Django modelform field how to make disabled and prevent tampering?

Question

There is this disabled attribute. But i am not able to apply it to the modelform fields. I am not sure how to. I can add it to forms.Form easily. But since I am using widgets I just dont know where to insert it.

https://docs.djangoproject.com/en/2.0/ref/forms/fields/#disabled

class TestForm(forms.ModelForm):
    class Meta:
        model = Test
        fields = ['date']
        widgets = {'date': forms.TextInput(attrs={'readonly': 'readonly'})}

You can add the attribute: `forms.TextInput(attrs={'disabled': 'disabled'}),` — Lemayzeur, May 12 '18 at 00:04

score 6 · Answer 1 · answered Mar 06 '19 at 12:26

I was facing a situation when I wanted to disable some fields when creating . And some fields disabled when editing.

My Env: Python 3, Django 2.1

My Form:

class AddInvoiceForm(forms.ModelForm):
    disabled_fields = ['inv_type', 'report', 'subsidiary']
    class Meta:
        model = models.Invoice
        fields = ('inv_type', 'report', 'subsidiary', 'rate_card', 'reviewed')

    def __init__(self, *args, **kwargs):
        super(AddInvoiceForm, self).__init__(*args, **kwargs)
        instance = getattr(self, 'instance', None)
        if instance and instance.pk:
            for field in self.disabled_fields:
                self.fields[field].disabled = True
        else:
            self.fields['reviewed'].disabled = True

score 4 · Answer 2 · answered May 12 '18 at 00:02

Try something like this, assuming that your date field is forms.DateField and that you want to use TextInput widget:

class TestForm(forms.ModelForm):
    date = forms.DateField(widget=forms.TextInput, disabled=True)
    class Meta:
        model = Test
        fields = ['date']

This will override the default field definition which is created from your Test model definition.

The disabled boolean argument, when set to True, disables a form field using the disabled HTML attribute so that it won’t be editable by users. Even if a user tampers with the field’s value submitted to the server, it will be ignored in favor of the value from the form’s initial data.

Read about readonly vs disabled HTML input attributes.

The key note to take out from the above SO post is:

A readonly element is just not editable, but gets sent when the according form submits. a disabled element isn't editable and isn't sent on submit.

From above quote, setting disabled=True is enough, so you dont need to set readonly attribute on your widget.

Can't someone just click on "inspect" on the form entry and modify the content and the resubmit the form? — Federico Gentile, Oct 03 '22 at 10:37
@FedericoGentile see the quote I use in my answer. It says 'Even if a user tampers with the field’s value submitted to the server, it will be ignored in favor of the value from the form’s initial data.'. Thats what official Django docs say (https://docs.djangoproject.com/en/dev/ref/forms/fields/#disabled) — an0o0nym, Oct 03 '22 at 17:33
Hello, I just tested it on my own and with readonly I am still able to modify the value and submit it. As a matter of fact when I check the database where I store the data I actually see the modified value — Federico Gentile, Oct 25 '22 at 09:00

score 3 · Answer 3 · answered May 11 '18 at 16:22

3

class TestForm(forms.ModelForm):
date = forms.CharField(disabled=True)
class Meta:
    model = Test
    fields = ['date']

    widgets = {
        'date': forms.TextInput(attrs={'readonly': 'readonly'}),
    }

answered May 11 '18 at 16:22

Sumeet Kumar

969
1
11
22

are you sure that will work? How will it knnow that the variable date and the field date are related to each other/ – questnofinterest May 11 '18 at 16:26
You are using model form.. So django will relate that implicitly – Sumeet Kumar May 12 '18 at 16:58

Django modelform field how to make disabled and prevent tampering?

3 Answers3