从模板传递数据以在Django中查看

Question

I'm building a bus reservation website using Django. After user searches buses on a specific route, a list is displayed showing available buses. Each list item ie bus has a book button which leads to new page called 'seats.html'. I want to pass the bus number and other information to the view of 'seats' so that I can display the number of seats available and javascript can also use this info. Here is my code

views.py

def find_bus(request):
    form = forms.FormFindBus

    template = 'home.html'
    context = {'form': form}
    return render(request, template, context)



def select(request):

    bus_type = request.GET.get('bus_type')

    bus_from = request.GET.get('bus_from')

    bus_to = request.GET.get('bus_to')

    date_string = request.GET.get('date')

    qs = Bus.objects.filter(type_of_bus=bus_type, route__location_from=bus_from, route__location_to=bus_to, date=date_string)


    context = {'qs': qs,}
    template = 'select.html'
    return render(request, template, context)

def seats(request):
    template = 'seats.html'
    context = {}
    return render(request, template, context)

select.html

{% for info in qs %}

    <a href="{% url 'book:seats' %}">Book</a>
    <ul>
        <li><b>Bus Number -</b> {{ info.bus_number }}</li>
        <li><b>Route -</b> {{ info.route }}</li>
        <li><b>Date -</b> {{ info.date }}</li>
        <li><b>Time -</b>{{ info.time }}</li>
    </ul>
</div>

{% endfor %}

As you can see query set gets passed in select.html where I use for loop to display all the buses available along with their information. I then click on book to book seats of my desired bus choice. I want that when I click on book, the bus information also gets passed to the next template ie seats.html so that I use that information to display available seats and other related info. Here are some screenshots to help you guys get a better picture.

As you can see in the first image user enters his query. Then a list of buses gets displayed in the second image or in this case just one bus. Then he click book on that bus and a seating chart is displayed. How can I pass info from 'select.html' template to seats view. Please don't suggest to pass info using url. It can lead to manipulation very easily.

Answer 1

Please don't suggest to pass info using url. It can lead to manipulation very easily.

Sadly, every other way to pass the information to the view is not that much better or more secure.

Never ever trust user input.

No matter what way you choose in the end, you will have to validate the input.

And using URLs has some advantages. For example: You can send a link to the route you just found to a friend (so called deep link). Otherwise your friend would have to click through your form by himself.

---

If you are still interested in doing this by URL you could do it as follows:

You could change your url schema for the URL that you called book:seats to contain all of the required information. Assume that book:seat looks like the following in your urls.py :

url(r'^book/seats/$', views.seats, name='book:seats')

You chould change this URL pattern to contain all of the information you want to pass to the seats view:

url(r'^book/seats/(?P<bus_number>\w+)/(?P<route>\w+)/(?P<date>\w+)/(?P<time>\w+)$', views.seats, name='book:seats')

This would add a so called named group to your URL pattern. You can read about named groups here: named groups documentation . Obviously, you will have to modify this example URL pattern to fit your needs.

Next step is to update your view function to handle all those extra view arguments:

def seats(request, bus_number, route, date, time):
    template = 'seats.html'
    context = {}
    return render(request, template, context)

The last step is to modify the way you render the link in your template:

<a href="{% url 'book:seats' info.bus_number info.route info.date info.time %}">Book</a>

You have to add the arguments in the same order as they are used in the seats function. You can read more about this in the official documentation here: template tag documentation .