flask-wtf DocumentationRelease 0.9.5 Dan Jacob August 14, 2015 5 5 6 7 9 11 3 API Documentation 3. . . . . . . . . . . . . . . . . . . . . . . . . . . 17 17 17 20 21 Python Module Index . . . . . . . . . . .4 BSD License . . . . . . . . . . . . . . . . . .1 Developer Interface . . .4 CSRF Protection 2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5 Configuration .2 Quickstart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3 Authors . . . . . 23 i . . . . . . . . . . . . . . . . 2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2. . . . . . . . . . . . . . . . . . . . . . 13 13 4 Additional Notes 4. . . . . . . . .1 Upgrading to Newer Releases 4. . . . . . . . . . . . . . . . . .2 Flask-WTF Changelog . . . . . . . . . . . .Contents 1 Features 2 User’s Guide 2. . . . . . . . . 4. . . . . . . . . . . . . 4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1 Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2. . . . . . . 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3 Creating Forms . . . . . . . . . . . . . . . . . . . . . . . ii . Contents 1 .9. Release 0.flask-wtf Documentation.5 Flask-WTF offers simple integration with WTForms. 5 2 Contents .flask-wtf Documentation.9. Release 0. • File upload that works with Flask-Uploads. • Secure Form with csrf token. • Internationalization integration. • Global csrf protection. 3 . • Recaptcha supporting.CHAPTER 1 Features • Integration with wtforms. Features .5 4 Chapter 1.9.flask-wtf Documentation. Release 0. 2. where the code is always available. You can either clone the public repository: git clone git://github.com/lepture/flask-wtf. The first step to using any software package is getting it properly installed. 2. 2.1 Distribute & Pip Installing Flask-WTF is simple with pip: $ pip install Flask-WTF or. download the zipball: $ curl -OL https://github.CHAPTER 2 User’s Guide This part of the documentation.2 Get the Code Flask-WTF is actively developed on GitHub. you can embed it in your Python package. begins with some background information about Flask-WTF. then focuses on step-by-step instructions for getting the most out of Flask-WTF. or install it into your site-packages easily: 5 .1.com/lepture/flask-wtf/zipball/master Once you have a copy of the source.git Download the tarball: $ curl -OL https://github.com/lepture/flask-wtf/tarball/master Or.1. with easy_install: $ easy_install Flask-WTF But.1 Installation This part of the documentation covers the installation of Flask-WTF. you really shouldn’t do that. which is mostly prose. 2. inside a hidden DIV tag: <form method="POST" action="/"> {{ form. 2. User’s Guide .0. methods=('GET'.2 Quickstart Eager to get started? This page gives a good introduction to Flask-WTF. validators=[DataRequired()]) Note: From version 0.name(size=20) }} <input type="submit" value="Go"> </form> However.9. you need to import fields from wtforms.name. If you do not.2.label }} {{ form. Heading over to Creating Forms to learn more skills. including the CSRF field. Release 0. 'POST')) def submit(): form = MyForm() if form. a CSRF token hidden field is created automatically.1 Creating Forms Flask-WTF provides your Flask application integration with WTForms. And the convenience validate_on_submit will check if it is a POST request and if it is valid.5 $ python setup. 6 Chapter 2. You can render this in your template: <form method="POST" action="/"> {{ form.label }} {{ form. Flask-WTF will not import anything from wtforms.2 Validating Forms Validating the request in your view handlers: @app. For example: from flask_wtf import Form from wtforms import StringField from wtforms.html'.flask-wtf Documentation. In addition.name(size=20) }} <input type="submit" value="Go"> </form> 2.name.route('/submit'.validators import DataRequired class MyForm(Form): name = StringField('name'. it will load automatically.csrf_token }} {{ form.validate_on_submit(): return redirect('/success') return render_template('submit. form=form) Note that you don’t have to pass request.form to Flask-WTF. head over to the Installation section. It assumes you already have Flask-WTF installed.hidden_tag() }} {{ form.9. in order to create valid XHTML/HTML the Form class has a method hidden_tag which renders any hidden fields.py install 2. . this is usually the same as your Flask app secret key.9. If you want to use another secret key. Flask-WTF supports validation on file uploading. 'POST')) def upload(): form = PhotoForm() if form.2 File Uploads Flask-WTF provides you a FileField to handle file uploading.5 2. We encourage you do nothing. For example: from werkzeug import secure_filename from flask_wtf.3. Creating Forms 7 . But if you insist.route('/upload/'.photo.. you can pass: form = Form(csrf_enabled=False) If you want to disable it globally.3. The FileAllowed works well with Flask-Uploads. the Form will be a session secure form with csrf protection.save('uploads/' + filename) else: filename = None return render_template('upload.data.file import FileField class PhotoForm(Form): photo = FileField('Your photo') @app. methods=('GET'.flask-wtf Documentation. But if you want to disable the csrf protection.3 Creating Forms This part of the documentation covers the Form parts. 2. </form> More than that.filename) form.validate_on_submit(): filename = secure_filename(form. config it: WTF_CSRF_SECRET_KEY = 'a random string' 2. it will automatically draw data from flask.request. which means: <form action="/upload/" method="POST" enctype="multipart/form-data"> ..1 Secure Form Without any configuration. which you really shouldn’t.photo.3. filename=filename) Note: Remember to set the enctype of your HTML form to multipart/form-data.data. The data attribute of FileField will be an instance of Werkzeug FileStorage.files if the form is posted. Release 0. form=form. it can be done with the configuration: WTF_CSRF_ENABLED = False In order to generate the csrf token. for example: 2. There are FileRequired and FileAllowed.html'. you must have a secret key. We will drop html5 module in next release 0.3. 'Images only!') ]) It can work without Flask-Uploads too.3.9. You can import a number of HTML5 widgets from wtforms: from wtforms. Example of RECAPTCHA_PARAMETERS. Release 0. FileAllowed(['jpg'. RecaptchaField from wtforms import TextField class SignupForm(Form): username = TextField('Username') recaptcha = RecaptchaField() This comes together with a number of configuration. FileAllowed(images.testing is True. IMAGES from flask_wtf import Form from flask_wtf. FileAllowed.5.9.flask-wtf Documentation. IMAGES) class UploadForm(Form): upload = FileField('image'.file import FileField.4 Recaptcha Flask-WTF also provides Recaptcha support through a RecaptchaField: from flask_wtf import Form.3 HTML5 Widgets Note: HTML5 widgets and fields are builtin of wtforms since 1. 'Images only!') ]) 2.3.ext. And it can be easily setup in the templates: 8 Chapter 2.fields. 'render': 'explicit'} RECAPTCHA_DATA_ATTRS = {'theme': 'dark'} For testing your application.html5 import URLField from wtforms. validators=[ FileRequired(). 'png'].5 from flask. User’s Guide . FileRequired images = UploadSet('images'.validators import url class LinkForm(Form): url = URLField(validators=[url()]) 2.uploads import UploadSet. You need to pass the extensions to FileAllowed: class UploadForm(Form): upload = FileField('image'. which you have to implement them. recaptcha field will always be valid for you convenience. and RECAPTCHA_DATA_ATTRS: RECAPTCHA_PARAMETERS = {'hl': 'zh'. You should consider import them from wtforms if possible. if app.0. validators=[ FileRequired(). 4. It is the same as before: <form method="post" action="/"> {{ form.csrf_token }} </form> But if the template has no forms.5 <form action="/" method="post"> {{ form.username }} {{ form.4. For example.9. You can’t get the csrf token prior 0. However. it will return a 400 response. You can customize the error response: 2. this is the same as your Flask app SECRET_KEY.9.csrf import CsrfProtect csrf = CsrfProtect() def create_app(): app = Flask(__name__) csrf.flask-wtf Documentation.recaptcha }} </form> We have an example for you: recaptcha@github. you still need a csrf token: <form method="post" action="/"> <input type="hidden" name="csrf_token" value="{{ csrf_token() }}" /> </form> Whenever a CSRF validation fails. That’s why we created this CSRF for you. but it has no form behind it. 2. Release 0. Usually. 2.4 CSRF Protection This part of the documentation covers the CSRF protection. the POST request is sent by AJAX.2 Implementation To enable CSRF protection for all your view handlers.init_app(app) Note: You need to setup a secret key for CSRF protection. you can load it lazily: from flask_wtf. CSRF Protection 9 . 2.1 Why CSRF Flask-WTF form is already protecting you from CSRF. and they still need protection.csrf import CsrfProtect CsrfProtect(app) Like any other Flask extensions.0 of Flask-WTF. you don’t have to worry about that. you need to enable the CsrfProtect module: from flask_wtf. you have views that contain no forms.4. you don’t need to do any thing. If the template has a form. error_handler def csrf_error(reason): return render_template('csrf_error.attr('content') $.4.ajaxSetup({ beforeSend: function(xhr. This method is available in every template. The suggested way is that you render the token in a <meta> tag: <meta name="csrf-token" content="{{ csrf_token() }}"> And it is also possible to render it in the <script> tag: <script type="text/javascript"> var csrftoken = "{{ csrf_token() }}" </script> We will take the <meta> way for example. you don’t have to worry if there is no example for it.setRequestHeader("X-CSRFToken". settings) { if (!/^(GET|HEAD|OPTIONS|TRACE)$/i. and selectively call csrf. But there is a chance that you might exclude some view handlers.html'. that way you don’t have to worry if there are no forms for rendering the csrf token field. Whenever you send a AJAX POST request.test(settings. Release 0... add the X-CSRFToken for it: var csrftoken = $('meta[name=csrf-token]'). User’s Guide . by setting WTF_CSRF_CHECK_DEFAULT to False. return 'ok' You can also disable CSRF protection in all views by default.5 @csrf.protect() 2. csrftoken) } } }) 10 Chapter 2.3 AJAX Sending POST requests via AJAX is possible where there is no forms at all. you can get the csrf token via {{ csrf_token() }}.protect() only when you need. 'POST')) def my_handler(): # . Assumimg you have done CsrfProtect(app).before_request def check_csrf(): if not is_oauth(request): csrf.route('/foo'. it can be done: @csrf.crossDomain) { xhr.9.0.flask-wtf Documentation.exempt @app.9. the <script> way is far more easier. methods=('GET'. This also enables you to do some pre-processing on the requests before checking for the CSRF token: @app. This feature is only available since 0. 400 We strongly suggest that you protect all your views from CSRF. reason=reason).type) && !this. google. Upon submitting forms. but CSRF protection will fail. most features besides CSRF protection will work (aside from form. WTF_I18N_ENABLED Disable/enable I18N support. WTF_CSRF_METHODS CSRF protection on these request methods. WTF_CSRF_HEADERS CSRF token HTTP headers checked.5.5. The problem is in your broken import statements. It just works.wtf. https://www. Usually. This table is only designed for a convience. Default is True.5 Configuration Here is the full table of all configurations.ext.1 Forms and CSRF The full list of configuration for Flask-WTF.4. WTF_CSRF_ENABLED Disable/enable CSRF protection for forms. WTF_CSRF_CHECK_DEFAULT Enable CSRF checks for all views by default. ‘PATCH’] WTF_HIDDEN_TAG HTML tag name of the hidden tag wrapper. Default is 3600 seconds. Default is [’POST’. required A public key. you don’t need to configure any of them.’} 2.flask-wtf Documentation.5.5 2. Default is True. Default is the same as SECRET_KEY. you’ll get Bad Request/CSRF token missing or incorrect (and the form. optional A dict of configuration options. Default is div WTF_HIDDEN_TAG_ATTRSHTML tag attributes of the hidden tag wrapper. if you make the mistake of importing Form from wtforms instead of from flask. Default is False. Default is True. 2. Default is True.com/recaptcha/admin/create 11 . Release 0. ‘PUT’. Default is [’X-CSRFToken’. Configuration Enable/disable recaptcha through ssl. not your configuration.csrf_token in your template will produce no output). RECAPTCHA_USE_SSL RECAPTCHA_PUBLIC_KEY RECAPTCHA_PRIVATE_KEY RECAPTCHA_OPTIONS 2. required A private key.2 Recaptcha You have already learned these configuration at Recaptcha. 2. WTF_CSRF_TIME_LIMIT CSRF token expiring time. Default is {‘style’: ‘display:none. validate if it is from the same origin.validate_on_submit()).4 Troubleshooting When you define your forms. WTF_CSRF_SSL_STRICT Strictly protection on SSL. This should work together with Flask-Babel. This will check the referrer. ‘X-CSRF-Token’] WTF_CSRF_SECRET_KEY A random string for generating CSRF token.9. 5 12 Chapter 2.9. User’s Guide .flask-wtf Documentation. Release 0. 3. csrf_enabled=None. The default case is if the HTTP method is PUT or POST. New in version 0. **kwargs) Flask-specific subclass of WTForms SecureForm class. Explicitly pass formdata = None to prevent this. 3.form._Auto>. the form will take the first of these that is defined: – SECRET_KEY attribute on this class – WTF_CSRF_SECRET_KEY config of flask app – SECRET_KEY config of flask app – session secret key • csrf_enabled – whether to use CSRF protection. is_submitted() Checks if form has been submitted. 3. *args. If this isn’t specified. Default: flask. this will use flask.request. If formdata is not specified. csrf_context=None.CHAPTER 3 API Documentation If you are looking for information on a specific function. secret_key=None. obj=None. 13 .form. this part of the documentation is for you.session.1. in order to keep XHTML compliance. If not provided will render all hidden fields. prefix=’‘. all csrf behavior is suppressed.Form(formdata=<class flask_wtf. Parameters • csrf_context – a session or dict-like object to use when making CSRF tokens. Parameters fields – list of hidden field names. • secret_key – a secret key for building CSRF tokens.1 Developer Interface This part of the documentation covers all interfaces of Flask-WTF.1 Forms and Fields class flask_wtf. class or method. Default: WTF_CSRF_ENABLED config value hidden_tag(*fields) Wraps hidden fields in a hidden DIV tag. If False. including the CSRF field. validate() This is a shortcut. 14 Chapter 3. _meta=None) Werkzeug-aware subclass of wtforms. _name=None. _meta=None) Represents an <input type="url">. description=u’‘.html5.ext. description=u’‘.flask-wtf Documentation. class flask_wtf. validators=None.EmailInput(input_type=None) Renders an input with type “email”. _prefix=u’‘.RecaptchaWidget class flask_wtf. validate_on_submit() Checks if form has been submitted and if so runs validate. description=u’‘. _prefix=u’‘.file. default=None. _translations=None.FileAllowed(upload_set. form. _translations=None. equivalent to class flask_wtf. default=None.html5.FileRequired(message=None) Validates that field has a file. Parameters message – error message You can also use the synonym file_required.is_submitted() and form.5 validate_csrf_data(data) Check if the csrf data is valid.URLInput(input_type=None) Renders an input with type “url”.file. _form=None. default=None. class flask_wtf. id=None. class flask_wtf.FileField Provides a has_file() method to check if its data is a FileStorage instance with an actual file.file.SearchField(label=None.UploadSet extention names or an instance of • message – error message You can also use the synonym file_allowed. message=None) Validates that the uploaded file is allowed by the given Flask-Uploads UploadSet. Release 0. validators=None. Parameters • upload_set – A list/tuple of flask. widget=None. widget=None.URLField(label=None.RecaptchaField(label=’‘.FileField(label=None. Parameters data – the csrf string to be validated.9. _prefix=u’‘. filters=().html5.uploads. id=None. _name=None. _form=None.SearchInput(input_type=None) Renders an input with type “search”. _name=None. validators=None. validators=None. class flask_wtf. filters=(). class flask_wtf.html5. _meta=None) Represents an <input type="search">.html5. API Documentation . has_file() Return True iff self. id=None.Recaptcha(message=None) Validates a ReCaptcha. _translations=None. widget=None.data is a FileStorage with file data class flask_wtf. class flask_wtf. _form=None. **kwargs) class flask_wtf. filters=(). class flask_wtf. html5.2 CSRF Protection class flask_wtf.1. places=<unset value>. _name=None. **kwargs) Represents an <input type="number">.html5. description=u’‘.IntegerField(label=None. default=None. error_handler(view) A decorator that set the error response handler. widget=None.9. class flask_wtf. description=u’‘.DecimalField(label=None.html5.RangeInput(step=None) Renders an input with type “range”.html'. Developer Interface 15 . and there is no form: <meta name="csrf_token" content="{{ csrf_token() }}" /> You can grab the csrf token with JavaScript. id=None. _meta=None) Represents an <input type="email">. _meta=None) Represents an <input type="tel">. and send the token together. validators=None. Register it with: app = Flask(__name__) CsrfProtect(app) And in the templates. validators=None.DecimalRangeField(label=None. validators=None. _prefix=u’‘. It accepts one parameter reason: @csrf.html5.TelInput(input_type=None) Renders an input with type “tel”. class flask_wtf.html5. validators=None.5 class flask_wtf. class flask_wtf.flask-wtf Documentation. rounding=None.NumberInput(step=None) Renders an input with type “number”. validators=None.html5. reason=reason) 3. widget=None.error_handler def csrf_error(reason): return render_template('error. places=<unset value>. filters=().IntegerRangeField(label=None. _prefix=u’‘.html5.html5. id=None. _name=None. 3. add the token input: <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/> If you need to send the token via AJAX. _form=None. validators=None. Release 0. _form=None. _translations=None. class flask_wtf.csrf. class flask_wtf.TelField(label=None. class flask_wtf. class flask_wtf. _translations=None.EmailField(label=None. filters=(). class flask_wtf. **kwargs) Represents an <input type="number">. **kwargs) Represents an <input type="range">. rounding=None. default=None.CsrfProtect(app=None) Enable csrf protect for Flask.html5. **kwargs) Represents an <input type="range">.1. Parameters • data – The csrf token value to be checked. Parameters • secret_key – A secret key for mixing in the token. Remember to put the decorator above the route: csrf = CsrfProtect(app) @csrf. flask_wtf. default is Flask.5 By default. default is Flask.secret_key.flask-wtf Documentation.csrf. default is 3600s. methods=['POST']) def some_view(): return flask_wtf. • time_limit – Token valid in the time limit. 16 Chapter 3.generate_csrf(secret_key=None.exempt @app.validate_csrf(data. API Documentation . Release 0.secret_key. time_limit=None) Check if the given data is a valid csrf token. it will return a 400 response.csrf. time_limit=None) Generate csrf token code.9. secret_key=None. • time_limit – Check if the csrf token is expired. • secret_key – A secret key for mixing in the token. exempt(view) A decorator that can exclude a view from csrf protection. default is True.route('/some-view'. 2 Flask-WTF Changelog Full list of changes between each Flask-WTF release.1.1 Version 0. it may be lots of pain for you. However every once in a while there are changes that do require some changes in your code or there are changes that make it possible for you to improve your own code quality by taking advantage of new features in Flask-WTF. There is a chance that you don’t need to do anything if you haven’t set any configuration. 4. make sure to pass it the -U parameter: $ pip install -U Flask-WTF 4. Instead of importing Fields from Flask-WTF.9. This version has many more features. This section of the documentation enumerates all the changes in Flask-WTF from release to release and how you can change your code to have a painless updating experience.CHAPTER 4 Additional Notes Legal information and changelog are here. 4. Most of the changes are the nice kind.0 Dropping the imports of wtforms is a big change. you need to import them from the original wtforms: from wtforms import TextField Configuration name of CSRF_ENABLED is changed to WTF_CSRF_ENABLED. if you don’t need them. 17 . but the imports are hard to maintain. If you want to use the easy_install command to upgrade your Flask-WTF installation.1 Upgrading to Newer Releases Flask-WTF itself is changing like any software is changing over time. the kind where you don’t have to change anything in your code to profit from a new release. they will not break any code of yours. 9.2 Released 2014/09/03 • Update translation for reCaptcha via #146.2.2 Version 0.10.12 Released 2015/07/09 • Abstract protect_csrf() into a separate method • Update reCAPTCHA configuration • Fix reCAPTCHA error handle 4. Release 0.1 Released 2014/08/26 • Update RECAPTCHA API SERVER URL via #145.0 now • Fix csrf validation without time limit (time_limit=False) • CSRF exempt supports blueprint #111.11 Released 2015/01/21 • Use the new reCAPTCHA API via #164.0 Released 2014/07/16 • Add configuration: WTF_CSRF_METHODS • Support WTForms 2.3 Released 2014/11/16 • Add configuration: WTF_CSRF_HEADERS via #159.4 Version 0. • And many more bug fixes 4.2.5 • Fix CsrfProtect exempt for blueprints via #143.10.2. • Support customize hidden tags via #150.9.1 Version 0.2.5 Version 0.10.2. 4. Additional Notes .6 Version 0. 4.10.2. 4. • Update requirement Werkzeug>=0.flask-wtf Documentation. 18 Chapter 4.3 Version 0.5 4. 5 Released 2014/03/21 • csrf_token for all template types #112.9. 4.1 Released 2013/8/21 This is a patch version for backward compitable for Flask<0.2.7 Version 0.flask-wtf Documentation. • PUT and PATCH for CSRF #86.2.9.2.2.2.10 #82. 4.3+ support • Redesign form.5 4. 4.2 Released 2013/9/11 • Upgrade wtforms to 1.9. • No DateInput widget in html5 #81.9.5. • Make FileRequired a subclass of InputRequired #108.12 Version 0.11 Version 0. Release 0.0 Released 2013/8/15 • Add i18n support (issue #65) • Use default html5 widgets and fields provided by wtforms • Python 3.9.9. • No lazy string for i18n #77.9 Version 0.10 Version 0. • Bugfix for csrf module #91 4.2.9.2.8 Version 0. replace SessionSecureForm • CSRF protection solution • Drop wtforms imports 4.3 Released 2013/10/02 • Fix validation of recaptcha when app in testing mode #89. Flask-WTF Changelog 19 .0.4 Released 2013/12/20 • Bugfix for csrf module when form has a prefix • Compatible support for wtforms2 • Remove file API for FileField 4. 4 Released 2013/3/28 • Recaptcha Validator now returns provided message (issue #66) • Minor doc fixes • Fixed issue with tests barking because of nose/multiprocessing issue. 20 Chapter 4. Additional Notes .2.8. 0. it’s 90%+ coverage now • Redesign documentation 4. and now is maintained by Hsiaoming Yang.3 Released 2013/3/13 • Update documentation to indicate pending deprecation of WTForms namespace facade • PEP8 fixes (issue #64) • Fix Recaptcha widget (issue #49) 4. Release 0.2 and prior Initial development by Dan Jacob and Ron Duplain.9.15 Version 0.14 Version 0. 4.5 • Fix recaptcha i18n support • Fix recaptcha validator for python 3 • More test cases.3 Authors Flask-WTF is created by Dan Jacob.flask-wtf Documentation.2. 4.2.13 Version 0.1 Contributors People who send patches and suggestions: • Dan Jacob • Ron DuPlain • Daniel Lepage • Anthony Ford • Hsiaoming Yang Find more contributors on GitHub.2 and prior there was not a change log. 4.8.3.8.8. 4. INDIRECT. with or without modification. Some rights reserved. are permitted provided that the following conditions are met: • Redistributions of source code must retain the above copyright notice. OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY. Copyright (c) 2013 . THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. INCLUDING. EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.2015 by Hsiaoming Yang. OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE. Redistribution and use in source and binary forms. BUT NOT LIMITED TO. OR CONSEQUENTIAL DAMAGES (INCLUDING.4. LOSS OF USE. BUT NOT LIMITED TO. SPECIAL. this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.flask-wtf Documentation. WHETHER IN CONTRACT. INCIDENTAL. PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES. • The names of the contributors may not be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES. BSD License 21 . this list of conditions and the following disclaimer. OR PROFITS. • Redistributions in binary form must reproduce the above copyright notice. EXEMPLARY. Release 0.5 4. STRICT LIABILITY. DATA. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT.9.4 BSD License Copyright (c) 2010 by Dan Jacob. 9. Release 0. Additional Notes .5 22 Chapter 4.flask-wtf Documentation. 7 flask_wtf.recaptcha.Python Module Index f flask_wtf. 9 flask_wtf.file. 8 23 . 14 flask_wtf. 7 flask_wtf.csrf.html5. Release 0.9.flask-wtf Documentation.5 24 Python Module Index . 14 SearchInput (class in flask_wtf. 15 E EmailField (class in flask_wtf.file).html5).html5). 14 flask_wtf. 15 exempt() (flask_wtf. 15 flask_wtf.html5 (module).Form method).html5).csrf.FileField method). 13 N NumberInput (class in flask_wtf. 15 DecimalRangeField (class in flask_wtf.html5). 14 EmailInput (class in flask_wtf. 7.file. 14 FileRequired (class in flask_wtf. 14 RecaptchaField (class in flask_wtf). 13 validate_on_submit() (flask_wtf.html5).Index C R CsrfProtect (class in flask_wtf.csrf). 9.html5).Form method). 15 25 .csrf). 13 S SearchField (class in flask_wtf.html5). 13 I IntegerField (class in flask_wtf.file).Form method).csrf).html5).file (module). 14 T TelField (class in flask_wtf.html5).CsrfProtect method). 14 flask_wtf. 8 Form (class in flask_wtf). 7.recaptcha (module). 14 RecaptchaWidget (class in flask_wtf).CsrfProtect method).Form method). 15 TelInput (class in flask_wtf. 14 flask_wtf (module). 13 flask_wtf. 15 Recaptcha (class in flask_wtf).csrf. 14 error_handler() (flask_wtf. 14 FileField (class in flask_wtf. 15 U URLField (class in flask_wtf. 16 F FileAllowed (class in flask_wtf.html5).html5).csrf (module).file). 14 URLInput (class in flask_wtf. 14 G generate_csrf() (in module flask_wtf. 15 IntegerRangeField (class in flask_wtf. 14 D DecimalField (class in flask_wtf. 15 RangeInput (class in flask_wtf. 14 hidden_tag() (flask_wtf.html5).html5). 14 V validate_csrf() (in module flask_wtf. 15 is_submitted() (flask_wtf.html5). 16 H has_file() (flask_wtf. 16 validate_csrf_data() (flask_wtf.