summaryrefslogtreecommitdiff
path: root/django/forms
AgeCommit message (Collapse)Author
2025-01-14[5.1.x] Fixed CVE-2024-56374 -- Mitigated potential DoS in IPv6 validation.Michael Manfre
Thanks Saravana Kumar for the report, and Sarah Boyce and Mariusz Felisiak for the reviews. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2024-06-17[5.1.x] Fixed #35483 -- Added NUL (0x00) character validation to ↵Alexander Lötvall
ModelChoiceFields. Applied the ProhibitNullCharactersValidator to ModelChoiceField and ModelMultipleChoiceField. Co-authored-by: Viktor Paripás <viktor.paripas@gmail.com> Co-authored-by: Vasyl Dizhak <vasyl@dizhak.com> Co-authored-by: Arthur Vasconcelos <vasconcelos.arthur@gmail.com> Backport of 38ad710aba885ad26944ff5708ce1a02a446d2d3 from main.
2024-06-14[5.1.x] Fixed #35488 -- Fixed BaseModelFormSet.validate_unique() crash due ↵Madalin Popa
to unhashable type. Backport of d28626ecf8bd340084ed70ff2d88e8dbab001e2c from main.
2024-05-14Fixed #29942 -- Restored source file linking in docs by using the Sphinx ↵Joachim Jablon
linkcode ext. Co-authored-by: David Smith <smithdc@gmail.com> Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2024-04-30Refs #32819 -- Avoided adding 'aria-describedby' to hidden inputs.David Smith
Hidden elements are not visible for both accessibility tools and browsers presentation layer. This change therefore only reduces the size of the generated HTML.
2024-03-14Refs #34488 -- Made ClearableFileInput preserve "Clear" checked attribute ↵Johannes Maron
when form is invalid.
2024-02-26Fixed #35241 -- Cached model's full parent list.Adam Johnson
co-authored-by: Keryn Knight <keryn@kerynknight.com> co-authored-by: Natalia <124304+nessita@users.noreply.github.com> co-authored-by: David Smith <smithdc@gmail.com> co-authored-by: Paolo Melchiorre <paolo@melchiorre.org>
2024-02-20Fixed #35236 -- Used Field.attname/column attributes instead of ↵Adam Johnson
get_attname()/get_attname_column().
2024-01-26Applied Black's 2024 stable style.Mariusz Felisiak
https://github.com/psf/black/releases/tag/24.1.0
2024-01-23Fixed #32923 -- Refactored out Field._clean_bound_field().Syed Waheed
2023-11-28Refs #34380 -- Added FORMS_URLFIELD_ASSUME_HTTPS transitional setting.Mariusz Felisiak
This allows early adoption of the new default "https".
2023-11-24Fixed #34818 -- Prevented GenericIPAddressField from mutating error messages.Parth Verma
Co-authored-by: Parth Verma <parth.verma@gmail.com>
2023-11-20Refs #31026 -- Simplified BaseForm.get_context().David Smith
bf.errors returns an ErrorList. Access this directly and avoid creating a new instance in BaseForm.get_context() Calling str() on the ErrorList can also be deferred to when the variable used in the template.
2023-11-17Refs #32819 -- Established relationship between form fieldsets and their ↵David Smith
help text. This adds aria-describedby for widgets rendered in a fieldset such as radios. aria-describedby for these widgets is added to the <fieldset> element rather than each <input>.
2023-11-16Refs #32819 -- Used auto_id instead of id_for_label as unique identifier for ↵David Smith
the field. `id_for_label` is blank for widgets with multiple inputs such as radios and multiple checkboxes. Therefore , `help_text` for fields using these widgets cannot currently be associated using `aria-describedby`. `id_for_label` is being used as a guard to avoid incorrectly adding `aria-describedby` to those widgets. This change uses `auto_id` as the unique identified for the fields `help_text`. A guard is added to avoid incorrectly adding `aria-describedby` to inputs by checking the widget's `use_fieldset` attribute. Fields rendered in a `<fieldset>` should have `aria-describedby` added to the `<fieldset>` and not every `<input>`.
2023-11-02Fixed #34927 -- Fixed admin system check for inlines with foreign keys to ↵Antoine Cheneau
proxy models. Follow up to 0e8be73812a6e62d5a6b12a585d133b56bc2bf52.
2023-09-04Refs #31262 -- Renamed ChoiceIterator to BaseChoiceIterator.Nick Pope
Some third-party applications, e.g. `django-filter`, already define their own `ChoiceIterator`, so renaming this `BaseChoiceIterator` will be a better fit and avoid any potential confusion. See https://github.com/carltongibson/django-filter/pull/1607.
2023-08-30 Fixed #31262 -- Added support for mappings on model fields and ↵Nick Pope
ChoiceField's choices.
2023-08-01Fixed #32820 -- Added aria-invalid="true" to fields with errors.Gregor Jerše
Co-authored-by: Demetris Stavrou <demestav@gmail.com> Co-authored-by: David Smith <smithdc@gmail.com>
2023-07-24Fixed #34532 -- Made formset_factory() respect Form's default_renderer.Christopher Cave-Ayland
Co-authored-by: David Smith <smithdc@gmail.com>
2023-07-12Fixed #34705 -- Reallowed BoundField.as_widget()'s attrs argument to set ↵Sage Abdullah
aria-describedby. Regression in 966ecdd482167f3f6b08b00f484936c837751cb9.
2023-07-07Fixed #32210 -- Fixed model inlines with to_field that has a default.Neeraj Kumar
2023-07-06Fixed #32819 -- Established relationship between form fields and their help ↵Gregor Jerše
text. Thanks Nimra for the initial patch. Thanks Natalia Bidart, Thibaud Colas, David Smith, and Mariusz Felisiak for reviews.
2023-07-03Fixed CVE-2023-36053 -- Prevented potential ReDoS in EmailValidator and ↵Mariusz Felisiak
URLValidator. Thanks Seokchan Yoon for reports.
2023-06-16Fixed #34473 -- Fixed step validation for form fields with non-zero minimum ↵Jacob Rief
value.
2023-05-17Refs #32339 -- Fixed super() call in deprecated renderers.Carlton Gibson
Missing function call `()` leads to: TypeError: descriptor '__init__' of 'super' object needs an argument Regression in b209518089131c6b4afd18b1d9c320ba3521c5ab.
2023-05-03Fixed CVE-2023-31047, Fixed #31710 -- Prevented potential bypass of ↵Mariusz Felisiak
validation when uploading multiple files using one form field. Thanks Moataz Al-Sharida and nawaik for reports. Co-authored-by: Shai Berger <shai@platonix.com> Co-authored-by: nessita <124304+nessita@users.noreply.github.com>
2023-04-28Fixed #34380 -- Allowed specifying a default URL scheme in forms.URLField.Coen van der Kamp
This also deprecates "http" as the default scheme.
2023-04-27Avoided creating default form fields in fields_for_model() when declared on ↵Mariusz Felisiak
form.
2023-04-21Fixed #34488 -- Made ClearableFileInput preserve "Clear" checked attribute ↵Marcelo Galigniana
when form is invalid.
2023-03-24Fixed #34077 -- Added form field rendering.David Smith
2023-03-22Fixed #34424 -- Fixed SelectDateWidget crash for inputs raising OverflowError.Jure Slak
2023-03-21Fixed #34388 -- Allowed using choice enumeration types directly on model and ↵T. Franzel
form fields.
2023-02-20Fixed #34349 -- Fixed FormSet.empty_form crash when deleting extra forms is ↵Laurens Verhoeven
disabled.
2023-02-07Fixed #34317 -- Renamed "instance" argument of ↵Bakdolot
BaseModelFormSet.save_existing() method.
2023-02-01Refs #33476 -- Applied Black's 2023 stable style.David Smith
Black 23.1.0 is released which, as the first release of the year, introduces the 2023 stable style. This incorporates most of last year's preview style. https://github.com/psf/black/releases/tag/23.1.0
2023-01-19Refs #32528 -- Simplified Media.merge().Nick Pope
This avoids building up a second datastructure for the duplicate files warning case and simply flatten and strip duplicates if that case ever arises.
2023-01-19Fixed #32528 -- Replaced django.utils.topological_sort with ↵Nick Pope
graphlib.TopologicalSort(). graphlib.TopologicalSort() is available since Python 3.9.
2023-01-18Refs #32339 -- Deprecated transitional form renderers.Mariusz Felisiak
2023-01-17Refs #32339 -- Changed default form and formset rendering style to div-based.Mariusz Felisiak
Per deprecation timeline. This also removes "django/forms/default.html" and "django/forms/formsets/default.html" templates.
2023-01-17Refs #31026 -- Removed ability to return string when rendering ↵Mariusz Felisiak
ErrorDict/ErrorList. Per deprecation timeline.
2023-01-17Refs #31026 -- Removed BaseForm._html_output() per deprecation timeline.Mariusz Felisiak
2023-01-17Refs #32365 -- Removed support for pytz timezones per deprecation timeline.Mariusz Felisiak
2022-11-18Fixed #34119 -- Prevented callable default hidden widget value from being ↵David Sanders
overridden. Thanks to Benjamin Rigaud for the report.
2022-11-18Fixed #34148 -- Reverted "Fixed #32901 -- Optimized BaseForm.__getitem__()."Francesco Panico
This reverts commit edde2a069929c93e37835dc3f7c9a229040058e2. Thanks Jan Pieter Waagmeester for the report.
2022-11-04Fixed #27654 -- Propagated alters_data attribute to callables overridden in ↵LightDiscord
subclasses. Thanks Shai Berger and Adam Johnson for reviews and the implementation idea.
2022-10-31Used more augmented assignment statements.Nick Pope
Identified using the following command: $ git grep -I '\(\<[_a-zA-Z0-9]\+\>\) *= *\1 *[-+/*^%&|<>@]'
2022-10-25Fixed #19215 -- Fixed rendering ClearableFileInput when editing with invalid ↵Marcelo Galigniana
files. Thanks Michael Cardillo for the initial patch.
2022-09-09Fixed #33995 -- Fixed FormSet.empty_form crash when empty_permitted is ↵DevilsAutumn
passed to form_kwargs.
2022-08-25Fixed #33830 -- Fixed VariableDoesNotExist when rendering ClearableFileInput.Neeraj Kumar
generated by cgit v1.3 (git 2.53.0) at 2026-07-09 22:33:55 +0000