[英]Django: invalid literal for int() with base 10: 'csrfmiddlewaretoken'
[英]filter csrfmiddlewaretoken while posting-django
我打算用django-piston制作通用CRUD。 我的示例代碼之一有以下內容
class TaskHandler(BaseHandler):
allowed_methods = ('GET','POST',)
model = Task
def read(self, name=None):
return self.model.objects.all()
def create(self, request, *args, **kwargs):
if not self.has_model():
return rc.NOT_IMPLEMENTED
attrs = self.flatten_dict(request.POST)
if attrs.has_key('data'):
# rest.POST.get('data') has csrfmiddlewaretoken as a hiddenfield
# i need to exclude it from post as my ORM is giving error message
ext_posted_data = simplejson.loads(request.POST.get('data'))
attrs = self.flatten_dict(ext_posted_data)
try:
inst = self.model.objects.get(**attrs)
return rc.DUPLICATE_ENTRY
except self.model.DoesNotExist:
inst = self.model(**attrs)
inst.save()
return inst
except self.model.MultipleObjectsReturned:
return rc.DUPLICATE_ENTRY
下面是錯誤日志
Piston/0.2.2 (Django 1.4) crash report:
Traceback (most recent call last):
File "C:\Python27\Lib\site-packages\django\bin\sumit\sumit\handler.py", line 27,
in create inst = self.model.objects.get(**attrs)
File "C:\Python27\lib\site-packages\django\db\models\manager.py", line 131,
in get return self.get_query_set().get(*args, **kwargs)
File "C:\Python27\lib\site-packages\django\db\models\query.py", line 358,
in get clone = self.filter(*args, **kwargs)
File "C:\Python27\lib\site-packages\django\db\models\query.py", line 621,
in filter return self._filter_or_exclude(False, *args, **kwargs)
File "C:\Python27\lib\site-packages\django\db\models\query.py", line 639,
in _filter_or_exclude clone.query.add_q(Q(*args, **kwargs))
File "C:\Python27\lib\site-packages\django\db\models\sql\query.py", line 1250,
in add_q can_reuse=used_aliases, force_having=force_having)
File "C:\Python27\lib\site-packages\django\db\models\sql\query.py", line 1122,
in add_filter process_extras=process_extras)
File "C:\Python27\lib\site-packages\django\db\models\sql\query.py", line 1316,
in setup_joins "Choices are: %s" % (name, ", ".join(names)))
FieldError: **Cannot resolve keyword 'csrfmiddlewaretoken' into field.
Choices are: complete, id, name**
簡而言之:不要那樣做。
任何用戶都可以發送他們想要的任何POST參數。 您無法保證即使您的表單不包含任何隨機POST參數也不會添加任何隨機POST參數。
不要嘗試從參數中過濾csrfmiddlewaretoken
,而是嘗試將要包含的內容列入白名單。 這意味着,只選擇與您的模型字段對應的那些, 並且您希望用戶能夠對它們進行過濾。
更新:
好吧,那么,如何過濾掉它,只是為了滿足你的好奇心。 flatten_dict
返回一個常規的Python字典,這意味着您可以直接將del attrs['csrfmiddlewaretoken']
從字典中刪除。
更新(2):
要列入白名單,以下內容應該有效:
allowed_keys = ['complete', 'id', 'name']
attrs = dict((key, value) for key, value in ext_posted_data if key in allowed_keys)
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.