详解Python的Django框架中的通用视图

#urls.py
from django.conf.urls.defaults import *
from django.views.generic.simple import direct_to_template
from mysite.books.views import about_pages
urlpatterns = patterns('',
  (r'^about/$', direct_to_template, {
                    'template': 'about.html'
                   }),
  (r'^about/(\w+)/$', about_pages),
)
# view.py
from django.http import Http404
from django.template import TemplateDoesNotExist
from django.views.generic.simple import direct_to_template
#由正则匹配的参数
def about_pages(request, page):
  try:
    return direct_to_template(request, template="about/%s.html" % page)#返回的HttpResponse
  except TemplateDoesNotExist:
    raise Http404()

运行结果：

安全问题的题外话
上面的例子中，有一个潜在的安全问题，比较容易被忽略。那就是template="about/%s.html" % page这
句，这样构造路径容易被名为directory traversal的手段攻击，简单的说就是利用"../"这样的返回父目录的
路径操作，去访问原本不应该被访问到的服务器上的文件，又被称为dot dot slash攻击。比如
使用"http://www.cnblogs.com/../etc/passwd"路径的话，有可能就能读取到服务器上的passwd这个文件，从而获取到
关键密码。

发布这篇博文的时候，cnblogs会把连续的"../"转义成"http://www.cnblogs.com",难道是在防止
dot dot slash攻击？不信，你可以试试。

那在上面的例子中会不会有这个问题呢？
答案：不会的。。。
因为\w只会匹配数字，字母和下划线，不会去匹配dot这个符号。所以可以安心使用。

回车后，会直接退回到主页，无法匹配。
3. 用于显示对象内容的通用视图
同样，我们可以只需要model，urls.py文件就可以显示对象的信息：
#model.py，之前例子中Publisher的定义

class Publisher(models.Model):
  name = models.CharField(max_length=30)
  address = models.CharField(max_length=50)
  city = models.CharField(max_length=60)
  state_province = models.CharField(max_length=30)
  country = models.CharField(max_length=50)
  website = models.URLField()
  def __unicode__(self):
    return self.name
#urls.py
from django.conf.urls.defaults import *
from django.views.generic import list_detail
from mysite.books.models import Publisher
publisher_info = {
  'queryset': Publisher.objects.all(),
  'template_name': 'publisher_list_page.html',
}
urlpatterns = patterns('',
  url(r'^publishers/$', list_detail.object_list, publisher_info),
)
#publisher_list_page.html
<h2>Publishers</h2>
  <ul>
    {% for publisher in object_list %}
    <li>{{ publisher.name }}</li>
    {% endfor %}
  </ul>

publisher_info = {
  'queryset': Publisher.objects.all(),
  'template_name': 'publisher_list_page.html',
  'template_object_name': 'publisher',
}
模板文件也要作相应的修改：
<h2>Publishers</h2>
  <ul>
    {% for publisher in publisher_list %}
    <li>{{ publisher.name }}</li>
    {% endfor %}
  </ul>

publisher_info = {
  'queryset': Publisher.objects.all(),
  'template_object_name': 'publisher',
  'template_name': 'publisher_list_page.html',
  'extra_context': {'book_list': Book.objects.all()}
}

<h2>Publishers</h2>
  <ul>
    {% for publisher in publisher_list %}
    <li>{{ publisher.name }}</li>
    {% endfor %}
  </ul>
<h2>Book</h2>
  <ul>
    {% for book in book_list %}
    <li>{{ book.title }}</li>
    {% endfor %}
  </ul>

def get_books():
  return Book.objects.all()
publisher_info = {
  'queryset': Publisher.objects.all(),
  'template_object_name': 'publisher',
  'template_name': 'publisher_list_page.html',
  'extra_context': {'book_list': get_books},
}

publisher_info = {
  'queryset': Publisher.objects.all(),
  'template_object_name': 'publisher',
  'extra_context': {'book_list': Book.objects.all},
}

apress_books = {
  'queryset': Book.objects.filter(publisher__name='Apress'),
  'template_name': 'books/apress_list.html',
}
urlpatterns = patterns('',
  url(r'^books/apress/$', list_detail.object_list, apress_books),
)

#urls.py
urlpatterns = patterns('',
  url(r'^publishers/$', list_detail.object_list, publisher_info),
  url(r'^books/(\w+)/$', books_by_publisher),
)
#views.py
from django.shortcuts import get_object_or_404
from django.views.generic import list_detail
from mysite.books.models import Book, Publisher
def books_by_publisher(request, name):
  # Look up the publisher (and raise a 404 if it can't be found).
  publisher = get_object_or_404(Publisher, name__iexact=name)
  # Use the object_list view for the heavy lifting.
  return list_detail.object_list(
    request,
    queryset = Book.objects.filter(publisher=publisher),
    template_name = 'books_by_publisher.html',
    template_object_name = 'book',
    extra_context = {'publisher': publisher}
)

#urls.py
from mysite.books.views import author_detail
urlpatterns = patterns('',
  # ...
  url(r'^authors/(?P\d+)/$', author_detail),
  # ...
)
#views.py
import datetime
from django.shortcuts import get_object_or_404
from django.views.generic import list_detail
from mysite.books.models import Author
def author_detail(request, author_id):
  # 执行通用视图函数，但不立即返回HttpResponse对象
  response = list_detail.object_list(
    request,
    queryset = Author.objects.all(),
    object_id = author_id,
  )
  # 记录访问该作者的时间
  now = datetime.datetime.now()
  Author.objects.filter(id=author_id).update(last_accessed=now)
  # 返回通用视图生成的HttpResponse对象
  return response

def author_list_plaintext(request):
  response = list_detail.object_list(
    request,
    queryset = Author.objects.all(),
    mimetype = 'text/plain',
    template_name = 'author_list.txt'
  )
  #修改响应格式，使其的内容不直接显示在网页中，而是储存在文件中，下载下来。
  response["Content-Disposition"] = "attachment; filename=authors.txt"
  return response

<h2>Author</h2>
<ul>
 {% for author in object_list %}
  <li>{{ author.first_name }}</li>
 {% endfor %}
</ul>