How to prevent data tampering when form is set as readonly with Django?

28 Views Asked by At

INTRO: I have a Django web app which does the following:

  1. Allows the user to fill the form
  2. After the form is submitted, it shows the form with the previously filled values

In step 2, the form fields are set as read-only because they should not be modified.

So in my views.py file I have the following information:

def insert_data(request):
    # Get the form from a previous post request (coming from step1)
    form_one_item = ProductForm(request.POST, request.FILES)

    # Set the fields as readonly (this is step 2)
    form_one_item.fields['name'].widget.attrs['readonly'] = True
    
    return render(request, 'mypage.html', {'form_one_item':'form_one_item'})

The form therefore looks like this:

enter image description here

and it is supposed to be resubmitted through another post request (I know it is confusing but I need to do so).

PROBLEM: At first glance, it looks like it is all fine but then I noticed that I can right-click on the field and modify its content:

enter image description here

As a matter of fact if I repost the readonly form, the value shown is modified according to what I write into the value field.

QUESTION: Are you able to suggest a possible way to keep the readonly option but at the same time to avoid to pass a modified value once I re-submit the post?

NOTE: None of the answers posted in this popular question worked for me.

0

There are 0 best solutions below