Re: Question about form security.

2015-02-19 Thread Carl Meyer
On 02/19/2015 04:03 PM, Chen Xu wrote: > what if I have two addresses, id is 1 and 2, and I want to update 2, how > I should distinguish 2 from 1, I mean, if I have addressid in the form, > and someone modify it from 2 to 1, and that will update 1, right? How to > prevent this? Your server-side co

Re: Question about form security.

2015-02-19 Thread Chen Xu
what if I have two addresses, id is 1 and 2, and I want to update 2, how I should distinguish 2 from 1, I mean, if I have addressid in the form, and someone modify it from 2 to 1, and that will update 1, right? How to prevent this? On Thu, Feb 19, 2015 at 6:01 PM, Mario Gudelj wrote: > Because t

Re: Question about form security.

2015-02-19 Thread Mario Gudelj
Because the user must be logged in to update their username you can get the current user from the request. You don't need to have their id inside the form. On 20/02/2015 9:49 am, "Chen Xu" wrote: > Hi > I am implementing a feature while building a website using Django, > basically, I want user to