Re: How can I work around the Django 3.2.10 cve release

2022-05-22 Thread Mike Dewhirst
I took your advice but no joy. AND I don't know why! The "invoice" is in fact the receipt model and receipt.get_absolute_url just wants the pk value to display what the customer paid. def get_absolute_url(self):     """ Show the Invoice receipt """     return f"/invoice/{self.id}/"

Re: How can I work around the Django 3.2.10 cve release

2022-05-21 Thread Jason
; -------- Original message ---- >> From: Lakshyaraj Dash XI-D 25 >> Date: 21/5/22 18:02 (GMT+10:00) >> To: django...@googlegroups.com >> Subject: Re: How can I work around the Django 3.2.10 cve release >> >> Hey why don't you use django v4 for you

Re: How can I work around the Django 3.2.10 cve release

2022-05-21 Thread Lakshyaraj Dash XI-D 25
placing wsgi. > > I want more unit test coverage before upgrading. > > Cheers > > Mike > > -- > (Unsigned mail from my phone) > > > > Original message > From: Lakshyaraj Dash XI-D 25 > Date: 21/5/22 18:02 (GMT+10:00) > To: django

Re: How can I work around the Django 3.2.10 cve release

2022-05-21 Thread Mike Dewhirst
25 Date: 21/5/22 18:02 (GMT+10:00) To: django-users@googlegroups.com Subject: Re: How can I work around the Django 3.2.10 cve release Hey why don't you use django v4 for your projects? On Fri, 20 May, 2022, 08:43 Mike Dewhirst, wrote:My billing (Stripe) mechanism is working right up until

Re: How can I work around the Django 3.2.10 cve release

2022-05-21 Thread Lakshyaraj Dash XI-D 25
Hey why don't you use django v4 for your projects? On Fri, 20 May, 2022, 08:43 Mike Dewhirst, wrote: > My billing (Stripe) mechanism is working right up until Django 3.2.9 - > which is where I'm stumped at the moment. > > Django 3.2.10 https://docs.djangoproject.com/en/3.2/releases/3.2.10/ >

Re: How can I work around the Django 3.2.10 cve release

2022-05-20 Thread Mike Dewhirst
nya gowda Date: 21/5/22 13:43 (GMT+10:00) To: Django users Subject: Re: How can I work around the Django 3.2.10 cve release Hi mike and jason kindly help me to my query also i have shared my query in group  its emergencymy humble request :-please help me here i do have some columns call

Re: How can I work around the Django 3.2.10 cve release

2022-05-20 Thread lavanya gowda
Hi mike and jason kindly help me to my query also i have shared my query in group its emergency *my humble request :-* please help me here i do have some columns called *sub_task_name* tht should every day update same perivous task_name but* sub_task_value* shld not update it shld give

Re: How can I work around the Django 3.2.10 cve release

2022-05-20 Thread Mike Dewhirst
On 20/05/2022 11:21 pm, Jason wrote: are you using re_path for the url in question? Thanks for responding Jason, yes! Here are my relevant lines ...     re_path(r"invoice/(?P\d+)/$", billing_views.invoice_view, name="invoice_view"),     # no trailing slash or the payment system barfs    

Re: How can I work around the Django 3.2.10 cve release

2022-05-20 Thread Jason
are you using re_path for the url in question? you can see the backport change here : https://github.com/django/django/commit/d4dcd5b9dd9e462fec8220e33e3e6c822b7e88a6 On Thursday, May 19, 2022 at 11:14:25 PM UTC-4 Mike Dewhirst wrote: > My billing (Stripe) mechanism is working right up until

How can I work around the Django 3.2.10 cve release

2022-05-19 Thread Mike Dewhirst
My billing (Stripe) mechanism is working right up until Django 3.2.9 - which is where I'm stumped at the moment. Django 3.2.10 https://docs.djangoproject.com/en/3.2/releases/3.2.10/ indicate a URL with a trailing newline can bypass upstream access control based on URL paths. Sadly, I am not