Because the user must be logged in to update their username you can get the current user from the request. You don't need to have their id inside the form. On 20/02/2015 9:49 am, "Chen Xu" <xuche...@gmail.com> wrote:
> Hi > I am implementing a feature while building a website using Django, > basically, I want user to be able to update their usernames. All of a > sudden, this question comes to me, if I have the userid (ex: 1) somewhere > in the form as a data attribute, if someone use firebug or something to > change the data-userid to 2, and submit the form, this will result in that > user 2 gets updated, right? > > What is the correct way to prevent this? > > Thanks > > > -- > ⚡ Chen Xu ⚡ > > -- > You received this message because you are subscribed to the Google Groups > "Django users" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to django-users+unsubscr...@googlegroups.com. > To post to this group, send email to django-users@googlegroups.com. > Visit this group at http://groups.google.com/group/django-users. > To view this discussion on the web visit > https://groups.google.com/d/msgid/django-users/CACac-qZ-dOZqFCzS0U7LHWE6Q7HR9bapVfFbYqjawtVhWG5-MQ%40mail.gmail.com > <https://groups.google.com/d/msgid/django-users/CACac-qZ-dOZqFCzS0U7LHWE6Q7HR9bapVfFbYqjawtVhWG5-MQ%40mail.gmail.com?utm_medium=email&utm_source=footer> > . > For more options, visit https://groups.google.com/d/optout. > -- You received this message because you are subscribed to the Google Groups "Django users" group. To unsubscribe from this group and stop receiving emails from it, send an email to django-users+unsubscr...@googlegroups.com. To post to this group, send email to django-users@googlegroups.com. Visit this group at http://groups.google.com/group/django-users. To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/CAHqTbjkXji3ggpUCPaD8qaiTBEptourA5Qrssmf3iEU22Lxkkg%40mail.gmail.com. For more options, visit https://groups.google.com/d/optout.
