该应用程序的基本功能是为每个教师生成一个动态的URL,例如:
一切正常,但如果用户(学生)执行一个奇怪的操作,就会出现问题。例如,当学生收费时,老师mike:url生成的是mywebsite.com/teacher/rate/1,并显示一个模板,说明答案已保存。问题出现在这里:
def send(request, user_pk):
if not request.user.is_authenticated:
return HttpResponseRedirect('/accounts/login/')
else:
#first look for the record not to exist in the DB to avoid duplicate records
exist = Answers.objects.filter(name= request.user, teacher= user_pk ).exists()
# if there is not then I proceed to create the record in the database
if exist == False:
for key, value in request.POST.items():
if clave != 'csrfmiddlewaretoken':
Answers.objects.create(question=int(clave), answer_to_question=int(valor), student = request.user,teacher = int(user_pk))
#then I change a record in the table of my DB where the finished evaluations are stored, from false to true.
actual_state= State.objects.get(student__name = request.user, teacher = user_pk)
actual_state.finished_evaluation = True
actual_state.save()
return render(request,"myapp\send.html")
else:
return render(request,"myapp\error.html")