Release notes Django 1.2 release notes

Model instances now have support for validating their own data, and both model and form fields now accept configurable lists of validators specifying reusable, encapsulated validation behavior. Note, however, that validation must still be performed explicitly.

Release notes Django 1.7 release notes

The behavior of the ValidationError constructor has changed when it receives a container of errors as an argument (e.g.

Release notes Django 4.2.18 release notes

Lack of upper bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack.

Release notes Django 5.0.11 release notes

Lack of upper bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack.

Release notes Django 5.1.5 release notes

Lack of upper bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack.

Release notes Django 1.10 release notes

Form and widget Media is now served using django.contrib.staticfiles if installed. The <input> tag rendered by CharField now includes a minlength attribute if the field has a min_length. Required form fields now have the required HTML attribute.

Release notes Django 1.7 release notes

The ValidationError constructor accepts metadata such as error code or params which are then available for interpolating into the error message (see Raising ValidationError for more details); however, before Django 1.7 those metadata were discarded as soon as the errors …

Release notes Django 1.10.2 release notes

Fixed a crash in MySQL database validation where SELECT @@sql_mode doesn’t return a result (#27180). Allowed combining contrib.postgres.search.SearchQuery with more than one & or | operators (#27143). Disabled system check for URL patterns beginning with a ‘/’ when APPEND_SLASH=False (#27238).

Release notes Django 1.6.10 release notes

Given a form that uses ModelMultipleChoiceField and show_hidden_initial=True (not a documented API), it was possible for a user to cause an unreasonable number of SQL queries by submitting duplicate values for the field’s data.

Release notes Django 1.7.3 release notes

Given a form that uses ModelMultipleChoiceField and show_hidden_initial=True (not a documented API), it was possible for a user to cause an unreasonable number of SQL queries by submitting duplicate values for the field’s data.

Release notes Django 1.3 release notes

Previously this field’s clean() method accepted a second, gender, argument which allowed stronger validation checks to be made, however since this argument could never actually be passed from the Django form machinery it is now pending deprecation.

Release notes Django 1.6 release notes

Fields included in the localized_fields list will be localized (by setting localize on the form field). The labels, help_texts and error_messages options may be used to customize the default fields, see Overriding the default fields for details.

Release notes Django 1.7 release notes

Heavy changes to the various error containers were necessary in order to support the features above, specifically Form.errors, django.forms.utils.ErrorList, and the internal storages of ValidationError.

Release notes Archive of security issues

Potential bypass of validation when uploading multiple files using one form field. Full description Django 4.2 (patch) Django 4.1 (patch) Django 3.2 (patch)

Release notes Django 4.0 release notes

ModelChoiceField now includes the provided value in the params argument of a raised ValidationError for the invalid_choice error message. This allows custom error messages to use the %(value)s placeholder.

Release notes Django 4.2.29 release notes

The URLField form field’s to_python() method used urlsplit() to determine whether to prepend a URL scheme to the submitted value. On Windows, urlsplit() performs NFKC normalization, which can be disproportionately slow for large inputs containing certain characters.

Release notes Django 5.2.12 release notes

The URLField form field’s to_python() method used urlsplit() to determine whether to prepend a URL scheme to the submitted value. On Windows, urlsplit() performs NFKC normalization, which can be disproportionately slow for large inputs containing certain characters.

Release notes Django 6.0.3 release notes

The URLField form field’s to_python() method used urlsplit() to determine whether to prepend a URL scheme to the submitted value. On Windows, urlsplit() performs NFKC normalization, which can be disproportionately slow for large inputs containing certain characters.

Release notes Django 1.1.4 release notes

Django includes a CSRF-protection mechanism, which makes use of a token inserted into outgoing forms. Middleware then checks for the token’s presence on form submission, and validates it.

Release notes Django 1.2.5 release notes

Django includes a CSRF-protection mechanism, which makes use of a token inserted into outgoing forms. Middleware then checks for the token’s presence on form submission, and validates it.