Internals Django’s security policies Reporting security issuesReporting guidelines

… sanitized: Developers must always validate and sanitize input before using it. The correct approach would be to use a Django form to ensure email is properly validated: Similarly, as Django’s raw SQL constructs (such as extra(), RawSQL, and keyword arguments …

Tutorial Writing your first Django app, part 2 Introducing the Django Admin

There’s the “What’s up?” question we created earlier: Click the “What’s up?” question to edit it: Things to note here: The form is automatically generated from the Question model.

Tutorial Writing your first Django app, part 3

Question “detail” page – displays a question text, with no results but with a form to vote. Question “results” page – displays results for a particular question. Vote action – handles voting for a particular choice in a particular question.

Tutorial Writing your first Django app, part 7

The “Add choice” form looks like this: In that form, the “Question” field is a select box containing every question in the database. Django knows that a ForeignKey should be represented in the admin as a <select> box.

Reference Applications

app_name is the full name of the app, e.g. 'django.contrib.admin'. apps.get_model(app_label,model_name,require_ready=True) : Returns the Model with the given app_label and model_name. As a shortcut, this method also accepts a single argument in the form app_label.model_name. model_name is case-insensitive.

Reference Class-based generic views - flattened index Editing views

classCreateView Attributes (with optional accessor): content_type context_object_name [get_context_object_name()] extra_context fields form_class [get_form_class()] http_method_names initial [get_initial()] model pk_url_kwarg prefix [get_prefix()] query_pk_and_slug queryset [get_queryset()] response_class [render_to_response()] slug_field [get_slug_field()] slug_url_kwarg success_url [get_success_url()] template_engine template_name [get_template_names()] template_name_field template_name_suffix Methods as_view() dispatch() form_invalid() form_valid() get() …

Reference Class-based generic views - flattened index Editing views

classUpdateView Attributes (with optional accessor): content_type context_object_name [get_context_object_name()] extra_context fields form_class [get_form_class()] http_method_names initial [get_initial()] model pk_url_kwarg prefix [get_prefix()] query_pk_and_slug queryset [get_queryset()] response_class [render_to_response()] slug_field [get_slug_field()] slug_url_kwarg success_url [get_success_url()] template_engine template_name [get_template_names()] template_name_field template_name_suffix Methods as_view() dispatch() form_invalid() form_valid() get() …

Reference

The following views are described on this page and provide a foundation for editing content: django.views.generic.edit.FormView django.views.generic.edit.CreateView django.views.generic.edit.UpdateView django.views.generic.edit.DeleteView NOTE: The messages framework contains > SuccessMessageMixin, which > facilitates presenting messages about successful form submissions.

Reference Generic editing views

If this view is fetched via GET, it will display a confirmation page that should contain a form that POSTs to the same URL. classdjango.views.generic.edit.BaseDeleteView : A base view for deleting an object instance.

Reference Editing mixins

classdjango.views.generic.edit.ProcessFormView : A mixin that provides basic HTTP GET and POST workflow.

Reference Clickjacking Protection How to use it

… use a view decorator that tells the middleware not to set the header: NOTE: If you want to submit a form or access a session cookie within a frame or > iframe, you may need to modify the CSRF_COOKIE_SAMESITE or …

Reference Admin actions Advanced action techniques

For example, to make an action available only on the change form, set location to ActionLocation.CHANGE_FORM: To make an action available on both the change list and the change form: Notice that description and description_plural were provided.

Reference The Django admin site ModelAdmin objects

ModelAdmin.fieldsets : Set fieldsets to control the layout of admin “add” and “change” pages.

Reference The Django admin site ModelAdmin objects

ModelAdmin.formfield_overrides : This provides a quick-and-dirty way to override some of the Field options for use in the admin. formfield_overrides is a dictionary mapping a field class to a dict of arguments to pass to the field at construction time.

Reference The Django admin site ModelAdmin objects

WARNING: When overriding ModelAdmin.save_model() and > ModelAdmin.delete_model(), your code must save/delete the > object. They aren’t meant for veto purposes, rather they allow you to > perform extra operations.

Reference The Django admin site ModelAdmin objects

ModelAdmin.get_exclude(request,obj=None) : The get_exclude method is given the HttpRequest and the obj being edited (or None on an add form) and is expected to return a list of fields, as described in ModelAdmin.exclude.

Reference The Django admin site ModelAdmin objects

ModelAdmin.get_inline_instances(request,obj=None)[source] : The get_inline_instances method is given the HttpRequest and the obj being edited (or None on an add form) and is expected to return a list or tuple of InlineModelAdmin objects, as described below in the InlineModelAdmin section.

Reference The Django admin site ModelAdmin objects

ModelAdmin.get_form(request,obj=None,**kwargs)[source] : Returns a ModelForm class for use in the admin add and change views, see add_view() and change_view(). ModelAdmin.get_formsets_with_inlines(request,obj=None)[source] : Yields (FormSet, InlineModelAdmin) pairs for use in admin add and change views.

Reference The Django admin site ModelAdmin objects

ModelAdmin.get_changeform_initial_data(request)[source] : A hook for the initial data on admin change forms. By default, fields are given initial values from GET parameters. For instance, ?name=initial_value will set the name field’s initial value to be initial_value.

Reference The Django admin site ModelAdmin objects

This can be accomplished by using a Media inner class on your ModelAdmin: The staticfiles app prepends STATIC_URL (or MEDIA_URL if STATIC_URL is None) to any asset paths. The same rules apply as regular asset definitions on forms.