diff options
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/ref/forms/widgets.txt | 43 | ||||
| -rw-r--r-- | docs/releases/1.3.txt | 25 |
2 files changed, 49 insertions, 19 deletions
diff --git a/docs/ref/forms/widgets.txt b/docs/ref/forms/widgets.txt index 1fc2bfa85d..e82fae7761 100644 --- a/docs/ref/forms/widgets.txt +++ b/docs/ref/forms/widgets.txt @@ -6,7 +6,7 @@ Widgets .. module:: django.forms.widgets :synopsis: Django's built-in form widgets. - + .. currentmodule:: django.forms A widget is Django's representation of a HTML input element. The widget @@ -29,7 +29,12 @@ commonly used groups of widgets: .. attribute:: PasswordInput.render_value Determines whether the widget will have a value filled in when the - form is re-displayed after a validation error (default is ``True``). + form is re-displayed after a validation error (default is ``False``). + +.. versionchanged:: 1.3 + The default value for + :attr:`~PasswordInput.render_value` was + changed from ``True`` to ``False`` .. class:: HiddenInput @@ -50,7 +55,7 @@ commonly used groups of widgets: Date input as a simple text box: ``<input type='text' ...>`` Takes one optional argument: - + .. attribute:: DateInput.format The format in which this field's initial value will be displayed. @@ -64,11 +69,11 @@ commonly used groups of widgets: Date/time input as a simple text box: ``<input type='text' ...>`` Takes one optional argument: - + .. attribute:: DateTimeInput.format - + The format in which this field's initial value will be displayed. - + If no ``format`` argument is provided, the default format is ``'%Y-%m-%d %H:%M:%S'``. @@ -77,11 +82,11 @@ commonly used groups of widgets: Time input as a simple text box: ``<input type='text' ...>`` Takes one optional argument: - + .. attribute:: TimeInput.format - + The format in which this field's initial value will be displayed. - + If no ``format`` argument is provided, the default format is ``'%H:%M:%S'``. .. versionchanged:: 1.1 @@ -98,15 +103,15 @@ commonly used groups of widgets: Takes one optional argument: .. attribute:: CheckboxInput.check_test - - A callable that takes the value of the CheckBoxInput + + A callable that takes the value of the CheckBoxInput and returns ``True`` if the checkbox should be checked for - that value. + that value. .. class:: Select Select widget: ``<select><option ...>...</select>`` - + Requires that your field provides :attr:`~Field.choices`. .. class:: NullBooleanSelect @@ -123,22 +128,22 @@ commonly used groups of widgets: .. class:: RadioSelect A list of radio buttons: - + .. code-block:: html - + <ul> <li><input type='radio' ...></li> ... </ul> - + Requires that your field provides :attr:`~Field.choices`. .. class:: CheckboxSelectMultiple A list of checkboxes: - + .. code-block:: html - + <ul> <li><input type='checkbox' ...></li> ... @@ -155,7 +160,7 @@ commonly used groups of widgets: Takes two optional arguments, ``date_format`` and ``time_format``, which work just like the ``format`` argument for ``DateInput`` and ``TimeInput``. - + .. versionchanged:: 1.1 The ``date_format`` and ``time_format`` arguments were not supported in Django 1.0. diff --git a/docs/releases/1.3.txt b/docs/releases/1.3.txt index b0d0397055..d64d161aa4 100644 --- a/docs/releases/1.3.txt +++ b/docs/releases/1.3.txt @@ -18,6 +18,31 @@ fixes and an easy upgrade path from Django 1.2. Backwards-incompatible changes in 1.3 ===================================== +PasswordInput default rendering behavior +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Prior to Django 1.3, a :class:`~django.forms.PasswordInput` would render +data values like any other form. If a form submission raised an error, +the password that was submitted would be reflected to the client as form +data populating the form for resubmission. + +This had the potential to leak passwords, as any failed password +attempt would cause the password that was typed to be sent back to the +client. + +In Django 1.3, the default behavior of +:class:`~django.forms.PasswordInput` is to suppress the display of +password values. This change doesn't alter the way form data is +validated or handled. It only affects the user experience with +passwords on a form when they make an error submitting form data (such +as on unsuccessful logins, or when completing a registration form). + +If you want restore the pre-Django 1.3 behavior, you need to pass in a +custom widget to your form that sets the ``render_value`` argument:: + + class LoginForm(forms.Form): + username = forms.CharField(max_length=100) + password = forms.PasswordField(widget=forms.PasswordInput(render_value=True)) Features deprecated in 1.3 |