Templates

TEMPLATES = [
    {
        "BACKEND": "django.template.backends.django.DjangoTemplates",
        "NAME": "django",
        "DIRS": [BASE_DIR / "templates"],
        "APP_DIRS": True,
        "OPTIONS": {
            "context_processors": [
                "django.template.context_processors.request",
                "django.contrib.auth.context_processors.auth",
                "django.contrib.messages.context_processors.messages",
                "catalog.context_processors.site_info",
            ],
            "builtins": ["catalog.templatetags.shortcuts"],
        },
    },
    {
        "BACKEND": "django.template.backends.jinja2.Jinja2",
        "NAME": "jinja2",
        "DIRS": [BASE_DIR / "jinja2"],
        "APP_DIRS": True,
        "OPTIONS": {"environment": "config.jinja2.environment"},
    },
    {
        "BACKEND": "catalog.backends.PercentEngine",
        "NAME": "percent",
        "DIRS": [BASE_DIR / "percent"],
        "APP_DIRS": True,
        "OPTIONS": {"prefix": "[catalog] "},
    },
]

def test_get_select_render(self):
    t = get_template("catalog/footer.html")
    self.assertIn("templates/catalog/footer.html", t.origin.name)
    self.assertEqual(
        select_template(["catalog/missing.html", "catalog/footer.html"]).origin.template_name, "catalog/footer.html"
    )
    with self.assertRaises(TemplateDoesNotExist):
        get_template("nope.html")


def test_engines_by_name(self):
    self.assertEqual(set(engines), {"django", "jinja2", "percent"})
    self.assertEqual(engines["django"].from_string("Hello {{ name }}!").render({"name": "W"}), "Hello W!")


def test_select_by_engine_order(self):
    # same name exists in both engines: django engine is first and wins unless `using` is given
    self.assertEqual(get_template("catalog/book_list.html").backend.name, "django")
    self.assertEqual(get_template("catalog/book_list.html", using="jinja2").backend.name, "jinja2")

{% load static %}<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <title>{% block title %}{{ SITE_NAME }}{% endblock title %}</title>
  <link rel="stylesheet" href="{% static 'catalog/site.css' %}" {% csp_nonce_attr %}>
</head>
<body>
  <nav>
    {% for name, label in nav_items %}
      <a href="{% url name %}"{% if request.resolver_match.view_name == name %} aria-current="page"{% endif %}>{{ label }}</a>
    {% endfor %}
    {% if user.is_authenticated %}Signed in as {{ user.get_username }}{% else %}Anonymous{% endif %}
  </nav>
  {% block content %}{% endblock content %}
  {% include "catalog/footer.html" %}
</body>
</html>

{% extends "base.html" %}
{% block title %}Books ({{ page_obj.paginator.count }}) | {{ block.super }}{% endblock %}
{% block content %}
<h1>Books</h1>
<form method="get">
  <input type="search" name="q" value="{{ request.GET.q }}">
  <button>Search</button>
</form>
<ul>
  {% for book in page_obj %}
    {% include "catalog/_book_row.html" with book=book only %}
  {% empty %}
    <li>No books match.</li>
  {% endfor %}
</ul>
<p>Showing {{ page_obj.start_index }}-{{ page_obj.end_index }} of {{ page_obj.paginator.count }}.</p>
{% if page_obj.has_previous %}<a rel="prev" href="{% querystring page=page_obj.previous_page_number %}">Previous</a>{% endif %}
{% if page_obj.has_next %}<a rel="next" href="{% querystring page=page_obj.next_page_number %}">Next</a>{% endif %}
<a href="{% querystring q=None page=None %}">Clear filters</a>
{% endblock content %}

<li>
  <a href="{{ book.get_absolute_url }}">{{ book.title }}</a>
  by {{ book.author.name }} ({{ book.author.name|initials }}), {{ book.price|floatformat:2 }}
</li>

def book_list(request):
    books = Book.objects.select_related("author")
    q = request.GET.get("q", "").strip()
    if q:
        books = books.filter(Q(title__icontains=q) | Q(author__name__icontains=q))
    page_obj = Paginator(books, 2).get_page(request.GET.get("page"))
    return render(request, "catalog/book_list.html", {"page_obj": page_obj})

def test_inheritance_include_querystring(self):
    r = self.client.get("/books/?q=a&page=2")
    self.assertContains(r, "<h1>Books</h1>", html=True)
    self.assertContains(r, "<title>Books (5) | Bookshelf</title>", html=True)
    self.assertContains(r, 'href="?q=a&amp;page=1"')  # previous link keeps q
    self.assertContains(r, 'href="?q=a&amp;page=3"')  # next link keeps q
    self.assertContains(r, 'href="?"')  # clear filters
    self.assertTemplateUsed(r, "catalog/_book_row.html")
    self.assertContains(r, "(BB)")  # builtins library: initials filter without {% load %}
    self.assertContains(r, "project templates directory")  # DIRS beats APP_DIRS

$ curl -s "http://127.0.0.1:8129/books/?q=a&page=2"
...
<title>Books (5) | Bookshelf</title>
...
<p>Showing 3-4 of 5.</p>
<a rel="prev" href="?q=a&amp;page=1">Previous</a>
<a rel="next" href="?q=a&amp;page=3">Next</a>
<a href="?">Clear filters</a>

def test_with_include_only(self):
    out = render_to_string("catalog/_book_row.html", {"book": Book(pk=1, title="T", author=Author(name="Ann Archer"), price=1)})
    self.assertIn("(AA)", out)

def test_autoescape_rules(self):
    self.assertEqual(self.render("{{ v }}", v="<b>"), "&lt;b&gt;")
    self.assertEqual(self.render("{{ v|safe }}", v="<b>"), "<b>")
    self.assertEqual(self.render("{% autoescape off %}{{ v }}{% endautoescape %}", v="<b>"), "<b>")
    self.assertEqual(self.render("{{ v|default:'3 &lt; 2' }}", v=""), "3 &lt; 2")  # literals are not escaped
    # join under autoescape off marks the result safe, so escape is a no-op; escapeseq fixes it
    t = "{% autoescape off %}{{ l|join:', '|escape }}|{{ l|escapeseq|join:', ' }}{% endautoescape %}"
    self.assertEqual(self.render(t, l=["<a>", "<b>"]), "<a>, <b>|&lt;a&gt;, &lt;b&gt;")


def test_escaping(self):
    Book.objects.create(title="<script>alert(1)</script>", author=Author.objects.first(), price=1)
    r = self.client.get("/books/?q=script")
    self.assertContains(r, "&lt;script&gt;alert(1)&lt;/script&gt;")
    self.assertNotContains(r, "<script>alert(1)")


def test_json_script(self):
    out = self.render("{{ data|json_script:'d' }}", data={"hello": "world</script>&"})
    self.assertEqual(out, '<script id="d" type="application/json">{"hello": "world\\u003C/script\\u003E\\u0026"}</script>')

from django.conf import settings


def site_info(request):
    return {
        "SITE_NAME": "Bookshelf",
        "DEBUG_MODE": settings.DEBUG,
        "nav_items": [
            ("catalog:book-list", "Books"),
        ],
    }

def test_request_context_applies_processors(self):
    request = RequestFactory().get("/")
    request.user = AnonymousUser()
    t = Template("{{ SITE_NAME }}|{{ request.path }}|{{ user.is_authenticated }}")
    self.assertEqual(t.render(RequestContext(request)), "Bookshelf|/|False")


def test_view_context_beats_processor(self):
    request = RequestFactory().get("/")
    request.user = AnonymousUser()
    out = render_to_string("catalog/footer.html", {"SITE_NAME": "View wins"}, request=request)
    self.assertIn("View wins", out)


def test_without_request_no_processors(self):
    # no request, no RequestContext, no context processors: SITE_NAME is simply missing
    self.assertTrue(render_to_string("catalog/footer.html").startswith("<footer> ("))

def test_standalone_engine(self):
    engine = Engine(debug=False)
    out = engine.from_string("{{ n|add:1 }} {{ s|title }}").render(Context({"n": 1, "s": "the web"}))
    self.assertEqual(out, "2 The Web")


def test_context_stack(self):
    c = Context({"foo": "first"})
    with c.push(foo="second"):
        self.assertEqual(c["foo"], "second")
    self.assertEqual(c["foo"], "first")
    self.assertEqual(c.flatten()["foo"], "first")

def test_block_super_and_syntax_error(self):
    with self.assertRaises(TemplateSyntaxError):
        Template("{% if %}x{% endif %}")
    with self.assertRaises(TemplateSyntaxError):
        Template("{% block a %}{% endblock %}{% block a %}{% endblock %}")


def test_extends_must_be_first(self):
    with self.assertRaisesMessage(TemplateSyntaxError, "must be the first tag"):
        Template("{% if x %}y{% endif %}{% extends 'base.html' %}")
    Template("hello{% extends 'base.html' %}")  # plain text before it is tolerated

def test_default_loaders_are_cached(self):
    from django.template.loaders.cached import Loader as Cached

    loaders = engines["django"].engine.template_loaders
    self.assertEqual(len(loaders), 1)
    self.assertIsInstance(loaders[0], Cached)
    self.assertEqual(get_template("catalog/footer.html").template, get_template("catalog/footer.html").template)


def test_explicit_loaders_disable_default_cache(self):
    engine = Engine(dirs=["/nonexistent"], loaders=["django.template.loaders.filesystem.Loader"])
    self.assertEqual(engine.template_loaders[0].__class__.__module__, "django.template.loaders.filesystem")


def test_locmem_loader_for_tests(self):
    with override_settings(
        TEMPLATES=[
            {
                "BACKEND": "django.template.backends.django.DjangoTemplates",
                "OPTIONS": {
                    "loaders": [("django.template.loaders.locmem.Loader", {"index.html": "hi {{ who }}"})]
                },
            }
        ]
    ):
        self.assertEqual(render_to_string("index.html", {"who": "you"}), "hi you")

{% extends "admin/base_site.html" %}
{% block branding %}
  <p class="bookshelf-badge">Bookshelf staff</p>
  {{ block.super }}
{% endblock %}

{# catalog/templates/catalog/footer.html (app default) #}
<footer>{{ SITE_NAME }} (default footer from the catalog app)</footer>

{# templates/catalog/footer.html (project override, the one that is used) #}
<footer>{{ SITE_NAME }} (footer from the project templates directory)</footer>

def test_overriding_project_beats_app(self):
    origin = get_template("catalog/footer.html").origin
    self.assertTrue(origin.name.endswith("templates/catalog/footer.html"))
    self.assertNotIn("/catalog/templates/", origin.name)


def test_extend_overridden_template(self):
    self.assertIn("Bookshelf staff", render_to_string("admin/base_site.html", {"title": "x", "site_title": "S", "site_header": "H"}))

$ curl -s http://127.0.0.1:8129/admin/login/ | grep -n bookshelf
42:  <p class="bookshelf-badge">Bookshelf staff</p>

from django.templatetags.static import static
from django.urls import reverse
from jinja2 import Environment


def environment(**options):
    env = Environment(**options)
    env.globals.update({"static": static, "url": reverse})
    return env

<h1>{{ site_name }}</h1>
<ul>
{% for book in books %}
  <li><a href="{{ url('catalog:book-detail', args=[book.pk]) }}">{{ book.title }}</a> - {{ "%.2f"|format(book.price) }}</li>
{% endfor %}
</ul>
<form method="post">{{ csrf_input }}<button>Buy</button></form>

def test_jinja2_engine(self):
    make_books()
    out = render_to_string("catalog/book_list.html", {"site_name": "J", "books": Book.objects.all()[:1]}, using="jinja2")
    self.assertIn('<a href="/books/%d/">' % Book.objects.all()[0].pk, out)
    self.assertIn("9.50", out)
    self.assertIn('<h1>J</h1>', out)


def test_jinja2_csrf_and_autoescape(self):
    request = RequestFactory().get("/")
    out = render_to_string("catalog/book_list.html", {"site_name": "<J>", "books": []}, request=request, using="jinja2")
    self.assertIn("&lt;J&gt;", out)
    self.assertIn('name="csrfmiddlewaretoken"', out)

from pathlib import Path
from string import Template as StringTemplate

from django.template import TemplateDoesNotExist, TemplateSyntaxError
from django.template.backends.base import BaseEngine
from django.template.backends.utils import csrf_input_lazy, csrf_token_lazy


class PercentEngine(BaseEngine):
    """A tiny backend based on string.Template ($name placeholders)."""

    app_dirname = "percent"

    def __init__(self, params):
        params = params.copy()
        options = params.pop("OPTIONS").copy()
        super().__init__(params)
        self.prefix = options.pop("prefix", "")

    def from_string(self, template_code):
        try:
            return PercentTemplate(StringTemplate(template_code), self.prefix)
        except ValueError as exc:
            raise TemplateSyntaxError(str(exc))

    def get_template(self, template_name):
        tried = []
        for directory in self.template_dirs:
            path = Path(directory) / template_name
            if path.is_file():
                return self.from_string(path.read_text(encoding="utf-8"))
            tried.append((path, "Source does not exist"))
        raise TemplateDoesNotExist(template_name, tried=tried, backend=self)


class PercentTemplate:
    def __init__(self, template, prefix):
        self.template = template
        self.prefix = prefix

    def render(self, context=None, request=None):
        context = dict(context or {})
        if request is not None:
            context["request"] = request
            context["csrf_input"] = csrf_input_lazy(request)
            context["csrf_token"] = csrf_token_lazy(request)
        return self.prefix + self.template.safe_substitute(context)

def test_percent_backend(self):
    t = engines["percent"].get_template("catalog/greeting.txt")
    self.assertEqual(t.render({"name": "Ana", "site": "Bookshelf"}), "[catalog] Hello Ana, welcome to Bookshelf.\n")
    self.assertEqual(render_to_string("catalog/greeting.txt", {"name": "Ana", "site": "S"}, using="percent"), "[catalog] Hello Ana, welcome to S.\n")


def test_percent_backend_request_and_missing(self):
    t = engines["percent"].from_string("path=$request")
    self.assertIn("WSGIRequest", t.render({}, request=RequestFactory().get("/")))
    with self.assertRaises(TemplateDoesNotExist) as cm:
        engines["percent"].get_template("zzz.txt")
    self.assertEqual(cm.exception.backend, engines["percent"])

{% for author in authors %}
{{ author.name }}: {{ author.books.count }} books, {% for b in author.books.all %}{{ b.title }};{% endfor %}
{% endfor %}

{% for author in authors %}
{{ author.name }}: {{ author.book_total }} books, {% for b in author.books.all %}{{ b.title }};{% endfor %}
{% endfor %}

def authors_good(request):
    authors = Author.objects.annotate(book_total=Count("books")).prefetch_related("books")
    return render(request, "catalog/stupid_good.html", {"authors": authors}, content_type="text/plain")


def authors_bad(request):
    return render(request, "catalog/stupid_bad.html", {"authors": Author.objects.all()}, content_type="text/plain")

class StupidTemplatesTests(TestCase):
    @classmethod
    def setUpTestData(cls):
        make_books()

    def test_bad_hits_db_per_author_in_template(self):
        with self.assertNumQueries(1 + 2 * 2):  # authors + (count + books) per author
            self.client.get("/authors-bad/")

    def test_good_prepares_data_in_view(self):
        with self.assertNumQueries(2):  # annotated authors + one prefetch
            r = self.client.get("/authors-good/")
        self.assertContains(r, "Ann Archer: 2 books")

async def async_books(request):
    # Evaluate the queryset in async code; templates are synchronous.
    books = [book async for book in Book.objects.select_related("author")]
    return render(request, "catalog/loop_demo.html", {"books": books}, content_type="text/plain")


async def async_books_lazy(request):
    # A lazy queryset would be evaluated by the template, i.e. in sync code.
    return render(request, "catalog/loop_demo.html", {"books": Book.objects.all()}, content_type="text/plain")

class AsyncTemplateTests(TestCase):
    @classmethod
    def setUpTestData(cls):
        make_books()

    async def test_async_view_with_evaluated_data(self):
        r = await AsyncClient().get("/async-books/")
        self.assertEqual(r.status_code, 200)
        self.assertIn("5/5 last", r.content.decode())

    async def test_async_view_lazy_queryset_fails(self):
        from django.core.exceptions import SynchronousOnlyOperation

        with self.assertRaises(SynchronousOnlyOperation):
            await AsyncClient().get("/async-books-lazy/")

$ curl -s http://127.0.0.1:8129/async-books/
1/5 first: Alpha
2/5: Beta
...
$ curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:8129/async-books-lazy/
500

def test_nonce_attribute_only_with_processor(self):
    from django.utils.csp import CSP

    plain = self.client.get("/books/").content.decode()
    self.assertNotIn("nonce=", plain)
    processors = ["django.template.context_processors.request", "django.contrib.auth.context_processors.auth",
                  "django.contrib.messages.context_processors.messages", "catalog.context_processors.site_info",
                  "django.template.context_processors.csp"]
    templates = [dict(settings.TEMPLATES[0], OPTIONS=dict(settings.TEMPLATES[0]["OPTIONS"], context_processors=processors))] + list(settings.TEMPLATES[1:])
    with override_settings(
        TEMPLATES=templates,
        MIDDLEWARE=settings.MIDDLEWARE + ["django.middleware.csp.ContentSecurityPolicyMiddleware"],
        SECURE_CSP={"default-src": [CSP.SELF], "style-src": [CSP.SELF, CSP.NONCE]},
    ):
        r = Client().get("/books/")  # a new client builds a new middleware chain
    nonce = r.headers["Content-Security-Policy"].split("'nonce-")[1].split("'")[0]
    self.assertIn(f'site.css" nonce="{nonce}">', r.content.decode())