Release notes Django 2.0 release notes What’s new in Django 2.0Minor features

The new ProhibitNullCharactersValidator disallows the null character in the input of the CharField form field and its subclasses. Null character input was observed from vulnerability scanning tools.

Release notes Django 4.1 release notes What’s new in Django 4.1Minor features

The new StepValueValidator checks if a value is an integral multiple of a given step size. This new validator is used for the new step_size argument added to form fields representing numeric values.

Release notes Django 1.4.21 release notes

You might also want to validate that any existing data in your application doesn’t contain unexpected newlines. validate_ipv4_address(), validate_slug(), and URLValidator and their usage in the corresponding form fields GenericIPAddresseField, IPAddressField, SlugField, and URLField are also affected.

Release notes Django 1.7.9 release notes

… unexpected newlines. validate_ipv4_address(), validate_slug(), and URLValidator are also affected, however, as of Django 1.6 the GenericIPAddresseField, IPAddressField, SlugField, and URLField form fields which use these validators all strip the input, so the possibility of newlines entering your data only exists …

Release notes Django 1.8.3 release notes

… unexpected newlines. validate_ipv4_address(), validate_slug(), and URLValidator are also affected, however, as of Django 1.6 the GenericIPAddresseField, IPAddressField, SlugField, and URLField form fields which use these validators all strip the input, so the possibility of newlines entering your data only exists …

Release notes Django 5.2.16 release notes

Django itself wasn’t vulnerable because HttpResponse prohibits newlines in HTTP headers. The vulnerability only affected uses of DomainNameValidator outside Django form fields, as CharField strips newlines by default. This issue has severity “low” according to the Django security policy.

Release notes Django 6.0.7 release notes

Django itself wasn’t vulnerable because HttpResponse prohibits newlines in HTTP headers. The vulnerability only affected uses of DomainNameValidator outside Django form fields, as CharField strips newlines by default. This issue has severity “low” according to the Django security policy.

Release notes Django 1.4 release notes What’s new in Django 1.4

Django 1.4 can now better handle IPv6 addresses with the new GenericIPAddressField model field, GenericIPAddressField form field and the validators validate_ipv46_address and validate_ipv6_address.

Release notes Django 2.1.4 release notes

Corrected the default password list that CommonPasswordValidator uses by lowercasing all passwords to match the format expected by the validator (#29952).

Release notes Django 1.11 release notes What’s new in Django 1.11Minor features

(This validator moved to the form field in Django 1.11.2.) Added support for time truncation to Trunc functions. Added the ExtractWeek function to extract the week from DateField and DateTimeField and exposed it through the week lookup.

Release notes Django 2.2.22 release notes

Moreover, the URLField form field which uses URLValidator silently removes newlines and tabs on Python 3.9.5+, so the possibility of newlines entering your data only existed if you are using this validator outside of the form fields.

Release notes Django 3.1.10 release notes

Moreover, the URLField form field which uses URLValidator silently removes newlines and tabs on Python 3.9.5+, so the possibility of newlines entering your data only existed if you are using this validator outside of the form fields.

Release notes Django 3.2.2 release notes

Moreover, the URLField form field which uses URLValidator silently removes newlines and tabs on Python 3.9.5+, so the possibility of newlines entering your data only existed if you are using this validator outside of the form fields.

Release notes Django 1.11 release notes What’s new in Django 1.11Minor features

… the deprecated password_reset_confirm() function-based view) stores the token in a session and redirects to itself to present the password change form to the user without the token in the URL. update_session_auth_hash() now rotates the session key to allow a password …

Reference GeoDjango Forms API

Reference GeoDjango Forms API

GeoDjango form widgets allow you to display and edit geographic data on a visual map. Note that none of the currently available widgets supports 3D geometries, hence geometry fields will fallback using a Textarea widget for such data.

Reference Settings Core Settings

Default: 'django.forms.renderers.DjangoTemplates' The default class that renders forms and form widgets. It must implement the low-level render API.

Reference Unicode data

HTML form submission is a tricky area. There’s no guarantee that the submission will include encoding information, which means the framework might have to guess at the encoding of submitted data. Django adopts a “lazy” approach to decoding form data.

Topic guide

Form processing generally has 3 paths: Initial GET (blank or prepopulated form) POST with invalid data (typically redisplay form with errors) POST with valid data (process the data and typically redirect) Implementing this yourself often results in a lot of …

Topic guide

Rendering an attractive and easy-to-use web form requires more than just HTML - it also requires CSS stylesheets, and if you want to use fancy widgets, you may also need to include some JavaScript on each page.