Changes¶
Version 1.2.1¶
Released 2023-10-02
Version 1.2.0¶
Released 2023-10-01
Version 1.1.2¶
Released 2023-09-29
Version 1.1.1¶
Released 2023-01-17
Fixed validate extra_validators parameter. #548
Version 1.1.0¶
Released 2023-01-15
Version 1.0.1¶
Released 2022-03-31
Update compatibility with the latest Werkzeug release. #511
Version 1.0.0¶
Released 2021-11-07
Version 0.15.1¶
Released 2021-05-25
Add
python_requiresmetadata to avoid installing on unsupported Python versions. #442
Version 0.15.0¶
Released 2021-05-24
Version 0.14.3¶
Released 2020-02-06
Fix deprecated imports from
werkzeugandcollections.
Version 0.14.2¶
Released 2017-01-10
Fix bug where
FlaskFormassumedmetaargument was notNoneif it was passed. #278
Version 0.14.1¶
Released 2017-01-10
Fix bug where the file validators would incorrectly identify an empty file as valid data. #276, #277
FileFieldis no longer deprecated. The data is checked during processing and only set if it’s a valid file.has_fileis deprecated; it’s now equivalent tobool(field.data).FileRequiredandFileAllowedwork with both the Flask-WTF and WTFormsFileFieldclasses.The
Optionalvalidator now works withFileField.
Version 0.14¶
Released 2017-01-06
Use ItsDangerous to sign CSRF tokens and check expiration instead of doing it ourselves. #264
All tokens are URL safe, removing the
url_safeparameter fromgenerate_csrf. #206All tokens store a timestamp, which is checked in
validate_csrf. Thetime_limitparameter ofgenerate_csrfis removed.
Remove the
appattribute fromCsrfProtect, usecurrent_app. #264CsrfProtectprotects theDELETEmethod by default. #264The same CSRF token is generated for the lifetime of a request. It is exposed as
g.csrf_tokenfor use during testing. #227, #264CsrfProtect.error_handleris deprecated. #264Use
Form.Metainstead of deprecatedSecureFormfor CSRF (and everything else). #216, #271csrf_enabledparameter is still recognized but deprecated. All other attributes and methods fromSecureFormare removed. #271
Provide
WTF_CSRF_FIELD_NAMEto configure the name of the CSRF token. #271validate_csrfraiseswtforms.ValidationErrorwith specific messages instead of returningTrueorFalse. This breaks anything that was calling the method directly. #239, #271CSRF errors are logged as well as raised. #239
CsrfProtectis renamed toCSRFProtect. A deprecation warning is issued when using the old name.CsrfErroris renamed toCSRFErrorwithout deprecation. #271FileFieldis deprecated because it no longer provides functionality over the provided validators. Usewtforms.FileFielddirectly. #272
Version 0.13.1¶
Released 2016-10-6
Version 0.13¶
Released 2016-09-29
Formis renamed toFlaskFormin order to avoid name collision with WTForms’s base class. UsingFormwill show a deprecation warning. #250hidden_tagno longer wraps the hidden inputs in a hidden div. This is valid HTML5 and any modern HTML parser will behave correctly. #193, #217flask_wtf.html5is deprecated. Import directly fromwtforms.fields.html5. #251is_submittedis true forPATCHandDELETEin addition toPOSTandPUT. #187generate_csrftakes atoken_keyparameter to specify the key stored in the session. #206generate_csrftakes aurl_safeparameter to allow the token to be used in URLs. #206form.datacan be accessed multiple times without raising an exception. #248File extension with multiple parts (
.tar.gz) can be used in theFileAllowedvalidator. #201
Version 0.12¶
Released 2015-07-09
Abstract
protect_csrf()into a separate method.Update reCAPTCHA configuration.
Fix reCAPTCHA error handle.
Version 0.11¶
Released 2015-01-21
Use the new reCAPTCHA API. #164
Version 0.10.3¶
Released 2014-11-16
Version 0.10.2¶
Released 2014-09-03
Update translation for reCaptcha. #146
Version 0.10.1¶
Released 2014-08-26
Version 0.10.0¶
Released 2014-07-16
Add configuration:
WTF_CSRF_METHODS.Support WTForms 2.0 now.
Fix CSRF validation without time limit (
time_limit=False).csrf_exemptsupports blueprint. #111
Version 0.9.5¶
Released 2014-03-21
Version 0.9.4¶
Released 2013-12-20
Bugfix for
csrfmodule when form has a prefix.Compatible support for WTForms 2.
Remove file API for
FileField
Version 0.9.3¶
Released 2013-10-02
Version 0.9.2¶
Released 2013-09-11
Version 0.9.1¶
Released 2013-08-21
Compatibility with Flask < 0.10. #82
Version 0.9.0¶
Released 2013-08-15
Add i18n support. #65
Use default HTML5 widgets and fields provided by WTForms.
Python 3.3+ support.
Redesign form, replace
SessionSecureForm.CSRF protection solution.
Drop WTForms imports.
Fix recaptcha i18n support.
Fix recaptcha validator for Python 3.
More test cases, it’s 90%+ coverage now.
Redesign documentation.
Version 0.8.4¶
Released 2013-03-28
Recaptcha Validator now returns provided message. #66
Minor doc fixes.
Fixed issue with tests barking because of nose/multiprocessing issue.
Version 0.8.3¶
Released 2013-03-13
Version 0.8.2 and prior¶
Initial development by Dan Jacob and Ron Duplain.