python - 启用 CSRF 保护的 Flask-WTF SelectField

Question

我在提交包含动态填充的 SelectField 的表单时遇到问题。出于某种原因，当 Flask 尝试验证 CSRF token 时，当 SelectField 在表单中时它总是失败。当我从表单中删除 SelectField 时，它会成功验证 CSRF token 。

有没有人遇到过这种行为？

编辑

表格:

class AddToReportForm(Form):
    selectReportField = SelectField(u'Reports',choices=[('test1','test')])

    def __init__(self, *args, **kwargs):
        """
        Initiates a new user form object
        :param args: Python default
        :param kwargs: Python default
        """
        Form.__init__(self, *args, **kwargs)




    def validate(self,id_list):
        rv = Form.validate(self)

        if not rv:
            print False
            #Check for the CSRF Token, if it's not there abort.
            return False

        print True
        return True

Jinja2:

<form  method=post name="test">
{{ form.hidden_tag()}}




    {{ form.selectReportField }}
    <a href="#" onclick="$(this).closest('form').submit()" class="button save">Add to report</a>

</form>

渲染:

form = AddToReportForm()
return render_template('random',title='add reports',form=form

Answer 1

你在哪里设置 SECRET_KEY？它必须在 Form 类中可用:

class AddToReportForm(Form):
    selectReportField = SelectField(u'Reports',choices=[('test1','test')])
    SECRET_KEY = "myverylongsecretkey"

    def __init__(self, *args, **kwargs):
        """
        Initiates a new user form object
        :param args: Python default
        :param kwargs: Python default
        """
        Form.__init__(self, *args, **kwargs)
    def validate(self,id_list):
        rv = Form.validate(self)

        if not rv:
            print False
            #Check for the CSRF Token, if it's not there abort.
            return False
        return True

或在应用程序 Bootstrap 中:

app = Flask(__name__)
app.secret_key = 'myverylongsecretkey'

或者在构造函数中:

form = AddToReportForm(secret_key='myverylongsecretkey')
return render_template('random',title='add reports',form=form)