87b8676fbf
Fixes the following security issues: CVE-2022-28346: Potential SQL injection in QuerySet.annotate(), aggregate(), and extra() QuerySet.annotate(), aggregate(), and extra() methods were subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods. CVE-2022-28347: Potential SQL injection via QuerySet.explain(**options) on PostgreSQL QuerySet.explain() method was subject to SQL injection in option names, using a suitably crafted dictionary, with dictionary expansion, as the **options argument. For more details, see the advisory: https://www.djangoproject.com/weblog/2022/apr/11/security-releases/ Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
19 lines
676 B
Makefile
19 lines
676 B
Makefile
################################################################################
|
|
#
|
|
# python-django
|
|
#
|
|
################################################################################
|
|
|
|
PYTHON_DJANGO_VERSION = 4.0.4
|
|
PYTHON_DJANGO_SOURCE = Django-$(PYTHON_DJANGO_VERSION).tar.gz
|
|
# The official Django site has an unpractical URL
|
|
PYTHON_DJANGO_SITE = https://files.pythonhosted.org/packages/d2/95/93d1f75da95624bf89e373d079fa72debf77f9b10acc31998cc52a5ff3f9
|
|
|
|
PYTHON_DJANGO_LICENSE = BSD-3-Clause
|
|
PYTHON_DJANGO_LICENSE_FILES = LICENSE
|
|
PYTHON_DJANGO_CPE_ID_VENDOR = djangoproject
|
|
PYTHON_DJANGO_CPE_ID_PRODUCT = django
|
|
PYTHON_DJANGO_SETUP_TYPE = setuptools
|
|
|
|
$(eval $(python-package))
|