Django發送消息問題

Question

我有一個名爲Message的模型，它有一個名爲in_response_to的字段。我通過在每個相關消息中存儲原始消息的主鍵來識別哪些消息彼此相關，並且列出所有消息

如果我收到來自您的新消息並且我想回復。我將在我的文本框下創建一個hidden_​​field，並存儲新消息的主ID，並使用它來創建一條消息，方法是將主鍵存儲在in_response_to中，因此我知道該消息與該消息相關，並且該方法會重複，因此每條消息都會有原始主鍵。

所以它像

(1) = message primary key 
(s) = store message primary key inside in_response_to 

John(1) send mail to Peter(s) 
Peter(1) send mail to John(s) 
John(1) send mail to Peter(s) 

現在的問題是，如果我向您發送消息。 in_response_to是空白的，因爲它有一條新消息。如果你回覆了這條消息，你會將我的主鍵存儲在in_response_to中，但是當我嘗試再次回覆時。我最終發送給自己。我不知道爲什麼。有人可以幫幫我嗎 。我在圈子裏

問題也會就此

 if messages.in_response_to: 
      if messages.user != request.user: 
       primary = messages.in_response_to 
       Message.objects.create(user=request.user,recipient=messages.user,body=body,in_response_to=primary) 
       return HttpResponseRedirect(reverse('world:message')) 
      if messages.user == request.user: 
       Message.objects.create(user=request.user,recipient=messages.recipient.user,body=body,in_response_to=primary) 

     Message.objects.create(user=request.user,recipient=messages.user,body=body,in_response_to=messages) 
     return HttpResponseRedirect(reverse('world:message')) 

車型

class Message(models.Model): 
    user = models.ForeignKey(User, related_name='sender') 
    recipient = models.ForeignKey(User, related_name='recipient') 
    created = models.DateTimeField(auto_now_add=True) 
    subject = models.CharField(max_length=100, blank=True) 
    body = models.CharField(max_length=1000) 
    read = models.BooleanField(default=False) 
    trash = models.BooleanField(default=False) 
    sentmessage = models.BooleanField(default=False) 
    in_response_to = models.ForeignKey('self', null=True, blank=True) 


    def __unicode__(self): 
     return self.body 

views.py

@login_required 
def read(request,id): 
    try: 
     messages = Message.objects.get(pk=id,recipient=request.user.id) 
    except Message.DoesNotExist: 
     return HttpResponseRedirect(reverse('world:Display')) 
    if request.method =='POST': 
     form = NewMessageForm(request.POST) 
     if form.is_valid(): 
      id = request.POST.get('hidden_field', False) 
      try: 
       messages = Message.objects.get(pk=id) 
      except Message.DoesNotExist: 
       return HttpResponseRedirect(reverse('world:LoginRequest')) 


      body = form.cleaned_data['body'] 
      if messages.in_response_to: 
       if messages.user != request.user: 
        primary = messages.in_response_to 
        Message.objects.create(user=request.user,recipient=messages.user,body=body,in_response_to=primary) 
        return HttpResponseRedirect(reverse('world:message')) 
       if messages.user == request.user: 
        Message.objects.create(user=request.user,recipient=messages.recipient.user,body=body,in_response_to=primary) 

      Message.objects.create(user=request.user,recipient=messages.user,body=body,in_response_to=messages) 
      return HttpResponseRedirect(reverse('world:message')) 

    if messages.in_response_to: 
     m = messages.in_response_to.id 
     message = Message.objects.filter(in_response_to=messages.in_response_to).filter(created__lte=messages.created) 

     initial = {} 
     initial.update({'hidden_field': m}) 
     form = NewMessageForm(initial=initial) 
     return render(request,'read.html',{'message':message,'form':form,'m':m}) 

    initial = {} 
    initial.update({'hidden_field': messages.id}) 
    form = NewMessageForm(initial=initial) 

    return render(request,'read.html',{'messages':messages,'form':form}) 

@login_required 
def message(request): 
    form = CheckBoxForm() 

    messages = Message.objects.filter(recipient=request.user.id).order_by("-created") 
    return render(request,'messages.html',{'messages':messages,'form':form}) 

模板

{％csrf_token％}

種

{{form.body}}{{form.hidden_field}} 
    <input type = "submit" value= "add" class="sen"/> 

</form> 

形式

class NewMessageForm(forms.Form): 
    body = forms.CharField(widget=forms.Textarea,required=False,max_length=22000) 
    hidden_field = forms.CharField(widget=forms.HiddenInput())  
    class Meta: 
     model = Message 

Answer 1

嗯，你應該明白，你可能是受害者的黑客。如果他們可以從hidden input改變in_response_to它打破了信息鏈。