#23482: SingleObjectMixin.get_object() should allow lookup by BOTH pk and slug
-------------------------------+--------------------
Reporter: jdufresne | Owner: nobody
Type: New feature | Status: new
Component: Generic views | Version: master
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------+--------------------
Using generic views such as DetailView.
Problem:
I do not want to use the object PK as the only differentiating URL
component, as it would allow users to brute force guess all URLs and gain
knowledge of all objects. In my application, users have permission to view
individual objects, but letting users know a complete list of all objects
is undesirable.
First thought, use a non-sequential slug. The slug could be based on the
name of the object. However, the obvious source of the slug is not
necessarily unique. Two objects can have identical names and this is OK
for the object. I'd prefer to avoid additional overhead of calculating a
unique slug.
Next thought, append the PK to the name to generate the slug: <name>-<pk>.
This works as a unique slug, but has the drawback that a newly created
object cannot create a slug until *after* the save when the
`auto_increment` kicks in.
Next thought, keep the slug as non-unique, but use both the slug and PK in
the URL. So the slug would remain the name, and the URL would contain:
`/<slug>-<pk>/`. Then look up the object by *both* the slug and the PK.
This solves:
* URLs aren't brute force guessable without first knowing the object you
want to lookup
* It is OK that the slug is not unique, the URL is.
* URLs are prettier than a simple PK as the slug is more friendly to
humans
* The slug can be generated before save without a database hit
However, the default implementation of `SingleObjectMixin.get_object()`
uses *either* the PK or the slug, in that order, but not both. I am
suggesting that it be modified to use both fields if they are both
available. This would be as simple as changing the `elif slug is not
None:` from `elif` to an `if` (with some minor cleanup for error checking
and tests).
If this change is agreeable, I would be happy to create a pull request
that solves this problem.
(I realize I can implement this in my own views, and will if I need to,
but I thought this would be nice built-in.)
--
Ticket URL: <https://code.djangoproject.com/ticket/23482>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/052.8e688a849bffa4b3d7bf0f9c6a3f8628%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
