Django发送消息问题

Question

我有一个名为Message的模型，它有一个名为in_response_to的字段。我通过在每个相关消息中存储原始消息的主键来识别哪些消息彼此相关，并且列出所有消息

如果我收到来自您的新消息并且我想回复。我将在我的文本框下创建一个hidden_​​field，并存储新消息的主ID，并使用它来创建一条消息，方法是将主键存储在in_response_to中，因此我知道该消息与该消息相关，并且该方法会重复，因此每条消息都会有原始主键。

所以它像

(1) = message primary key 
(s) = store message primary key inside in_response_to 

John(1) send mail to Peter(s) 
Peter(1) send mail to John(s) 
John(1) send mail to Peter(s) 

现在的问题是，如果我向您发送消息。 in_response_to是空白的，因为它有一条新消息。如果你回复了这条消息，你会将我的主键存储在in_response_to中，但是当我尝试再次回复时。我最终发送给自己。我不知道为什么。有人可以帮帮我吗 。我在圈子里

问题也会就此

 if messages.in_response_to: 
      if messages.user != request.user: 
       primary = messages.in_response_to 
       Message.objects.create(user=request.user,recipient=messages.user,body=body,in_response_to=primary) 
       return HttpResponseRedirect(reverse('world:message')) 
      if messages.user == request.user: 
       Message.objects.create(user=request.user,recipient=messages.recipient.user,body=body,in_response_to=primary) 

     Message.objects.create(user=request.user,recipient=messages.user,body=body,in_response_to=messages) 
     return HttpResponseRedirect(reverse('world:message')) 

车型

class Message(models.Model): 
    user = models.ForeignKey(User, related_name='sender') 
    recipient = models.ForeignKey(User, related_name='recipient') 
    created = models.DateTimeField(auto_now_add=True) 
    subject = models.CharField(max_length=100, blank=True) 
    body = models.CharField(max_length=1000) 
    read = models.BooleanField(default=False) 
    trash = models.BooleanField(default=False) 
    sentmessage = models.BooleanField(default=False) 
    in_response_to = models.ForeignKey('self', null=True, blank=True) 


    def __unicode__(self): 
     return self.body 

views.py

@login_required 
def read(request,id): 
    try: 
     messages = Message.objects.get(pk=id,recipient=request.user.id) 
    except Message.DoesNotExist: 
     return HttpResponseRedirect(reverse('world:Display')) 
    if request.method =='POST': 
     form = NewMessageForm(request.POST) 
     if form.is_valid(): 
      id = request.POST.get('hidden_field', False) 
      try: 
       messages = Message.objects.get(pk=id) 
      except Message.DoesNotExist: 
       return HttpResponseRedirect(reverse('world:LoginRequest')) 


      body = form.cleaned_data['body'] 
      if messages.in_response_to: 
       if messages.user != request.user: 
        primary = messages.in_response_to 
        Message.objects.create(user=request.user,recipient=messages.user,body=body,in_response_to=primary) 
        return HttpResponseRedirect(reverse('world:message')) 
       if messages.user == request.user: 
        Message.objects.create(user=request.user,recipient=messages.recipient.user,body=body,in_response_to=primary) 

      Message.objects.create(user=request.user,recipient=messages.user,body=body,in_response_to=messages) 
      return HttpResponseRedirect(reverse('world:message')) 

    if messages.in_response_to: 
     m = messages.in_response_to.id 
     message = Message.objects.filter(in_response_to=messages.in_response_to).filter(created__lte=messages.created) 

     initial = {} 
     initial.update({'hidden_field': m}) 
     form = NewMessageForm(initial=initial) 
     return render(request,'read.html',{'message':message,'form':form,'m':m}) 

    initial = {} 
    initial.update({'hidden_field': messages.id}) 
    form = NewMessageForm(initial=initial) 

    return render(request,'read.html',{'messages':messages,'form':form}) 

@login_required 
def message(request): 
    form = CheckBoxForm() 

    messages = Message.objects.filter(recipient=request.user.id).order_by("-created") 
    return render(request,'messages.html',{'messages':messages,'form':form}) 

模板

{％csrf_token％}

种

{{form.body}}{{form.hidden_field}} 
    <input type = "submit" value= "add" class="sen"/> 

</form> 

形式

class NewMessageForm(forms.Form): 
    body = forms.CharField(widget=forms.Textarea,required=False,max_length=22000) 
    hidden_field = forms.CharField(widget=forms.HiddenInput())  
    class Meta: 
     model = Message 

Answer 1

嗯，你应该明白，你可能是受害者的黑客。如果他们可以从hidden input改变in_response_to它打破了信息链。