summaryrefslogtreecommitdiff
path: root/django/forms
AgeCommit message (Collapse)Author
2026-04-01Fixed #37004 -- Used QuerySet.totally_ordered in ↵Rodrigo Vieira
BaseModelFormSet.get_queryset() for stable ordering.
2026-03-26Refs #36913 -- Maintained error message determinism in ↵afenoum
MultipleChoiceField.validate(). Used Django's OrderedSet datastructure instead of set() in MultipleChoiceField.validate() to prevent submission ordering from being discarded during validation. Thanks to Jacob Walls, JaeHyuck Sa, Jake Howard and Simon Charette for the reviews.
2026-03-25Fixed #36913 -- Optimized MultipleChoiceField.validate().afenoum
2026-03-03Fixed CVE-2026-25673 -- Simplified URLField scheme detection.Natalia
This simplicaftion mitigates a potential DoS in URLField on Windows. The usage of `urlsplit()` in `URLField.to_python()` was replaced with `str.partition(":")` for URL scheme detection. On Windows, `urlsplit()` performs Unicode normalization which is slow for certain characters, making `URLField` vulnerable to DoS via specially crafted POST payloads. Thanks Seokchan Yoon for the report, and Jake Howard and Shai Berger for the review. Refs #36923. Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
2025-12-31Fixed #36829 -- Reverted value of ClearableFileInput.use_fieldset to True.Johannes Maron
There was unresolved discussion regarding whether to set ClearableFileInput.use_fieldset to True or False when use_fieldset was introduced in Django 4.1, since the clear checkbox appears only sometimes. Although using <fieldset> is likely desirable, since the primary motivation in #35892 was just to improve markup in the admin, and a deprecation path was not provided for general form usage, future work is deferred to #36828. Regression in 4187da258fe212d494cb578a0bc2b52c4979ab95. Thanks Tim Graham, Antoliny, and David Smith for triage.
2025-12-19Fixed #36618 -- Corrected error message in BaseForm.add_error().Nilesh Kumar Pahari
The error message now correctly states that the error argument is a dictionary.
2025-11-13Fixed #36724 -- Removed invalid "for" attribute on <legend> tags.Kasyap Pentamaraju
2025-08-25Fixed #36251 -- Avoided mutating form Meta.fields in BaseInlineFormSet.SaJH
Signed-off-by: SaJH <wogur981208@gmail.com>
2025-08-21Clarified "inline foreign key" to avoid confusion with generated fields in ↵Clifford Gama
django/forms/models.py.
2025-08-19Fixed #35892 -- Supported Widget.use_fieldset in admin forms.antoliny0919
2025-07-23Refs #36500 -- Corrected rewrapped long lines fixed via a script.Mike Edmunds
Manually reformatted some comments and docstrings where autofix_w505.py changed the meaning of the formatting.
2025-07-23Refs #36500 -- Rewrapped long docstrings and block comments via a script.django-bot
Rewrapped long docstrings and block comments to 79 characters + newline using script from https://github.com/medmunds/autofix-w505.
2025-07-23Refs #36500 -- Shortened some long docstrings and comments.Mike Edmunds
Manually reformatted some long docstrings and comments that would be damaged by the to-be-applied autofixer script, in cases where editorial judgment seemed necessary for style or wording changes.
2025-03-31Refs #28909 -- Simplified code using unpacking generalizations.Aarni Koskela
2025-03-12Fixed #35676 -- Made BaseModelForm validate constraints that reference an ↵Clifford Gama
InlineForeignKeyField. Co-authored-by: Simon Charette <charette.s@gmail.com>
2025-03-10Fixed #36201 -- Caught ValidationError in ↵saJaeHyukc
ModelChoiceField/ModelMultipleChoiceField.clean(). Signed-off-by: saJaeHyukc <wogur981208@gmail.com>
2025-03-01Applied Black's 2025 stable style.Mariusz Felisiak
https://github.com/psf/black/releases/tag/25.1.0
2025-01-15Refs #34380 -- Changed the URLField default scheme to https and removed ↵Sarah Boyce
FORMS_URLFIELD_ASSUME_HTTPS per deprecation timeline.
2025-01-15Refs #32339 -- Removed transitional form renderers per deprecation timeline.Sarah Boyce
2025-01-15Fixed #35521 -- Allowed overriding BoundField class on fields, forms and ↵Matthias Kestenholz
renderers. Thank you Sarah Boyce, Carlton Gibson, Tim Schilling and Adam Johnson for reviews. Co-authored-by: Christophe Henry <contact@c-henry.fr> Co-authored-by: David Smith <smithdc@gmail.com> Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Co-authored-by: Matthias Kestenholz <mk@feinheit.ch>
2025-01-14Fixed CVE-2024-56374 -- Mitigated potential DoS in IPv6 validation.Michael Manfre
Thanks Saravana Kumar for the report, and Sarah Boyce and Mariusz Felisiak for the reviews. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2025-01-02Fixed #32819 -- Added aria-describedby to fields with errors.David Smith
2025-01-02Fixed #35886 -- Added support for object-based form media script assets.Johannes Maron
2024-12-17Refs #32819 -- Added aria-describedby property to BoundField.David Smith
2024-12-10Fixed #35987 -- Made ErrorList.copy() copy the renderer attribute.Adam Johnson
2024-12-10Fixed #35988 -- Made BaseForm.full_clean() pass renderer to ErrorDict.Adam Johnson
2024-12-05Refs #32819 -- Added id to ErrorList class and template.David Smith
2024-11-20Fixed #35913 -- Prevented formset name suffix 'FormFormSet'.antoliny0919
2024-09-09Refs #373 -- Added Model._is_pk_set() abstraction to check if a Model's PK ↵Csirmaz Bendegúz
is set.
2024-08-28Refs #32339 -- Adjusted deprecation warning stacklevel in transitional form ↵Simon Charette
renderers.
2024-08-02Fixed #35601 -- Added TelInput widget.lucasesposito
2024-08-02Fixed #35599 -- Added ColorInput widget.arjunomray
2024-07-31Fixed #35598 -- Added SearchInput widget.Jeremy Thompson
2024-06-17Fixed #35483 -- Added NUL (0x00) character validation to ModelChoiceFields.Alexander Lötvall
Applied the ProhibitNullCharactersValidator to ModelChoiceField and ModelMultipleChoiceField. Co-authored-by: Viktor Paripás <viktor.paripas@gmail.com> Co-authored-by: Vasyl Dizhak <vasyl@dizhak.com> Co-authored-by: Arthur Vasconcelos <vasconcelos.arthur@gmail.com>
2024-06-13Fixed #35488 -- Fixed BaseModelFormSet.validate_unique() crash due to ↵Madalin Popa
unhashable type.
2024-05-29Fixed 35467 -- Replaced urlparse with urlsplit where appropriate.Jake Howard
This work should not generate any change of functionality, and `urlsplit` is approximately 6x faster. Most use cases of `urlparse` didn't touch the path, so they can be converted to `urlsplit` without any issue. Most of those which do use `.path`, simply parse the URL, mutate the querystring, then put them back together, which is also fine (so long as urlunsplit is used).
2024-05-14Fixed #29942 -- Restored source file linking in docs by using the Sphinx ↵Joachim Jablon
linkcode ext. Co-authored-by: David Smith <smithdc@gmail.com> Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2024-04-30Refs #32819 -- Avoided adding 'aria-describedby' to hidden inputs.David Smith
Hidden elements are not visible for both accessibility tools and browsers presentation layer. This change therefore only reduces the size of the generated HTML.
2024-03-14Refs #34488 -- Made ClearableFileInput preserve "Clear" checked attribute ↵Johannes Maron
when form is invalid.
2024-02-26Fixed #35241 -- Cached model's full parent list.Adam Johnson
co-authored-by: Keryn Knight <keryn@kerynknight.com> co-authored-by: Natalia <124304+nessita@users.noreply.github.com> co-authored-by: David Smith <smithdc@gmail.com> co-authored-by: Paolo Melchiorre <paolo@melchiorre.org>
2024-02-20Fixed #35236 -- Used Field.attname/column attributes instead of ↵Adam Johnson
get_attname()/get_attname_column().
2024-01-26Applied Black's 2024 stable style.Mariusz Felisiak
https://github.com/psf/black/releases/tag/24.1.0
2024-01-23Fixed #32923 -- Refactored out Field._clean_bound_field().Syed Waheed
2023-11-28Refs #34380 -- Added FORMS_URLFIELD_ASSUME_HTTPS transitional setting.Mariusz Felisiak
This allows early adoption of the new default "https".
2023-11-24Fixed #34818 -- Prevented GenericIPAddressField from mutating error messages.Parth Verma
Co-authored-by: Parth Verma <parth.verma@gmail.com>
2023-11-20Refs #31026 -- Simplified BaseForm.get_context().David Smith
bf.errors returns an ErrorList. Access this directly and avoid creating a new instance in BaseForm.get_context() Calling str() on the ErrorList can also be deferred to when the variable used in the template.
2023-11-17Refs #32819 -- Established relationship between form fieldsets and their ↵David Smith
help text. This adds aria-describedby for widgets rendered in a fieldset such as radios. aria-describedby for these widgets is added to the <fieldset> element rather than each <input>.
2023-11-16Refs #32819 -- Used auto_id instead of id_for_label as unique identifier for ↵David Smith
the field. `id_for_label` is blank for widgets with multiple inputs such as radios and multiple checkboxes. Therefore , `help_text` for fields using these widgets cannot currently be associated using `aria-describedby`. `id_for_label` is being used as a guard to avoid incorrectly adding `aria-describedby` to those widgets. This change uses `auto_id` as the unique identified for the fields `help_text`. A guard is added to avoid incorrectly adding `aria-describedby` to inputs by checking the widget's `use_fieldset` attribute. Fields rendered in a `<fieldset>` should have `aria-describedby` added to the `<fieldset>` and not every `<input>`.
2023-11-02Fixed #34927 -- Fixed admin system check for inlines with foreign keys to ↵Antoine Cheneau
proxy models. Follow up to 0e8be73812a6e62d5a6b12a585d133b56bc2bf52.
2023-09-04Refs #31262 -- Renamed ChoiceIterator to BaseChoiceIterator.Nick Pope
Some third-party applications, e.g. `django-filter`, already define their own `ChoiceIterator`, so renaming this `BaseChoiceIterator` will be a better fit and avoid any potential confusion. See https://github.com/carltongibson/django-filter/pull/1607.
generated by cgit v1.3 (git 2.53.0) at 2026-05-02 02:58:30 +0000