Django formset security and injecting PKs in formset hidden id fields

I've noticed something troubling in Django formsets: Each formset.form has a hidden field with the id of the model being edited. All one would need to do is change this id and submit, and the default formset clean() or save() methods don't bat an eye. I would think that it wouldn't be too c

Re: Django formset hidden id field

Carl Meyer said: "Whatever queryset you pass to the model formset limits the available rows for editing. The end user can edit the PK to refer to any item in that queryset, but not any item in the table. " That's not true, based on my observation. As long as the PK refers to any object of that

Re: problem with deploying django using mod wsgi

It may be looking in html because it isn't getting the definition from the view method or class, so it's going with the default. Try importing everything in views: from webapp import views * On Saturday, August 10, 2013 3:46:19 AM UTC-4, WongoBongo wrote: > > Is your form (on page /mice/search_mi