Django：找不到字段？

Question

我一直收到错误消息

ImproperlyConfigured at /messages/compose/
Creating a ModelForm without either the 'fields' attribute or the 'exclude' attribute is prohibited; form ComposeForm needs updating.

我完全理解指出的错误是什么，但是我不明白为什么它会首先出现？

这是 django 要我更新的表单：

from django import forms
from .models import DirectMessage

class ComposeForm(forms.ModelForm):
    class Meta:
        model = DirectMessage

这是我的模型（包含字段）：

from django.db import models
from django.contrib.auth.models import User

# Create your models here.
user_obj = User.objects.get(username = 'jess')

class DirectMessage(models.Model):
    subject = models.CharField(max_length =150)
    body = models.CharField(max_length =3000)
    sender = models.ForeignKey(User, related_name='sent_direct_messages', null=True, blank=True)
    receiver = models.ForeignKey(User, related_name='recieved_direct_messages', null=True, blank=True)
    sent = models.DateTimeField(auto_now_add=False, auto_now=False, null=True, blank=True)
    read = models.DateTimeField(auto_now_add=False, auto_now=False, null=True, blank=True)

    def __unicode__(self):
        return self.subject

也许我的语法有问题，或者我遗漏了一个明显的基本错误。任何帮助将不胜感激，如果您需要更多帮助，请告诉我 information/context。谢谢！

Answer 1

如Django documentation: Creating forms from models: Selecting the fields to use中所述：

It is strongly recommended that you explicitly set all fields that should be edited in the form using the fields attribute. Failure to do so can easily lead to security problems when a form unexpectedly allows a user to set certain fields, especially when new fields are added to a model. Depending on how the form is rendered, the problem may not even be visible on the web page.

The alternative approach would be to include all fields automatically, or blacklist only some. This fundamental approach is known to be much less secure and has led to serious exploits on major websites (e.g. GitHub).

因此，无论模型中定义了哪些字段，您都应该在 Meta 中明确包含一个 fields 变量。这必须是您需要在 ModelForm 中拥有的模型的所有字段的元组。您也可以将值指定为 '__all__'.

这是 introduced in Django 1.6:

Changed in Django 1.6:

Before version 1.6, the 'all' shortcut did not exist, but omitting the fields attribute had the same effect. Omitting both fields and exclude is now deprecated, but will continue to work as before until version 1.8.

Answer 2

I totally understand what the error is pointing out however I don't understand why it's showing up in the first place?

错误...因为您的 ModelForm 没有明确指定 fields 列表或 exclude 列表？

Here is the form django wants me to update: class DirectMessageAdmin(admin.ModelAdmin):

这不是 ModelForm，这是 ModelAdmin。鉴于您的错误消息中的 url，我认为这与您的管理员没有任何关系...

Django：找不到字段？

Django: Fields not found?

python

django

django-models

django-forms