Re: User data being exposed with mod_wsgi/apache

On Tue, Nov 1, 2011 at 4:40 PM, Jennifer Bell <jenniferlianne@yahoo.ca> wrote:

   def __init__(self,data=None,files=None,initial={},first_update=False,user=None, report=None):
      if user and user.is_authenticated() and UserProfile.objects.filter(user=user).exists():
              initial[ 'author' ] = user.first_name + " " + user.last_name
              initial[ 'phone' ] = user.get_profile().phone
              initial[ 'email' ] = user.email
      super(ReportUpdateForm,self).__init__(data,files=files,initial=initial)

---------------------------------------->

... I'm guessing because the 'initial' declaration in the form
constructor prototype is not on the stack, like I would have thought.
Changing the view to construct the ReportUpdateForm like so:

                 "update_form": ReportUpdateForm(user=request.user, initial={}),

This is a classic learning Python gotcha, see for example: http://www.ferg.org/projects/python_gotchas.html#contents_item_6

which describes the why in a fair amount of detail.

You should really replace initial={} in the __init__ definition with initial=None and replace None with an empty dictionary inside the method body...otherwise you are relying on all ReportUpdateForm callers to do the right thing (that is, always specify initial, even though it's not "required") to prevent that default initial dictionary from getting modified.

Karen
--
http://tracey.org/kmt/

--
You received this message because you are subscribed to the Google Groups "Django users" group.
To post to this group, send email to django-users@googlegroups.com.
To unsubscribe from this group, send email to django-users+unsubscribe@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/django-users?hl=en.