summaryrefslogtreecommitdiff
path: root/django/forms
AgeCommit message (Collapse)Author
2026-03-03[5.2.x] Fixed CVE-2026-25673 -- Simplified URLField scheme detection.Natalia
This simplicaftion mitigates a potential DoS in URLField on Windows. The usage of `urlsplit()` in `URLField.to_python()` was replaced with `str.partition(":")` for URL scheme detection. On Windows, `urlsplit()` performs Unicode normalization which is slow for certain characters, making `URLField` vulnerable to DoS via specially crafted POST payloads. Thanks Seokchan Yoon for the report, and Jake Howard and Shai Berger for the review. Refs #36923. Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com> Backport of 951ffb3832cd83ba672c1e3deae2bda128eb9cca from main.
2025-03-01[5.2.x] Applied Black's 2025 stable style.Mariusz Felisiak
https://github.com/psf/black/releases/tag/25.1.0 Backport of ff3aaf036f0cb66cd8f404cd51c603e68aaa7676 from main
2025-01-15Fixed #35521 -- Allowed overriding BoundField class on fields, forms and ↵Matthias Kestenholz
renderers. Thank you Sarah Boyce, Carlton Gibson, Tim Schilling and Adam Johnson for reviews. Co-authored-by: Christophe Henry <contact@c-henry.fr> Co-authored-by: David Smith <smithdc@gmail.com> Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Co-authored-by: Matthias Kestenholz <mk@feinheit.ch>
2025-01-14Fixed CVE-2024-56374 -- Mitigated potential DoS in IPv6 validation.Michael Manfre
Thanks Saravana Kumar for the report, and Sarah Boyce and Mariusz Felisiak for the reviews. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2025-01-02Fixed #32819 -- Added aria-describedby to fields with errors.David Smith
2025-01-02Fixed #35886 -- Added support for object-based form media script assets.Johannes Maron
2024-12-17Refs #32819 -- Added aria-describedby property to BoundField.David Smith
2024-12-10Fixed #35987 -- Made ErrorList.copy() copy the renderer attribute.Adam Johnson
2024-12-10Fixed #35988 -- Made BaseForm.full_clean() pass renderer to ErrorDict.Adam Johnson
2024-12-05Refs #32819 -- Added id to ErrorList class and template.David Smith
2024-11-20Fixed #35913 -- Prevented formset name suffix 'FormFormSet'.antoliny0919
2024-09-09Refs #373 -- Added Model._is_pk_set() abstraction to check if a Model's PK ↵Csirmaz Bendegúz
is set.
2024-08-28Refs #32339 -- Adjusted deprecation warning stacklevel in transitional form ↵Simon Charette
renderers.
2024-08-02Fixed #35601 -- Added TelInput widget.lucasesposito
2024-08-02Fixed #35599 -- Added ColorInput widget.arjunomray
2024-07-31Fixed #35598 -- Added SearchInput widget.Jeremy Thompson
2024-06-17Fixed #35483 -- Added NUL (0x00) character validation to ModelChoiceFields.Alexander Lötvall
Applied the ProhibitNullCharactersValidator to ModelChoiceField and ModelMultipleChoiceField. Co-authored-by: Viktor Paripás <viktor.paripas@gmail.com> Co-authored-by: Vasyl Dizhak <vasyl@dizhak.com> Co-authored-by: Arthur Vasconcelos <vasconcelos.arthur@gmail.com>
2024-06-13Fixed #35488 -- Fixed BaseModelFormSet.validate_unique() crash due to ↵Madalin Popa
unhashable type.
2024-05-29Fixed 35467 -- Replaced urlparse with urlsplit where appropriate.Jake Howard
This work should not generate any change of functionality, and `urlsplit` is approximately 6x faster. Most use cases of `urlparse` didn't touch the path, so they can be converted to `urlsplit` without any issue. Most of those which do use `.path`, simply parse the URL, mutate the querystring, then put them back together, which is also fine (so long as urlunsplit is used).
2024-05-14Fixed #29942 -- Restored source file linking in docs by using the Sphinx ↵Joachim Jablon
linkcode ext. Co-authored-by: David Smith <smithdc@gmail.com> Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2024-04-30Refs #32819 -- Avoided adding 'aria-describedby' to hidden inputs.David Smith
Hidden elements are not visible for both accessibility tools and browsers presentation layer. This change therefore only reduces the size of the generated HTML.
2024-03-14Refs #34488 -- Made ClearableFileInput preserve "Clear" checked attribute ↵Johannes Maron
when form is invalid.
2024-02-26Fixed #35241 -- Cached model's full parent list.Adam Johnson
co-authored-by: Keryn Knight <keryn@kerynknight.com> co-authored-by: Natalia <124304+nessita@users.noreply.github.com> co-authored-by: David Smith <smithdc@gmail.com> co-authored-by: Paolo Melchiorre <paolo@melchiorre.org>
2024-02-20Fixed #35236 -- Used Field.attname/column attributes instead of ↵Adam Johnson
get_attname()/get_attname_column().
2024-01-26Applied Black's 2024 stable style.Mariusz Felisiak
https://github.com/psf/black/releases/tag/24.1.0
2024-01-23Fixed #32923 -- Refactored out Field._clean_bound_field().Syed Waheed
2023-11-28Refs #34380 -- Added FORMS_URLFIELD_ASSUME_HTTPS transitional setting.Mariusz Felisiak
This allows early adoption of the new default "https".
2023-11-24Fixed #34818 -- Prevented GenericIPAddressField from mutating error messages.Parth Verma
Co-authored-by: Parth Verma <parth.verma@gmail.com>
2023-11-20Refs #31026 -- Simplified BaseForm.get_context().David Smith
bf.errors returns an ErrorList. Access this directly and avoid creating a new instance in BaseForm.get_context() Calling str() on the ErrorList can also be deferred to when the variable used in the template.
2023-11-17Refs #32819 -- Established relationship between form fieldsets and their ↵David Smith
help text. This adds aria-describedby for widgets rendered in a fieldset such as radios. aria-describedby for these widgets is added to the <fieldset> element rather than each <input>.
2023-11-16Refs #32819 -- Used auto_id instead of id_for_label as unique identifier for ↵David Smith
the field. `id_for_label` is blank for widgets with multiple inputs such as radios and multiple checkboxes. Therefore , `help_text` for fields using these widgets cannot currently be associated using `aria-describedby`. `id_for_label` is being used as a guard to avoid incorrectly adding `aria-describedby` to those widgets. This change uses `auto_id` as the unique identified for the fields `help_text`. A guard is added to avoid incorrectly adding `aria-describedby` to inputs by checking the widget's `use_fieldset` attribute. Fields rendered in a `<fieldset>` should have `aria-describedby` added to the `<fieldset>` and not every `<input>`.
2023-11-02Fixed #34927 -- Fixed admin system check for inlines with foreign keys to ↵Antoine Cheneau
proxy models. Follow up to 0e8be73812a6e62d5a6b12a585d133b56bc2bf52.
2023-09-04Refs #31262 -- Renamed ChoiceIterator to BaseChoiceIterator.Nick Pope
Some third-party applications, e.g. `django-filter`, already define their own `ChoiceIterator`, so renaming this `BaseChoiceIterator` will be a better fit and avoid any potential confusion. See https://github.com/carltongibson/django-filter/pull/1607.
2023-08-30 Fixed #31262 -- Added support for mappings on model fields and ↵Nick Pope
ChoiceField's choices.
2023-08-01Fixed #32820 -- Added aria-invalid="true" to fields with errors.Gregor Jerše
Co-authored-by: Demetris Stavrou <demestav@gmail.com> Co-authored-by: David Smith <smithdc@gmail.com>
2023-07-24Fixed #34532 -- Made formset_factory() respect Form's default_renderer.Christopher Cave-Ayland
Co-authored-by: David Smith <smithdc@gmail.com>
2023-07-12Fixed #34705 -- Reallowed BoundField.as_widget()'s attrs argument to set ↵Sage Abdullah
aria-describedby. Regression in 966ecdd482167f3f6b08b00f484936c837751cb9.
2023-07-07Fixed #32210 -- Fixed model inlines with to_field that has a default.Neeraj Kumar
2023-07-06Fixed #32819 -- Established relationship between form fields and their help ↵Gregor Jerše
text. Thanks Nimra for the initial patch. Thanks Natalia Bidart, Thibaud Colas, David Smith, and Mariusz Felisiak for reviews.
2023-07-03Fixed CVE-2023-36053 -- Prevented potential ReDoS in EmailValidator and ↵Mariusz Felisiak
URLValidator. Thanks Seokchan Yoon for reports.
2023-06-16Fixed #34473 -- Fixed step validation for form fields with non-zero minimum ↵Jacob Rief
value.
2023-05-17Refs #32339 -- Fixed super() call in deprecated renderers.Carlton Gibson
Missing function call `()` leads to: TypeError: descriptor '__init__' of 'super' object needs an argument Regression in b209518089131c6b4afd18b1d9c320ba3521c5ab.
2023-05-03Fixed CVE-2023-31047, Fixed #31710 -- Prevented potential bypass of ↵Mariusz Felisiak
validation when uploading multiple files using one form field. Thanks Moataz Al-Sharida and nawaik for reports. Co-authored-by: Shai Berger <shai@platonix.com> Co-authored-by: nessita <124304+nessita@users.noreply.github.com>
2023-04-28Fixed #34380 -- Allowed specifying a default URL scheme in forms.URLField.Coen van der Kamp
This also deprecates "http" as the default scheme.
2023-04-27Avoided creating default form fields in fields_for_model() when declared on ↵Mariusz Felisiak
form.
2023-04-21Fixed #34488 -- Made ClearableFileInput preserve "Clear" checked attribute ↵Marcelo Galigniana
when form is invalid.
2023-03-24Fixed #34077 -- Added form field rendering.David Smith
2023-03-22Fixed #34424 -- Fixed SelectDateWidget crash for inputs raising OverflowError.Jure Slak
2023-03-21Fixed #34388 -- Allowed using choice enumeration types directly on model and ↵T. Franzel
form fields.
2023-02-20Fixed #34349 -- Fixed FormSet.empty_form crash when deleting extra forms is ↵Laurens Verhoeven
disabled.
generated by cgit v1.3 (git 2.53.0) at 2026-07-08 22:45:38 +0000