CVS commit: pkgsrc/www/py-django3

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Wed Apr 20 12:29:47 UTC 2022

Modified Files:
        pkgsrc/www/py-django3: Makefile distinfo

Log Message:
py-django3: updated to 3.2.13

Django 3.2.13 fixes two security issues with severity “high” in 3.2.12 and a regression in 3.2.4.

CVE-2022-28346: Potential SQL injection in QuerySet.annotate(), aggregate(), and extra()

QuerySet.annotate(), aggregate(), and extra() methods were subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these 
methods.

CVE-2022-28347: Potential SQL injection via QuerySet.explain(**options) on PostgreSQL

QuerySet.explain() method was subject to SQL injection in option names, using a suitably crafted dictionary, with dictionary expansion, as the **options argument.

Bugfixes

Fixed a regression in Django 3.2.4 that caused the auto-reloader to no longer detect changes when the DIRS option of the TEMPLATES setting contained an empty string


To generate a diff of this commit:
cvs rdiff -u -r1.27 -r1.28 pkgsrc/www/py-django3/Makefile
cvs rdiff -u -r1.26 -r1.27 pkgsrc/www/py-django3/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/py-django3/Makefile
diff -u pkgsrc/www/py-django3/Makefile:1.27 pkgsrc/www/py-django3/Makefile:1.28
--- pkgsrc/www/py-django3/Makefile:1.27 Wed Feb  2 10:23:41 2022
+++ pkgsrc/www/py-django3/Makefile      Wed Apr 20 12:29:47 2022
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.27 2022/02/02 10:23:41 adam Exp $
+# $NetBSD: Makefile,v 1.28 2022/04/20 12:29:47 adam Exp $
 
-DISTNAME=      Django-3.2.12
+DISTNAME=      Django-3.2.13
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME:tl}
 CATEGORIES=    www python
 MASTER_SITES=  https://www.djangoproject.com/m/releases/${PKGVERSION_NOREV:R}/

Index: pkgsrc/www/py-django3/distinfo
diff -u pkgsrc/www/py-django3/distinfo:1.26 pkgsrc/www/py-django3/distinfo:1.27
--- pkgsrc/www/py-django3/distinfo:1.26 Wed Feb  2 10:23:41 2022
+++ pkgsrc/www/py-django3/distinfo      Wed Apr 20 12:29:47 2022
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.26 2022/02/02 10:23:41 adam Exp $
+$NetBSD: distinfo,v 1.27 2022/04/20 12:29:47 adam Exp $
 
-BLAKE2s (Django-3.2.12.tar.gz) = 749e76e0ad521c9ad09cbb2054722c4c987d063b4de8db58f1b82fe9b5a08934
-SHA512 (Django-3.2.12.tar.gz) = fc8ad3af019b268d514cc5240cac9c6b2fbf3a169c7933e8ab2da92e9cfed72df7a2784a8d92eaec8105bc9c245763acd307178bdf662e5d51407e72ae9d8683
-Size (Django-3.2.12.tar.gz) = 9812448 bytes
+BLAKE2s (Django-3.2.13.tar.gz) = 2546c0988f02e41038b6f14f0ee23300cde9c70faaccd87df25df136becb144b
+SHA512 (Django-3.2.13.tar.gz) = 08f056b18bc04b95d6705cf70c2ecc5be0c1324e0b38582991b907ed5977c4e3d35417ccf4ec06c2436a718e3aae007b015f0d40dd94ce5cfb129a54cceb6578
+Size (Django-3.2.13.tar.gz) = 9813985 bytes