Python/Django Class based saving
Question


  But now I'm worried a hacker could do something with the app_name and model_name values.
  
  Can he crash my server when he manipulate these values? (maybe "ajax-injection" or something like this?)


I'm not sure what the best approach to this would be. Perhaps it would be wise to define a list of the values that are acceptable for a user to pass there, though maybe that wouldn't be sufficient.

Other review points


function vote(bool){



The name bool is not very descriptive. Given that it is used as the value for the voted parameter a name like voted would be more appropriate. And if your code complies with ecmascript-6 standards you could simply write
    voted

in the list of parameters as a shorthand for voted: voted



The success handler looks like this:


success: function(data) {
    if (!data.error){
        if (bool){
            $(".half .fa-thumbs-up").removeClass("far").addClass("fas");
            $(".half #count").text(parseInt($(".half #count").text()) + 1);
        } else {
            $(".half .fa-thumbs-down").removeClass("far").addClass("fas");
            $(".half #count").text(parseInt($(".half #count").text()) - 1);
        }



There is quite a bit of redundancy in both cases. Also parseInt() calls should pass a radix1.

if (!data.error){
    const thumbClass = '.fa-thumbs-' + bool ? 'up' : 'down';
    $(".half " + thumbClass).removeClass("far").addClass("fas");
    const toAdd = bool ? 1 : -1;
    $(".half #count").text(parseInt($(".half #count").text(), 10) + toAdd);




In the vote function in ajax/views.py there is this line:


votedFor = True if request.GET.get("voted") == "true" else False



This could be simplified to just:

votedFor = request.GET.get("voted") == "true"


1https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/parseInt#Octal_interpretations_with_no_radix