Flask-WTF Changelog¶
Version 0.14.2¶
Released 2017-01-10
- Fix bug where
FlaskForm
assumedmeta
argument was notNone
if it was passed. (#278)
Version 0.14.1¶
Released 2017-01-10
Fix bug where the file validators would incorrectly identify an empty file as valid data. (#276, #277)
FileField
is no longer deprecated. The data is checked during processing and only set if it's a valid file.has_file
is deprecated; it's now equivalent tobool(field.data)
.FileRequired
andFileAllowed
work with both the Flask-WTF and WTFormsFileField
classes.- The
Optional
validator now works withFileField
.
Version 0.14¶
Released 2017-01-06
Use itsdangerous to sign CSRF tokens and check expiration instead of doing it ourselves. (#264)
- All tokens are URL safe, removing the
url_safe
parameter fromgenerate_csrf
. (#206) - All tokens store a timestamp, which is checked in
validate_csrf
. Thetime_limit
parameter ofgenerate_csrf
is removed.
- All tokens are URL safe, removing the
Remove the
app
attribute fromCsrfProtect
, usecurrent_app
. (#264)CsrfProtect
protects theDELETE
method by default. (#264)The same CSRF token is generated for the lifetime of a request. It is exposed as
request.csrf_token
for use during testing. (#227, #264)CsrfProtect.error_handler
is deprecated. (#264)Use
Form.Meta
instead of deprecatedSecureForm
for CSRF (and everything else). (#216, #271)csrf_enabled
parameter is still recognized but deprecated. All other attributes and methods fromSecureForm
are removed. (#271)
Provide
WTF_CSRF_FIELD_NAME
to configure the name of the CSRF token. (#271)validate_csrf
raiseswtforms.ValidationError
with specific messages instead of returningTrue
orFalse
. This breaks anything that was calling the method directly. (#239, #271)- CSRF errors are logged as well as raised. (#239)
CsrfProtect
is renamed toCSRFProtect
. A deprecation warning is issued when using the old name.CsrfError
is renamed toCSRFError
without deprecation. (#271)FileField
is deprecated because it no longer provides functionality over the provided validators. Usewtforms.FileField
directly. (#272)
Version 0.13.1¶
Released 2016/10/6
Version 0.13¶
Released 2016/09/29
Form
is renamed toFlaskForm
in order to avoid name collision with WTForms's base class. UsingForm
will show a deprecation warning. (#250)hidden_tag
no longer wraps the hidden inputs in a hidden div. This is valid HTML5 and any modern HTML parser will behave correctly. (#217, #193)flask_wtf.html5
is deprecated. Import directly fromwtforms.fields.html5
. (#251)is_submitted
is true forPATCH
andDELETE
in addition toPOST
andPUT
. (#187)generate_csrf
takes atoken_key
parameter to specify the key stored in the session. (#206)generate_csrf
takes aurl_safe
parameter to allow the token to be used in URLs. (#206)form.data
can be accessed multiple times without raising an exception. (#248)- File extension with multiple parts (
.tar.gz
) can be used in theFileAllowed
validator. (#201)
Version 0.12¶
Released 2015/07/09
- Abstract protect_csrf() into a separate method
- Update reCAPTCHA configuration
- Fix reCAPTCHA error handle
Version 0.10.3¶
Released 2014/11/16
Version 0.10.1¶
Released 2014/08/26
Version 0.10.0¶
Released 2014/07/16
- Add configuration: WTF_CSRF_METHODS
- Support WTForms 2.0 now
- Fix csrf validation without time limit (time_limit=False)
- CSRF exempt supports blueprint #111.
Version 0.9.5¶
Released 2014/03/21
Version 0.9.4¶
Released 2013/12/20
- Bugfix for csrf module when form has a prefix
- Compatible support for wtforms2
- Remove file API for FileField
Version 0.9.3¶
Released 2013/10/02
Version 0.9.2¶
Released 2013/9/11
Version 0.9.1¶
Released 2013/8/21
This is a patch version for backward compitable for Flask<0.10 #82.
Version 0.9.0¶
Released 2013/8/15
- Add i18n support (issue #65)
- Use default html5 widgets and fields provided by wtforms
- Python 3.3+ support
- Redesign form, replace SessionSecureForm
- CSRF protection solution
- Drop wtforms imports
- Fix recaptcha i18n support
- Fix recaptcha validator for python 3
- More test cases, it's 90%+ coverage now
- Redesign documentation
Version 0.8.4¶
Released 2013/3/28
- Recaptcha Validator now returns provided message (issue #66)
- Minor doc fixes
- Fixed issue with tests barking because of nose/multiprocessing issue.
Version 0.8.3¶
Released 2013/3/13
- Update documentation to indicate pending deprecation of WTForms namespace facade
- PEP8 fixes (issue #64)
- Fix Recaptcha widget (issue #49)
Version 0.8.2 and prior¶
Initial development by Dan Jacob and Ron Duplain. 0.8.2 and prior there was not a change log.