summaryrefslogtreecommitdiff
path: root/tests/model_formsets
AgeCommit message (Collapse)Author
2026-10-06Fixed CVE-2026-87975 -- Prevented forging actions in model formsets with ↵Jacob Walls
editable PKs. Deleting instances outside a `ModelFormSet`'s queryset was possible by forging POST data for an editable primary key. In the same way, creating instances was possible for edit-only model formsets. An object outside the queryset is represented by a newly constructed instance, but its PK can still be populated: `BaseInlineFormSet` sets the parent link when it's also the primary key, and `construct_instance()` sets any editable primary PK present on the form. `save_existing_objects()` then took the populated primary key as proof that the instance came from the queryset and deleted or persisted the row. This change now checks `_state.adding` to identify instances that did not come from the queryset, whichever way the primary key was populated. Models using the default `AutoField` primary key are not affected. Thanks Seonggwon Yoon for the report and Natalia Bidart for reviews.
2026-09-07Fixed #37145 -- Made ModelFormSet respect custom Form.add_prefix().phanky1
2026-08-27Fixed #37255 -- Avoided relying on implicit SELECT ordering in tests.viralpraxis
Many (~70) tests assert a specific row order for querysets whose SQL has no ORDER BY. SQL standard does not define that order. On PostgreSQL the rows usually arrive in physical storage order, which on a freshly loaded table matches insertion order -- so these assertions pass by coincidence rather than by contract. That breaks when rows are updated or deleted and the space is reused, or when the planner picks a different access path such as an index scan. A test like this can start failing with no change to Django or to the test itself. The patch made sure that most of these tests do not rely on unspecified unordered selection order.
2026-06-25Removed hardcoded pks in many tests.Tim Graham
2026-04-24Reverted inadvertent changes to PK formatting in tests.Tim Graham
Bad conflict resolution in 63c56cda133a85a158502891c40465bc0331d3d9 reverted bits of d007fcf7291cc3c24d4545e23c759bde22b6a8a6.
2026-04-22Fixed #35870 -- Made blank choice label in forms more accessible.Annabelle Wiegart
Added new constant django.db.models.fields.BLANK_CHOICE_LABEL for an accessible and translatable blank choice label in forms. Deprecated django.db.models.fields.BLANK_CHOICE_DASH constant. Added the immediately deprecated transitional setting USE_BLANK_CHOICE_DASH. Co-Authored-By: Marijke Luttekes <mail@marijkeluttekes.dev>
2026-04-01Fixed #37004 -- Used QuerySet.totally_ordered in ↵Rodrigo Vieira
BaseModelFormSet.get_queryset() for stable ordering.
2026-04-01Refs #37004 -- Added coverage for BaseModelFormSet.get_queryset() fallback ↵Rodrigo Vieira
ordering.
2026-02-10Modified tests to format PKs with %s rather than %d.Tim Graham
It's how Django formats values internally and makes tests compatible with databases that use non-integer primary keys.
2025-11-13Fixed #36724 -- Removed invalid "for" attribute on <legend> tags.Kasyap Pentamaraju
2025-08-25Fixed #36251 -- Avoided mutating form Meta.fields in BaseInlineFormSet.SaJH
Signed-off-by: SaJH <wogur981208@gmail.com>
2025-07-23Refs #36500 -- Rewrapped long docstrings and block comments via a script.django-bot
Rewrapped long docstrings and block comments to 79 characters + newline using script from https://github.com/medmunds/autofix-w505.
2025-07-23Refs #36500 -- Shortened some long docstrings and comments.Mike Edmunds
Manually reformatted some long docstrings and comments that would be damaged by the to-be-applied autofixer script, in cases where editorial judgment seemed necessary for style or wording changes.
2025-07-23Removed double spaces after periods and within phrases.Sarah Boyce
2024-06-13Fixed #35488 -- Fixed BaseModelFormSet.validate_unique() crash due to ↵Madalin Popa
unhashable type.
2023-07-24Fixed #34532 -- Made formset_factory() respect Form's default_renderer.Christopher Cave-Ayland
Co-authored-by: David Smith <smithdc@gmail.com>
2023-07-07Fixed #32210 -- Fixed model inlines with to_field that has a default.Neeraj Kumar
2023-07-07Refs #24377 -- Added assertions for model inlines with primary key that has ↵Neeraj Kumar
a default. This ensures that a model field default is ignored.
2022-10-08Refs #33990 -- Renamed TransactionTestCase.assertQuerysetEqual() to ↵Gregor Gärtner
assertQuerySetEqual(). Co-Authored-By: Michael Howitz <mh@gocept.com>
2022-07-05Fixed #33822 -- Fixed save() crash on model formsets when not created by ↵Shawn Dong
modelformset_factory(). Thanks Claude Paroz for the report. Regression in e87f57fdb8dcdabc452bd15abd015bf6c9b1f7a8.
2022-02-07Refs #33476 -- Refactored code to strictly match 88 characters line length.Mariusz Felisiak
2022-02-07Refs #33476 -- Reformatted code with Black.django-bot
2022-01-27Fixed #26142 -- Allowed model formsets to prevent new object creation.vgolubev
Thanks Jacob Walls, David Smith, and Mariusz Felisiak for reviews. Co-authored-by: parth <parthvin@gmail.com>
2021-12-09Refs #32338 -- Added Boundfield.legend_tag().David Smith
2021-09-20Fixed #31026 -- Switched form rendering to template engine.David Smith
Thanks Carlton Gibson, Keryn Knight, Mariusz Felisiak, and Nick Pope for reviews. Co-authored-by: Johannes Hoppe <info@johanneshoppe.com>
2020-11-06Fixed #31235 -- Made assertQuerysetEqual() compare querysets directly.Hasan Ramezani
This also replaces assertQuerysetEqual() to assertSequenceEqual()/assertCountEqual() where appropriate. Co-authored-by: Peter Inglesby <peter.inglesby@gmail.com> Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2020-11-05Fixed #22276 -- Fixed crash when formset management form is invalid.Jon Dufresne
Co-authored-by: Patryk Zawadzki <patrys@room-303.com>
2020-09-28Fixed #32042 -- Improved error messages for the number of submitted forms in ↵meghanabhange
formsets.
2020-06-24Fixed #9061 -- Allowed FormSets to disable deleting extra forms.David Smith
Thanks to Dan Ward for the initial patch.
2020-06-05Fixed #20347 -- Allowed customizing the maximum number of instantiated forms ↵David Smith
in formsets. Co-authored-by: ethurgood <ethurgood@gmail.com>
2020-05-04Changed `'%s' % value` pattern to `str(value)`.Nick Pope
2018-12-27Followed style guide for model attribute ordering.Matt Wiens
2018-08-21Fixed #29696 -- Prevented BaseModelFormSet.initial_form_count()'s from ↵Jon Dufresne
treating data={} as unbound.
2018-07-30Fixed #26819 -- Fixed BaseModelFormSet.validate_unique() "unhashable type: ↵Demur Nodia
list" crash.
2018-07-30Fixed nonexistent field reference in test model __str__() method.Demur Nodia
2018-01-21Fixed #29038 -- Removed closing slash from HTML void tags.Jon Dufresne
2017-07-11Fixed #22229 -- Added primary key validation to ↵Jon Dufresne
BaseModelFormSet._construct_form().
2017-07-11Added ModelFormSet test for validation of a nonexistent PK.Jon Dufresne
2017-05-27Fixed #28249 -- Removed unnecessary dict.keys() calls.Jon Dufresne
iter(dict) is equivalent to iter(dict.keys()).
2017-05-03Fixed #28159 -- Fixed BaseInlineFormSet._construct_form() crash when using ↵Alexander Kavanaugh
save_as_new. Regression in 4a246a02bdcbc13b15480c014f51cb0682af7c1e.
2017-01-25Refs #23919 -- Replaced super(ClassName, self) with super().chillaranand
2017-01-18Refs #23919 -- Removed six.<various>_types usageClaude Paroz
Thanks Tim Graham and Simon Charette for the reviews.
2017-01-18Refs #23919 -- Removed python_2_unicode_compatible decorator usageClaude Paroz
2017-01-18Refs #23919 -- Removed encoding preambles and future importsClaude Paroz
2016-12-06Fixed #27416 -- Prevented ModelFormSet from creating objects for invalid PKs ↵Hiroki Kiyohara
in data.
2016-11-10Refs #27392 -- Removed "Tests that", "Ensures that", etc. from test docstrings.za
2016-09-21Fixed #27256 -- Changed Select widget's selected attribute to use HTML5 ↵Jon Dufresne
boolean syntax.
2016-09-09Refs #25415 -- Fixed invalid models in the test suite.Adam Chainz
2016-06-16Fixed #26747 -- Used more specific assertions in the Django test suite.Jon Dufresne
2016-04-21Fixed #22383 -- Added support for HTML5 required attribute on required form ↵Jon Dufresne
fields.
generated by cgit v1.3 (git 2.53.0) at 2026-11-15 23:42:33 +0000