What about instead of trying to guess the forms from the input, just fix the one condition which causes the error and return 0 as totalformcount + an error marker to reraise the error in clean of the modelform?
On Friday, June 5, 2015 at 11:29:21 AM UTC+1, Patryk Zawadzki wrote: > > Hi folks, > > I've talked to Marc about fixing the case where a formset will raise > an uncaught ValidationError when instantiated with a missing or broken > management form. This has caused us great pain when dealing with > vulnerability scanners that tend to POST random crap to each endpoint > they find as it means formsets—unlike forms—are not safe to > instantiate with untrusted data. > > Now wrapping each and every formset instance in a try/except block and > having to manually handle the fallback case is not fun. But as Marc > pointed out, forgetting a management form is one of the most common > pitfalls people run into when dealing with formsets. > > Therefore I propose making the management form optional. The only case > that requires an explicit TOTAL_FORMS variable are forms that consist > of nothing but checkboxes (as unchecked checkboxes are not included in > POST data). In other cases (including all ModelFormSets as they always > contain a hidden PK field) we can deduct the number of submitted forms > from the data itself. > > Ideally I would get rid of the management form entirely and document > that a form that is nothing but checkboxes is an unsupported case and > that a workaround would be to include an extra hidden field. Honza may > or may not kill me for suggesting that. > > For now, I would like to make the formset optional and document the > cases where you need to include it. If included, it would take > precedence to keep the existing deployments working. > > Thoughts? > > -- > Patryk Zawadzki > I solve problems. > -- You received this message because you are subscribed to the Google Groups "Django developers (Contributions to Django itself)" group. To unsubscribe from this group and stop receiving emails from it, send an email to django-developers+unsubscr...@googlegroups.com. To post to this group, send email to django-developers@googlegroups.com. Visit this group at http://groups.google.com/group/django-developers. To view this discussion on the web visit https://groups.google.com/d/msgid/django-developers/de9e5a03-7f14-42e8-bf76-9405440ecf94%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
