Django - 更安全的联系表格

时间:2012-05-05 06:56:56

标签: django forms security session cookies

我正在撰写一份预防反垃圾邮件的联系表格。我决定创建一个部分解决问题的会话(我想)。但是,在重定向到成功页面后,我可以返回浏览器并再次发送消息,就像会话cookie不会被设置一样。

我应该使用什么来阻止用户返回并再次发送消息?

def index(request):

    if request.method == 'POST':

        form = ContactForm(request.POST or None)

        if form.is_valid():

            full_name = escape(form.cleaned_data['full_name'])
            subject = escape(form.cleaned_data['subject'])
            text = escape(form.cleaned_data['text'])
            email = escape(form.cleaned_data['email'])
            phone = escape(form.cleaned_data['phone'])
            cc_myself = escape(form.cleaned_data['cc_myself'])


            request.session.set_expiry(60)
            request.session['has_commented'] = True

            form.save()

            messages.success(request, ugettext_lazy("Your message has been sent."))
            return HttpResponseRedirect('/kontakt/success/')

    else:

        form = ContactForm()

    return TemplateResponse(request, 'contact.html', {'form': form},)


def success(request):
    return TemplateResponse(request, "success.html")

联系表格:

{% load i18n %}


<form class="grid_8" action="/kontakt/" method="post">
    {% csrf_token %}

    <h2 class="center"> {% trans "Formularz kontaktowy:"%} </h2>
    <hr>

    {% if request.session.has_commented %}
    <h2>{% trans "You've already sent a message. Please wait 60 seconds to send another message" %}</h2>

    {%else%}
    {% for field in form %}

    <div class="grid_3 ">
        <div class="label">
            {{ field.label_tag }}
        </div>
        <div class="help_text">
        {% if field.errors %}
            <div class="error">({{ field.errors|striptags }})</div>

        {% endif %}

            {{ field.help_text }}


        </div>
    </div>
    <div class="grid_4 alpha">
        {{ field }}
    </div>
    <div class="clear"></div>
    {% endfor %}
    <hr>
    <div style="text-align: center;">
        <input class="submit" type="submit" value="{% trans "Wyślij wiadomość" %}" />
    </div>




    {% endif %}
</form>

0 个答案:

没有答案