csrf and honeypots
[wolnelektury.git] / apps / ajaxable / utils.py
1 from functools import wraps
2
3 from django.http import (HttpResponse, HttpResponseRedirect,
4         HttpResponseForbidden)
5 from django.shortcuts import render_to_response
6 from django.template import RequestContext
7 from django.utils.encoding import force_unicode
8 from django.utils.functional import Promise
9 from django.utils.http import urlquote_plus
10 from django.utils import simplejson
11 from django.utils.translation import ugettext_lazy as _
12 from django.views.decorators.vary import vary_on_headers
13 from honeypot.decorators import verify_honeypot_value
14
15
16 class LazyEncoder(simplejson.JSONEncoder):
17     def default(self, obj):
18         if isinstance(obj, Promise):
19             return force_unicode(obj)
20         return obj
21
22 # shortcut for JSON reponses
23 class JSONResponse(HttpResponse):
24     def __init__(self, data={}, callback=None, **kwargs):
25         # get rid of mimetype
26         kwargs.pop('mimetype', None)
27         data = simplejson.dumps(data)
28         if callback:
29             data = callback + "(" + data + ");" 
30         super(JSONResponse, self).__init__(data, mimetype="application/json", **kwargs)
31
32
33 def method_decorator(function_decorator):
34     """Converts a function decorator to a method decorator.
35
36     It just makes it ignore first argument.
37     """
38     def decorator(method):
39         @wraps(method)
40         def wrapped_method(self, *args, **kwargs):
41             def function(*fargs, **fkwargs):
42                 return method(self, *fargs, **fkwargs)
43             return function_decorator(function)(*args, **kwargs)
44         return wrapped_method
45     return decorator
46
47
48 def require_login(request):
49     """Return 403 if request is AJAX. Redirect to login page if not."""
50     if request.is_ajax():
51         return HttpResponseForbidden('Not logged in')
52     else:
53         return HttpResponseRedirect('/uzytkownicy/zaloguj')# next?=request.build_full_path())
54
55
56 def placeholdized(form):
57     for field in form.fields.values():
58         field.widget.attrs['placeholder'] = field.label
59     return form
60
61
62 class AjaxableFormView(object):
63     """Subclass this to create an ajaxable view for any form.
64
65     In the subclass, provide at least form_class.
66
67     """
68     form_class = None
69     placeholdize = False
70     # override to customize form look
71     template = "ajaxable/form.html"
72     submit = _('Send')
73     
74     title = ''
75     success_message = ''
76     POST_login = False
77     formname = "form"
78     form_prefix = None
79     full_template = "ajaxable/form_on_page.html"
80     honeypot = False
81
82     @method_decorator(vary_on_headers('X-Requested-With'))
83     def __call__(self, request, *args, **kwargs):
84         """A view displaying a form, or JSON if request is AJAX."""
85         obj = self.get_object(request, *args, **kwargs)
86         form_args, form_kwargs = self.form_args(request, obj)
87         if self.form_prefix:
88             form_kwargs['prefix'] = self.form_prefix
89
90         if request.method == "POST":
91             if self.honeypot:
92                 response = verify_honeypot_value(request, None)
93                 if response:
94                     return response
95
96             # do I need to be logged in?
97             if self.POST_login and not request.user.is_authenticated():
98                 return require_login(request)
99
100             form_kwargs['data'] = request.POST
101             form = self.form_class(*form_args, **form_kwargs)
102             if form.is_valid():
103                 add_args = self.success(form, request)
104                 redirect = request.GET.get('next')
105                 if not request.is_ajax() and redirect:
106                     return HttpResponseRedirect(urlquote_plus(
107                             redirect, safe='/?=&'))
108                 response_data = {'success': True, 
109                     'message': self.success_message, 'redirect': redirect}
110                 if add_args:
111                     response_data.update(add_args)
112             elif request.is_ajax():
113                 # Form was sent with errors. Send them back.
114                 if self.form_prefix:
115                     errors = {}
116                     for key, value in form.errors.items():
117                         errors["%s-%s" % (self.form_prefix, key)] = value
118                 else:
119                     errors = form.errors
120                 response_data = {'success': False, 'errors': errors}
121             else:
122                 response_data = None
123             if request.is_ajax():
124                 return HttpResponse(LazyEncoder(ensure_ascii=False).encode(response_data))
125         else:
126             if (self.POST_login and not request.user.is_authenticated()
127                     and not request.is_ajax()):
128                 return require_login(request)
129
130             form = self.form_class(*form_args, **form_kwargs)
131             response_data = None
132
133         title = self.title
134         if request.is_ajax():
135             template = self.template
136         else:
137             template = self.full_template
138             cd = self.context_description(request, obj)
139             if cd:
140                 title += ": " + cd
141         if self.placeholdize:
142             form = placeholdized(form)
143         context = {
144                 self.formname: form, 
145                 "title": title,
146                 "honeypot": self.honeypot,
147                 "placeholdize": self.placeholdize,
148                 "submit": self.submit,
149                 "response_data": response_data,
150                 "ajax_template": self.template,
151                 "view_args": args,
152                 "view_kwargs": kwargs,
153             }
154         context.update(self.extra_context(request, obj))
155         return render_to_response(template, context,
156             context_instance=RequestContext(request))
157
158     def redirect_or_refresh(self, request, path, message=None):
159         """If the form is AJAX, refresh the page. If not, go to `path`.""" 
160         if request.is_ajax():
161             output = "<script>window.location.reload()</script>"
162             if message:
163                 output = "<div class='normal-text'>" + message + "</div>" + output
164             return HttpResponse(output);
165         else:
166             return HttpResponseRedirect(path)
167
168     def get_object(self, request, *args, **kwargs):
169         """Override to parse view args and get some associated data."""
170         return None
171
172     def form_args(self, request, obj):
173         """Override to parse view args and give additional args to the form."""
174         return (), {}
175
176     def extra_context(self, request, obj):
177         """Override to pass something to template."""
178         return {}
179
180     def context_description(self, request, obj):
181         """Description to appear in standalone form, but not in AJAX form."""
182         return ""
183
184     def success(self, form, request):
185         """What to do when the form is valid.
186         
187         By default, just save the form.
188
189         """
190         return form.save(request)