Skip to content

Conversation

@laundmo
Copy link
Contributor

@laundmo laundmo commented Aug 11, 2025

I would like to write forms which act on a subset of fields like this:

return Form([
	db.tbl.field1,
	db.tbl.field2
])

but currently, this disabled dbio due to a if isinstance(table, list) check.

But if all fields have the same table, dbio is perfectly safe.

Also, to allow more complex logic including potentially multiple forms on a single page (haven't tested this tho), this makes form processing its own method, analogous to Grid


if not readonly and auto_process:
self.process()
if self.csrf_protection:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this now always run after process() even if auto_process is False?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oh, you're right

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wait, no, I was right originally.

The original code looks like this:

if not readonly:
    # [...]
    if post_vars:
        self.submitted = True
        if not self.csrf_protection or self._verify_form(post_vars):
            process = True
    if process:
        # [...]
if self.csrf_protection:
    self._sign_form()

We both probably got turned around by the if not self.csrf_protection - thats been moved into the new process method and rewritten to an early return ((not A) or B inverted to A and (not B))

So this is actually matching the original logic exactly. If CSRF is enabled, the form is always signed. What i can't say if that original logic was correct.


if not readonly and auto_process:
self.process()
if self.csrf_protection:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this now always run after process() even if auto_process is False?

@mdipierro mdipierro merged commit 025c34c into web2py:master Aug 19, 2025
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants