diff options
Diffstat (limited to 'djangorestframework/resources.py')
| -rw-r--r-- | djangorestframework/resources.py | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/djangorestframework/resources.py b/djangorestframework/resources.py index 68b285b9..d2651036 100644 --- a/djangorestframework/resources.py +++ b/djangorestframework/resources.py @@ -78,13 +78,22 @@ class FormResource(Resource): This can be overridden by a :attr:`form` attribute on the :class:`views.View`. """ + unknown_form_fields = False + """ + Flag to check for unknown fields when validating a form. If set to false and + we receive request data that is not expected by the form it raises an + :exc:`response.ErrorResponse` with status code 400. If set to true, only + expected fields are validated. + """ + def validate_request(self, data, files=None): """ Given some content as input return some cleaned, validated content. Raises a :exc:`response.ErrorResponse` with status code 400 (Bad Request) on failure. - Validation is standard form validation, with an additional constraint that *no extra unknown fields* may be supplied. + Validation is standard form validation, with an additional constraint that *no extra unknown fields* may be supplied + if :attr:`self.unknown_form_fields` is ``True``. On failure the :exc:`response.ErrorResponse` content is a dict which may contain :obj:`'errors'` and :obj:`'field-errors'` keys. If the :obj:`'errors'` key exists it is a list of strings of non-field errors. @@ -132,7 +141,7 @@ class FormResource(Resource): unknown_fields = unknown_fields - set(('csrfmiddlewaretoken', '_accept', '_method')) # TODO: Ugh. # Check using both regular validation, and our stricter no additional fields rule - if bound_form.is_valid() and not unknown_fields: + if bound_form.is_valid() and (self.unknown_form_fields or not unknown_fields): # Validation succeeded... cleaned_data = bound_form.cleaned_data |