diff options
| author | Aymeric Augustin <aymeric.augustin@m4x.org> | 2013-02-12 11:22:41 +0100 |
|---|---|---|
| committer | Carl Meyer <carl@oddbird.net> | 2013-02-19 10:39:04 -0700 |
| commit | 3ef4bbf495cc6c061789132e3d50a8231a89406b (patch) | |
| tree | 771fc4671ebb8fecea076976073e15696d99fdea /docs | |
| parent | 0e46c7f7ac9c8c56149090b58a277239708cf4f7 (diff) | |
[1.5.x] Added a default limit to the maximum number of forms in a formset.
This is a security fix. Disclosure and advisory coming shortly.
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/topics/forms/formsets.txt | 4 | ||||
| -rw-r--r-- | docs/topics/forms/modelforms.txt | 4 |
2 files changed, 4 insertions, 4 deletions
diff --git a/docs/topics/forms/formsets.txt b/docs/topics/forms/formsets.txt index c07e2200d4..e315220a77 100644 --- a/docs/topics/forms/formsets.txt +++ b/docs/topics/forms/formsets.txt @@ -98,8 +98,8 @@ If the value of ``max_num`` is greater than the number of existing objects, up to ``extra`` additional blank forms will be added to the formset, so long as the total number of forms does not exceed ``max_num``. -A ``max_num`` value of ``None`` (the default) puts no limit on the number of -forms displayed. +A ``max_num`` value of ``None`` (the default) puts a high limit on the number +of forms displayed (1000). In practice this is equivalent to no limit. Formset validation ------------------ diff --git a/docs/topics/forms/modelforms.txt b/docs/topics/forms/modelforms.txt index 09010f142d..7251dc916a 100644 --- a/docs/topics/forms/modelforms.txt +++ b/docs/topics/forms/modelforms.txt @@ -727,8 +727,8 @@ so long as the total number of forms does not exceed ``max_num``:: <tr><th><label for="id_form-2-name">Name:</label></th><td><input id="id_form-2-name" type="text" name="form-2-name" value="Walt Whitman" maxlength="100" /><input type="hidden" name="form-2-id" value="2" id="id_form-2-id" /></td></tr> <tr><th><label for="id_form-3-name">Name:</label></th><td><input id="id_form-3-name" type="text" name="form-3-name" maxlength="100" /><input type="hidden" name="form-3-id" id="id_form-3-id" /></td></tr> -A ``max_num`` value of ``None`` (the default) puts no limit on the number of -forms displayed. +A ``max_num`` value of ``None`` (the default) puts a high limit on the number +of forms displayed (1000). In practice this is equivalent to no limit. Using a model formset in a view ------------------------------- |