django POST [Legitimacy] - django

Lets say I have a web application that displays 2 random buttons on each session, and I want the user to click on 1 button or the other. If a button is clicked, I want to increment the score for that button. However, the user has no control on what 2 buttons are presented each time and there are thousands of possible buttons.
If I create a view to increment the button, how would I be sure that the user wont just manually go to that view through the browser.
My thoughts are that you need to create a form and have users POST to a certain address, but how do you know that the user didn't just send a post request through AJAX to increment the button and that the user actually received that button from the randomized session with 2 buttons.
How would I handle this in Django is there documentation detailing how Django specifically supports this?
EDIT: Or do you have to create a unique session ID for each button selecting session and check each button click against the unique session ID.

Create a session variable to track the button they see, like:
def button_display_view(request):
# ...lots of cool logic
session['buttons_shown'] = [button_1_primary_key, button_2_primary_key]
return response
Then, in your button click view, ensure that the button clicked was in the list of buttons that they were shown. The user will have zero knowledge of your session variable, nor be able to edit it, much like he/she can't when you use session variables to track authentication, etc.
If you're building a multivariate testing system (or even an AB testing system), it might be worth checking out this MVT app for ideas.

Related

Refresh browser after modal dialog

My application calls a modal window from the navigation bar. The modal window has a pop-up LOV where the user selects an organization they wish to view data for. As soon as the change event occurs, the page is submitted, recording the new organization id and organization name into session state. The modal dialog is then closed.
The navigation bar displays the name of the organization that is stored in session state, making it simple for the user to tell which organization they are working with.
Since the modal to change organizations can be accessed from any page in the application, I need to be able to refresh the web browser to pick up the new organization name displayed in the nav bar once the modal has closed.
I've seen several posts online as to how to refresh a region or report once a modal closes, but I've not uncovered how to refresh the browser window, or perhaps alternatively, how to redirect back to the page where the user was when they accessed the modal via the nav bar.
How can this be achieved?
(Nav Bar displaying current context, and link to modal window)
#TineO - I was orginally thinking the same as you suggested, but the implementation wasn't coming together for me.
After further internet mining, I found this blog post which led me to a working solution, below. The bind variable :REFERRING_PAGE is a hidden field, which is populated by the link in the nav bar, using the configuration in the second image below.
You can create dynamic action or process which can work on 'click' action. You may just run 'submit page' or pl/sql or from a huge list of activities as per your need.
Hope this helps.

Stopping multiple view calls generated via frenzied button clicks (Django app)

I'm uploading an image file in a basic Django web app. There's an upload button in the html template wrapped around by a form tag. Once the upload button is pressed, the underlying view takes over and processes image upload.
In the Chrome browser of my colleague's Macbook, pressing upload multiple times really quickly manages to call the underlying function multiples times too. I end up getting a plethora of copies of the image being uploaded.
However, this isn't replicatable in my own environment's Firefox (Ubuntu OS). Seems this issue is browser sensitive?
In any case, how do I cut off this code behavior? If the user goes into a click frenzy, I don't want multiple images to go up. Can someone guide me how to handle this in Django? I would prefer a non-JS, server solution too.
Note: Let me know if you need to see my related code.
Many people faces this issue. If the submit button called 3 times wihtout waiting to refresh the browser, it will gonna add 3 times.To prevent that you can use jQuery.
For example on form submit you can show the loader or disable the submit button,
$('#login_form').submit(function() {
$('#gif').css('visibility', 'visible');
or
$('#button').prop('disabled', true);
});
Edit for server side implementation:
I do not suggest this for user interface point of view but if you can also valid submits using sessions or cookies.Generate random token in your view and set this in your form as hidden input.
for e.g.,
def checkform(request):
form = ExampleForm(request.POST or None)
randomtoken = #generate random token here and set in session or cookie
if form.is_valid():
# check_token here
session_value == request.POST.get('your_hidden_token')
# if matched than change the random token and save your data else do your restriction processing
render ( request,'template.html',context={ 'form':form,'randomstring':randomstring } )

Store Button Click in database Django

I am developing a Django app, I need to track users click for particular button.
Suppose I have 10 buttons and if logged in user clicks btn1, btn2, and btn5
then I want to store this to my database that user clicked these buttons

How to restrict users from going back to the previous page with the browser "back button" (redirect to a different page, instead)?

I am working on a site that would allow users to post some data. To successfully add a new post, the users need to go through three states: Form -> Preview -> Posted page. I want to restrict the users from going back to the Preview page with the browser "back button" once they have already reached the Posted page (instead, they should be redirected to the empty Form page). How can I implement this behaviour in Django?
I am not sure how you get this desired behavior from Django as you have limited control over the user's browser. However, in Javascript you can use:
window.location.replace(url);
which will remove history, thus preventing the back button from working.
See this stack overflow question about window location:
What's the difference between window.location= and window.location.replace()?
An idea: from your preview page, use AJAX to submit and if all is successful, window.location.replace to your posted page.
I can't speak for how to deal with this using browser technologies but with django you could just set a flag in the session.
# posted_page view
request.session['posted_page_visited'] = True
# preview_page view
if request.session.get('posted_page_visited'):
del request.session['posted_page_visited']
return http.HttpResponseRedirect("form_page")
Using js (window.location.replace(url)) doesn't fulfill this requirement because "replace url" will just replace the page with another one,Ex: if form flow goes from page1 to page2 then page3 then page4 and (window.location.replace(url)) is used in page2 (window.location.replace(page4);) then page3 will never be visited!! moreover user will still be able to go back in the same forward path meaning from page4 to page2...etc
the good thing, you can solve it by using Django session as shown below assuming users will be able to go back and forth as long as form not yet saved, and once its saved they can't go back anymore:
in page1/view function where first part of form is issued create session varaible:
in view1.py
def view1(request)
.
.
.
request.session['forward'] = True
return redirect(....)
in view2.py:
def view2(request):
if not request.session['forward']:
return redirect(..Select whatever page you want to redirect users to it..)
the same in rest of pages views..
in the last page/view where after saving the form, reset the variable:
request.session['forward'] = False
return redirect(..Select whatever page you want to redirect users to it..)
hopes its clear enough
django's form wizard should do what you want:
How it works
Here’s the basic workflow for how a user would use a wizard:
The user visits the first page of the wizard, fills in the form and submits it.
The server validates the data. If it’s invalid, the form is displayed again, with error messages. If it’s valid, the server saves
the current state of the wizard in the backend and redirects to the
next step.
Step 1 and 2 repeat, for every subsequent form in the wizard.
Once the user has submitted all the forms and all the data has been validated, the wizard processes the data – saving it to the
database, sending an email, or whatever the application needs to do.

How can I store the number of facebook Likes of a particular url in my own database?

Lets say I am having 5 news articles on my website and 2 registered users. Each news article is having an FB like button. I want to insert the username and article name in my own database whenever the user likes one of the articles. How can this be done?
If it would have been a normal submit button (instead of FB like button) then i would have simply added an onclick event to call a javascript function which in turn sends an ajax request to a php file which inserts the row in the database with the required field.
Can I add an onClick event with FB like button? if not then is there an alternative?
A slightly hack-y way to go about it would be to attach an onclick event handler to the iframe container to trigger an event whenever a user clicks like on page.
I haven't worked with the API that much, but can't you use this: edge.create -- fired when the user likes something (fb:like)? http://developers.facebook.com/docs/reference/javascript/FB.Event.subscribe/