From dba5c97d51716a6293dde33f7564f1fe64852507 Mon Sep 17 00:00:00 2001 From: mdipierro Date: Wed, 11 Nov 2015 18:38:48 -0600 Subject: [PATCH] fixed check for form tampering --- gluon/sqlhtml.py | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/gluon/sqlhtml.py b/gluon/sqlhtml.py index c6a7ee16..9008536e 100644 --- a/gluon/sqlhtml.py +++ b/gluon/sqlhtml.py @@ -1504,7 +1504,7 @@ class SQLFORM(FORM): self.custom.end = CAT(self.hidden_fields(), self.custom.end) - auch = record_id and self.errors and self.deleted + auch = self.record_id and self.errors and self.deleted if self.record_changed and self.detect_record_change: message_onchange = \ @@ -1551,8 +1551,6 @@ class SQLFORM(FORM): if str(record_id) != str(self.record_id): raise SyntaxError('user is tampering with form\'s record_id: ' '%s != %s' % (record_id, self.record_id)) - else: - record_id = self.record_id if record_id and dbio and not keyed: self.vars.id = self.record[self.id_field_name]