Re: Question about form security.

2015-02-19 Thread Carl Meyer
On 02/19/2015 04:03 PM, Chen Xu wrote: > what if I have two addresses, id is 1 and 2, and I want to update 2, how > I should distinguish 2 from 1, I mean, if I have addressid in the form, > and someone modify it from 2 to 1, and that will update 1, right? How to > prevent this? Your server-side co

Re: Question about form security.

2015-02-19 Thread Chen Xu
what if I have two addresses, id is 1 and 2, and I want to update 2, how I should distinguish 2 from 1, I mean, if I have addressid in the form, and someone modify it from 2 to 1, and that will update 1, right? How to prevent this? On Thu, Feb 19, 2015 at 6:01 PM, Mario Gudelj wrote: > Because t

Re: Question about form security.

2015-02-19 Thread Mario Gudelj
Because the user must be logged in to update their username you can get the current user from the request. You don't need to have their id inside the form. On 20/02/2015 9:49 am, "Chen Xu" wrote: > Hi > I am implementing a feature while building a website using Django, > basically, I want user to

Question about form security.

2015-02-19 Thread Chen Xu
Hi I am implementing a feature while building a website using Django, basically, I want user to be able to update their usernames. All of a sudden, this question comes to me, if I have the userid (ex: 1) somewhere in the form as a data attribute, if someone use firebug or something to change the da