假设我有一个表单,它在数据库中执行某些操作,并需要通过POST发送用户身份验证,那么在request内部是否可能被某个恶意人士更改user以便利用系统?
下面的示例在数据库中创建一个项目,但需要已登录的用户。是否可以在request.user中发送其他用户的数据?
from django.shortcuts import render, redirect
from django.contrib.auth.decorators import login_required
from items_core.models import Item
from items.forms import CreateItemForm
from django.views.decorators.csrf import csrf_exempt
@csrf_exempt
@login_required
def create(request):
errors = None
if request.method == 'POST':
form = CreateItemForm(request.POST)
if form.is_valid():
try:
Item.objects.get(
name = form.cleaned_data['name'],
user = request.user
)
errors = 'Item already exist. Please provide other name.'
except Item.DoesNotExist:
Item.objects.create(
name = form.cleaned_data['name'],
user = request.user
)
return redirect('items:list')
form = CreateItemForm()
else:
form = CreateItemForm()
template = {
'form':form,
'items':Item.objects.filter(user=request.user),
'request':request,
'errors':errors
}
return render(request, 'items/item_create.html', template)
谢谢!
del response['user']
。还要确保删除相应的上下文处理器。更多信息请参见此处:https://docs.djangoproject.com/en/1.9/ref/request-response/ - karthikr