summaryrefslogtreecommitdiff
path: root/django/forms
AgeCommit message (Collapse)Author
2026-03-03[6.0.x] Fixed CVE-2026-25673 -- Simplified URLField scheme detection.Natalia
This simplicaftion mitigates a potential DoS in URLField on Windows. The usage of `urlsplit()` in `URLField.to_python()` was replaced with `str.partition(":")` for URL scheme detection. On Windows, `urlsplit()` performs Unicode normalization which is slow for certain characters, making `URLField` vulnerable to DoS via specially crafted POST payloads. Thanks Seokchan Yoon for the report, and Jake Howard and Shai Berger for the review. Refs #36923. Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com> Backport of 951ffb3832cd83ba672c1e3deae2bda128eb9cca from main.
2025-12-31[6.0.x] Fixed #36829 -- Reverted value of ClearableFileInput.use_fieldset to ↵Johannes Maron
True. There was unresolved discussion regarding whether to set ClearableFileInput.use_fieldset to True or False when use_fieldset was introduced in Django 4.1, since the clear checkbox appears only sometimes. Although using <fieldset> is likely desirable, since the primary motivation in #35892 was just to improve markup in the admin, and a deprecation path was not provided for general form usage, future work is deferred to #36828. Regression in 4187da258fe212d494cb578a0bc2b52c4979ab95. Thanks Tim Graham, Antoliny, and David Smith for triage.
2025-08-25Fixed #36251 -- Avoided mutating form Meta.fields in BaseInlineFormSet.SaJH
Signed-off-by: SaJH <wogur981208@gmail.com>
2025-08-21Clarified "inline foreign key" to avoid confusion with generated fields in ↵Clifford Gama
django/forms/models.py.
2025-08-19Fixed #35892 -- Supported Widget.use_fieldset in admin forms.antoliny0919
2025-07-23Refs #36500 -- Corrected rewrapped long lines fixed via a script.Mike Edmunds
Manually reformatted some comments and docstrings where autofix_w505.py changed the meaning of the formatting.
2025-07-23Refs #36500 -- Rewrapped long docstrings and block comments via a script.django-bot
Rewrapped long docstrings and block comments to 79 characters + newline using script from https://github.com/medmunds/autofix-w505.
2025-07-23Refs #36500 -- Shortened some long docstrings and comments.Mike Edmunds
Manually reformatted some long docstrings and comments that would be damaged by the to-be-applied autofixer script, in cases where editorial judgment seemed necessary for style or wording changes.
2025-03-31Refs #28909 -- Simplified code using unpacking generalizations.Aarni Koskela
2025-03-12Fixed #35676 -- Made BaseModelForm validate constraints that reference an ↵Clifford Gama
InlineForeignKeyField. Co-authored-by: Simon Charette <charette.s@gmail.com>
2025-03-10Fixed #36201 -- Caught ValidationError in ↵saJaeHyukc
ModelChoiceField/ModelMultipleChoiceField.clean(). Signed-off-by: saJaeHyukc <wogur981208@gmail.com>
2025-03-01Applied Black's 2025 stable style.Mariusz Felisiak
https://github.com/psf/black/releases/tag/25.1.0
2025-01-15Refs #34380 -- Changed the URLField default scheme to https and removed ↵Sarah Boyce
FORMS_URLFIELD_ASSUME_HTTPS per deprecation timeline.
2025-01-15Refs #32339 -- Removed transitional form renderers per deprecation timeline.Sarah Boyce
2025-01-15Fixed #35521 -- Allowed overriding BoundField class on fields, forms and ↵Matthias Kestenholz
renderers. Thank you Sarah Boyce, Carlton Gibson, Tim Schilling and Adam Johnson for reviews. Co-authored-by: Christophe Henry <contact@c-henry.fr> Co-authored-by: David Smith <smithdc@gmail.com> Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Co-authored-by: Matthias Kestenholz <mk@feinheit.ch>
2025-01-14Fixed CVE-2024-56374 -- Mitigated potential DoS in IPv6 validation.Michael Manfre
Thanks Saravana Kumar for the report, and Sarah Boyce and Mariusz Felisiak for the reviews. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2025-01-02Fixed #32819 -- Added aria-describedby to fields with errors.David Smith
2025-01-02Fixed #35886 -- Added support for object-based form media script assets.Johannes Maron
2024-12-17Refs #32819 -- Added aria-describedby property to BoundField.David Smith
2024-12-10Fixed #35987 -- Made ErrorList.copy() copy the renderer attribute.Adam Johnson
2024-12-10Fixed #35988 -- Made BaseForm.full_clean() pass renderer to ErrorDict.Adam Johnson
2024-12-05Refs #32819 -- Added id to ErrorList class and template.David Smith
2024-11-20Fixed #35913 -- Prevented formset name suffix 'FormFormSet'.antoliny0919
2024-09-09Refs #373 -- Added Model._is_pk_set() abstraction to check if a Model's PK ↵Csirmaz Bendegúz
is set.
2024-08-28Refs #32339 -- Adjusted deprecation warning stacklevel in transitional form ↵Simon Charette
renderers.
2024-08-02Fixed #35601 -- Added TelInput widget.lucasesposito
2024-08-02Fixed #35599 -- Added ColorInput widget.arjunomray
2024-07-31Fixed #35598 -- Added SearchInput widget.Jeremy Thompson
2024-06-17Fixed #35483 -- Added NUL (0x00) character validation to ModelChoiceFields.Alexander Lötvall
Applied the ProhibitNullCharactersValidator to ModelChoiceField and ModelMultipleChoiceField. Co-authored-by: Viktor Paripás <viktor.paripas@gmail.com> Co-authored-by: Vasyl Dizhak <vasyl@dizhak.com> Co-authored-by: Arthur Vasconcelos <vasconcelos.arthur@gmail.com>
2024-06-13Fixed #35488 -- Fixed BaseModelFormSet.validate_unique() crash due to ↵Madalin Popa
unhashable type.
2024-05-29Fixed 35467 -- Replaced urlparse with urlsplit where appropriate.Jake Howard
This work should not generate any change of functionality, and `urlsplit` is approximately 6x faster. Most use cases of `urlparse` didn't touch the path, so they can be converted to `urlsplit` without any issue. Most of those which do use `.path`, simply parse the URL, mutate the querystring, then put them back together, which is also fine (so long as urlunsplit is used).
2024-05-14Fixed #29942 -- Restored source file linking in docs by using the Sphinx ↵Joachim Jablon
linkcode ext. Co-authored-by: David Smith <smithdc@gmail.com> Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2024-04-30Refs #32819 -- Avoided adding 'aria-describedby' to hidden inputs.David Smith
Hidden elements are not visible for both accessibility tools and browsers presentation layer. This change therefore only reduces the size of the generated HTML.
2024-03-14Refs #34488 -- Made ClearableFileInput preserve "Clear" checked attribute ↵Johannes Maron
when form is invalid.
2024-02-26Fixed #35241 -- Cached model's full parent list.Adam Johnson
co-authored-by: Keryn Knight <keryn@kerynknight.com> co-authored-by: Natalia <124304+nessita@users.noreply.github.com> co-authored-by: David Smith <smithdc@gmail.com> co-authored-by: Paolo Melchiorre <paolo@melchiorre.org>
2024-02-20Fixed #35236 -- Used Field.attname/column attributes instead of ↵Adam Johnson
get_attname()/get_attname_column().
2024-01-26Applied Black's 2024 stable style.Mariusz Felisiak
https://github.com/psf/black/releases/tag/24.1.0
2024-01-23Fixed #32923 -- Refactored out Field._clean_bound_field().Syed Waheed
2023-11-28Refs #34380 -- Added FORMS_URLFIELD_ASSUME_HTTPS transitional setting.Mariusz Felisiak
This allows early adoption of the new default "https".
2023-11-24Fixed #34818 -- Prevented GenericIPAddressField from mutating error messages.Parth Verma
Co-authored-by: Parth Verma <parth.verma@gmail.com>
2023-11-20Refs #31026 -- Simplified BaseForm.get_context().David Smith
bf.errors returns an ErrorList. Access this directly and avoid creating a new instance in BaseForm.get_context() Calling str() on the ErrorList can also be deferred to when the variable used in the template.
2023-11-17Refs #32819 -- Established relationship between form fieldsets and their ↵David Smith
help text. This adds aria-describedby for widgets rendered in a fieldset such as radios. aria-describedby for these widgets is added to the <fieldset> element rather than each <input>.
2023-11-16Refs #32819 -- Used auto_id instead of id_for_label as unique identifier for ↵David Smith
the field. `id_for_label` is blank for widgets with multiple inputs such as radios and multiple checkboxes. Therefore , `help_text` for fields using these widgets cannot currently be associated using `aria-describedby`. `id_for_label` is being used as a guard to avoid incorrectly adding `aria-describedby` to those widgets. This change uses `auto_id` as the unique identified for the fields `help_text`. A guard is added to avoid incorrectly adding `aria-describedby` to inputs by checking the widget's `use_fieldset` attribute. Fields rendered in a `<fieldset>` should have `aria-describedby` added to the `<fieldset>` and not every `<input>`.
2023-11-02Fixed #34927 -- Fixed admin system check for inlines with foreign keys to ↵Antoine Cheneau
proxy models. Follow up to 0e8be73812a6e62d5a6b12a585d133b56bc2bf52.
2023-09-04Refs #31262 -- Renamed ChoiceIterator to BaseChoiceIterator.Nick Pope
Some third-party applications, e.g. `django-filter`, already define their own `ChoiceIterator`, so renaming this `BaseChoiceIterator` will be a better fit and avoid any potential confusion. See https://github.com/carltongibson/django-filter/pull/1607.
2023-08-30 Fixed #31262 -- Added support for mappings on model fields and ↵Nick Pope
ChoiceField's choices.
2023-08-01Fixed #32820 -- Added aria-invalid="true" to fields with errors.Gregor Jerše
Co-authored-by: Demetris Stavrou <demestav@gmail.com> Co-authored-by: David Smith <smithdc@gmail.com>
2023-07-24Fixed #34532 -- Made formset_factory() respect Form's default_renderer.Christopher Cave-Ayland
Co-authored-by: David Smith <smithdc@gmail.com>
2023-07-12Fixed #34705 -- Reallowed BoundField.as_widget()'s attrs argument to set ↵Sage Abdullah
aria-describedby. Regression in 966ecdd482167f3f6b08b00f484936c837751cb9.
2023-07-07Fixed #32210 -- Fixed model inlines with to_field that has a default.Neeraj Kumar
generated by cgit v1.3 (git 2.53.0) at 2026-06-30 20:53:49 +0000