尽管具有csrf令牌,但表单仍无法验证

时间:2020-09-26 18:03:45

标签: python html flask flask-wtforms

我在这里看到了一些类似的问题,但是似乎没有一种解决方案适用于此(问题通常是它缺少一个csrf令牌,在这里不是这种情况)。

我有一个包含四个字段的表单-3个带有SelectField的下拉列表和一个String-15-使用flask wtforms构建的表单。我尝试为此添加一个编辑功能,该功能使用相同的HTML模板,但是此功能尚未通过验证(未输入form.validate_on_submit部分)。这是该函数的代码:

@app.route('/movements/<int:movement_id>/edit', methods=['GET', 'POST'])   
def edit_movement(movement_id):
    movement = Movement.query.get_or_404(movement_id)
    form = MovementForm()
    if form.validate_on_submit():
        product = Product.query.filter_by(id=form.product.data).first()
        from_location = Location.query.filter_by(id=form.from_location.data).first()
        to_location = Location.query.filter_by(id=form.to_location.data).first()
        if int((Balance.query.filter_by(product = product.name).filter_by(location = from_location.name).first()).balance) < int(form.quantity.data) and from_location.name != "":
           flash("Invalid movement. Quantity of the product is insufficient.")
        else: 
            movement.product_id = product.id
            movement.product = product.name
            movement.from_location_id = from_location.id
            movement.from_location = from_location.name
            movement.to_location_id = to_location.id
            movement.to_location = to_location.name
            movement.quantity = form.quantity.data
            db.session.commit()
            flash('The product movement has been edited!', 'success')
        return redirect(url_for('movements'))
    elif request.method == 'GET':
        form.product.choices = [(product.id,product.name) for product in Product.query.all()]
        form.from_location.choices = [(location.id,location.name) for location in Location.query.all()]
        form.to_location.choices = [(location.id,location.name) for location in Location.query.all()]
        form.quantity.data = movement.quantity
    edit_button = True   
    return render_template('movements.html',form=form, edit_button=edit_button)

这是表单的代码:

class MovementForm(FlaskForm):
    product = SelectField("Product", choices = [])
    from_location = SelectField("From Location", choices = [], coerce=int)
    to_location = SelectField("To Location", choices = [], coerce=int)
    quantity = StringField("Quantity", validators=[DataRequired()])
    add_movement = SubmitField("Add Movement")

这是表格的模型:

class Movement(db.Model):
    id = db.Column(db.Integer, primary_key=True)
    product_id = db.Column(db.Integer, db.ForeignKey('product.id'), nullable=False)
    product = db.Column(db.String(50), nullable=False)
    from_location_id = db.Column(db.Integer, db.ForeignKey('location.id'))
    from_location = db.Column(db.String(50))
    to_location_id = db.Column(db.Integer, db.ForeignKey('location.id'))
    to_location = db.Column(db.String(50))
    quantity = db.Column(db.Integer, nullable=False)
    timestamp = db.Column(db.DateTime, nullable=False, default=datetime.utcnow)

表单的HTML代码:

<form action="" method="POST">
        {{ form.csrf_token }}
        {{ form.product.label }}
        {{ form.product }}
        {{ form.from_location.label }}
        {{ form.from_location }}
        {{ form.to_location.label }}
        {{ form.to_location }}
        {{ form.quantity.label }}
        {{ form.quantity }}
        {% if edit_button %}
            <input type="submit" value="Edit Movement">
        {% else %}
            {{ form.add_movement }}
        {% endif %}
</form>

3 个答案:

答案 0 :(得分:1)

validate_on_submit是一项便捷的功能,它结合了对表单是否已提交的检查(即POST,PUT,PATCH或DELETE)和对form.validate的调用。如果验证失败,则form.errors持有的字典将填充有用的信息。

调试问题的一个有用步骤是,如果form.errors返回False,则记录(打印)validate_on_submit的内容。

答案 1 :(得分:1)

您的代码中的form.errors如下:

{'product': ['Not a valid choice'], 'from_location': ['Not a valid choice'], 'to_location': ['Not a valid choice']}

因此,validate_on_submit返回False是合理的。

如果您注释掉这些字段并仅保留应该工作的数量。以下更改对我有用,我设法更新了数据库中的数量。如果它也对您有用,那么您可以尝试取消注释每个字段并进一步调试。

将表单更改为:

class MovementForm(FlaskForm):
quantity = StringField("Quantity", validators=[DataRequired()])
add_movement = SubmitField("Add Movement")

以及到达以下地点的路线

@app.route('/movements/<int:movement_id>/edit', methods=['GET', 'POST'])
def edit_movement(movement_id):
movement = Movement.query.get_or_404(movement_id)
form = MovementForm()
if form.validate_on_submit():
    movement.quantity = form.quantity.data
    db.session.commit()
    flash('The product movement has been edited!', 'success')
    return redirect(url_for('movements'))
elif request.method == 'GET':
    form.quantity.data = movement.quantity
print(form.errors)
edit_button = True
return render_template('movements.html', form=form, edit_button=edit_button)

将模板更改为:

<form action="" method="POST">
    {{ form.csrf_token }}
    {{ form.quantity.label }}
    {{ form.quantity }}
    {% if edit_button %}
        <input type="submit" value="Edit Movement">
    {% else %}
        {{ form.add_movement }}
    {% endif %}
</form>

更新

here说明了您面临的问题。

请尝试以下操作,如果它能按预期工作,则对其余字段进行类似设置(它对我有用,我设法更新了数据库中的数量和from_location / id):

表格:

class MovementForm(FlaskForm):
fromloc = [(location.id,location.name) for location in Location.query.all()]
from_location_id = SelectField("From Location ID", choices = fromloc, coerce=int)
quantity = StringField("Quantity", validators=[DataRequired()])
add_movement = SubmitField("Add Movement")

路线:

@app.route('/movements/<int:movement_id>/edit', methods=['GET', 'POST'])
def edit_movement(movement_id):
    movement = Movement.query.get_or_404(movement_id)
    form = MovementForm()
    if form.validate_on_submit():
        movement.from_location_id = form.from_location_id.data
        movement.from_location = (Location.query.filter_by(id = form.from_location_id.data).first()).name
        movement.quantity = form.quantity.data
        db.session.commit()
        flash('The product movement has been edited!', 'success')
        return redirect(url_for('movements'))
    elif request.method == 'GET':
        form.from_location_id.choices = [(location.id,location.name) for location in Location.query.all()]
        form.quantity.data = movement.quantity
    print(form.errors)
    edit_button = True
    return render_template('movements.html', form=form, edit_button=edit_button)

模板:

<form action="" method="POST">
    {{ form.csrf_token }}
    {{ form.from_location_id.label }}
    {{ form.from_location_id }}
    {{ form.quantity.label }}
    {{ form.quantity }}
    {% if edit_button %}
        <input type="submit" value="Edit Movement">
    {% else %}
        {{ form.add_movement }}
    {% endif %}
</form>

答案 2 :(得分:0)

我仍然不太确定为什么我的表单没有通过验证,但是在我将if form.validate_on_submit()替换为if request.method == 'POST'之后,我的函数开始起作用了。