summaryrefslogtreecommitdiff
path: root/django/forms/fields.py
AgeCommit message (Collapse)Author
2026-04-29Fixed #16429 -- Extracted set_choices() method from FilePathField.__init__().TildaDares
2026-04-22Fixed #35870 -- Made blank choice label in forms more accessible.Annabelle Wiegart
Added new constant django.db.models.fields.BLANK_CHOICE_LABEL for an accessible and translatable blank choice label in forms. Deprecated django.db.models.fields.BLANK_CHOICE_DASH constant. Added the immediately deprecated transitional setting USE_BLANK_CHOICE_DASH. Co-Authored-By: Marijke Luttekes <mail@marijkeluttekes.dev>
2026-03-26Refs #36913 -- Maintained error message determinism in ↵afenoum
MultipleChoiceField.validate(). Used Django's OrderedSet datastructure instead of set() in MultipleChoiceField.validate() to prevent submission ordering from being discarded during validation. Thanks to Jacob Walls, JaeHyuck Sa, Jake Howard and Simon Charette for the reviews.
2026-03-25Fixed #36913 -- Optimized MultipleChoiceField.validate().afenoum
2026-03-03Fixed CVE-2026-25673 -- Simplified URLField scheme detection.Natalia
This simplicaftion mitigates a potential DoS in URLField on Windows. The usage of `urlsplit()` in `URLField.to_python()` was replaced with `str.partition(":")` for URL scheme detection. On Windows, `urlsplit()` performs Unicode normalization which is slow for certain characters, making `URLField` vulnerable to DoS via specially crafted POST payloads. Thanks Seokchan Yoon for the report, and Jake Howard and Shai Berger for the review. Refs #36923. Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
2025-07-23Refs #36500 -- Corrected rewrapped long lines fixed via a script.Mike Edmunds
Manually reformatted some comments and docstrings where autofix_w505.py changed the meaning of the formatting.
2025-07-23Refs #36500 -- Rewrapped long docstrings and block comments via a script.django-bot
Rewrapped long docstrings and block comments to 79 characters + newline using script from https://github.com/medmunds/autofix-w505.
2025-01-15Refs #34380 -- Changed the URLField default scheme to https and removed ↵Sarah Boyce
FORMS_URLFIELD_ASSUME_HTTPS per deprecation timeline.
2025-01-15Fixed #35521 -- Allowed overriding BoundField class on fields, forms and ↵Matthias Kestenholz
renderers. Thank you Sarah Boyce, Carlton Gibson, Tim Schilling and Adam Johnson for reviews. Co-authored-by: Christophe Henry <contact@c-henry.fr> Co-authored-by: David Smith <smithdc@gmail.com> Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Co-authored-by: Matthias Kestenholz <mk@feinheit.ch>
2025-01-14Fixed CVE-2024-56374 -- Mitigated potential DoS in IPv6 validation.Michael Manfre
Thanks Saravana Kumar for the report, and Sarah Boyce and Mariusz Felisiak for the reviews. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2024-05-29Fixed 35467 -- Replaced urlparse with urlsplit where appropriate.Jake Howard
This work should not generate any change of functionality, and `urlsplit` is approximately 6x faster. Most use cases of `urlparse` didn't touch the path, so they can be converted to `urlsplit` without any issue. Most of those which do use `.path`, simply parse the URL, mutate the querystring, then put them back together, which is also fine (so long as urlunsplit is used).
2024-01-23Fixed #32923 -- Refactored out Field._clean_bound_field().Syed Waheed
2023-11-28Refs #34380 -- Added FORMS_URLFIELD_ASSUME_HTTPS transitional setting.Mariusz Felisiak
This allows early adoption of the new default "https".
2023-11-24Fixed #34818 -- Prevented GenericIPAddressField from mutating error messages.Parth Verma
Co-authored-by: Parth Verma <parth.verma@gmail.com>
2023-08-30 Fixed #31262 -- Added support for mappings on model fields and ↵Nick Pope
ChoiceField's choices.
2023-07-03Fixed CVE-2023-36053 -- Prevented potential ReDoS in EmailValidator and ↵Mariusz Felisiak
URLValidator. Thanks Seokchan Yoon for reports.
2023-06-16Fixed #34473 -- Fixed step validation for form fields with non-zero minimum ↵Jacob Rief
value.
2023-04-28Fixed #34380 -- Allowed specifying a default URL scheme in forms.URLField.Coen van der Kamp
This also deprecates "http" as the default scheme.
2023-03-24Fixed #34077 -- Added form field rendering.David Smith
2023-03-21Fixed #34388 -- Allowed using choice enumeration types directly on model and ↵T. Franzel
form fields.
2022-10-25Fixed #19215 -- Fixed rendering ClearableFileInput when editing with invalid ↵Marcelo Galigniana
files. Thanks Michael Cardillo for the initial patch.
2022-05-12Fixed #32559 -- Added 'step_size’ to numeric form fields.Kapil Bansal
Co-authored-by: Jacob Rief <jacob.rief@uibk.ac.at>
2022-02-07Refs #33476 -- Reformatted code with Black.django-bot
2021-07-21Fixed #32949 -- Restored invalid number handling in DecimalField.validate().yakimka
DecimalField must itself validate() values, such as NaN, which cannot be passed to validators, such as MaxValueValidator, during the run_validators() phase. Regression in cc3d24d7d577f174937a0744d886c4c7123cfa85.
2021-06-28Fixed #32807 -- Fixed JSONField crash when redisplaying None values.Dan Strokirk
Thanks to Alex Hill for the initial patch.
2021-06-07Fixed #32821 -- Updated os.scandir() uses to use a context manager.Chris Jerdonek
2021-01-16Improved performance of DecimalField.David Smith
strip() is unnecessary because decimal.Decimal() strips the input value.
2020-10-09Fixed #32080 -- Fixed displaying Unicode chars in forms.JSONField and ↵Qi Zhao
read-only JSONField values in admin.
2020-07-27Removed redundant forms.DecimalField.validate() in favor of DecimalValidator.Jon Dufresne
2020-05-08Fixed #12990, Refs #27694 -- Added JSONField model field.sage
Thanks to Adam Johnson, Carlton Gibson, Mariusz Felisiak, and Raphael Michel for mentoring this Google Summer of Code 2019 project and everyone else who helped with the patch. Special thanks to Mads Jensen, Nick Pope, and Simon Charette for extensive reviews. Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2020-01-07Fixed #15982 -- Added DATE_INPUT_FORMATS to forms.DateTimeField default ↵Claude Paroz
input formats.
2020-01-06Fixed #11385 -- Made forms.DateTimeField accept ISO 8601 date inputs.Claude Paroz
Thanks José Padilla for the initial patch, and Carlton Gibson for the review.
2019-10-29Fixed #30899 -- Lazily compiled import time regular expressions.Hasan Ramezani
2019-10-08Fixed #30839 -- Fixed Field.__deepcopy__() so forms don't share error messages.Hasan Ramezani
2019-09-24Removed some outdated backwards compatibility imports and misleading comments.Mads Jensen
EmptyResultSet moved in 46509cf13dbf049f75077981c29ef2c60b5a96ab. FieldDoesNotExist moved in 8958170755b37ce346ae5257c1000bd936faa3b0. BoundField and pretty_name moved in 8550161e531a603d57723850fb09c4c9b7ca60b9. EMPTY_VALUES moved in 471596fc1afcb9c6258d317c619eaf5fd394e797. BaseRunserverCommand moved in 5c53e30607014163872e89c221b206992a9acfef.
2018-08-29Refs #29689 -- Moved FilePathField choices sorting outside the loop.Sergey Fedoseev
2018-08-20Fixed #29689 -- Improved performance of FileSystemStorage.listdir() and ↵Federico Bond
FilePathField with os.scandir().
2018-08-18Refs #29426 -- Made UUIDField render values with dashes.Tim Graham
2018-08-08Fixed #29623 -- Fixed translation failure of DurationField's "overflow" ↵Tim Graham
error message.
2018-04-04Fixed #29284 -- Made ImageField render with accept="image/*"' HTML attribute.safu9
2018-01-11Refs #29006 -- Simplified handling of SNaN values in DecimalField.validate().Sergey Fedoseev
2018-01-10Fixed #29006 -- Fixed DecimalField.clean() crash on sNaN values.Fabio Bonelli
2018-01-05Fixed #28882 -- Fixed cleaning of disabled MultiValueFields.Tim Graham
Thanks avalanchy for the initial patch.
2018-01-03Fixed #28982 -- Simplified code with and/or.Дилян Палаузов
2017-12-30Used Decimal.scaleb() in backends.utils.format_number() and ↵Mariusz Felisiak
DecimalField.widget_attrs() to improve performance.
2017-12-11Fixed #28909 -- Simplified code using tuple/list/set/dict unpacking.Nick Pope
2017-10-25Fixed #28474 -- Made DurationField raise ValidationError for inputs that ↵Srinivas Reddy Thatiparthy
raised OverflowError.
2017-09-07Reverted "Fixed #27818 -- Replaced try/except/pass with contextlib.suppress()."Tim Graham
This reverts commit 550cb3a365dee4edfdd1563224d5304de2a57fda because try/except performs better.
2017-09-05Fixed #28555 -- Made CharField convert whitespace-only values to the ↵Josh Schneier
empty_value when strip is enabled.
2017-08-12Fixed #28201 -- Added ProhibitNullCharactersValidator and used it on ↵Alejandro Zamora
CharField form field.