Ticket #9583: django_formwizard_hash.patch

django/contrib/formtools/wizard.py

@@ -59 +62 @@
             raise Http404('Step %s does not exist' % current_step)
 
         # For each previous step, verify the hash and process.
-        # TODO: Move "hash_%d" to a method to make it configurable.
         for i in range(current_step):
             form = self.get_form(i, request.POST)
-            if request.POST.get("hash_%d" % i, '') != self.security_hash(request, form):
+            if request.POST.get(self.hash_field_for_step(i), '') != self.security_hash(request, form):
                 return self.render_hash_failure(request, i)
             self.process_step(request, form, i)
 
@@ -106 +108 @@
             # Collect all data from previous steps and render it as HTML hidden fields.
             for i in range(step):
                 old_form = self.get_form(i, old_data)
-                hash_name = 'hash_%s' % i
+                hash_name = self.hash_field_for_step(i)
                 prev_fields.extend([bf.as_hidden() for bf in old_form])
                 prev_fields.append(hidden.render(hash_name, old_data.get(hash_name, self.security_hash(request, old_form))))
         return self.render_template(request, form, ''.join(prev_fields), step, context)
@@ -117 +119 @@
         "Given the step, returns a Form prefix to use."
         return str(step)
 
+    def hash_field_for_step(self, step):
+        "Given the step, returns the name of the hash field to use"
+        return 'hash_%s' % str(step)
+
     def render_hash_failure(self, request, step):
         """
         Hook for rendering a template if a hash check failed.