CHANGES.txt 7.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331
  1. Changes
  2. =======
  3. 2.2.0 (2016-07-20)
  4. ------------------
  5. - Improve the logic when using a reverse proxy to avoid possible attacks.
  6. [camilonova]
  7. 2.1.0 (2016-07-14)
  8. ------------------
  9. - Add `default_app_config` so you can just use `axes` in `INSTALLED_APPS`
  10. [vdboor]
  11. 2.0.0 (2016-06-24)
  12. ------------------
  13. - Removed middleware to use app_config
  14. [camilonova]
  15. - Lots of cleaning
  16. [camilonova]
  17. - Improved test suite and versions
  18. [camilonova]
  19. 1.7.0 (2016-06-10)
  20. ------------------
  21. - Use render shortcut for rendering LOCKOUT_TEMPLATE
  22. [Radosław Luter]
  23. - Added app_label for RemovedInDjango19Warning
  24. [yograterol]
  25. - Add iso8601 translator.
  26. [mullakhmetov]
  27. - Edit json response. Context now contains ISO 8601 formatted cooloff time
  28. [mullakhmetov]
  29. - Add json response and iso8601 tests.
  30. [mullakhmetov]
  31. - Fixes issue 162: UnicodeDecodeError on pip install
  32. [joeribekker]
  33. - Added AXES_NEVER_LOCKOUT_WHITELIST option to prevent certain IPs from being locked out.
  34. [joeribekker]
  35. 1.6.1 (2016-05-13)
  36. ------------------
  37. - Fixes whitelist check when BEHIND_REVERSE_PROXY
  38. [Patrick Hagemeister]
  39. - Made migrations py3 compatible
  40. [mvdwaeter]
  41. - Fixing #126, possibly breaking compatibility with Django<=1.7
  42. [int-ua]
  43. - Add note for upgrading users about new migration files
  44. [kelseyq]
  45. - Fixes #148
  46. [camilonova]
  47. - Decorate auth_views.login only once
  48. [teeberg]
  49. - Set IP public/private classifier to be compliant with RFC 1918.
  50. [SilasX]
  51. - Issue #155. Lockout response status code changed to 403.
  52. [Артур Муллахметов]
  53. - BUGFIX: Missing migration
  54. [smeinel]
  55. 1.6.0 (2016-01-07)
  56. ------------------
  57. - Stopped using render_to_response so that other template engines work
  58. [tarkatronic]
  59. - Improved performance & DoS prevention on query2str
  60. [tarkatronic]
  61. - Immediately return from is_already_locked if the user is not lockable
  62. [jdunck]
  63. - Iterate over ip addresses only once
  64. [annp89]
  65. - added initial migration files to support django 1.7 &up. Upgrading users should run migrate --fake-initial after update
  66. [ibaguio]
  67. - Add db indexes to CommonAccess model
  68. [Schweigi]
  69. 1.5.0 (2015-09-11)
  70. ------------------
  71. - Fix #_get_user_attempts to include username when filtering AccessAttempts if AXES_LOCK_OUT_BY_COMBINATION_USER_AND_IP is True
  72. [afioca]
  73. 1.4.0 (2015-08-09)
  74. ------------------
  75. - Send the user_locked_out signal. Fixes #94.
  76. [toabi]
  77. 1.3.9 (2015-02-11)
  78. ------------------
  79. - Python 3 fix (#104)
  80. 1.3.8 (2014-10-07)
  81. ------------------
  82. - Rename GitHub organization from django-security to django-pci to emphasize focus on providing assistance with building PCI compliant websites with Django.
  83. [aclark4life]
  84. 1.3.7 (2014-10-05)
  85. ------------------
  86. - Explain common issues where Axes fails silently
  87. [cericoda]
  88. - Allow for user-defined username field for lookup in POST data
  89. [SteveByerly]
  90. - Log out only if user was logged in
  91. [zoten]
  92. - Support for floats in cooloff time (i.e: 0.1 == 6 minutes)
  93. [marianov]
  94. - Limit amount of POST data logged (#73). Limiting the length of value is not enough, as there could be arbitrary number of them, or very long key names.
  95. [peterkuma]
  96. - Improve get_ip to try for real ip address
  97. [7wonders]
  98. - Change IPAddressField to GenericIPAddressField. When using a PostgreSQL database and the client does not pass an IP address you get an inet error. This is a known problem with PostgreSQL and the IPAddressField. https://code.djangoproject.com/ticket/5622. It can be fixed by using a GenericIPAddressField instead.
  99. [polvoblanco]
  100. - Get first X-Forwarded-For IP
  101. [tutumcloud]
  102. - White listing IP addresses behind reverse proxy. Allowing some IP addresses to have direct access to the app even if they are behind a reverse proxy. Those IP addresses must still be on a white list.
  103. [ericbulloch]
  104. - Reduce logging of reverse proxy IP lookup and use configured logger. Fixes #76. Instead of logging the notice that django.axes looks for a HTTP header set by a reverse proxy on each attempt, just log it one-time on first module import. Also use the configured logger (by default axes.watch_login) for the message to be more consistent in logging.
  105. [eht16]
  106. - Limit the length of the values logged into the database. Refs #73
  107. [camilonova]
  108. - Refactored tests to be more stable and faster
  109. [camilonova]
  110. - Clean client references
  111. [camilonova]
  112. - Fixed admin login url
  113. [camilonova]
  114. - Added django 1.7 for testing
  115. [camilonova]
  116. - Travis file cleanup
  117. [camilonova]
  118. - Remove hardcoded url path
  119. [camilonova]
  120. - Fixing tests for django 1.7
  121. [Andrew-Crosio]
  122. - Fix for django 1.7 exception not existing
  123. [Andrew-Crosio]
  124. - Removed python 2.6 from testing
  125. [camilonova]
  126. - Use django built-in six version
  127. [camilonova]
  128. - Added six as requirement
  129. [camilonova]
  130. - Added python 2.6 for travis testing
  131. [camilonova]
  132. - Replaced u string literal prefixes with six.u() calls
  133. [amrhassan]
  134. - Fixes object type issue, response is not an string
  135. [camilonova]
  136. - Python 3 compatibility fix for db_reset
  137. [nicois]
  138. - Added example project and helper scripts
  139. [barseghyanartur]
  140. - Admin command to list login attemps
  141. [marianov]
  142. - Replaced six imports with django.utils.six ones
  143. [amrhassan]
  144. - Replaced u string literal prefixes with six.u() calls to make it compatible with Python 3.2
  145. [amrhassan]
  146. - Replaced `assertIn`s and `assertNotIn`s with `assertContains` and `assertNotContains`
  147. [fcurella]
  148. - Added py3k to travis
  149. [fcurella]
  150. - Update test cases to be python3 compatible
  151. [nicois]
  152. - Python 3 compatibility fix for db_reset
  153. [nicois]
  154. - Removed trash from example urls
  155. [barseghyanartur]
  156. - Added django installer
  157. [barseghyanartur]
  158. - Added example project and helper scripts
  159. [barseghyanartur]
  160. 1.3.6 (2013-11-23)
  161. ------------------
  162. - Added AttributeError in case get_profile doesn't exist [camilonova]
  163. - Improved axes_reset command [camilonova]
  164. 1.3.5 (2013-11-01)
  165. ------------------
  166. - Fix an issue with __version__ loading the wrong version [graingert]
  167. 1.3.4 (2013-11-01)
  168. ------------------
  169. - Update README.rst for PyPI [marty] [camilonova] [graingert]
  170. - Add cooloff period [visualspace]
  171. 1.3.3 (2013-07-05)
  172. ------------------
  173. - Added 'username' field to the Admin table [bkvirendra]
  174. - Removed fallback logging creation since logging cames by default on django 1.4 or later, if you don't have it is because you explicitly wanted. Fixes #45 [camilonova]
  175. 1.3.2 (2013-03-28)
  176. ------------------
  177. - Fix an issue when a user logout [camilonova]
  178. - Match pypi version [camilonova]
  179. - Better User model import method [camilonova]
  180. - Use only one place to get the version number [camilonova]
  181. - Fixed an issue when a user on django 1.4 logout [camilonova]
  182. - Handle exception if there is not user profile model set [camilonova]
  183. - Made some cleanup and remove a pokemon exception handling [camilonova]
  184. - Improved tests so it really looks for the rabbit in the hole [camilonova]
  185. - Match pypi version [camilonova]
  186. 1.3.1 (2013-03-19)
  187. ------------------
  188. - Add support for Django 1.5 [camilonova]
  189. 1.3.0 (2013-02-27)
  190. ------------------
  191. - Bug fix: get_version() format string [csghormley]
  192. 1.2.9 (2013-02-20)
  193. ------------------
  194. - Add to and improve test cases [camilonova]
  195. 1.2.8 (2013-01-23)
  196. ------------------
  197. - Increased http accept header length [jslatts]
  198. 1.2.7 (2013-01-17)
  199. ------------------
  200. - Reverse proxy support [rmagee]
  201. - Clean up README [martey]
  202. 1.2.6 (2012-12-04)
  203. ------------------
  204. - Remove unused import [aclark4life]
  205. 1.2.5 (2012-11-28)
  206. ------------------
  207. - Fix setup.py [aclark4life]
  208. - Added ability to flag user accounts as unlockable. [kencochrane]
  209. - Added ipaddress as a param to the user_locked_out signal. [kencochrane]
  210. - Added a signal receiver for user_logged_out. [kencochrane]
  211. - Added a signal for when a user gets locked out. [kencochrane]
  212. - Added AccessLog model to log all access attempts. [kencochrane]