我有一个生成2个表单的模板。表单用于通过POST检索数据
问题是当用户通过POST篡改数据时,例如删除名为process的输入属性名称。
----------------------------- 4827543632391 \ r \ nConContent-Disposition:form-data; NAME = “csrfmiddlewaretoken为” \ r \ n \ r \ nYWSIqoP9MjdKYlauwT5fSdxtFH2rcoaH \ r \ n ----------------------------- 4827543632391 \ r \ nContent-Disposition:form-data; NAME = “板” \ r \ n \ r \ n \ r \ n ----------------------------- 4827543632391 \ r \ nContent-Disposition:form-data;名称= “过程为” \ r \ n \ r \ n删除\ r \ n ----------------------------- 4827543632391 - \ r \ñ
我收到此错误如果用户从名称中删除了值进程。
如何解决此错误并防止用户篡改表单。
MultiValueDictKeyError at /whiteboardeditor/
Key 'process' not found in <QueryDict: {u'': [u'delete'], u'csrfmiddlewaretoken': [u'YWSIqoP9MjdKYlauwT5fSdxtFH2rcoaH'], u'board': [u'2']}>
File "C:\o\17\mysite\pet\views.py" in WhiteBoardEditor
362. if request.POST['process'] == 'primary':
File "C:\Python26\lib\site-packages\django\utils\datastructures.py" in __getitem__
258. raise MultiValueDictKeyError("Key %r not found in %r" % (key, self))
Exception Type: MultiValueDictKeyError at /whiteboardeditor/
Exception Value: Key 'process' not found in <QueryDict: {u'': [u'delete'], u'csrfmiddlewaretoken': [u'YWSIqoP9MjdKYlauwT5fSdxtFH2rcoaH'], u'board': [u'2']}>
我的HTML
<form method="POST" enctype="multipart/form-data">
{% csrf_token %}
{{ boardpicture.as_p }}
<input type = "hidden" name="process" value= "primary" />
<input type = "submit" value= "save" />
</form>
{% for p in picture %}
<li><a href ="{% url world:delpic p.id 1 %}">{{p.description}}</a>
{% endfor %}
<form method="POST" enctype="multipart/form-data">
{% csrf_token %}
{{ picturedelete.as_p }}
<input type = "hidden" name="process" value= "delete" />
<input type = "submit" value= "save" />
</form>
</form>
{% for pi in pict %}
<li><a href ="{% url world:delpic pi.id 2 %}">{{ pi.description }}</a>
{% endfor %}
我的views.py
def WhiteBoardEditor(request):
if not request.user.is_authenticated():
return HttpResponseRedirect(reverse('world:LoginRequest'))
picture = {}
pict = {}
if request.method == "POST":
forms = WhiteBoardPictureForm(request.user,request.POST,)
formss = PictureDeleteForm(request.user,request.POST,)
if request.POST['process'] == 'primary':
if forms.is_valid():
board = forms.cleaned_data['board']
if board:
boards = forms.cleaned_data['board']
picture = Picture.objects.filter(board=boards)
return render(request,'boardeditor.html',{
'picture':picture,
'boardpicture':WhiteBoardPictureForm(request.user),
'picturedelete':PictureDeleteForm(request.user)})
elif request.POST['process'] == 'delete':
if formss.is_valid():
pooh = formss.cleaned_data['board']
if pooh:
pooh = formss.cleaned_data['board']
pict = Picture.objects.filter(board=pooh)
return render(request,'boardeditor.html',{
'pict':pict,
'boardpicture':WhiteBoardPictureForm(request.user),
'picturedelete':PictureDeleteForm(request.user)})
return render(request,'boardeditor.html',{'board':WhiteBoardNameForm(request.user),'boardpicture':WhiteBoardPictureForm(request.user),'picturedelete':PictureDeleteForm(request.user)})
我的views.py
class WhiteBoardPictureForm(forms.ModelForm):
def __init__(self, user, *args, **kwargs):
super(WhiteBoardPictureForm, self).__init__(*args, **kwargs)
self.fields['board'].queryset = Board.objects.filter(user=user)
class Meta:
model = Picture
fields = ('board',)
class PictureDeleteForm(forms.ModelForm):
def __init__(self, user, *args, **kwargs):
super(PictureDeleteForm, self).__init__(*args, **kwargs)
self.fields['board'].queryset = Board.objects.filter(user=user)
class Meta:
model = Picture
fields = ('board',)
答案 0 :(得分:1)
您应该在处理之前验证表单,例如form.is_valid()
并返回相应的表单
带有表单和错误的页面,如果它无效。
如果表单有效,请使用form.cleaned_data
表示发布的数据,而不是request.POST
。
以下是表单Using forms in view
的使用方法因此,您可以在表单中添加process
输入字段。
或者对于此特定实例,您可以在处理表单之前在视图中添加检查
if request.POST.has_key('process'):
# return error