如何将易受攻击的参数从模板传递到 Django 中的视图？
我正在创建一个可以创建、编辑或查看地点的应用程序。
当我编辑或查看地点时，我通过 URL 传递“id”字段，例如：
/places/place/1
/places/place/2 ...
当我尝试编辑一个地方时，我会这样做：
place_detail.html
<a href="{% url places_edit_place place.id %}">Edit</a>
'place' var 是一种表单。
url.py
urlpatterns = patterns('',
url(r'^edit_place/(?P<id_place>\w+)/$',
views.edit_place,
name='places_edit_place'),
)
view.py
def edit_place(request, id_place, template_name='places/edit_place.html'):
我在“id_place”参数中收到地点对象的“id”字段。但是，如果我更改网址中的“id”arg（/places/edit_place/1 到 /places/edit_place/2），则网页将转到第二个要编辑的位置，并且用户可以按照自己的意愿更改此arg。
我如何将这个私有“id”参数从模板发送到视图，而用户看不到它。
I'm creating an app which can create, edit or view a place.
When I edit or view a place, I pass the 'id' field throught the URL, for example:
/places/place/1
/places/place/2
...
When I try to edit a place I do:
place_detail.html
<a href="{% url places_edit_place place.id %}">Edit</a>
The 'place' var is a form.
url.py
urlpatterns = patterns('',
url(r'^edit_place/(?P<id_place>\w+)/
view.py
def edit_place(request, id_place, template_name='places/edit_place.html'):
I receive the 'id' field of a place object in the 'id_place' arg. But if I change in the url the 'id' arg (/places/edit_place/1 to /places/edit_place/2), the web page go to the second place to be edited and an user could change this arg like he wants.
How I can send this private 'id' arg from a template to a view without the user can't see it.
,
views.edit_place,
name='places_edit_place'),
)
view.py
I receive the 'id' field of a place object in the 'id_place' arg. But if I change in the url the 'id' arg (/places/edit_place/1 to /places/edit_place/2), the web page go to the second place to be edited and an user could change this arg like he wants.
How I can send this private 'id' arg from a template to a view without the user can't see it.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
不。
如果您的应用程序具有确定用户可以编辑哪些位置的规则，则您应该实现一些业务逻辑以确保用户无法编辑该位置，即使他们碰巧访问了 URL 来执行此操作。您可以使用 Django 的 授权装饰器，以确保用户无法访问任何他们不应该访问的内容。
Don't.
If your app has rules to determine which places a user can edit, you should implement some business logic to ensure that the user can't edit that place, even if they happen to go the URL to do so. You can use Django's authorization decorators to ensure that the user can't access anything they shouldn't.