2

I have a Flask form (WTForms) which consist of several inserted FormFields. I don't know how to deal with the fact, that each sub-form and the main form generates it's own csrf token.

Should I render all tokens in template? Deactivate csrf for "inner" forms? The view itself wouldn't be accesible to all (only staff users).

Here are the forms.py:

class PersonForm(FlaskForm):
    name = StringField('Name')
    role = HiddenField(validators=[AnyOf(values=['A', 'T', 'R', 'I'])])


class CreatorsForm(FlaskForm):
    authors = FieldList(FormField(PersonForm, default={'role': 'A'), min_entries=3)
    translators = FieldList(FormField(PersonForm, default={'role': 'T'), min_entries=3)
    submit = SubmitField('Submit')

The presented code it's just a begining of a much bigger form, which I'd have to convert into a step form. So I render the fields manually, and my template looks like this:

<form class="form form-horizontal" action="" method="POST" accept-charset="utf-8">
        {{ form.hidden_tag() }}
   <div class="container" id="authors">
    <h4>{{ form.authors.label }}</h4>
    {% for f in form.authors %}
        <p> {{ f.form.name.label }}  {{ f.form.name() }}</p>
    {% endfor %}
    {% for error in form.authors.errors %}
        <span style="color: red">{{ error }}</span>   
    {% endfor %}
        </div> <br>
        <div class="container" id="translators">
        <h4>{{ form.translators.label }}</h4>
    {% for f in form.translators %}
        <p>{{ f.form.name.label }} {{ f.form.name() }}</p>
    {% endfor %}
    {% for error in form.translators.errors %}
        <span style="color: red">{{ error }}</span>   
    {% endfor %}
        </div>
    <p>{{ form.submit() }}</p>
    </form>
maria
  • 123
  • 1
  • 5

0 Answers0