Ticket #10643: security_hash.diff

django/contrib/formtools/utils.py

@@ -15 +15 @@
     order, pickles the result with the SECRET_KEY setting, then takes an md5
     hash of that.
     """
-
-    data = [(bf.name, bf.field.clean(bf.data) or '') for bf in form]
+    if form.empty_permitted and not form.has_changed():
+        data = [(bf.name, bf.data or '') for bf in form]
+    else:
+        data = [(bf.name, bf.field.clean(bf.data) or '') for bf in form]
     data.extend(args)
     data.append(settings.SECRET_KEY)
 

new file tests/regressiontests/forms/formtools.py

@@ +1 @@
+# coding: utf-8
+from django.test import TestCase
+
+class FormToolsUtilsTests(TestCase):
+    def test_security_hash_for_empty_permitted_form(self):
+        """Check that formtools.utils.security_hash handles forms with
+        empty_permitted=True"""
+        from django import forms
+
+        class BlankForm(forms.Form):
+            name = forms.CharField(max_length=10, required=False)
+        class NotBlankForm(forms.Form):
+            name = forms.CharField(max_length=10)
+        blank_form = BlankForm({})
+        not_blank_form = NotBlankForm({}, empty_permitted=True)
+        
+        from django.contrib.formtools.utils import security_hash
+        self.assertEqual(security_hash(None, blank_form), security_hash(None, not_blank_form))

tests/regressiontests/forms/tests.py

@@ -32 +32 @@
 from formsets import tests as formset_tests
 from media import media_tests
 
+from formtools import *
+
 __test__ = {
     'extra_tests': extra_tests,
     'fields_tests': fields_tests,