Re: A Django Async Roadmap

2018-06-09 Thread Ran Benita
> Loading a lazy ForeignKey/RelatedField attribute on a model instance Also deferred fields. -- You received this message because you are subscribed to the Google Groups "Django developers (Contributions to Django itself)" group. To unsubscribe from this group and stop receiving emails from it

Re: Proposal: security enhancements

2018-05-03 Thread Ran Benita
Regarding CSP, I'd like to point to this thread from a year ago, "Django and CSP strict-dynamic", https://groups.google.com/forum/#!topic/django-developers/n--RWhLAoYM. Unfortunately I haven't had time to follow through on it (yet?). I think `strict-dynamic` provides an avenue for on-by-default CS

Re: non-concurrent QuerySet.get_or_create() on Postgresql

2017-10-16 Thread Ran Benita
The code tries to handle a scenario like the following (of course, the statements can be relatively ordered in different ways). Can you describe how the scenario which fails for you looks like? I am assuming you are using READ COMMITTED, and that the lookup fields are unique together. THREAD1

Re: non-concurrent QuerySet.get_or_create() on Postgresql

2017-10-12 Thread Ran Benita
Have you drilled down to `self._create_object_from_params(params)`? It does handle this case, as follows: try: with transaction.atomic(using=self.db): params = {k: v() if callable(v) else v for k, v in params.items()} obj = self.create(**params) return obj, True except Inte

Re: Django and CSP strict-dynamic

2017-05-16 Thread Ran Benita
OK, so to refocus the issue: Using CSP nonces requires the following: any

Re: Django and CSP strict-dynamic

2017-05-16 Thread Ran Benita
Hi Adam, thanks for your comments. > Given that it's still a W3C draft I am not sure it should be added to Django core yet. I agree; note however, that nonces are part of CSP Level 2, which is in "W3C Recommendation" status. Since support for nonces is a prerequisite for any of this, I'll refo