[1.3.x] Added ALLOWED_HOSTS setting for HTTP host header validation.

This is a security fix; disclosure and advisory coming shortly.
[1.3.x] Restrict the XML deserializer to prevent network and entity-expansion DoS attacks.

This is a security fix. Disclosure and advisory coming shortly.
[1.3.x] Checked object permissions on admin history view.

This is a security fix. Disclosure and advisory coming shortly.

Patch by Russell Keith-Magee.
[1.3.x] Added a default limit to the maximum number of forms in a formset.

This is a security fix. Disclosure and advisory coming shortly.
[1.3.x] Update 1.3.6 release notes for all security fixes.
[1.3.x] Bump version numbers for security release.
[1.3.x] Don't characterize XML vulnerabilities as DoS-only.
[1.3.x] Fixed #19857 -- Fixed broken docs link in project template.

Backport of 4cdfb24c98 from 1.4.x.
[1.4.x] Note that ALLOWED_HOSTS default changes in Django 1.5.
[1.3.x] Bump version numbers to roll a clean package.
[1.3.x] Bump version to no longer claim to be 1.3.7 final.
Import django.core.urlresolvers.reverse a little bit later.

This fixes our url mangling when permalinks are used - it's a slight
hack, but won't break anything. This can be reverted if we do it
the slightly harder but "right" way using an explicit mangling
method.
Allow post save redirects to be callable.
Support filtering by non-database (queryset) fields in the admin.
Fix for static admin validation with non-database field filters
Test fixes for non-unique emails.
Fixed issue with default manager handling saving.
For some reason _default_manager was returning the manager set with objects = ... in the model definition
Changed that around so ModelAdmin class now uses queryset() only to get all objects
Also changed base.py such that the objects are looked for through QuerySet(self.__class__) rather than _default_manager
Fix #811: IPv6 address field support (patch from http://code.djangoproject.com/ticket/811)
Fix #7907: Tables argument of QuerySet.extra should allow subqueries.
Fix #9209: ModelChoiceField fails when passed a non-integer string.

Patch modified from http://code.djangoproject.com/ticket/9209 -
9209.diff (3.9 kB) - added by kmtracey on 11/05/08 19:25:38.