Django对中间件的调用思想、csrf中间件详细介绍、Django settings源码剖析、Django的Auth模块

module_path = 'notify.msg'
md = importlib.import_module(module_path) #md就是notify文件夹下的msg文件

cls = getattr(md,cls_name)#将文件名作为对象右面填类的名字就能拿到对应的类

class Msg:
    def __init__(self):
        pass

    # 发送信息前的准备

    def send(self, content):
        print(f'Msg通知：{content}')

NOTIFY_LISTS = [
    'notify.email.Email',
    'notify.msg.Msg',
    'notify.qq.Qq',
    'notify.WeChat.WeChat'
]

import importlib
import settings
def send_all(content):
    for path in settings.NOTIFY_LISTS:
        module_path,cls_name = path.rsplit('.',maxsplit=1)
        module = importlib.import_module(module_path)
        cls = getattr(module,cls_name)
        obj = cls()
        obj.send(content)

import os,sys
from notify import send_all


sys.path.append(os.path.dirname(__file__))

if __name__ == '__main__':
    send_all('现在测试通知')
    
Email通知：现在测试通知
Msg通知：现在测试通知
QQ通知：现在测试通知
WeChat通知：现在测试通知

<input type="hidden" name="csrfmiddlewaretoken" value="rJ47FeK9T55wavvVJGY6UxdM1kTMHhTqotGfaXjXIK8Ahz2Uvs02yR9T8bBn5q2D">

<form action="" method="post">
    {% csrf_token %}
    <p>username:<input type="text" name="username"></p>
    <p>target_account:<input type="text" name="target_user"></p>
    <p>money:<input type="text" name="money"></p>
    <input type="submit">
</form>
<input type="hidden" name="csrfmiddlewaretoken" value="rJ47FeK9T55wavvVJGY6UxdM1kTMHhTqotGfaXjXIK8Ahz2Uvs02yR9T8bBn5q2D">           

function getCookie(name) {
    var cookieValue = null;
    if (document.cookie && document.cookie !== '') {
        var cookies = document.cookie.split(';');
        for (var i = 0; i < cookies.length; i++) {
            var cookie = jQuery.trim(cookies[i]);
            // Does this cookie string begin with the name we want?
            if (cookie.substring(0, name.length + 1) === (name + '=')) {
                cookieValue = decodeURIComponent(cookie.substring(name.length + 1));
                break;
            }
        }
    }
    return cookieValue;
}
var csrftoken = getCookie('csrftoken');

function csrfSafeMethod(method) {
  // these HTTP methods do not require CSRF protection
  return (/^(GET|HEAD|OPTIONS|TRACE)$/.test(method));
}

$.ajaxSetup({
  beforeSend: function (xhr, settings) {
    if (!csrfSafeMethod(settings.type) && !this.crossDomain) {
      xhr.setRequestHeader("X-CSRFToken", csrftoken);
    }
  }
});

<script src="/static/setup.js"></script>

from django.views.decorators.csrf import csrf_exempt
@csrf_exempt  # 不校验 csrf
def index(request):
    return HttpResponse('index')

@csrf_protect  # 校验
def login(request):
    return HttpResponse('login')

# @method_decorator(csrf_exempt,name='post')  # csrf_exempt不支持该方法
@method_decorator(csrf_exempt,name='dispatch')  # csrf_exempt
class MyIndex(views.View):
    # @method_decorator(csrf_exempt)  # 可以
    def dispatch(self, request, *args, **kwargs):
        return super().dispatch(request,*args,**kwargs)
    def get(self,request):
        return render(request,'transfer.html')
    # @method_decorator(csrf_exempt,name='post')  # csrf_exempt不支持该方法
    def post(self,request):
        return HttpResponse('OK')       
    # csrf_exempt这个装饰器只能给dispatch装才能生效

# @method_decorator(csrf_protect,name='post')  # 可以
class MyIndex(views.View):
    @method_decorator(csrf_protect)
    def dispatch(self, request, *args, **kwargs):
        return super().dispatch(request,*args,**kwargs)
    def get(self,request):
        return render(request,'transfer.html')
    # @method_decorator(csrf_protect)  # 可以
    def post(self,request):
        return HttpResponse('OK')

from django.conf import settings#配置文件实例化出的一个类
from django.conf import global_settings#配置文件

 def _setup(self, name=None):
        """
        Load the settings module pointed to by the environment variable. This
        is used the first time we need any settings at all, if the user has not
        previously configured the settings manually.
        """
        settings_module = os.environ.get(ENVIRONMENT_VARIABLE)
        # os.environ是一个全局的大字典，而settings_module获取了key为ENVIRONMENT_VARIABLE的值，从manage.py中可以看出settings_module获取到的就是用户配置文件路径:项目名.settings
        if not settings_module:
            desc = ("setting %s" % name) if name else "settings"
            raise ImproperlyConfigured(
                "Requested %s, but settings are not configured. "
                "You must either define the environment variable %s "
                "or call settings.configure() before accessing settings."
                % (desc, ENVIRONMENT_VARIABLE))

        self._wrapped = Settings(settings_module)
        #settings路径传入了Settings，我们进Settings里面看看。
        
class Settings(object):
    def __init__(self, settings_module):
        # update this dict from global settings (but only for ALL_CAPS settings)
        for setting in dir(global_settings):#获取全局配置文件中所有变量名
            if setting.isupper():#只获取是大写的变量名，这就是为啥配置文件中所有的变量名都是大写的
                setattr(self, setting, getattr(global_settings, setting))#setattr将获取到global_settings的变量值添加到settings对象自己的属性中

        # store the settings module in case someone later cares
        self.SETTINGS_MODULE = settings_module#项目名.settings

        mod = importlib.import_module(self.SETTINGS_MODULE)
        #导入暴露给用户的配置文件，相当于from 用户名 import settings

        tuple_settings = (
            "INSTALLED_APPS",
            "TEMPLATE_DIRS",
            "LOCALE_PATHS",
        )
        
        
     self._explicit_settings = set()
        for setting in dir(mod):#获取用户配置文件中所有的变量名
            if setting.isupper():
                setting_value = getattr(mod, setting)#利用反射取出所有的变量值

                if (setting in tuple_settings and
                        not isinstance(setting_value, (list, tuple))):
                    raise ImproperlyConfigured("The %s setting must be a list or a tuple. " % setting)
                setattr(self, setting, setting_value)#将用户settings的属性和属性值写入settings对象中
                #到这里我们可以看到，实例化出的settings对象先将全局配置文件中的变量名和变量值写入，然后再将用户配置文件的变量名和变量值写入，这样如果用户配置文件配置了对应的变量名和变量值就会替换掉全局的，从而实现了如果用户配置了settings就用用户的，如果用户没有配置，就用全局的配置文件的功能。
                self._explicit_settings.add(setting)

        if not self.SECRET_KEY:
            raise ImproperlyConfigured("The SECRET_KEY setting must not be empty.")

import importlib
from lib.conf import global_settings
import os

class Settings(object):
    def __init__(self):
        for name in dir(global_settings):
            if name.isupper():
                setattr(self,name,getattr(global_settings,name))
        # 获取暴露给用户的配置文件字符串路径
        module_path = os.environ.get('xxx')
        md = importlib.import_module(module_path)  # md = settings
        for name in dir(md):
            if name.isupper():
                k = name
                v = getattr(md,name)
                setattr(self,k,v)


settings = Settings()

from django.contrib.auth.models import User
user = User.objects.create_user（username='用户名',password='密码',email='邮箱',...）

user = authenticate(username='usernamer',password='password')

from django.contrib.auth import authenticate, login
   
def my_view(request):
  username = request.POST['username']
  password = request.POST['password']
  user = authenticate(username=username, password=password)
  if user is not None:
    login(request, user)
    # Redirect to a success page.
    ...
  else:
    # Return an 'invalid login' error message.
    ...

def my_view(request):
  if not request.user.is_authenticated():
    return redirect('%s?next=%s' % (settings.LOGIN_URL, request.path))

ok = user.check_password('密码')

user.set_password(password='')
user.save()

from django.contrib.auth import logout
   
def logout_view(request):
  logout(request)
  # Redirect to a success page.

from django.contrib.auth.decorators import login_required
      
@login_required
def my_view(request):
  ...

LOGIN_URL = '/login/'  # 这里配置成你项目登录页面的路由

LOGIN_URL = '/login/'#如果全局和局部都配置了以局部的为准

class UserDetail(models.Model):
    phone = models.BigIntegerField()
    user = models.OneToOneField(to='User')

#自定义类
from django.contrib.auth.models import AbstractUser
class Userinfo(AbstractUser):
    phone = models.BigIntegerField()
    register_time = models.DateField(auto_now_add=True)
    
#配置文件中添加
AUTH_USER_MODEL = 'app01.Userinfo'  # 应用名.表名