Current user in form.

[marc-dms]

Hi,

Thanks for your contributions. On one hand, the following suggestion from ​https://docs.djangoproject.com/en/3.0/topics/class-based-views/generic-editing/ to store the current user in a form impairs form level validation such as unique-together.

form.instance.created_by = self.request.user

On the other hand hiding the field and using the following code exposes the id and opens a backdoor to malicious code that would modify the hidden field.

def get_initial(self): return { 'created_by': self.request.user }

Could the doc rather suggest a solution that would solve both issues?

Best,

-- M

[Mariusz Felisiak]

On the other hand hiding the field and using the following code exposes the id and opens a backdoor to malicious code that would modify the hidden field.

def get_initial(self): return { 'created_by': self.request.user }

Could the doc rather suggest a solution that would solve both issues?

I don't see such recommendation anywhere in the docs. Moreover you cannot add a hidden field if an user ID is sensitive for you. It's a support question and Trac is not a support channel.

Closing per TicketClosingReasons/UseSupportChannels.