Release notes Django 1.1 release notes What’s new in Django 1.1

Instances of Django forms (see the forms overview) now have two additional methods, hidden_fields() and visible_fields(), which return the list of hidden – i.e., <input type="hidden"> – and visible fields on the form, respectively.

Release notes Django 1.1.2 release notes

Django 1.2 (the next major release of Django) will contain a feature that will improve protection against Cross-Site Request Forgery (CSRF) attacks. This feature requires the use of a new csrf_token template tag in all forms that Django renders.

Release notes Django 1.10 release notes What’s new in Django 1.10Minor features

The success message that appears after adding or editing an object now contains a link to the object’s change form. All inline JavaScript is removed so you can enable the Content-Security-Policy HTTP header if you wish.

Release notes Django 1.10 release notes What’s new in Django 1.10Minor features

To protect against BREACH attacks, the CSRF protection mechanism now changes the form token value on every request (while keeping an invariant secret which can be used to validate the different tokens).

Release notes Django 1.10 release notes Backwards incompatible changes in 1.10

If you want to preserve the 30 character limit for usernames, use a custom form when creating a user or changing usernames: If you wish to keep this restriction in the admin, set UserAdmin.add_form to use this form:

Release notes Django 1.10 release notes Backwards incompatible changes in 1.10

File uploads don’t count toward this limit. DATA_UPLOAD_MAX_NUMBER_FIELDS limits the number of GET/POST parameters that are parsed. Applications that receive unusually large form posts may need to tune these settings.

Release notes Django 1.10.1 release notes

Fixed a checks framework crash with an empty Meta.default_permissions (#26997). Fixed a regression in the number of queries when using RadioSelect with a ModelChoiceField form field (#27001). Fixed a crash if request.META['CONTENT_LENGTH'] is an empty string (#27005).

Release notes Django 1.11 release notes Backwards incompatible changes in 1.11

The OpenLayers-based form widgets now use OpenLayers.js from https://cdnjs.cloudflare.com which is more suitable for production use than the old https://openlayers.org/ source. They are also updated to use OpenLayers 3. PostGIS migrations can now change field dimensions.

Release notes Django 1.11 release notes What’s new in Django 1.11Minor features

Three fields are provided: CICharField, CIEmailField, and CITextField. The new JSONBAgg allows aggregating values as a JSON array. The HStoreField (model field) and HStoreField (form field) allow storing null values.

Release notes Django 1.11 release notes What’s new in Django 1.11Minor features

The new empty_value attribute on CharField, EmailField, RegexField, SlugField, and URLField allows specifying the Python value to use to represent “empty”. The new Form.get_initial_for_field() method returns initial data for a form field.

Release notes Django 1.11 release notes Backwards incompatible changes in 1.11

The GEOSGeometry equality operator now also compares SRID. The OpenLayers-based form widgets now use OpenLayers 3, and the gis/openlayers.html and gis/openlayers-osm.html templates have been updated. Check your project if you subclass these widgets or extend the templates.

Release notes Django 1.11.4 release notes

Fixed a regression in 1.11.3 on Python 2 where non-ASCII format values for date/time widgets results in an empty value in the widget’s HTML (#28355). Fixed QuerySet.union() and difference() when combining with a queryset raising EmptyResultSet (#28378).

Release notes Django 1.4 release notes Backwards incompatible changes in 1.4

This is wrong for URLs whose unquoted form contains a %xx sequence, but such URLs are very unlikely to happen in the wild, because they would confuse browsers too.

Release notes Django 1.4 release notes Backwards incompatible changes in 1.4

In Django 1.3, the get_initial method of the django.views.generic.edit.FormMixin class was returning the class initial dictionary.

Release notes Django 1.4.11 release notes

The CSRF-protection system is based on a random nonce sent to the client in a cookie which must be sent by the client on future requests and, in forms, a hidden value which must be submitted back with the form.

Release notes Django 1.5 release notes Backwards incompatible changes in 1.5Changes in tests execution

This should not cause any problems unless you have existing doctests which assume a TransactionTestCase executed earlier left some database state behind or unit tests that rely on some form of state being preserved after the execution of other tests.

Release notes Django 1.5.6 release notes

The CSRF-protection system is based on a random nonce sent to the client in a cookie which must be sent by the client on future requests and, in forms, a hidden value which must be submitted back with the form.

Release notes Django 1.6 release notes Features deprecated in 1.6

Previously, if you wanted a ModelForm to use all fields on the model, you could simply omit the Meta.fields attribute, and all fields would be used.

Release notes Django 1.6 release notes Features deprecated in 1.6

The generic views CreateView and UpdateView, and anything else derived from ModelFormMixin, are vulnerable to the security problem described in the section above, because they can automatically create a ModelForm that uses all fields for a model.

Release notes Django 1.6.3 release notes

The CSRF-protection system is based on a random nonce sent to the client in a cookie which must be sent by the client on future requests and, in forms, a hidden value which must be submitted back with the form.