summaryrefslogtreecommitdiff
path: root/django/forms
AgeCommit message (Collapse)Author
2026-06-10Fixed #36104 -- Returned NotImplemented in Media.__add__ for non-Media RHS.Jacob Walls
2026-06-09Fixed #37147 -- Fixed rendering empty values for models with db_default on ↵Mariusz Felisiak
primary key.
2026-05-21Fixed #37088 -- Included attributes in media object equality.Johannes Maron
Since in the majority of cases the `MediaAsset.attributes` will be empty or small, there's only a tiny performance penalty. However, the accidental use of the `path` property caused a 1_000x performacne degredation (N=1_000_000).
2026-05-07Fixed #37085 -- Added support for object-based form media stylesheet assets.Natalia
Thank you James Walls and James Bligh for reviews. Co-authored-by: Johannes Maron <johannes@maron.family>
2026-05-06Fixed #36784 -- Added csp_nonce_attr template tag for CSP nonce inclusion.Natalia
New default tag `{% csp_nonce_attr %}` was added for explicit CSP nonce inclusion into `<script>` and `<link>` elements. `{% csp_nonce_attr %}` renders `nonce="<value>"` when `csp_nonce` is present in the template context, and renders nothing otherwise. `{% csp_nonce_attr media %}` renders a `Media` object's assets with the nonce attr applied to each tag. Thanks Jacob Walls for the accurate and spot on review comments. Co-authored-by: Johannes Maron <johannes@maron.family>
2026-04-29Fixed #16429 -- Extracted set_choices() method from FilePathField.__init__().TildaDares
2026-04-22Fixed #35870 -- Made blank choice label in forms more accessible.Annabelle Wiegart
Added new constant django.db.models.fields.BLANK_CHOICE_LABEL for an accessible and translatable blank choice label in forms. Deprecated django.db.models.fields.BLANK_CHOICE_DASH constant. Added the immediately deprecated transitional setting USE_BLANK_CHOICE_DASH. Co-Authored-By: Marijke Luttekes <mail@marijkeluttekes.dev>
2026-04-01Fixed #37004 -- Used QuerySet.totally_ordered in ↵Rodrigo Vieira
BaseModelFormSet.get_queryset() for stable ordering.
2026-03-26Refs #36913 -- Maintained error message determinism in ↵afenoum
MultipleChoiceField.validate(). Used Django's OrderedSet datastructure instead of set() in MultipleChoiceField.validate() to prevent submission ordering from being discarded during validation. Thanks to Jacob Walls, JaeHyuck Sa, Jake Howard and Simon Charette for the reviews.
2026-03-25Fixed #36913 -- Optimized MultipleChoiceField.validate().afenoum
2026-03-03Fixed CVE-2026-25673 -- Simplified URLField scheme detection.Natalia
This simplicaftion mitigates a potential DoS in URLField on Windows. The usage of `urlsplit()` in `URLField.to_python()` was replaced with `str.partition(":")` for URL scheme detection. On Windows, `urlsplit()` performs Unicode normalization which is slow for certain characters, making `URLField` vulnerable to DoS via specially crafted POST payloads. Thanks Seokchan Yoon for the report, and Jake Howard and Shai Berger for the review. Refs #36923. Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
2025-12-31Fixed #36829 -- Reverted value of ClearableFileInput.use_fieldset to True.Johannes Maron
There was unresolved discussion regarding whether to set ClearableFileInput.use_fieldset to True or False when use_fieldset was introduced in Django 4.1, since the clear checkbox appears only sometimes. Although using <fieldset> is likely desirable, since the primary motivation in #35892 was just to improve markup in the admin, and a deprecation path was not provided for general form usage, future work is deferred to #36828. Regression in 4187da258fe212d494cb578a0bc2b52c4979ab95. Thanks Tim Graham, Antoliny, and David Smith for triage.
2025-12-19Fixed #36618 -- Corrected error message in BaseForm.add_error().Nilesh Kumar Pahari
The error message now correctly states that the error argument is a dictionary.
2025-11-13Fixed #36724 -- Removed invalid "for" attribute on <legend> tags.Kasyap Pentamaraju
2025-08-25Fixed #36251 -- Avoided mutating form Meta.fields in BaseInlineFormSet.SaJH
Signed-off-by: SaJH <wogur981208@gmail.com>
2025-08-21Clarified "inline foreign key" to avoid confusion with generated fields in ↵Clifford Gama
django/forms/models.py.
2025-08-19Fixed #35892 -- Supported Widget.use_fieldset in admin forms.antoliny0919
2025-07-23Refs #36500 -- Corrected rewrapped long lines fixed via a script.Mike Edmunds
Manually reformatted some comments and docstrings where autofix_w505.py changed the meaning of the formatting.
2025-07-23Refs #36500 -- Rewrapped long docstrings and block comments via a script.django-bot
Rewrapped long docstrings and block comments to 79 characters + newline using script from https://github.com/medmunds/autofix-w505.
2025-07-23Refs #36500 -- Shortened some long docstrings and comments.Mike Edmunds
Manually reformatted some long docstrings and comments that would be damaged by the to-be-applied autofixer script, in cases where editorial judgment seemed necessary for style or wording changes.
2025-03-31Refs #28909 -- Simplified code using unpacking generalizations.Aarni Koskela
2025-03-12Fixed #35676 -- Made BaseModelForm validate constraints that reference an ↵Clifford Gama
InlineForeignKeyField. Co-authored-by: Simon Charette <charette.s@gmail.com>
2025-03-10Fixed #36201 -- Caught ValidationError in ↵saJaeHyukc
ModelChoiceField/ModelMultipleChoiceField.clean(). Signed-off-by: saJaeHyukc <wogur981208@gmail.com>
2025-03-01Applied Black's 2025 stable style.Mariusz Felisiak
https://github.com/psf/black/releases/tag/25.1.0
2025-01-15Refs #34380 -- Changed the URLField default scheme to https and removed ↵Sarah Boyce
FORMS_URLFIELD_ASSUME_HTTPS per deprecation timeline.
2025-01-15Refs #32339 -- Removed transitional form renderers per deprecation timeline.Sarah Boyce
2025-01-15Fixed #35521 -- Allowed overriding BoundField class on fields, forms and ↵Matthias Kestenholz
renderers. Thank you Sarah Boyce, Carlton Gibson, Tim Schilling and Adam Johnson for reviews. Co-authored-by: Christophe Henry <contact@c-henry.fr> Co-authored-by: David Smith <smithdc@gmail.com> Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Co-authored-by: Matthias Kestenholz <mk@feinheit.ch>
2025-01-14Fixed CVE-2024-56374 -- Mitigated potential DoS in IPv6 validation.Michael Manfre
Thanks Saravana Kumar for the report, and Sarah Boyce and Mariusz Felisiak for the reviews. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2025-01-02Fixed #32819 -- Added aria-describedby to fields with errors.David Smith
2025-01-02Fixed #35886 -- Added support for object-based form media script assets.Johannes Maron
2024-12-17Refs #32819 -- Added aria-describedby property to BoundField.David Smith
2024-12-10Fixed #35987 -- Made ErrorList.copy() copy the renderer attribute.Adam Johnson
2024-12-10Fixed #35988 -- Made BaseForm.full_clean() pass renderer to ErrorDict.Adam Johnson
2024-12-05Refs #32819 -- Added id to ErrorList class and template.David Smith
2024-11-20Fixed #35913 -- Prevented formset name suffix 'FormFormSet'.antoliny0919
2024-09-09Refs #373 -- Added Model._is_pk_set() abstraction to check if a Model's PK ↵Csirmaz Bendegúz
is set.
2024-08-28Refs #32339 -- Adjusted deprecation warning stacklevel in transitional form ↵Simon Charette
renderers.
2024-08-02Fixed #35601 -- Added TelInput widget.lucasesposito
2024-08-02Fixed #35599 -- Added ColorInput widget.arjunomray
2024-07-31Fixed #35598 -- Added SearchInput widget.Jeremy Thompson
2024-06-17Fixed #35483 -- Added NUL (0x00) character validation to ModelChoiceFields.Alexander Lötvall
Applied the ProhibitNullCharactersValidator to ModelChoiceField and ModelMultipleChoiceField. Co-authored-by: Viktor Paripás <viktor.paripas@gmail.com> Co-authored-by: Vasyl Dizhak <vasyl@dizhak.com> Co-authored-by: Arthur Vasconcelos <vasconcelos.arthur@gmail.com>
2024-06-13Fixed #35488 -- Fixed BaseModelFormSet.validate_unique() crash due to ↵Madalin Popa
unhashable type.
2024-05-29Fixed 35467 -- Replaced urlparse with urlsplit where appropriate.Jake Howard
This work should not generate any change of functionality, and `urlsplit` is approximately 6x faster. Most use cases of `urlparse` didn't touch the path, so they can be converted to `urlsplit` without any issue. Most of those which do use `.path`, simply parse the URL, mutate the querystring, then put them back together, which is also fine (so long as urlunsplit is used).
2024-05-14Fixed #29942 -- Restored source file linking in docs by using the Sphinx ↵Joachim Jablon
linkcode ext. Co-authored-by: David Smith <smithdc@gmail.com> Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2024-04-30Refs #32819 -- Avoided adding 'aria-describedby' to hidden inputs.David Smith
Hidden elements are not visible for both accessibility tools and browsers presentation layer. This change therefore only reduces the size of the generated HTML.
2024-03-14Refs #34488 -- Made ClearableFileInput preserve "Clear" checked attribute ↵Johannes Maron
when form is invalid.
2024-02-26Fixed #35241 -- Cached model's full parent list.Adam Johnson
co-authored-by: Keryn Knight <keryn@kerynknight.com> co-authored-by: Natalia <124304+nessita@users.noreply.github.com> co-authored-by: David Smith <smithdc@gmail.com> co-authored-by: Paolo Melchiorre <paolo@melchiorre.org>
2024-02-20Fixed #35236 -- Used Field.attname/column attributes instead of ↵Adam Johnson
get_attname()/get_attname_column().
2024-01-26Applied Black's 2024 stable style.Mariusz Felisiak
https://github.com/psf/black/releases/tag/24.1.0
2024-01-23Fixed #32923 -- Refactored out Field._clean_bound_field().Syed Waheed
generated by cgit v1.3 (git 2.53.0) at 2026-07-01 03:30:11 +0000