website/conservancy/views.py

from datetime import datetime
import mimetypes

from django.conf import settings
from django.http import FileResponse, Http404, HttpResponse, HttpResponseRedirect
from django.shortcuts import render
from django.template import RequestContext, Template

from .blog.models import Entry
from .news.models import PressRelease
from .supporters.models import Supporter


def frontpage(request):
    """Conservancy front page view

    Performs all object queries necessary to render the front page.
    """
    now = datetime.now()
    context = {
        'press_releases': PressRelease.objects.all().filter(pub_date__lte=now, sites=2)[:5],
        'supporters_count': Supporter.objects.all().filter(display_until_date__gte=now).count(),
        'blog': Entry.objects.all().filter(pub_date__lte=now)[:5],
    }
    return render(request, "frontpage.html", context)


def content(request, *args, **kwargs):
    """Faux CMS: bulk website content stored in templates and document files.

    Rationale: Many websites have a CMS and store the majority of their website
    content in a relational database eg. WordPress or Wagtail. That's useful
    because various people can easily be given access to edit the website. The
    downside is that is application complexity - the management of who change
    what, when it changed and what changed becomes an application concern. At
    the other end of the spectrum, we have files that are checked into a Git
    repository - we get the precise who/what/when out of the box with Git, but
    require you to have some technical knowledge and appropriate access to
    commit. Since you're committing to a code repository, this also opens up the
    possibility to break things you couldn't break via a CMS.

    This view serves most of the textual pages and documents on
    sfconservancy.org. It works a little like Apache serving mixed PHP/static
    files - it looks at the URL and tries to find a matching file on the
    filesystem. If it finds a template, it renders it via Django's template
    infrastructure. If it finds a file but it's not a template, it will serve
    the file as-is.
    """
    base_path = settings.BASE_DIR / 'content'
    path = request.path.lstrip('/')
    if path.endswith('/'):
        path += 'index.html'
    full_path = (base_path / path).resolve()
    safe_from_path_traversal = full_path.is_relative_to(base_path)
    if full_path.is_dir():
        # Should have been accessed with a trailing slash.
        return HttpResponseRedirect(request.path + '/')
    elif not full_path.exists() or not safe_from_path_traversal:
        raise Http404()
    is_template = mimetypes.guess_type(full_path)[0] == 'text/html'
    if not is_template:
        return FileResponse(open(full_path, 'rb'))
    else:
        # These template are intentionally not in the template loader path, so
        # we open them directly, rather than using the template loader.
        with open(full_path, encoding='utf-8') as t:
            template = Template(t.read())
        context = RequestContext(request, kwargs)
        return HttpResponse(template.render(context))