mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-24 14:16:09 +00:00
Code Issues 32 Releases Wiki Activity

Added a default limit to the maximum number of forms in a formset.

Browse Source 
This is a security fix. Disclosure and advisory coming shortly.
This commit is contained in:
Aymeric Augustin
2013-02-12 11:22:41 +01:00
committed by Carl Meyer
parent 1f39eafd60
commit 35c991aa06
5 changed files with 85 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
docs/topics/forms/formsets.txt
View File

@@ -98,8 +98,8 @@ If the value of ``max_num`` is greater than the number of existing
objects, up to ``extra`` additional blank forms will be added to the formset,
so long as the total number of forms does not exceed ``max_num``.
A ``max_num`` value of ``None`` (the default) puts no limit on the number of
forms displayed.
A ``max_num`` value of ``None`` (the default) puts a high limit on the number
of forms displayed (1000). In practice this is equivalent to no limit.
Formset validation
------------------

4
docs/topics/forms/modelforms.txt
View File

@@ -738,8 +738,8 @@ so long as the total number of forms does not exceed ``max_num``::
<tr><th><label for="id_form-2-name">Name:</label></th><td><input id="id_form-2-name" type="text" name="form-2-name" value="Walt Whitman" maxlength="100" /><input type="hidden" name="form-2-id" value="2" id="id_form-2-id" /></td></tr>
<tr><th><label for="id_form-3-name">Name:</label></th><td><input id="id_form-3-name" type="text" name="form-3-name" maxlength="100" /><input type="hidden" name="form-3-id" id="id_form-3-id" /></td></tr>
A ``max_num`` value of ``None`` (the default) puts no limit on the number of
forms displayed.
A ``max_num`` value of ``None`` (the default) puts a high limit on the number
of forms displayed (1000). In practice this is equivalent to no limit.
Using a model formset in a view
-------------------------------