rduplain/flask-wtf — Issue #20: csrf field trickles into populate_obj
Author: rduplain
Created: 2012-02-29 16:46:52+00:00
State: open
Labels: bug, import

csrf is defined as standard HiddenField, which means that calling form.populate_obj(dbrecord) will insert 'csrf' value into the db record.

csrf should be defined with a class whose populate_obj() method does nothing - such as this

#!python

class InternalField(HiddenField):
def populate_obj(self, obj, name):
pass

---------------------------------------
- Bitbucket: https://bitbucket.org/danjac/flask-wtf/issue/20
- Originally Reported By: [ ](http://bitbucket.org/matejcik)
- Originally Created At: 2011-12-20 15:38:31