Flask-WTF源码学习

Goals:

• 学习使用WTForms.
• 学习使用Flask-WTF
• 学习使用如何写Flask插件.
• 学习什么是CSRF(待完成).
• 学习flask中的redirect.

Part1 WTForms --- A Quick Start.

---

Let's begin from A mini example.

# flask_wtf_demo.py
from flask import Flask, render_template
from flask_wtf import Form
from wtforms import StringField, SubmitField
from wtforms.validators import DataRequired

app = Flask(__name__)
app.config['SECRET_KEY'] = "salt river"

class MyForm(Form):
    name = StringField("what's your name", validators=[DataRequired()])
    submit = SubmitField('Submit')

@app.route('/index', methods=('GET', 'POST'))
def submit():
    name = None
    form = MyForm()
    if form.validate_on_submit():
        name = form.name.data 
        form.name.data = ''
    return render_template('index.html', form=form, name=name)

if __name__ == '__main__':
    app.run(debug=True)

    


    

        {{ form.hidden_tag() }}
        {{ form.name.label }} {{ form.name() }}
        {{ form.submit() }}
    

    {% if not name %}
    
Hello, Stranger.
    {% else %}
    
Hello, {{name}}
    {% endif %}

Part2 Flask-WTF

---

下面我们一起来追踪一下程序执行流程，重点关注，flask.request, session, current_app中的信息是怎么与插件交互的. 当我们执行完这段代码时候（此时request还没有到来）:

class MyForm(Form):
    name = StringField("what's your name", validators=[DataRequired()])
    submit = SubmitField('Submit')

实际上MyForm的metaclass（wtforms中的FormMeta类）已经在定义类的时候干了很多事情了.具体干了哪些事呢？我们暂时只关注结果就行了. 查看MyForm.name, 和MyForm.submit中的内容.

• MyForm.name ---> ]})>
• MyForm.submit --->
  从字面意思来理解就是未被绑定的Field.因为还没有与具体的request/app中的Form进行绑定.当我们直接初始化form = MyForm()时， 会出现 "RuntimeError: working outside of application context."原因在于，在flask_wtf.Form中的init函数中:

        if csrf_enabled is None:
            csrf_enabled = current_app.config.get('WTF_CSRF_ENABLED', True)

current_app并没有push到Request_Context中.
下面我们在命令行中做下面的实验:

$python -i flask_wtf_demo.py
>>>#模拟"GET"方法.
>>>ctx=app.test_request_context('127.0.0.1:5000/index')
>>>form = MyForm()
>>>form.name.data  # None
>>>form.validate()
False
>>>form.errors
...
>>>form.name.label()
u'what\'s your name'
>>>form.name()
u''
>>>ctx.pop()

对应到flask_wtf源码中就是Form.init中:

        if formdata is _Auto:
            if self.is_submitted():
                ...
            else:
                formdata = None # <------

因为为"GET"方法所以formdata为None.
另一个实验,在命令行中测试"POST"方法:

>>>ctx = app.test_request_context('127.0.0.1:5000/index', method='POST', data={'name': 'saltriver'})
>>>ctx.push()
>>>form=MyForm(csrf_enabled=False)
>>>form.validate()
True
>>>form.validate_on_submit()
True

于是我们便可以对form进行处理了.

Part 3 Redirect重定向.

---

@app.route('/', methods=('GET', 'POST'))
def submit():
    name = None
    form = MyForm()
    if form.validate_on_submit():
        session['name'] = form.name.data
        return redirect(url_for('submit'))
    return render_template('index.html', form=form, name=session.get('name'))

下面看看redirect的实现.