Fixed #16247 -- Removed wildcard expansion of application names in INSTALLED_APPS.

                    setting_value = (setting_value,) # In case the user forgot the comma.

                setattr(self, setting, setting_value)

        # Expand entries in INSTALLED_APPS like "django.contrib.*" to a list

        # of all those apps.

        new_installed_apps = []

        for app in self.INSTALLED_APPS:

            if app.endswith('.*'):

                app_mod = importlib.import_module(app[:-2])

                appdir = os.path.dirname(app_mod.__file__)

                app_subdirs = os.listdir(appdir)

                app_subdirs.sort()

                name_pattern = re.compile(r'[a-zA-Z]\w*')

                for d in app_subdirs:

                    if name_pattern.match(d) and os.path.isdir(os.path.join(appdir, d)):

                        new_installed_apps.append('%s.%s' % (app[:-2], d))

            else:

                new_installed_apps.append(app)

        self.INSTALLED_APPS = new_installed_apps

        if hasattr(time, 'tzset') and self.TIME_ZONE:

            # When we can, attempt to validate the timezone. If we can't find

            # this file, no check happens and it's harmless.

help reduce the impact of potential XSS attacks. For strict backwards

compatibility, use ``SESSION_COOKIE_HTTPONLY = False`` in settings.

Wildcard expansion of application names in `INSTALLED_APPS`

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Until Django 1.3, :setting:`INSTALLED_APPS` accepted wildcards in application

names, like ``django.contrib.*``. The expansion was performed by a

filesystem-based implementation of ``from <package> import *``. Unfortunately,

`this can't be done reliably`_.

This behavior was never documented. Since it is un-pythonic and not obviously

useful, it was removed in Django 1.4. If you relied on it, you must edit your

settings file to list all your applications explicitly.

.. _this can't be done reliably: http://docs.python.org/tutorial/modules.html#importing-from-a-package