HeavySelect2Widget confusion regarding choices arg

[tisdall]

Sorry if I'm missing something simple, but after a few hours of staring at this I feel like I really need to ask...

The docs show an example like this:

class MyForm(forms.Form):
    my_field = forms.ChoicesField(
        widget=HeavySelect2Widget(
            data_url='/url/to/json/response'
        )
    )

What I don't understand is that ChoiceField requires a choices arg but none is passed. When the form is submitted the ChoiceField checks for the value in choices but since no values are passed it always invalidates as there are no values.

[codingjoe]

Yes you are right, the documentation is wrong. There should be choices. I'd appreciate a pull request.

Thanks!

[tisdall]

It seems that you used to have a HeavyChoiceField that properly handled values coming in that weren't already in choices, but then it was removed. I'm really confused at how any of this works without that Field... It seems like you have to populate choices with all possible values and then you're back to having the same functionality as the "light" versions.

[codingjoe]

To be honest, I never used the HeavyChoiceField. It is only a base really for your own work. I never uses the new widget ether, so I don't have any great examples I can share. If you do, feel free to extend the documentation.

[tisdall]

Well, this isn't anything that can be merged, but this is what I ended up using and it may help someone. It contains references to a specific model so it'd need to be modified so that model was passed in somehow (I wasn't sure how to access the field's queryset from the widget). The ModelMultipleChoiceField properly validates the choices by doing a DB query and ensuring they're legit values.

class TagWidget(HeavySelect2MultipleWidget):
    data_view = 'rpc_tags'  # json view to fetch options from

    def render(self, *args, **kwargs):
        # replace `choices` as we only want selected options to be in the list
        values = args[1]
        tag_dikt = {force_text(tag.pk): tag.name for tag in Tag.objects.filter(pk__in=values)}
        kwargs['choices'] = [(force_text(k), tag_dikt[force_text(k)]) for k in values]
        return super(TagWidget, self).render(*args, **kwargs)

    def set_to_cache(self):
        pass  # we don't need to cache this (that's only used by the django-select2 auto json view)


class TagField(forms.ModelMultipleChoiceField):
    widget = TagWidget
    _choices = tuple()  # stop call to queryset to get all; widget will fetch needed values
    queryset = Tag.objects

    # use queryset from class definition instead of passed in value
    def __init__(self, cache_choices=False, required=False,
                 widget=None, label=None, initial=None,
                 help_text='', *args, **kwargs):
        super(forms.ModelMultipleChoiceField, self).__init__(self.queryset, None,
            cache_choices, required, widget, label, initial, help_text,
            *args, **kwargs)

[cdw9]

@tisdall I'm trying to use your code here, how are you using the field within the form? Is it just tags = TagField() ?

And then what does the json return, a list of tuples?

[tisdall]

@cdw9 - I have this in my code for a ModelForm:

    tags = TagField(
        widget=TagWidget(
            attrs={
                'data-minimum-input-length': 1,  # defaults to 0
            }
        )
    )

You could just do tags = TagField() but in my cause I wanted to modify the settings passed to the widget.

[lorenzomorandini]

Still no solution for this issue? The widget is unusable right now.

[tsepelev]

Also waiting for a solution to this issue. Maybe someone managed to solve it differently?

[tisdall]

@cdw9 - I just realized I didn't answer your question about the json response... It's probably too late, but here's what it is:

    return JsonResponse({
        'results': [
            {
                'text': i.name,
                'id': i.pk,
            }
            for i in qs
        ]
    })

qs is the queryset of the objects being returned

The format is specified with the select2 documentation.

[mattaw]

Ah, here is a pretty brain teaser, and the choices field is the wrong choice here in the documentation IMHO.

Form classes do two things:

1. Create HTML to render the form (delegated to a widget)
2. Do csrf and basic validation / escaping on responses

So a ChoicesField validates the response is one from a provided list and draws a dropdown for us to choose from.

However using HeavySelect2Widget we don't care about 1. as the HeavySelectWidget renders the correct HTML/CSS/JScript for an AJAX dropdown for us. Validating the choice is correct from an a-priori definitive list is actually an antipattern here. We are trying to avoid hitting the database and generating the definitive list of all choices in the first place to avoid performance problems, but we should do it to get the correct list choices?!

I propose CharField or IntegerField, (based on whether your JSON ID is an int or str) as it will perform csrf and escaping which is what we want. The HeavySelect2Widget takes care of creating the HTML/CSS/JScript for select so it renders correctly.

Here is my thinking on any safety/security implications:

1. I generated the JSON to feed the select2 box anyway via my custom JSON view, so hopefully that can't be wrong.
2. I validate the form so I know for sure it is an int or an escaped string, and the csrf token is checked.

[tisdall]

@mattaw - If I remember correctly (and I haven't looked at this or a while), the field confirms that the values exist in the queryset. It's very possible for a value to be returned by the ajax call that is deleted before the form is submitted. It's also very possible for a form to be manually modified.

[rmControls]

Is anyone found solutions for this....?? I have a similar requirement and above solutions didn't worked for me...