Ticket #11112: wizard.patch

wizard.py

@@ -4 +4 @@
 stored on the server side.
 """
 
-import cPickle as pickle
-
 from django import forms
 from django.conf import settings
 from django.http import Http404
@@ -62 +60 @@
         # TODO: Move "hash_%d" to a method to make it configurable.
         for i in range(current_step):
             form = self.get_form(i, request.POST)
+            # Handle formsets
+            if issubclass(form.__class__,forms.formsets.BaseFormSet):
+                # checkhash for management form
+                if request.POST.get("hash_%d" % i, '') != self.security_hash(request, form.management_form):
+                    return self.render_hash_failure(request, i)
+                for f in form.forms:
+                    # check hash in every form
+                    if request.POST.get("hash_%d_%s" % (i,f.prefix)) != self.security_hash(request,f):
+                        return self.render_hash_failure(request,i)
             if request.POST.get("hash_%d" % i, '') != self.security_hash(request, form):
                 return self.render_hash_failure(request, i)
             self.process_step(request, form, i)
@@ -107 +114 @@
             for i in range(step):
                 old_form = self.get_form(i, old_data)
                 hash_name = 'hash_%s' % i
-                prev_fields.extend([bf.as_hidden() for bf in old_form])
-                prev_fields.append(hidden.render(hash_name, old_data.get(hash_name, self.security_hash(request, old_form))))
+                # handle formsets
+                if issubclass(old_form.__class__,forms.formsets.BaseFormSet):
+                    # do management form and generate hash
+                    prev_fields.extend([bf.as_hidden() for bf in old_form.management_form])
+                    prev_fields.append(hidden.render(hash_name, old_data.get(hash_name, self.security_hash(request, old_form.management_form))))
+                    for f in old_form.forms:
+                        # do each form and generate a hash for each
+                        hash_name = 'hash_%s_%s' % (i,f.prefix)
+                        prev_fields.extend([bf.as_hidden() for bf in f])
+                        prev_fields.append(hidden.render(hash_name, old_data.get(hash_name, self.security_hash(request, f))))
+                else:
+                    prev_fields.extend([bf.as_hidden() for bf in old_form])
+                    prev_fields.append(hidden.render(hash_name, old_data.get(hash_name, self.security_hash(request, old_form))))
+
         return self.render_template(request, form, ''.join(prev_fields), step, context)
 
     # METHODS SUBCLASSES MIGHT OVERRIDE IF APPROPRIATE ########################