn’t prohibit newlines and tabs. If you used values with newlines in HTTP response, you could suffer from header injection attacks. Django itself wasn’t vulnerable 
because HttpResponse prohibits newlines in HTTP headers.

Moreover, the URLField form field which uses URLValidator silently removes newlines and tabs on Python 3.9.5+, so the possibility of newlines entering your data only existed if you are using this 
validator outside of the form fields.

This issue was introduced by the bpo-43882 fix.

diffstat:

 www/py-django3/Makefile |   4 ++--
 www/py-django3/distinfo |  10 +++++-----
 2 files changed, 7 insertions(+), 7 deletions(-)

diffs (27 lines):

diff -r 4eedfb4de49c -r eb6cce8308b7 www/py-django3/Makefile
--- a/www/py-django3/Makefile   Fri May 14 18:53:07 2021 +0000
+++ b/www/py-django3/Makefile   Fri May 14 18:54:38 2021 +0000
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.14 2021/05/05 07:06:29 adam Exp $
+# $NetBSD: Makefile,v 1.15 2021/05/14 18:54:38 adam Exp $
 
-DISTNAME=      Django-3.2.1
+DISTNAME=      Django-3.2.3
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME:tl}
 CATEGORIES=    www python
 MASTER_SITES=  https://www.djangoproject.com/m/releases/${PKGVERSION_NOREV:R}/
diff -r 4eedfb4de49c -r eb6cce8308b7 www/py-django3/distinfo
--- a/www/py-django3/distinfo   Fri May 14 18:53:07 2021 +0000
+++ b/www/py-django3/distinfo   Fri May 14 18:54:38 2021 +0000
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.14 2021/05/05 07:06:29 adam Exp $
+$NetBSD: distinfo,v 1.15 2021/05/14 18:54:38 adam Exp $
 
-SHA1 (Django-3.2.1.tar.gz) = cd6f18967e13a6e67dbee4713116aab9cb348865
-RMD160 (Django-3.2.1.tar.gz) = 669c38006c87e1776aa86611b51f0738a0b809b0
-SHA512 (Django-3.2.1.tar.gz) = 5f3f80047cdcb6c9a07ca0dc9d6d83d190c8c0215311f39e6e441384659c92e4fa42bf4677d297a4ba8520a0bfbd78c4b2ca13cf467c1e1220c0c6a3131ba444
-Size (Django-3.2.1.tar.gz) = 9820723 bytes
+SHA1 (Django-3.2.3.tar.gz) = 577af5cf8f756e2693ea0e7f7bb94e835e2ba7e3
+RMD160 (Django-3.2.3.tar.gz) = 89b380998123bc3a6cb623419f99b490fb4e6601
+SHA512 (Django-3.2.3.tar.gz) = a1f9f9661f1a851a00387007f5079615e70ad2357a3a99a1b4a77da6a31419b22fd9d321b8d9737092a02a3055df76cee2aa69404b804b392d94d3423d54b0f8
+Size (Django-3.2.3.tar.gz) = 9798957 bytes