diff --git a/days/069-072-django-rest/demo/api/serializers.py b/days/069-072-django-rest/demo/api/serializers.py index 7d811729..baebb6d0 100644 --- a/days/069-072-django-rest/demo/api/serializers.py +++ b/days/069-072-django-rest/demo/api/serializers.py @@ -5,6 +5,13 @@ class QuoteSerializer(serializers.ModelSerializer): + # This is not included in the videos. Without this setting, it was possible + # to set the user value to something other than the currently logged-in + # user. This setting hides the user field from the form in the API frontend + # and sets the currently logged-in users as the field value by default. + # See also: https://stackoverflow.com/a/53193276 + user = serializers.HiddenField(default=serializers.CurrentUserDefault()) + class Meta: model = Quote fields = ('quote', 'author', 'source', 'cover', 'user') diff --git a/days/069-072-django-rest/demo/mysite/templates/django_registration/registration_form.html b/days/069-072-django-rest/demo/mysite/templates/django_registration/registration_form.html index 5df14191..0425b7aa 100644 --- a/days/069-072-django-rest/demo/mysite/templates/django_registration/registration_form.html +++ b/days/069-072-django-rest/demo/mysite/templates/django_registration/registration_form.html @@ -14,19 +14,40 @@