0

我有一个生成 2 个表单的模板。表单用于通过 POST 检索数据

问题是当用户通过 POST 篡改数据时，例如删除名为 process 的输入属性名称。

-----------------------------4827543632391\r\n内容-处置：表单-数据；name="csrfmiddlewaretoken"\r\n\r\nYWSIqoP9MjdKYlauwT5fSdxtFH2rcoaH\r\n-----------------------------4827543632391\r\ nContent-Disposition：表单数据；名称="板"\r\n\r\n\r\n-----------------------------4827543632391\r\ nContent-Disposition：表单数据；name="进程"\r\n\r\ndelete\r\n-----------------------------4827543632391--\ r\n

如果用户从名称中删除值过程，我会收到此错误。

如何解决此错误并防止用户篡改表单。

MultiValueDictKeyError at /whiteboardeditor/

Key 'process' not found in <QueryDict: {u'': [u'delete'], u'csrfmiddlewaretoken':     [u'YWSIqoP9MjdKYlauwT5fSdxtFH2rcoaH'], u'board': [u'2']}>
File "C:\o\17\mysite\pet\views.py" in WhiteBoardEditor
  362.             if request.POST['process'] == 'primary':
File "C:\Python26\lib\site-packages\django\utils\datastructures.py" in __getitem__
  258.             raise MultiValueDictKeyError("Key %r not found in %r" % (key, self))

Exception Type: MultiValueDictKeyError at /whiteboardeditor/
Exception Value: Key 'process' not found in <QueryDict: {u'': [u'delete'],     u'csrfmiddlewaretoken': [u'YWSIqoP9MjdKYlauwT5fSdxtFH2rcoaH'], u'board': [u'2']}>

我的html

 <form method="POST" enctype="multipart/form-data">
     {% csrf_token %}
    {{ boardpicture.as_p }}
<input type = "hidden" name="process" value= "primary" />
<input type = "submit" value= "save" />
 </form>

      {% for p in picture %}
 <li><a href ="{% url world:delpic p.id 1 %}">{{p.description}}</a>
 {% endfor %}




 <form method="POST" enctype="multipart/form-data">
     {% csrf_token %}
    {{ picturedelete.as_p }}
    <input type = "hidden" name="process" value= "delete" />
    <input type = "submit" value= "save" />

 </form>

 </form>
 {% for pi in pict %}
 <li><a href ="{% url world:delpic pi.id 2 %}">{{ pi.description }}</a>
 {% endfor %}

我的观点.py

def WhiteBoardEditor(request):
    if not request.user.is_authenticated():
    return HttpResponseRedirect(reverse('world:LoginRequest'))
picture = {}
pict = {}

if request.method == "POST":
        forms = WhiteBoardPictureForm(request.user,request.POST,)
        formss = PictureDeleteForm(request.user,request.POST,)
        if request.POST['process'] == 'primary':
            if forms.is_valid():
                board = forms.cleaned_data['board']
            if board:
                boards = forms.cleaned_data['board']
                picture = Picture.objects.filter(board=boards)
            return render(request,'boardeditor.html',{
                'picture':picture, 
                'boardpicture':WhiteBoardPictureForm(request.user), 
                'picturedelete':PictureDeleteForm(request.user)})

        elif request.POST['process'] == 'delete':
            if formss.is_valid():
                pooh = formss.cleaned_data['board']
                if pooh:
                    pooh = formss.cleaned_data['board']
                    pict = Picture.objects.filter(board=pooh)
            return render(request,'boardeditor.html',{
            'pict':pict, 
            'boardpicture':WhiteBoardPictureForm(request.user), 
            'picturedelete':PictureDeleteForm(request.user)})

            return render(request,'boardeditor.html',{'board':WhiteBoardNameForm(request.user),'boardpicture':WhiteBoardPictureForm(request.user),'picturedelete':PictureDeleteForm(request.user)})

我的观点.py

class WhiteBoardPictureForm(forms.ModelForm):

        def __init__(self, user, *args, **kwargs):
                super(WhiteBoardPictureForm, self).__init__(*args, **kwargs)
                self.fields['board'].queryset = Board.objects.filter(user=user)

    class Meta:
        model = Picture 
        fields = ('board',)

class PictureDeleteForm(forms.ModelForm):

        def __init__(self, user, *args, **kwargs):
                super(PictureDeleteForm, self).__init__(*args, **kwargs)
                self.fields['board'].queryset = Board.objects.filter(user=user)

    class Meta:
        model = Picture 
        fields = ('board',)
4

1 回答 1

1

您应该在处理之前验证表单form.is_valid()，如果它无效，则返回带有表单和错误的适当页面。

如果表单form.cleaned_data对发布的数据有效，而不是request.POST.

以下是如何使用表单 在视图中使用表单

因此，您可以process在表单中添加输入字段。

或者对于这个特定的实例，您可以在处理表单之前在视图中添加一个检查

if request.POST.has_key('process'):
    # return error
于 2013-04-08T10:51:11.290 回答