Fixes#8614 and #12811
We match MySQL's behaviour of treating non-alphanumeric characters as token separators, equivalent to spaces. This way, the Lexeme instances consist of alphanumerics only, avoiding escaping issues that lead to these syntax errors.
(note: the \w class in regexp also counts underscores as "alphanumeric", but this is also consistent with the MySQL behaviour and presents no issues with escaping.)
Fixes https://github.com/wagtail/wagtail/issues/12742
Previously, `permission_order.register` performed a database lookup for the content type. This is invalid if called from an app `ready` method as the documentation suggests, because this may run before the database has been initialised. Instead, `register` now queues up the arguments it receives, and the content type lookup is constructed lazily on first call to `get_content_type_order_lookup` (which happens when the group edit view is requested).
Django 5.1.5 (and other security releases released today) has added a `max_length` attribute to GenericIPAddressField, which breaks an assertion in the form builder tests that compares HTML directly. Change this to a BeautifulSoup-based test so that it works on older and newer releases.
Requiring a word boundary before the start of a filter prevents backtracking, as substrings of the filter name are no longer valid filter names.
This also makes matching around an order of magnitude faster.
When the urlify util is used, ensure that we pass in the allow unicode value correctly in the SlugController.
Note: This was passed in for slugify but the usage of slugify, not urlify.
Fixes#11828
Cherry pick of 2d075177c4
DRF changed its behaviour in
56946fac8f
A custom message that is specified when raising a PermissionDenied
exception is now preserved by DRF, instead of using a generic "You do
not have permission to perform this action."