Changes between Initial Version and Version 1 of CookBookManipulatorWithPostpopulatedFields

Timestamp:

Sep 16, 2005, 4:55:29 PM (19 years ago)

Author:

hugo <gb@…>

Comment:

first take at a skeleton for update view with only a subset of fields

CookBookManipulatorWithPostpopulatedFields

@@ +1 @@
+If your template should only edit part of an object because some fields are not to be changed by the user, you can use the following view-function-template to do the job. It just populates those fields that are left out of the template and the form and fills in there values from known content. Especially it overwrites fields in the new_data with known values so that users can't just fake POST requests to populate left-out fields.
+
+The code is stolen from my gallery project - there you have a picturefolder that has a path and a slug that point to the filesystem and a user_id that denotes the owner (actually it's a ForeignKey to the auth.users model). So users should never be able to change the owner or change the filesystem path (otherwise they might be able to fetch files from security relevant parts of the filesystem). The following code prevents changing those fields by overwriting them in the POST data with data from the original object. That way even faked POST requests won't get access to those attributes.
+
+{{{
+#!python
+def update_folder(request, folder):
+  # this just resolves a object from it's slug - you will most definitely
+  # need to change this to your own model
+  try: f = picturefolders.get_object(slug__exact=folder)
+  except picturefolders.PicturefolderDoesNotExist: raise Http404
+
+  # now just fetch a standard change manipulator for that object
+  manipulator = picturefolders.ChangeManipulator(f.id)
+  if request.POST:
+    new_data = request.POST.copy()
+
+    # here I am filling in fields from the fetched object
+    # to make sure that the user can't pass in security relevant
+    # data. Make sure that you turn your values into strings,
+    # as that's expected by the later html2python call.
+    new_data['path'] = f.path
+    new_data['slug'] = f.slug
+    new_data['user'] = str(f.user_id)
+
+    # the rest of this is pretty standard as we now have a
+    # fully populated POST data dict
+    errors = manipulator.get_validation_errors(new_data)
+    if not errors:
+      manipulator.do_html2python(new_data)
+      manipulator.save(new_data)
+      return HttpResponseRedirect(request.path)
+    else:
+      new_data = f.__dict__
+      errors = {}
+    form = formfields.FormWrapper(manipulator, new_data, errors)
+    t = template_loader.get_template('picturefolder_form')
+    c = Context(request, {
+      'form': form,
+      'folder': f,
+    })
+    return HttpResponse(t.render(c), mimetype='text/html; charset=utf-8')
+  else:
+    raise Http404
+}}}