Thanks Alexey Boriskin for the report.

Fix #21121: Add archive of security issues.

Thanks stavros for the suggestion.

Thanks daniel.quattro at gmail.com for the report.

Thanks simonpercivall for the report and bmispelon for the review.

Thanks rmboggs for the report.

* django.template.loader.get_template()
* django.template.loader.select_template()
* django.shortcuts.render()
* django.shortcuts.render_to_response()

Thanks amcnabb for the suggestion.

Thanks margieroginski for the suggestion.

The SubfieldBase's descriptor caused an AttributeError when accessed
from the class. Introspection didn't like that.

Patch by Trac alias supervacuo.

Ensure that selenium quits before the live server thread to
prevent occasional hangs when killing the live server.

tearDownClass is not called if setUpClass throws an exception, in our case
this means that LiveServerTestCase leaks LiveServerThread sockets if the
test happens to be skipped later on, and AdminSeleniumWebDriverTestCase
doesn't close it's already open browser window. To prevent this leakage
we catch errors where needed and manually call _tearDownClassInternal.
_tearDownClassInternal should be written as defensively as possible since
it is not allowed to make any assumptions on how far setUpClass got.

This patch should fix the sporadic "Address already in use"-errors on jenkins
and also the "This code isn't under transaction management"-error for sqlite
(also just on jenkins).

After discussion with koniiiik, jezdez, kmtracey, tos9, lifeless, nedbat and
voidspace it was decided that this is the safest approach (thanks to everyone
for their comments and help). Manually calling tearDownClass was shut down
cause we don't know how our users override our classes.

This is a private and very specialized API on purpose and should not be used
without a strong reason!

This patch partially reverts the earlier attempts to fix those issues,
namely:
	2fa0dd73 and
	3c5775d3

Final note: If this patch breaks in a later version of Django, please be
very careful on how you fix it, you might not see test failures locally.
That said, this patch hopefully doesn't produce even more failures.

Thanks to Matthias Kestenholz for the report and patch.

refs #17627

Thanks PaulM for the suggestion and Luke Granger-Brown and
Wiktor Kołodziej for the initial patch.

* Limit the password length to 4096 bytes
  * Password hashers will raise a ValueError
  * django.contrib.auth forms will fail validation
* Document in release notes that this is a backwards incompatible change

Thanks to Josh Wright for the report, and Donald Stufft for the patch.

This is a security fix; disclosure to follow shortly.

By settings an implicit wait timeout for the find_* methods we can wait
till the javascript code add the new option to the DOM.

See http://ci.djangoproject.com/job/Django/database=mysql_gis,python=python3.3/3174/testReport/junit/admin_widgets.tests/RelatedFieldWidgetSeleniumFirefoxTests/test_foreign_key_using_to_field/

Stacktrace:
Traceback (most recent call last):
  File "/var/lib/jenkins/jobs/Django/workspace/database/mysql_gis/python/python3.3/tests/admin_widgets/tests.py", line 1060, in test_foreign_key_using_to_field
      self.assertEqual(username_value, new_option.get_attribute('value'))
      AssertionError: 'newuser' != 'testser'
      - newuser
      + testser

If setUpClass throws an exception (in this case "Address already in use" if the
super call can't find any open port to bind too) tearDownClass is not called.
This results in open browser windows from the webdriver, hence we only construct
it once we are sure there is no code afterwards which could error out.

The use of OrderedDict (even an empty one) was surprisingly slow. By
initializing OrderedDict only when needed it is possible to save
non-trivial amount of computing time (Model.save() is around 30% faster
for example).

This commit targetted sql.Query only, there are likely other places
which could use similar optimizations.

This reverts commit c1ec0899.

There are backwards compatability concerns with this.

Refs #21102.

We want to be able to use it for instance for discovering `tasks.py` modules
inside the INSTALLED_APPS.

This commit therefore moves the logic to `autodiscover_modules` method in
django.utils.module_loading.