Reputation: 857
I have a Django to-do list app. In this app there is a page that gives all the details about a task like subtasks and notes, etc. The url of this page is like this "/todo/name of task". I wish to pass the pk of the task as well for security reasons. Also, if I check for a task in the database with its pk along with the title then this would allow a user to have multiple tasks with the same name. But as soon as I pass the pk with the URL, I face weird issues with subtasks and notes. This is my view function that handles the page of the task:
def todo_detail(request, title):
try:
todo = ToDo.objects.get(title=title, creator=request.user)
except:
return render(request, "ToDo/restrict_access.html")
subtasks = SubTask.objects.filter(parent_task=todo)
try:
note = Notes.objects.get(parent_task=todo)
except:
note = Notes()
if request.method == "POST":
note_form = ToDoNotesForm(request.POST)
subtask_form = SubTaskForm(request.POST)
due_form = DueDateForm(request.POST)
if note_form.is_valid():
task_notes = note_form.cleaned_data.get("task_notes")
new_note = Notes(content=task_notes)
new_note.parent_task = todo
new_note.save()
todo.has_notes = True
todo.save()
messages.success(request, "Your notes are saved")
return HttpResponseRedirect(request.META.get('HTTP_REFERER', '/'))
elif subtask_form.is_valid():
subtask_title = subtask_form.cleaned_data.get("sub_task")
subtask = SubTask(title=subtask_title)
subtask.parent_task = todo
subtask.parent_task.num_of_subtasks += 1
subtask.parent_task.save()
subtask.save()
messages.success(request, "Subtask added")
return HttpResponseRedirect(request.META.get('HTTP_REFERER', '/'))
elif due_form.is_valid():
days = due_form.cleaned_data.get("due_date").lower()
if days == "today":
days = 0
elif days == "tomorrow":
days = 1
elif days == "next week":
days = 7
elif days == "yesterday":
days = -1
elif days == "last week":
days = -7
else:
days = int(days)
today = datetime.datetime.today()
due_date = today + datetime.timedelta(days=days)
todo.due_date = due_date
todo.save()
messages.success(request, "Due Date added to task")
return HttpResponseRedirect(request.META.get('HTTP_REFERER', '/'))
else:
note_form = ToDoNotesForm()
subtask_form = SubTaskForm()
due_form = DueDateForm()
context = {
"todo": todo,
"note_form": note_form,
"note": note,
"subtask_form": subtask_form,
"subtasks": subtasks,
"due_form": due_form,
"title": todo.title,
"percentage": percentage
}
return render(request, "ToDo/detailed_view.html", context=context)
In the detail page, there are links to check, uncheck or edit a subtask or edit the notes. In the html page I have made sure to pass only the according pk to the editing or checking view fuctions.
There were some HTML code here that is not relevent
{% if subtasks %}
<br><br>
<center style="font-size:27px; background-color: burlywood; color: 'black';">Subtasks for this task:</center>
<br>
<div style="padding-left: 4ch;">
{% for subtask in subtasks %}
<div class="content-section dark-mode-assist-section">
{% if not subtask.done %}
{% if request.user_agent.is_mobile %}
<li style="font-size: 23px;">
<a style="color:inherit; text-decoration: none;" href="{% url 'todo-edit-subtask' subtask.pk %}"> {{ subtask.title }} </a>
<br>
<button onclick="location.href='{% url 'todo-toggle-subtask' subtask.pk %}'" type="button" class="btn btn-outline-success">Check it off</button>
<button onclick="location.href='{% url 'delete-item' 'subtask' subtask.pk %}'" type="submit" class="btn btn-outline-danger">Delete</button>
</li>
{% else %}
<li style="font-size: 23px;">
<a style="color:inherit; text-decoration: none;" href="{% url 'todo-edit-subtask' subtask.pk %}"> {{ subtask.title }} </a>
<button onclick="location.href='{% url 'todo-toggle-subtask' subtask.pk %}'" style="float: right; size:3ch" type="button" class="btn btn-outline-success">Check it off</button>
<button onclick="location.href='{% url 'delete-item' 'subtask' subtask.pk %}'" style="float: right; size:3ch" type="submit" class="btn btn-outline-danger">Delete</button>
</li>
{% endif %}
{% else %}
{% if request.user_agent.is_mobile %}
<li style="font-size: 23px;">
<a style="color:inherit; text-decoration: line-through;" href="{% url 'todo-edit-subtask' subtask.pk %}"> {{ subtask.title }} </a>
<br>
<button onclick="location.href='{% url 'todo-toggle-subtask' subtask.pk %}'" type="button" class="btn btn-outline-success">Uncheck it </button>
<button onclick="location.href='{% url 'delete-item' 'subtask' subtask.pk %}'" type="submit" class="btn btn-outline-danger">Delete</button>
</li>
{% else %}
<li style="font-size: 23px;"><a class="control-subtask" style="color:inherit; text-decoration: line-through;" href="{% url 'todo-edit-subtask' subtask.pk %}"> {{ subtask.title }} </a> <button onclick="location.href='{% url 'todo-toggle-subtask' subtask.pk %}'" style="float: right; size:3ch" type="button" class="btn btn-outline-success">Uncheck it</button> <button onclick="location.href='{% url 'delete-item' 'subtask' subtask.pk %}'" style="float: right; size:3ch" type="submit" class="btn btn-outline-danger">Delete</button> </li>
{% endif %}
{% endif %}
</div>
{% endfor %}
{% if percentage != 0 %}
<center style="font-size:23px; background-color: burlywood; color: 'black';">Your progress:</center>
<center> <span style="font-size:10ch; color:lightseagreen">{{ percentage }}%</span></center>
{% endif %}
</div>
{% endif %}
{% if todo.has_notes %}
<br>
<center style="font-size:27px; background-color: burlywood; color: 'black';">Notes for this task:</center>
<h3>
<br>
<div style="font-family:Candara">{{ note.content|linebreaks }}</div>
<button class="btn btn-outline-danger" type="submit" onclick="location.href='{% url 'delete-item' 'notes' note.pk %}'">Delete notes</button>
<button class="btn btn-outline-info" type="submit" onclick="location.href='{% url 'todo-edit-notes' note.pk %}'">Edit notes</button>
</h3>
<p>
<br>
Notes added on: <b>{{ note.date_added|date:"F d, Y" }}</b>
<br>
{% if note.date_edited != note.date_added %}
Notes edited on: <b>{{ note.date_edited|date:"F d, Y" }}</b>
{% endif %}
</p>
{% else %}
<br>
<form method="POST" name={{ note.pk }} >
{% csrf_token %}
<fieldset class="form-group dark-mode-assist">
<legend class="border-bottom mb-4">Add notes</legend>
{{ note_form|crispy }}
<input type="hidden" name="title" value={{ note.pk }}>
</fieldset>
<div class="form-group">
<button class="btn btn-outline-info" type="submit">Add</button>
</div>
</form>
{% endif %}
</div>
{% endblock content %}
As long as I am only passing the title to the detail page, all the other links work. But if I pass the pk of the task to the detail page, and I want to check a particular subtask, then this happens:
As you can see the pk after toggle-subtask
is the pk for that subtask, yet Django is telling that it cannot find a ToDo object? To check the subtask there is a different URL and has no connection with the detail page. This doesn't make sense.
Any help on this issue will be seriously and hugely appreciated. Thank you all.
Edit: This is my view function that checks and unchecks a subtask:
@login_required
def toggle_subtask(request, pk):
try:
subtask = SubTask.objects.get(pk=pk)
# Security check
if subtask.parent_task.creator != request.user:
return render(request, "ToDo/restrict_access.html")
except:
return render(request, "ToDo/restrict_access.html")
if subtask.done:
subtask.done = False
subtask.save()
messages.info(request, "Okay, take your time!")
else:
subtask.done = True
subtask.save()
messages.info(request, "Awesome!")
return HttpResponseRedirect(request.META.get('HTTP_REFERER', '/'))
So apparently, I should've gotten error in the first place when visiting the details page if no ToDo was found. But I was able to get to the details page. The issue is when I want to check a subtask, they say that the ToDo is not found, but in reality I am checking for SubTask not ToDo.
Upvotes: 0
Views: 234
Reputation: 15128
Your view function toggle_subtask
isn't being routed to because todo_detail
is getting routed to first.
From the django docs in How Django processes a request:
- Django runs through each URL pattern in order, and stops at the first one that matches the requested URL, matching against
path_info
.
In your urls.py
file, you can structure the urls so that the most specific ones (like /todo/toggle_subtask/<pk>/
) come before the least specific ones (like /todo/<title>/
):
from django.urls import path
from . import views # Wherever your `views.py` should be imported from
urlpatterns = [
# /todo/toggle_subtask/<pk>/
path('/todo/toggle_subtask/<int:pk>/', views.toggle_subtask),
# /todo/<title>/
path('/todo/<str:title>/', views.todo_detail),
]
Upvotes: 1
Reputation: 4095
As the first query does not matches to the database. You got this error. So, you can use ToDo.DoesNotExist
to track the exception like:
try:
todo = ToDo.objects.get(title=title, creator=request.user)
except ToDo.DoesNotExist:
return render(request, "ToDo/restrict_access.html")
Upvotes: 0