Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Doesn't work with jQuery 3 #197

Closed
6 tasks
nealscut opened this issue Apr 9, 2017 · 28 comments
Closed
6 tasks

Doesn't work with jQuery 3 #197

nealscut opened this issue Apr 9, 2017 · 28 comments

Comments

@nealscut
Copy link

nealscut commented Apr 9, 2017

All versions of django-smart-selects prior to version 1.2.8 are vulnerable to an XSS attack as detailed in issue 171. As a result, all previous versions have been removed from PyPI to prevent users from installing insecure versions. All users are urged to upgrade as soon as possible.

Checklist

  • This issue is not about installing previous versions of django-smart-selects older than 1.2.8. I understand that previous versions are insecure.
  • I have verified that that issue exists against the master branch of django-smart-selects.
  • I have searched for similar issues in both open and closed tickets and cannot find a duplicate.
  • I have debugged the issue to the smart_selects app.
  • I have reduced the issue to the simplest possible case.
  • I have included all relevant sections of models.py, forms.py, and views.py with problems.

Steps to reproduce

Expected behavior

Actual behavior

@nealscut
Copy link
Author

nealscut commented Apr 9, 2017

my ChainedManyToManyField get no selects, i don't know why, and how to fix it.....

#my models.py

from django.db import models
from smart_selects.db_fields import ChainedManyToManyField

class size(models.Model):
	size_name = models.CharField(max_length=255)
	def __str__(self):
		return self.size_name

class quality(models.Model):
	quality_name = models.CharField(max_length=255)
	quality_size = models.ManyToManyField(size)
	def __str__(self):
		return self.quality_name

class PL(models.Model):
	PL_name = models.CharField(max_length=255)
	PL_quality = models.ForeignKey(quality,related_name='q1')
	PL_size = ChainedManyToManyField(
		quality,
		horizontal=True,
		chained_field='PL_quality',
		chained_model_field='quality_size',
	)

#my forms.py

from django import forms
from django.forms import ModelForm
from .models import quality,PL

class PL_form(ModelForm):
    class Meta:
        model = quality
        fields = "__all__"  # ('quality','size')

class PL_form2(ModelForm):
    class Meta:
        model = PL
        fields = "__all__"

#my views.py

from django.shortcuts import render
from aa.forms import PL_form,PL_form2
from django.views.decorators.csrf import csrf_exempt

@csrf_exempt
def home(request):
    form = PL_form()
    form2 = PL_form2
    return render(request,'home.html',{'form':form,'form2':form2})

#my home.html

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
    <script src="/static/jquery-3.2.0.js"></script>
    <script src="/static/chainedfk.js"></script>
    <script src="/static/chainedm2m.js"></script>
    <script>$(document).ready(function () {
        $("#ibutton").click(function () {
             $.post('/',{a:1},function () {
                 alert($("#id_size").val())
             })
        })
    })
    </script>
</head>
<body>
    {{ csrf_token }}
    {{ form }}
    <button id="ibutton">确认</button>
    {{ form2 }}
</body>
</html>

#my web get:

<label for="id_PL_size">PL size:</label>
<select id="id_PL_size" class="chained selectfilter" multiple="multiple" data-field-name="PL size" name="PL_size" required=""> </select>
<script type="text/javascript">

        (function($) {

        var chainfield = "#id_PL_quality";
        var url = "/chaining/filter/aa/quality/quality_size/aa/PL/PL_size";
        var id = "#id_PL_size";
        var value = "";
        var auto_choose = false;
        // Use $(window).load to call function after SelectBox and SelectFilter2
        $(window).load(function() {
            chainedm2m.init(chainfield, url, id, value, auto_choose);
        });
        })(jQuery || django.jQuery);
        
</script>

Edit (by Blag): Formatted code blocks with GFM.

@blag
Copy link
Collaborator

blag commented Apr 9, 2017

Please format your code with GitHub Flavored Markdown by using fenced blocks:

```python
def this_python_function():
    # Get rendered properly
    return awesome
```

gets rendered as:

def this_python_function():
    # Get rendered properly
    return awesome

@blag
Copy link
Collaborator

blag commented Apr 9, 2017

You seem to be trying to render the PL_form2 class:

def home(request):
    form = PL_form()
    form2 = PL_form2  # <-- HERE
    return render(request,'home.html',{'form':form,'form2':form2})

when you should be trying to render the constructed form object:

def home(request):
    form = PL_form()
    form2 = PL_form2()  # <-- Note the () at the end
    return render(request,'home.html',{'form':form,'form2':form2})

See if that fixes it.

@nealscut
Copy link
Author

sorry,i am first time to use git, thanks your help!!!

@blag
Copy link
Collaborator

blag commented Apr 10, 2017

No worries! 😄

Did my suggestion fix your issue?

@nealscut
Copy link
Author

nealscut commented Apr 10, 2017

Foreignkey is works,but ManyToManyField is not work...it's the js cause this question?

<tr><th><label for="id_PL_name">PL name:</label></th><td><input id="id_PL_name" maxlength="255" name="PL_name" type="text" required /></td></tr>
<tr><th><label for="id_PL_quality">PL quality:</label></th><td><select id="id_PL_quality" name="PL_quality" required>
<option value="" selected="selected">---------</option>
<option value="1">pvc</option>
</select></td></tr>
<tr><th><label for="id_PL_size">PL size:</label></th><td><select multiple="multiple" class="chained selectfilter" data-field-name="PL size" id="id_PL_size" name="PL_size" required>
</select>
        <script type="text/javascript">
        (function($) {

        var chainfield = "#id_PL_quality";
        var url = "/chaining/filter/apppppp/quality/quality_size/apppppp/PL/PL_size";
        var id = "#id_PL_size";
        var value = "";
        var auto_choose = false;
        // Use $(window).load to call function after SelectBox and SelectFilter2
        $(window).load(function() {
            chainedm2m.init(chainfield, url, id, value, auto_choose);
        });
        })(jQuery || django.jQuery);
        </script>

        </td></tr>

@blag
Copy link
Collaborator

blag commented Apr 10, 2017

What is actually happening? What do you expect to happen?

Are you loading jQuery twice on the page? Are there any errors in your browser console?

@nealscut
Copy link
Author

1、when i access /chaining/filter/apppppp/quality/quality_size/apppppp/PL/PL_size, it show didn't match any of these.
2、1)'pvc' has tow size 'dn20','dn25'.2)'ppr' has tow size 'dn32','dn40'.
3、i want that when i select 'pvc', it show tow selects 'dn20','dn25')...when i select 'ppr',it show tow selects 'dn32','dn40'.

@nealscut
Copy link
Author

here is my html

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
    <script src="/static/jquery-3.2.0.js"></script>
    <script src="/static/chainedfk.js"></script>
    <script src="/static/chainedm2m.js"></script>
    <script>$(document).ready(function () {
        $("#ibutton").click(function () {
             $.post('/',{a:1},function () {
                 alert($("#id_size").val())
             })
        })
    })
    </script>
</head>
<body>
    {{ csrf_token }}
    {{ form }}
    <button id="ibutton">确认</button>
    {{ form2 }}
</body>
</html>

@blag
Copy link
Collaborator

blag commented Apr 10, 2017

  1. Are there any errors in your browser console?
  2. What does the AJAX request look like?
  3. What does the AJAX response look like?

@nealscut
Copy link
Author

ohhhh, you remind me.
it's not requset and response!!!
but why ? where is wrong?

@blag
Copy link
Collaborator

blag commented Apr 10, 2017

Are there any errors in your browser console?

@nealscut
Copy link
Author

no errors in my browser console!
but when i select 'pvc' ,my server get nothing, nothing requset or response!!,it should requset or response something!

@nealscut
Copy link
Author

i think that models.py or ChaineManyToManyField something is wrong?

@nealscut
Copy link
Author

from django.db import models
from smart_selects.db_fields import ChainedManyToManyField

class size(models.Model):
	size_name = models.CharField(max_length=255)
	def __str__(self):
		return self.size_name

class quality(models.Model):
	quality_name = models.CharField(max_length=255)
	quality_size = models.ManyToManyField(size)
	def __str__(self):
		return self.quality_name

class PL(models.Model):
	PL_name = models.CharField(max_length=255)
	PL_quality = models.ForeignKey(quality,related_name='q1')
	PL_size = ChainedManyToManyField(
		quality,
		horizontal=True,
		chained_field='PL_quality',
		chained_model_field='quality_size',
	)

@blag
Copy link
Collaborator

blag commented Apr 10, 2017

Try taking jQuery and the second form out of your template:

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
    {# <script src="/static/jquery-3.2.0.js"></script> #}
    <script src="/static/chainedfk.js"></script>
    <script src="/static/chainedm2m.js"></script>
    <script>$(document).ready(function () {
        $("#ibutton").click(function () {
             $.post('/',{a:1},function () {
                 alert($("#id_size").val())
             })
        })
    })
    </script>
</head>
<body>
    {{ csrf_token }}
    {{ form }}
    <button id="ibutton">确认</button>
    {# And comment out this #}
    {# {{ form2 }} #}
</body>
</html>

django-smart-selects may load its own jQuery (depending on your settings), and including two forms may overwrite that.

@nealscut
Copy link
Author

i change my html.
but i selsct 'pvc', my server still only show :[10/Apr/2017 21:01:03] "GET / HTTP/1.1" 200 1689.
i use django=1.10.6、pycharm、win7

@nealscut
Copy link
Author

chainedfk.js and chainedm2m.js can GET.
[10/Apr/2017 21:05:44] "GET / HTTP/1.1" 200 1689
[10/Apr/2017 21:05:44] "GET /static/chainedfk.js HTTP/1.1" 304 0
[10/Apr/2017 21:05:44] "GET /static/chainedm2m.js HTTP/1.1" 304 0

@nealscut
Copy link
Author

oh i get something !!

ReferenceError: jQuery is not defined
chainedm2m.js (line 150, col 1)
ReferenceError: $ is not defined
127.0.0.1:8002 (line 9, col 1)
ReferenceError: jQuery is not defined
127.0.0.1:8002 (line 39, co

@blag
Copy link
Collaborator

blag commented Apr 10, 2017

Working with jQuery is a little weird because that error can be caused if jQuery is never loaded, or if it is loaded multiple times. View the generated HTML and verify that jQuery is being loaded exactly once, and tweak your settings until that happens. Once you do that, then check your browser console for errors, check the AJAX request and response, etc.

@nealscut
Copy link
Author

thanks , i cheak it.

@nealscut
Copy link
Author

i know why ,something is wrong in the jquery-3.2.0.js .
when i use <script src="http://libs.baidu.com/jquery/2.0.0/jquery.min.js"></script>, i get it work.

@blag
Copy link
Collaborator

blag commented Apr 10, 2017

Oh, django-smart-selects may not be compatible with jQuery 3+. You're the first user to be using jQuery 3, so if you fix the issue and create a pull request for me I'll merge it in.

@nealscut
Copy link
Author

i want to fix issue ,but i am new bird. i am not sure i can fix it. 😢

@blag
Copy link
Collaborator

blag commented Apr 10, 2017

No worries, either somebody else will fix it or you can learn.

I'll keep this issue open until it's fixed.

@blag
Copy link
Collaborator

blag commented Apr 10, 2017

Until it's fixed, can you use jQuery 2?

@nealscut
Copy link
Author

ok!!!,i just start to learn django,jquery2 or 3 is same for me,thanks your help!!

@blag blag changed the title my ChainedManyToManyField not work, i don't know why!!! Doesn't work with jQuery 3 Apr 20, 2017
@manelclos
Copy link
Member

This seems to be fixed. Please reopen if necessary.

# for free to join this conversation on GitHub. Already have an account? # to comment
Projects
None yet
Development

No branches or pull requests

3 participants