Hi Rob,
On 05/03/2016 12:23 PM, Rob Ladd wrote:
> I've noticed something troubling in Django formsets:
>
> Each formset.form has a hidden field with the id of the model being edited.
>
> All one would need to do is change this id and submit, and the default
> formset |clean()| or |save()| metho
How would you keep track of which objects were in the original formset? If
you generate the same queryset in the formset for both formset creation and
formset submission you shouldn't run into any security issues.
On Tuesday, May 3, 2016 at 2:23:12 PM UTC-4, Rob Ladd wrote:
>
> I've noticed some
I've noticed something troubling in Django formsets:
Each formset.form has a hidden field with the id of the model being edited.
All one would need to do is change this id and submit, and the default
formset clean() or save() methods don't bat an eye.
I would think that it wouldn't be too c
3 matches
Mail list logo
