Flask-WTF Changelog — Flask-WTF 0.14

# Flask-WTF Changelog

## Version 0.14.2

Released 2017-01-10

- Fix bug where `FlaskForm` assumed `meta` argument was not `None` if it was passed. (#278)

## Version 0.14.1

Released 2017-01-10

- Fix bug where the file validators would incorrectly identify an empty file as valid data. (#276, #277)

  > - `FileField` is no longer deprecated. The data is checked during processing and only set if it’s a valid file.

  > - `has_file` is deprecated; it’s now equivalent to `bool(field.data)`.

  > - `FileRequired` and `FileAllowed` work with both the Flask-WTF and WTForms `FileField` classes.

  > - The `Optional` validator now works with `FileField`.

## Version 0.14

Released 2017-01-06

- Use itsdangerous to sign CSRF tokens and check expiration instead of doing it ourselves. (#264)

  > - All tokens are URL safe, removing the `url_safe` parameter from `generate_csrf`. (#206)

  > - All tokens store a timestamp, which is checked in `validate_csrf`. The `time_limit` parameter of `generate_csrf` is removed.

- Remove the `app` attribute from `CsrfProtect`, use `current_app`. (#264)

- `CsrfProtect` protects the `DELETE` method by default. (#264)

- The same CSRF token is generated for the lifetime of a request. It is exposed as `request.csrf_token` for use during testing. (#227, #264)

- `CsrfProtect.error_handler` is deprecated. (#264)

  > - Handlers that return a response work in addition to those that raise an error. The behavior was not clear in previous docs.

  > - (#200, #209, #243, #252)

- Use `Form.Meta` instead of deprecated `SecureForm` for CSRF (and everything else). (#216, #271)

  > - `csrf_enabled` parameter is still recognized but deprecated. All other attributes and methods from `SecureForm` are removed. (#271)

- Provide `WTF_CSRF_FIELD_NAME` to configure the name of the CSRF token. (#271)

- `validate_csrf` raises `wtforms.ValidationError` with specific messages instead of returning `True` or `False`. This breaks anything that was calling the method directly. (#239, #271)

  > - CSRF errors are logged as well as raised. (#239)

- `CsrfProtect` is renamed to `CSRFProtect`. A deprecation warning is issued when using the old name. `CsrfError` is renamed to `CSRFError` without deprecation. (#271)

- `FileField` is deprecated because it no longer provides functionality over the provided validators. Use `wtforms.FileField` directly. (#272)

## Version 0.13.1

Released 2016/10/6

- Deprecation warning for `Form` is shown during `__init__` instead of immediately when subclassing. (#262)

- Don’t use `pkg_resources` to get version, for compatibility with GAE. (#261)

## Version 0.13

Released 2016/09/29

- `Form` is renamed to `FlaskForm` in order to avoid name collision with WTForms’s base class. Using `Form` will show a deprecation warning. (#250)

- `hidden_tag` no longer wraps the hidden inputs in a hidden div. This is valid HTML5 and any modern HTML parser will behave correctly. (#217, #193)

- `flask_wtf.html5` is deprecated. Import directly from `wtforms.fields.html5`. (#251)

- `is_submitted` is true for `PATCH` and `DELETE` in addition to `POST` and `PUT`. (#187)

- `generate_csrf` takes a `token_key` parameter to specify the key stored in the session. (#206)

- `generate_csrf` takes a `url_safe` parameter to allow the token to be used in URLs. (#206)

- `form.data` can be accessed multiple times without raising an exception. (#248)

- File extension with multiple parts (`.tar.gz`) can be used in the `FileAllowed` validator. (#201)

## Version 0.12

Released 2015/07/09

- Abstract protect_csrf() into a separate method

- Update reCAPTCHA configuration

- Fix reCAPTCHA error handle

## Version 0.11

Released 2015/01/21

- Use the new reCAPTCHA API via #164.

## Version 0.10.3

Released 2014/11/16

- Add configuration: WTF_CSRF_HEADERS via #159.

- Support customize hidden tags via #150.

- And many more bug fixes

## Version 0.10.2

Released 2014/09/03

- Update translation for reCaptcha via #146.

## Version 0.10.1

Released 2014/08/26

- Update RECAPTCHA API SERVER URL via #145.

- Update requirement Werkzeug>=0.9.5

- Fix CsrfProtect exempt for blueprints via #143.

## Version 0.10.0

Released 2014/07/16

- Add configuration: WTF_CSRF_METHODS

- Support WTForms 2.0 now

- Fix csrf validation without time limit (time_limit=False)

- CSRF exempt supports blueprint #111.

## Version 0.9.5

Released 2014/03/21

- `csrf_token` for all template types #112.

- Make FileRequired a subclass of InputRequired #108.

## Version 0.9.4

Released 2013/12/20

- Bugfix for csrf module when form has a prefix

- Compatible support for wtforms2

- Remove file API for FileField

## Version 0.9.3

Released 2013/10/02

- Fix validation of recaptcha when app in testing mode #89.

- Bugfix for csrf module #91

## Version 0.9.2

Released 2013/9/11

- Upgrade wtforms to 1.0.5.

- No lazy string for i18n #77.

- No DateInput widget in html5 #81.

- PUT and PATCH for CSRF #86.

## Version 0.9.1

Released 2013/8/21

This is a patch version for backward compitable for Flask<0.10 #82.

## Version 0.9.0

Released 2013/8/15

- Add i18n support (issue #65)

- Use default html5 widgets and fields provided by wtforms

- Python 3.3+ support

- Redesign form, replace SessionSecureForm

- CSRF protection solution

- Drop wtforms imports

- Fix recaptcha i18n support

- Fix recaptcha validator for python 3

- More test cases, it’s 90%+ coverage now

- Redesign documentation

## Version 0.8.4

Released 2013/3/28

- Recaptcha Validator now returns provided message (issue #66)

- Minor doc fixes

- Fixed issue with tests barking because of nose/multiprocessing issue.

## Version 0.8.3

Released 2013/3/13

- Update documentation to indicate pending deprecation of WTForms namespace facade

- PEP8 fixes (issue #64)

- Fix Recaptcha widget (issue #49)

## Version 0.8.2 and prior

Initial development by Dan Jacob and Ron Duplain. 0.8.2 and prior there was not a change log.