dinislage/web2py
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fixed check for form tampering

Browse Source
This commit is contained in:
mdipierro
2015-11-11 18:38:48 -06:00
parent 948bd0c671
commit dba5c97d51
1 changed files with 1 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
gluon/sqlhtml.py
+1 -3
View File
@@ -1504,7 +1504,7 @@ class SQLFORM(FORM):
self.custom.end = CAT(self.hidden_fields(), self.custom.end) self.custom.end = CAT(self.hidden_fields(), self.custom.end)
auch = record_id and self.errors and self.deleted auch = self.record_id and self.errors and self.deleted
if self.record_changed and self.detect_record_change: if self.record_changed and self.detect_record_change:
message_onchange = \ message_onchange = \
@@ -1551,8 +1551,6 @@ class SQLFORM(FORM):
if str(record_id) != str(self.record_id): if str(record_id) != str(self.record_id):
raise SyntaxError('user is tampering with form\'s record_id: ' raise SyntaxError('user is tampering with form\'s record_id: '
'%s != %s' % (record_id, self.record_id)) '%s != %s' % (record_id, self.record_id))
else:
record_id = self.record_id
if record_id and dbio and not keyed: if record_id and dbio and not keyed:
self.vars.id = self.record[self.id_field_name] self.vars.id = self.record[self.id_field_name]