FormAlchemy / formalchemy

MIT License
81 stars 29 forks source link

Do not overwrite read-only values! #51

Closed smurfix closed 10 years ago

smurfix commented 10 years ago

This may be a security hole, but the more immediate effect of this problem is that it's not possible to have a fieldset which selectively displays some fields as read-only -- on submission, the missing values will be erased from the model. Ouch.