Gfrktyl

I'm creating multiple Django apps with vote possibilities, so I made an app vote to handle all this votes. In my templates I'm including an ajax-function named vote. To know on which model I'm liking I add app_name and model_name to the vote function (I made some templatetags to get these values). In my views.py I use model = apps.get_model(app_name, model_name) to get the model class. But now I'm worried a hacker could do something with the app_name and model_name values.

vote/ajax.html (only function):

function vote(bool){

    $.ajax({

        type: "post",

        timeout: 8000,

        url: '{% url 'ajax:vote' %}',

        dataType: 'json',

        data: {

            'csrfmiddlewaretoken': getCookie('csrftoken'),

            'model_name': "{{ model|get_model_name }}",

            'app_name': "{{ model|get_app_name }}",

            'voted': bool,

            'id': "{{ model.id }}",

        },

        success: function(data) {

            if (!data.error){

                if (bool){

                    $(".half .fa-thumbs-up").removeClass("far").addClass("fas");

                    $(".half #count").text(parseInt($(".half #count").text()) + 1);

                } else {

                    $(".half .fa-thumbs-down").removeClass("far").addClass("fas");

                    $(".half #count").text(parseInt($(".half #count").text()) - 1);

                }

            }

        }

    });

}

ajax/views.py:

def vote(request):
try:
app_name = request.POST.get("app_name")
model_name = request.POST.get("model_name")
id = request.POST.get("id")
votedFor = True if request.POST.get("voted") == "true" else False
except ValueError:
return JsonResponse({"error": True})

model = apps.get_model(app_name, model_name)



if model is None or id is None:

    return JsonResponse({"error": True})



try:

    usable_model = model.objects.get(id=id)

except model.DoesNotExist:

    return JsonResponse({"error": True})



try:

    usable_model.vote._meta.get_field("votes")

except FieldDoesNotExist:

    return JsonResponse({"error": True})





usable_model.vote.vote(request, votedFor)

return JsonResponse({"error": False})

vote/functions:

    def vote(self, request, votedFor):

    if request.user.is_authenticated:

        if not UserVoted.objects.filter(User=request.user, Vote=self).exists():

            UserVoted.objects.create(User=request.user, Vote=self, votedFor=votedFor)

            self._like_or_dislike(votedFor)

            return True

        return False

    ip = get_client_ip(request)

    if ip:

        if not UserVoted.objects.filter(ip=ip, Vote=self).exists():

            UserVoted.objects.create(ip=ip, Vote=self, votedFor=votedFor)

            self._like_or_dislike(votedFor)

            return True

        return False

    return False



def _like_or_dislike(self, votedFor):

    if votedFor is not None:

        Vote.objects.filter(id=self.id).update(votes=F('votes') + 1) if votedFor else Vote.objects.filter(id=self.id).update(votes=F('votes') - 1)

        return True

    return False

I already manipulated app_name and model_name and the server didn't crash but I don't know what a hacker can do. Can he crash my server when he manipulate these values? (maybe "ajax-injection" or something like this?)