Deleting objects in Django

Question

In a mini blog app, I want to create a delete function, so that the owner of the blog can delete his entries (and only his entries). I guess that the only methods for doing do, is using a form. Though my the deletion code seems clear and correct, it doesn't work. My code:

def delete_new(request,id):    u = New.objects.get(pk=id).delete()    if request.method == 'POST':        form = DeleteNewForm(request.POST)            form.u.delete()                     form.save()       return render_to_response('news/deleteNew.html', {            'form': form,            },          context_instance=RequestContext(request))  

and in the template:

<a href='/news/delete_new/{{object.id}}/'> Delete</a> <br />  

Is this a correct approach? I mean, creating a form for this? also, the only way to take the blog post associated with the deletion link is having an id as a parameter. Is it right? I mean, maybe any user can type another id, in the url, and delete another entry (eventually not one of his)

Answer 1

You need to use a form, or you're vulnerable to CSRF attacks. You're also deleting the model before you've checked whether the request was a GET or a POST.

Create a simple ModelForm:

from django import forms  from .models import New  class DeleteNewForm(forms.ModelForm):     class Meta:         model = New         fields = [] 

In your views.py in the same Django app:

from django.shortcuts import render, get_object_or_404  from .forms import DeleteNewForm from .models import New  def delete_new(request, new_id):     new_to_delete = get_object_or_404(New, id=new_id)     #+some code to check if this object belongs to the logged in user      if request.method == 'POST':         form = DeleteNewForm(request.POST, instance=new_to_delete)          if form.is_valid(): # checks CSRF             new_to_delete.delete()             return HttpResponseRedirect("/") # wherever to go after deleting      else:         form = DeleteNewForm(instance=new_to_delete)      template_vars = {'form': form}     return render(request, 'news/deleteNew.html', template_vars)