django-secureform 0.3-1

简介

提供针对垃圾邮件发送者和骗子的防护。

安装

使用pip安装 pip install django-secureform

然后，将应用程序安装到您的Django项目的settings.py中。还有一些可选的设置，这些设置将影响SecureForm实例的行为。

INSTALLED_APPS += ('django_secureform', )

# If you wish to use an encryption key other than Django's SECRET_KEY
SECUREFORM_CRYPT_KEY = 'super-secret encryption key'

# This is the name of the hidden field added to the form to contain
# security data.
SECUREFORM_FIELD_NAME = 'foobar'

# The number of seconds allowed between form rendering and submittal.
SECUREFORM_TTL = 300

# The number of honeypot fields added to the form.
SECUREFORM_HONEYPOTS = 1

# By default, jQuery is needed to hide honeypots. If you already
# use jQuery in your app, you can disable this feature (preventing
# a duplicate script reference to jQuery).
SECUREFORM_INCLUDE_JQUERY = False

用法

from django_secureform.forms import SecureForm


# Define your form class as usual.
class MySecureForm(SecureForm):
    class Meta:
        # Override options in settings.py for this class.
        include_jquery = False

    name = forms.CharField()

单元测试

如果您想为继承自SecureForm的表单编写单元测试，您需要让此应用程序知道您正在测试。SecureForm会查找settings.TESTING并评估为True。如果是这样，它将禁用安全功能，允许Django测试客户端使用原始字段名发送POST数据。

将来，我更愿意提供工具，以便在启用安全功能的情况下进行测试，但这是一种快速解决方案。我们的测试框架使用环境变量来设置settings.TESTING。例如，在settings.py...

import os

TESTING = True if 'TESTING' in os.environ else False