Supplemental Django Topics

DOCTYPE declaration: https://www.w3schools.com/tags/tag_doctype.asp

• All HTML documents require the DocType on top
• Because of the “extends” of the “base.html”, we don’t need this for all HTML documents that “extends” from the “base.html” (as long as it works as an HTML document itself)

on_delete options in Django: https://docs.djangoproject.com/en/3.1/ref/models/fields/#arguments

• Usually this is a design choice where consultation with other CompServ members and domain knowledge is needed to know which one is best

Importing data from other Data Models: https://stackoverflow.com/questions/43847173/cannot-import-models-from-another-app-in-django

• Read the Checkmarked answer

Form as_p: https://www.geeksforgeeks.org/form-as_p-render-django-forms-as-paragraph/

• Making forms using <p>

Django Permission + Login Decorators:

• permission_required: https://docs.djangoproject.com/en/3.1/topics/auth/default/#the-permission-required-decorator
• login_required: https://docs.djangoproject.com/en/3.1/topics/auth/default/#the-login-required-decorator

Django Authentication Views: https://docs.djangoproject.com/en/3.1/topics/auth/default/#module-django.contrib.auth.views

• Only the following sections:
  • Authentication Views
    • Using the views
    • All authentication views
      • class LoginView
      • class LogoutView
      • other sections optional

---

Advanced Topics

Topics that are good to know

Allowing HTML code from text

• Review: SQL Injection Attack
  • https://cs61a.org/assets/slides/34-Databases_1pp.pdf
  • There is such a thing as “HTML Injection”, web developers call it Cross-Site Scripting (XSS) attacks
• XSS Attacks
  • https://owasp.org/www-community/attacks/xss/
• “safe” tag
  • More info from Django (basically allow render as HTML code)
    • https://docs.djangoproject.com/en/3.1/ref/templates/builtins/#safe
  • Vulnerability of using “safe”
    • https://adamj.eu/tech/2020/02/18/safely-including-data-for-javascript-in-a-django-template/
• Markdown
  • https://django-markdownify.readthedocs.io/en/latest/settings.html
  • Vulnerability issues of Markdown + fix
    • https://github.com/neutronX/django-markdownx/issues/163
  • Fixed on HKNWeb
    • https://github.com/compserv/hknweb/pull/280
• Sanitizing HTML tags
  • Bleach library
    • https://bleach.readthedocs.io/en/latest/clean.html#bleach.sanitizer.ALLOWED_TAGS
    • https://github.com/mozilla/bleach

Pull Origin changes to your forked repo

• git fetch and merge
• https://stackoverflow.com/questions/20101994/git-pull-from-master-into-the-development-branch
  • Follow the first code block of ANSWER