Re: FormSet.is_valid() raises ValidationError

Hi,

  In case of <form method="post">

    <table>          {{ formset }}      </table>  </form> 

no probs. but in case of 

<form method="post">      {{ formset.management_form }}      <table>          {% for form in formset %}          {{ form }}          {% endfor %}      </table>  </form>

    {{ formset.management_form }} is required and of course       {% csrf_token %}. Ref https://docs.djangoproject.com/en/2.2/topics/forms/formsets/

On Tuesday, October 29, 2019 at 5:41:16 PM UTC+5:30, Benoit Blanchon wrote:

Hi,

From what I understand, Form.is_valid() must return False when the form is invalid or incomplete.

BaseFormSet, however, raises a ValidationError with the message "ManagementForm data is missing or has been tampered with,"  when the management form has been tampered.

I think this is incorrect: BaseFormSet.is_valid() should catch this exception and return False; otherwise, it allows a malicious user to cause an error 500 by tampering the management form.

Best regards,

Benoit Blanchon

(Django version: 2.2.6)

--
You received this message because you are subscribed to the Google Groups "Django users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to django-users+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/c78a89fd-b44b-4863-aee7-33646bf5114e%40googlegroups.com.