Commit graph

17963 commits

Author SHA1 Message Date
Senthil Kumaran
7bfbd1d3c5 merge heads 2016-07-30 23:48:19 -07:00
Senthil Kumaran
17742f2d45 [merge from 3.4] - Prevent HTTPoxy attack (CVE-2016-1000110)
Ignore the HTTP_PROXY variable when REQUEST_METHOD environment is set, which
indicates that the script is in CGI mode.

Issue #27568 Reported and patch contributed by Rémi Rampin.
2016-07-30 23:39:06 -07:00
Senthil Kumaran
436fe5a447 [merge from 3.3] Prevent HTTPoxy attack (CVE-2016-1000110)
Ignore the HTTP_PROXY variable when REQUEST_METHOD environment is set, which
indicates that the script is in CGI mode.

Issue #27568 Reported and patch contributed by Rémi Rampin.
2016-07-30 23:34:34 -07:00
Senthil Kumaran
4cbb23f8f2 Prevent HTTPoxy attack (CVE-2016-1000110)
Ignore the HTTP_PROXY variable when REQUEST_METHOD environment is set, which
indicates that the script is in CGI mode.

Issue #27568 Reported and patch contributed by Rémi Rampin.
2016-07-30 23:24:16 -07:00
Benjamin Peterson
dbaa559b7f all SCHED_ constants are optional (closes #27656) 2016-07-30 23:21:50 -07:00
Xavier de Gaye
3a32bdfaa7 Issue #27453: CPP invocation in configure must use CPPFLAGS.
Patch by Chi Hsuan Yen.
2016-07-30 11:28:35 +02:00
Victor Stinner
4a865a35cd NEWS: tag security related changes with [Security] prefix
Issue #27404.
2016-07-28 17:06:25 +02:00
Martin Panter
3e5b1d3cf5 Issue #23943: Restore extra fixes lost in merge 4fb2075952a4 2016-07-28 03:48:29 +00:00
Martin Panter
eb9957065a Issue #27626: Spelling fixes in docs, comments and internal names
Based on patch by Ville Skyttä.
2016-07-28 01:11:04 +00:00
Martin Panter
eac67be948 Issue #27490: Do not build pgen when cross-compiling
The dependendency on the $(PGEN) variable must only be
set when not cross-compiling. When cross-compiling,
$(PGEN) will not be used, so no need to build it.

Patch by Thomas Perl.
2016-07-28 01:28:27 +00:00
Xavier de Gaye
fd0d5939bd Issue #26662: Set PYTHON_FOR_GEN in configure
as the Python program to be used for file generation during the build.
2016-07-26 12:48:08 +02:00
Martin Panter
e8db861f47 Issue #27581: Don’t rely on overflow wrapping in PySequence_Tuple()
Patch by Xiang Zhang.
2016-07-25 02:30:05 +00:00
Steve Dower
df450d1a18 Issue #27469: Adds a shell extension to the launcher so that drag and drop works correctly. 2016-07-16 16:17:33 -07:00
Martin Panter
84544c1020 Issue #27130: Fix handling of buffers exceeding UINT_MAX in “zlib” module
Patch by Xiang Zhang.
2016-07-23 03:02:07 +00:00
Zachary Ware
48e3f98206 Issue #25393: Fix probable copy/paste error in resource docs
Patch by Alakshendra Yadav.
2016-07-19 16:41:20 -05:00
Martin Panter
371731ebfd Issue #27507: Check for integer overflow in bytearray.extend()
Patch by Xiang Zhang.
2016-07-18 07:53:13 +00:00
Steve Dower
25f9cf479f Issue #27309: Enables proper Windows styles in python[w].exe manifest. 2016-07-17 21:39:13 -07:00
Steve Dower
b22a67737e Issue #27533: Release GIL in nt._isdir 2016-07-17 20:49:38 -07:00
Serhiy Storchaka
b3b65e618c Issue #27419: Standard __import__() no longer look up "__import__" in globals
or builtins for importing submodules or "from import".  Fixed handling an
error of non-string package name.
2016-07-17 12:47:17 +03:00
Serhiy Storchaka
dec25afab1 Issue #17711: Fixed unpickling by the persistent ID with protocol 0.
Original patch by Alexandre Vassalotti.
2016-07-17 11:24:17 +03:00
R David Murray
702b0460d2 #27522: break unintended cycle in feedparser.
Patch by Costas.
2016-07-15 21:29:13 -04:00
Brett Cannon
a47a7a5bf8 Issue #27083: Respect the PYTHONCASEOK environment variable under
Windows.

Originally only b'PYTHONCASEOK' was being checked for in os.environ,
but that won't work under Windows where all environment variables are
strings (on OS X they are bytes).

Thanks to Eryk Sun for the bug report.
2016-07-15 11:54:38 -07:00
Brett Cannon
f76457e122 Issue #26844: Fix imp.find_module() to have the exception related to
type issues be about 'path' instead of 'name'.

Thanks to Lev Maximov for the patch.
2016-07-15 10:58:54 -07:00
Benjamin Peterson
e09ed5419b make too many nested blocks be a SyntaxError instead of a SystemError (closes #27514)
Patch by Ammar Askar.
2016-07-14 22:00:03 -07:00
Martin Panter
c29df658a7 Issue #27369: Merge test_pyexpat from 3.4 into 3.5 2016-07-14 03:35:15 +00:00
Martin Panter
b7b5d35545 Issue #27369: Merge test_pyexpat from 3.3 into 3.4 2016-07-14 02:09:17 +00:00
Martin Panter
d27a7c1f22 Issue #27369: Merge test_pyexpat from 3.2 into 3.3 2016-07-14 01:42:53 +00:00
Martin Panter
076ca6c3c8 Issue #27369: Don’t test error message detail that changed in Expat 2.2.0 2016-07-14 01:31:46 +00:00
Martin Panter
2cdcaf1353 Issue #22758: Move NEWS entry to Library section 2016-07-14 01:17:03 +00:00
Yury Selivanov
252e9ed974 Issue #27392: Add loop.connect_accepted_socket().
Patch by Jim Fulton.
2016-07-12 18:23:10 -04:00
Martin Panter
204bf0b9ae English spelling and grammar fixes 2016-07-11 07:51:37 +00:00
Martin Panter
0ca0edee33 Restore NEWS entries lost in revision 8145f25f26aa 2016-07-11 12:43:38 +00:00
Martin Panter
bed7f1a512 Issue #23804: Fix SSL zero-length recv() calls to not block and raise EOF 2016-07-11 00:17:13 +00:00
Serhiy Storchaka
06cfb0cd70 Issue #27473: Fixed possible integer overflow in bytes and bytearray
concatenations.  Patch by Xiang Zhang.
2016-07-10 20:48:43 +03:00
R David Murray
5f21f43af7 #22758: fix regression in handling of secure cookies.
This backports the fix from #16611, per discussion with the release
manager.
2016-07-10 13:32:43 -04:00
Senthil Kumaran
d5b47fb8ce Issue #27466: Change time format returned by http.cookie.time2netscape,
confirming the netscape cookie format.
2016-07-10 06:45:38 -07:00
Serhiy Storchaka
1a2b24f02d Issue #27332: Fixed the type of the first argument of module-level functions
generated by Argument Clinic.  Patch by Petr Viktorin.
2016-07-07 17:35:15 +03:00
Serhiy Storchaka
af65872da2 Issue #27443: __length_hint__() of bytearray itearator no longer return
negative integer for resized bytearray.
2016-07-03 14:41:36 +03:00
Berker Peksag
e39682b076 Issue #27430: Fix typos, patch by scop. 2016-07-01 12:17:05 +03:00
Brett Cannon
660c8fc997 Issue #26665: Remove mis-use of `$` in activate.fish.
This is a revertion of cfc66e37eb8e.

Thanks to 鄭景文 for the bug report. Thanks to Tin Tvrtković, Xiang
Zhang, and Dan McCombs for diagnosing the issue.
2016-06-30 11:41:55 -07:00
Serhiy Storchaka
eb51faadbe Issue #27418: Fixed Tools/importbench/importbench.py. 2016-06-30 10:33:17 +03:00
Larry Hastings
1b329e791a Merge. 2016-06-26 19:53:18 -07:00
Larry Hastings
9bb2005459 Post-release fixups for Python 3.5.2. 2016-06-26 19:47:22 -07:00
Larry Hastings
ea684921c2 Post-release fixups for Python 3.4.5. 2016-06-26 19:41:21 -07:00
Terry Jan Reedy
1e957d145f Update NEWS and idlelib NEWS.text. 2016-06-26 18:20:20 -04:00
Serhiy Storchaka
745a407df8 Issue #22115: Fixed tracing Tkinter variables:
* tracing in the "u" mode now works
* trace_vdelete() with wrong mode no longer break tracing
* trace_vinfo() now always returns a list of pairs of strings
2016-06-26 17:42:23 +03:00
Larry Hastings
98be9d500e Version bump for 3.4.5 final. 2016-06-25 14:44:30 -07:00
Brett Cannon
e92dc9c23d Fix a scoping issue where an UnboundLocalError was triggered if a
lazy-loaded module was already in sys.modules.
2016-06-25 10:47:53 -07:00
Serhiy Storchaka
514f9736a7 Issue #27294: Numerical state in the repr for Tkinter event objects is now
represented as a compination of known flags.
2016-06-18 22:08:11 +03:00
Serhiy Storchaka
9305d83425 Issue #26754: PyUnicode_FSDecoder() accepted a filename argument encoded as
an iterable of integers. Now only strings and byte-like objects are accepted.
2016-06-18 13:53:36 +03:00