Blog with Django (Codemy.com) - 17 How to restrict who can make blog posts (Java Script)

Problem

When we post, dropdown bar shows available uers, anyone can pick anyone.

Because frontend knows user.id and who logged in, but backend doesn't know it yet.

in order to forms.py to go to the frontend and figure out the user and comeback

solution: use Java Sript

1. forms.py

no more select drowdown bar, change it to testinput and add id in the widgets

forms.py

class PostForm(forms.ModelForm): #inherit forms. ModelForm allows us to create form fields for our Post model.
    class Meta:
        model = Post
        fields = ('title', 'title_tag', 'author', 'category', 'body')

    #add styling: widget dictionary
        widgets = {
            'author': forms.TextInput(attrs={'class': 'form-control', 'placeholder': 'username', 'id': 'cats'} ),}

2. add_post.html

view the source code to identify id

since we added id as 'users_id' in the forms.py, it's now showing it in the html code.

Add JS script down below.
variable 'name'
user.id, user.username, user.first_name, etc

<script>
    var name = "{{ user.id }}";
    document.getElementById("users_id").value
             = name;

</script>

Now it's showing user_id in the form.
we want input box to be value not a placeholder. Leave value as empty as JS will put the value in it.

'author': forms.TextInput(attrs={'class': 'form-control','value': '', 'id': 'users_id'} ),

make the field hidden so user cannot edit their username.

'author': forms.TextInput(attrs={'class': 'form-control','value': '', 'id': 'users_id', 'type':'hidden'} ),

value is empty but JS put id in there. We just can't see it.