Django validate answer for specific question - django

Question

Overview:
I want to build a Question-Answer website, where the user has to enter the correct answer for each question. I have made 3 models for this:
class ProblemSet(models.Model):
id = models.IntegerField(primary_key=True)
class Problem(models.Model):
id = models.IntegerField(primary_key=True)
problem_set = models.ForeignKey(ProblemSet, on_delete=models.CASCADE)
question = models.TextField()
solution = models.TextField()
class Solve(models.Model):
username = models.ForeignKey(User, on_delete=models.CASCADE)
problem_set = models.ForeignKey(ProblemSet, on_delete=models.CASCADE)
problem_id = models.ForeignKey(Problem, on_delete= models.CASCADE)
In solve model, if there is any entry that means that particular user has solved that problem_id.
So, I have utilized the generic Form View:
class IndexView(FormView):
form_class = ProblemForm
template_name = 'home/index.html'
success_url = reverse_lazy('index')
def get_context_data(self, **kwargs):
context = super(IndexView, self).get_context_data(**kwargs)
if self.request.user.is_authenticated:
inner_qs = "fetch ids that are solved from Solve model"
problem_obj = Problem.objects\
.exclude(id__in=inner_qs)\
.order_by('id').first()
else:
#do something
context['question'] = problem_obj.question
return context
The problem form is:
from django import forms
class ProblemForm(forms.Form):
solution = forms.CharField(widget=forms.TextInput())
How do I validate that the user is inputting the correct answer? I do get the value of solution field in def form_valid(self, form) function but how should I deal with it? Should i pass question_id in context and query the database in form_valid, or should i pass solution itself to context and access context data in form_valid() method to prevent double query but in this method I am not sure if this is secure as I don't want solution to be passed to client.
Is there any elegant way of doing this?
P.S. After user entered solution is compared to the one in database for that question, I add an entry in the Solve table denoting that this particular user has solved the question id.

Answer 1

The FormView is processing two separate requests: First the GET request when the student fetches the form with a question to answer. Then the POST request when the student submits her answer to the question.
Now HTTP is stateless so somehow you need to keep track of the question that was presented in the first request so you know which question was answered when receiving the POST request.
The easiest way I would say is to actually include the question_id in the form itself, as a hidden input field. There's not real security issue here: The question_id can be manipulated by the student even though it's hidden, but what's the point?
So this is what I would do:
Add problem as a ModelChoiceField with a HiddenInput widget to your ProblemForm.
problem = forms.ModelChoiceField(queryset=Problem.objects.all(), widget=forms.HiddenInput())
Set an initial value for the problem in the get_inital() method of your IndexView:
def get_problem(self): # use also in get_context_data() to add the question
if hasattr(self, 'problem'):
return self.problem
if self.request.user.is_authenticated:
inner_qs = "fetch ids that are solved from Solve model"
self.problem = Problem.objects\
.exclude(id__in=inner_qs)\
.order_by('id').first()
return self.problem
def get_initial(self):
initial = super().get_initial()
initial['problem'] = self.get_problem()}
return initial
When the form gets submitted and is valid, you'll see that form.cleaned_data['problem'] is the submitted problem. So you can use that in the form_valid() method:
def form_valid(self, form):
problem = form.cleaned_data['problem']
# check that it hasn't been solved by the user already
if problem.answer == form.cleaned_data['solution']:
# create solve object for the user
return redirect(...)
The alternative would be to not include it in the form but refetch the problem in form_valid (note that the problem is fetched in the above method as well, when the form maps the submitted problem_id to the actual problem instance to populate its cleaned_data).