Django的。 登录后重定向用户

Question

I'm newbie in Django and I need your help.

I'm building my app on class-based views. For login I using default django.contrib.auth.models.User class and one-to-one relationship for UserInfo class for storing additional information(like profile photo and so on):

models.py

class UserInfo(models.Model):
    user = models.OneToOneField(User)
    birth_date = models.DateField()
    avatar = models.FilePathField()

After login succeed I want to pass UserInfo data to home page(defined as DetailView ). So currently I have something like this:

urls.py

urlpatterns = patterns('',
    url(r'^$',      Index.as_view(), name='index'), #Returns page with login form.
    url(r'^login$', Index.as_view(), name='login'), #Proceed login form and redirects to homepage.
    url(r'^home/id(?P<pk>\d+)$',  login_required(Home.as_view(), login_url='/'),  name='home'),
)

index.py

#Login proceed here
class Index(generic.FormView):
    template_name = 'index.html'
    form_class = AuthenticationForm
    success_url = '/home/id'

    def post(self, request, *args, **kwargs):
        username = request.POST.get('username')
        password = request.POST.get('password')
        user = authenticate(username = username, password = password)
        if user is not None and user.is_active:
            login(request, user)
            return redirect('/home/id', pk = user.id)
        else:
            return redirect('/', {'error' : 'Incorrect login or password'})

home.py

class Home(generic.DetailView):
    model = UserInfo
    template_name = 'home.html'

Unfortunately it doesn't work. Could you please help me to understand how it should work? And how I should get UserInfo data inside my home.html page?

Answer 1

You should not pass data in URL redirects, because this is inherently safe and prone to all kind of exploitation ( Content Spoofing vulnerability ).

Instead, you should pass data over redirect using Django sessions . Particularly, in the case of the success/error messages, Django messages framework is handy .

from django.contrib import messages

def post(self, request, *args, **kwargs):
    ....
    else:
        messages.error(request, "Incorrect username or password")
        return redirect('/')