GitLab

Backport of 1eac8468cbde790fecb51dd055a439f4947d01e9 from main

Thanks Claude Paroz for the initial patch.
Thanks Dennis Brinkrolf for the report.

Backport of d4d800ca1addc4141e03c5440a849bb64d1582cd from main.

Backport of ab58f072502e86dfe21b2bd5cccdc5e94dce8d26 from master

[3.0.x] Fixed CVE-2021-23336 -- Fixed web cache poisoning via django.utils.http.limited_parse_qsl().

Backport of d02d60eb0f032c9395199fb73c6cd29ee9bb2646 from master

Backport of f749148d62ece28d208ab66b109f858215ba090a from master

Thanks Florian Apolloner, Shai Berger, and Simon Charette for reviews.

Thanks Wang Baohua for the report.

Backport of 05413afa8c18cdb978fcdf470e09f7a12b234a23 from master.

Backport of 135c800fe6138d7818501a384c0ebbdc5442762c from master

Backport of 656b331b13e08e82bbf0b88d39080c5b1a02109c from master

"format string with unnamed arguments cannot be properly localized"
warning is not raised in xgettext 0.21+.

This patch uses a message that causes an xgettext warning regardless of
the version.

Backport of 07a30f561661efae1691ff45d10ec6014b395b58 from master

Backport of 7fc07b9b2ba0c5c62a8840325d21b414a099fda0 from master

Regression in 42c08ee46539ef44f8658ebb1cbefb408e0d03fe.

Thanks Simon Charette for the review.

Backport of 4ac2d4fa42e1659f328c35b6b8d4761b3419c11a from master

Backport of 7f85498eef1d8fcc52e4fb70df8041f5452d405a from master

Backport of e18156b6c35908f2a4026287b5225a6a4da8af1a from master.

Bumped minimum Pillow version to 4.2.0 in test requirements.

Backport of fce389af7cf95151118c9fc7cafd777a31f94946 from master

Backport of d5b526bf78a9e5d9760e0c0f7647622bf47782fe from master

Backport of 976e2b7420c0f7e3060a13792b97511a9aad31d7 from master

[3.0.x] Fixed CVE-2020-24584 -- Fixed permission escalation in intermediate-level directories of the file system cache on Python 3.7+.

Backport of f56b57976133129b0b351a38bba4ac882badabf0 from master.

[3.0.x] Fixed CVE-2020-24583, #31921 -- Fixed permissions on intermediate-level static and storage directories on Python 3.7+.

Thanks WhiteSage for the report.

Backport of ea0febbba531a3ecc8c77b570efbfb68ca7155db from master.

Backport of 3e753d3de33469493b1f0947a2e0152c4000ed40 from master

Backport of 21768a99f47ee73a2f93405151550ef7c3d9c8a2 from master

Regression in bfb746f983aa741afa3709794e70f1e0ab6040b5.

Backport of 94ea79be137f3cb30949bf82198e96e094f2650d from master

Backport of 60626162f76f26d32a38d18151700cb041201fb3 from master

Backport of 8a5683b6b2aede38edcff070686ed1fce470dec5 from master

Backport of b68b8cb89abb35ff2152175ea540619ec384b1f4 from master

Backport of 8703680ebee47bfa9e912a30a0509798500bf42a from master

Backport of eb215da363e6cf0e8f3405db3c4392398c8777cb from master

Backport of bac5777bff8e8d8189193438b5af52f158a3f2a4 from master