CVS commit: pkgsrc/www/py-django2

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Fri May 14 18:53:07 UTC 2021

Modified Files:
        pkgsrc/www/py-django2: Makefile distinfo

Log Message:
py-django2: updated to 2.2.23

Django 2.2.23 fixes a regression in 2.2.21.

Bugfixes

Fixed a regression in Django 2.2.21 where saving FileField would raise a SuspiciousFileOperation even when a custom upload_to returns a valid file path

Django 2.2.22 fixes a security issue in 2.2.21.

CVE-2021-32052: Header injection possibility since URLValidator accepted newlines in input on Python 3.9.5+

On Python 3.9.5+, URLValidator didn’t prohibit newlines and tabs. If you used values with newlines in HTTP response, you could suffer from header injection attacks. Django itself wasn’t vulnerable 
because HttpResponse prohibits newlines in HTTP headers.

Moreover, the URLField form field which uses URLValidator silently removes newlines and tabs on Python 3.9.5+, so the possibility of newlines entering your data only existed if you are using this 
validator outside of the form fields.

This issue was introduced by the bpo-43882 fix.


To generate a diff of this commit:
cvs rdiff -u -r1.34 -r1.35 pkgsrc/www/py-django2/Makefile
cvs rdiff -u -r1.32 -r1.33 pkgsrc/www/py-django2/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/py-django2/Makefile
diff -u pkgsrc/www/py-django2/Makefile:1.34 pkgsrc/www/py-django2/Makefile:1.35
--- pkgsrc/www/py-django2/Makefile:1.34 Wed May  5 07:04:18 2021
+++ pkgsrc/www/py-django2/Makefile      Fri May 14 18:53:07 2021
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.34 2021/05/05 07:04:18 adam Exp $
+# $NetBSD: Makefile,v 1.35 2021/05/14 18:53:07 adam Exp $
 
-DISTNAME=      Django-2.2.21
+DISTNAME=      Django-2.2.23
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME:tl}
 CATEGORIES=    www python
 MASTER_SITES=  https://www.djangoproject.com/m/releases/${PKGVERSION_NOREV:R}/

Index: pkgsrc/www/py-django2/distinfo
diff -u pkgsrc/www/py-django2/distinfo:1.32 pkgsrc/www/py-django2/distinfo:1.33
--- pkgsrc/www/py-django2/distinfo:1.32 Wed May  5 07:04:18 2021
+++ pkgsrc/www/py-django2/distinfo      Fri May 14 18:53:07 2021
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.32 2021/05/05 07:04:18 adam Exp $
+$NetBSD: distinfo,v 1.33 2021/05/14 18:53:07 adam Exp $
 
-SHA1 (Django-2.2.21.tar.gz) = 203abbd4ab8dd336a5e1cfcacf2e481ac5a29979
-RMD160 (Django-2.2.21.tar.gz) = d2f9cf28cd455cd4c5b833757e19a7f101eaf4f6
-SHA512 (Django-2.2.21.tar.gz) = 37d1f58c23907792e49c827fe1efe4345fd5d74ca85b44d1f492d45c9f4f7cc9ebfbd59dc6a142bb24b666fb89e2ee62a3bc3e2242cd25d5c1e801a3f07a2589
-Size (Django-2.2.21.tar.gz) = 9209871 bytes
+SHA1 (Django-2.2.23.tar.gz) = 52e0be0807bdb0d94ec95384242d268b326a87a6
+RMD160 (Django-2.2.23.tar.gz) = c5c83986b04c7f42ac8884364253a900b85af3ed
+SHA512 (Django-2.2.23.tar.gz) = 0f9b8705ce150f7c291452551933135a521b2d22cad00928bddbd6cac8ccb44da2c6c9a4302dc49b6f5188f6d72e148bd3c9806001e50972acefcb6ef853777b
+Size (Django-2.2.23.tar.gz) = 9182567 bytes