using django apps vs established apps...security? - django

Ive been making a site in django and thinking about using some of the apps available online for things like wiki or forum. I was wondering what the drawbacks were. Are those apps likely to be less secure that using something like vbulletin or mediawiki instead?
In general is django pretty secure to begin with? I know almost nothing about security so I find myself wondering sometimes.

vBulletin and MediaWiki are pretty insecure apps. I think typical django app is much more secure than these two :-)
Django by default prevents many security mistakes (SQL injection, xss, csrf) so developer should make an effort to create insecure app.

Related

Twitter in Django

I have to create web application similar to twitter with a few tweaks using django. I am clueless if I have to use a CMS for this or any other existing django-application. Working from ground up is quite tedious to be honest. Can anyone recommend me which CMS( or anything else) I should attempt trying?
There is a project called trillr1. According to its page:
"Trillr is a Twitter-like microblogging service enhanced with user directory and group discussion features. " that's maybe what you want.
https://contributions.coremedia.com/trillr1
I guess, the closest you can come with an out-of-the-box software to imitate Twitter is Status.net, the software, that powers identi.ca. However, this is a PHP application.
I'm not aware of something similar in the Django world.

Django Admin site and Forms on AppEngine

i'm developing a web site hosted on AppEngine and wanted to use Django for some tasks. I've read these two answers:
Django on Google App Engine
Django and App Engine
But those are pretty old, and my question is a little more specific. I've taken a look at django-nonrel and seems good, but i've not used it and cant affirm anything.
So, the question is. Can I use the Admin site and the forms from Django with this package? If not, do you know any other patch that allow me to use them?
Thank you very much!
If you use django-nonrel, then you can use the Django admin site but it will be limited to the types of queries you can do on app engine. I personally found it easier to code my own simple admin interfaces that to type to make things work in Django Admin.
Regarding forms, regular Django Forms and ModelForms work quite well.
Yes, you can (both Admin and forms).
(definitely) :)
I installed djangoappengine 3 months ago and work on it daily under Eclipse (Windows).
If you have some expericence with Django it should be easy, I faced much more problems with Eclipse integration, but nothing unfeseable (even for a newbie - as I'm still).
You just have to start from here:
http://www.allbuttonspressed.com/projects/djangoappengine#installation
Be careful anyway: there are some limitations due to the Datastore capabilities.
A lot of work has been done to circumvent them (dbindexer, specifics decorators...) and if you're planning to develop an app from scratch you will find your way (keeping " noSQL " in mind) but if you plan to migrate a plain vanilla SQL app, it may cause you some pain...
Last point: instances handling Django and all its libraries may be long to start with App Engine ; an issue to consider:
http://code.google.com/p/googleappengine/issues/detail?id=1695
Hope it helps.
Florent

Running Mezzanine on App Engine

I am looking for a blog solution to run inside a Django project deployed on the Google App Engine. After a bit of review I decided to try out Mezzanine v0.11.3. I've overcome the hurdle of getting it in project using the advice of others deploying on App Engine at this link: http://groups.google.com/group/mezzanine-users/browse_thread/thread/c8b13c41a3168c94.
Mezzanine is now showing up in the Admin, but clicking on Blog posts leads to a multi-table inheritance failure. I believe that this is due to multi-site support functionality in Mezzanine via use of the Django sites framework.
Has anyone overcome this issue? I'm going to try to use django-dbindexer but I'm not confident it will work.
*Update: as far as I can tell, the folks at AllButtonsPressed don't have any magic solutions to work around ManyToManyField issues yet, so I think that option is dead.
If no one knows a work around, do any of you know of a good blog solution I can run inside a Django project on the App Engine?
*Update: found this post Integrating Blogger into a Google App Engine App. Will investigate if this solves the problem.
*Current Status:
I have not been able to solve this problem and I don't think it is currently solvable. Thought I would share what I found through my investigations though; maybe someone out there can carry on and come up with a solution.
Options tried:
Bloog
I looked this over but it is a Python
solution, not a Django solution and I
didn't want to do the work to turn it
into one
Byteflow ( https://bitbucket.org/piranha/byteflow/wiki/Home ) notes:
designed to be standalone, will need a
lot of edits to settings.py,
inclusion of 12 additional apps and
overrides on account settings plus
hand tuning at every upgrade.
AppEngineBlog ( http://code.google.com/p/appengineblogsoftware/ ) notes:
written in appengine specific code,
not maintained, no example sites
available to see how it looks
Coltrane ( http://code.google.com/p/coltrane-blog/source/browse/ ):
simple blog constructed from standard
Django functionality no development
or support, basically need to use
this code as a way to develop your
own blog and go from there
Flother ( https://github.com/flother/flother ):
found via Coltrane comments, probably
embeddable without too much trouble,
requires 8 additional apps,the photos
and places components have
ManyToManyFields that would have to
be re-written or these components
disabled
Blogger API ( http://code.google.com/apis/blogger/ ):
use Blogger at whatever location you
wish to gain fully functional
blogging capabilities, then use
Blogger API to deliver content to any
other site you wish to display it
Flother came close to what I need but there is still a fair bit of uncertainty and effort there. I'm proceeding with the Blogger option as the only viable choice for me at this time.
Well, as far as I can see, there is no way to get Mezzanine running on GAE other than wading into the code and ripping out anything relating to a ManyToManyField (Sites support, Photos and ... something else. Can't remember what).
The only thing I could find out there that has the potential to be added to an existing project, uses only portable Django code (app engine specific) and runs on App Engine is http://www.allbuttonspressed.com/projects/allbuttonspressed . I haven't actually tried to integrate it yet because I'm going to see if the Blogger solution works.
I've been using bloog for two of my blogs without any serious troubles so far - there are few little quirks that make it mildly unpleasant sometimes but nothing that's been a deal breaker.
I use the Blogger solution and it works fine, especially if you're only one person and you run the whole site.
The problem comes when you want to others to help you out. Now every css and design decision needs to be sent to a programmer who hacks away at django templates. A CMS with a real WYSIWYG editor would allow you to ship off that work to marketing/design people and let you focus on the fun stuff.
I came across a decent review of the various blogging engines for Django, however, it's unclear how well they each integrate with GAE.
I have deployed Mezzanine/Cartridge in GAE succesfully but I have not documented it yet in github or something like that. It works using python 2.7 of course and django 1.5. Additionally it works with Google Cloud SQL, and the local file system GAE provides. It additionally works with google gmail facilities. For thumbnailing I am using local GAE functionality.
It requires several additional libraries like boto, but it works well.
See a short demo in midevocional365.appspot.com/

Is it possible to use Django with Qooxdoo framework?

Guys i would like to use Django as my backend framework and qooxdoo as the frontend framework.
Is it practical to do this?
Has anyone tried to do this?
How did they do it?
Links and pointers would nice.
Gath
I have no direct experience using Django and qooxdoo, but the general answer to the question "Is it practical?" is: yes :). Although Django's default rendering behaviour is to produce HTML (which is unsuitable for a single page application like the ones you build with qooxdoo), it's easy to switch to returning e.g. Json on requests, which is a common format for the client-server communication between a qooxdoo frontend and a server. They just exchange data.
Has anyone tried to do this? - Yes, but they don't give much information on how, other than the before mentioned Json data exchange, implementing a Json RPC server in Django using RPC4Django.
AFAIK, there is no deeper Django integration, e.g. interfacing qooxdoo with Django views on the server (like dojango).
Hope this helps.
Update:
There is one elaborate product, Sava, using qooxdoo for the frontend and Django for the backend. There is a short overview, but I think it's closed-source so it only testifies to the "practicality" of using this technology stack. You probably won't learn in detail how it is realized.
There is also enre, a qooxdoo-based GUI for Django. But I'm not familiar with it, and couldn't find any documentation on first glance, so I'm not sure what this really means.

Django: Moving from XAMPP to Django questions

I've worked with XAMPP, WAMPP, MAMPP, etc and am starting to look at Django.
A majority of the work we do is very CMS orientated; although we've been told not to use third-party CMS' (mainly because of user's find them hard to use, and other issues), I've found that I can code a very simple CMS using Cake, CodeIgniter or one of the other PHP frameworks.
And yet, I'm getting increasingly frustrated with the amount of coding I need to do just to get something up and running, and I've been told that Django is a good Python framework to use. It also seems to get a lot of buzz from reddit.
I have some concerns and queries about moving from XAMPP to Django.
1) Security
Any web app should be coded defensively. Over the past few years we've seen a movement towards protecting against XSS, SQL injections, Cross site forgeries, session fixation, session hi-jacking, cookie hi-jacking; the amount of security one needs can be overwhelming.
What things does Django do to prevent/limit XSS, SQL injections, Javascript injections, and santizing input; one normally associates with securing PHP web apps? Is it something I need to worry about, or does Django do all this stuff out of the box.
2) What goes in the /www/ public folder?
In a manual I read it said not to put manage.py or the other .py stuff in the main webroot, so this means I put everything outside of the webroot; so what goes in there?
Do I put the /templates/ directory inside the webroot? How does the server know what to run?
3) Can I still use .htaccess on Django projects? I am familiar with Apache and often use it to do routing, or blocking off bad bots, but will using .htaccess still work?
4) Cronjobs
Do cronjobs still work with Python/Django projects?
5) Running Third party perl/other scripts
In PHP you can use other libraries such as the curl library, ffmpeg, ImageMagik as well as many others; can I still use these libraries with Python/Django?
6) Admin screen
Django gives you an out-of-the-box admin screen; is this only for development purposes or can it put live? I am concerned about any the security of the admin screen.
7) Integration with Discuss, Facebook, Twitter, OpenID, captcha, etc.
There are libraries in PHP that help integrate DisQuss, Facebook, Twitter; but is it relatively easy to do an integration with these and other third party apps?
8) E-commerce, SSL
Are there many e-commerce sites that use Django? I've seen a lot of CMS/Blog type software but not many e-commerce sites. By which I mean, shopping card, Protx/Paypal or Worldpay integration.
That's another thing; there are sandboxes for Protx, Paypal, Worldpay etc for PHP -- but are there any for Django?
9) Is it worth it?
Is it worth moving to Django from an XAMPP background? Will it really make things faster, or is that just marketing hype?
Thanks.
Security. The Django core team are very security-conscious, and have taken great care to make things like SQL injection impossible. The next version, 1.2, includes a whole new cross-site request forgery protection library. Obviously, you still need to be aware of these when developing your application, but Django does a lot to help you.
What goes under /www/public: Nothing. Django doesn't work via the normal Apache serving mechanism: it hooks into (preferably) mod_wsgi, which needs a single file which then tells it to run the rest of the code. The templates can go anywhere, and are pointed to by your Django settings file, but again aren't served directly by Apache.
.htaccess: You don't really need it, because of point 2: you're not serving things in a filesystem hierarchy. The best way to do it is to set up vhosts and manage things that way.
Cron jobs: Absolutely. Django is just Python, and you can easily run Python scripts via cron. Django allows you to set up custom command scripts which initialise the ORM and give you access to anything you would need.
Libraries: Again, because Django is Python, you get access to the huge amount of Python libraries that are out there. For curl, Python has urllib; for ImageMagick, it has PIL; and no doubt there are equivalents of ffmpeg too.
Admin: Again, security has been thought of from the beginning. Opinions differ as to whether you should use the admin only for your expert users, or customise it and allow access for all users; I've had a lot of success using it as the basis for my custom CMS interfaces.
Facebook, etc: Yes, there are libraries for all of these.
E-commerce: There is a whole e-commerce project, Satchmo, written in Django. Libraries exist to interface with all the payment providers.
Is it worth it? Only you can tell. My experience working alongside a range of developers who have moved from PHP is that they've enjoyed the experience and became much more productive.
On SQL Injections: Django uses an ORM, which takes care of SQL injection protection, and you will rarely write you own SQL. If you do, just follow the instructions on how to pass parameters to raw queries and prevent SQL Injections.
There is an entire chapter on the django book about security that should answer all your questions.
On what goes into /www/: anything that is not code? The concern is to not put the python code there.
On .htaccess: Yes, it should still work (for any non Django resources as Daniel points out).
On cronjobs: what do you mean?
On Libraries: Python - the language you will use with Django - is rich in libraries that probably provide the same functionality you are used to. This is a key point: you will need to learn Python well to benefit the most from Django.
On the admin interface: This is actually the thing that will probably help you the most, judging from your question. They are customizable (within some limits) and they really give the staff (it is not intended for public users, but for staff users) the basics of CRUD for your database models. It is a time saver. You might need to write your own templates for advanced functionality, but for most simple CRUD aimed at staff (which is usually the point of a CMS) it is very useful and easy to set up.
On integration: Check Pinax for a group of applications that provide extra functionality. There is a rich and diverse universe of integration solutions out there. It is not unusual to find questions here in SO about django + facebook and others.
On E-commerce: Check Satchmo out.
Is it worth it: Now, I have no experience with XAMPP. I know that I like Python better than both Perl and PHP (and Java, for that matter). I know that as a framework Django is simpler to use, faster to deploy than anything I used before.
My suggestion is the age old: go build a simple project and make up your own mind. You are the only one in position to decide if Django is the framework for you.
An older question on SO discusses some Django limitations. My answer to that might be helpful to you too.
I recently moved to developing any new projects in Django, coming from a PHP background. Here are my thoughts on your questions.
1) Security
Strings sent to templates is escaped by default, which takes care of most of that. Since you're using an ORM, SQL injection shouldn't be an issue unless you build raw queries for some reason.
2) What goes in the /www/ public folder?
Django doesn't use a file hierarchy for URLs like a typical PHP setup. The server knows what to run from your urls.py and settings.py pointer to the template folder.
3) Can I still use .htaccess on Django projects? I am familiar with Apache and often use it to do routing, or blocking off bad bots, but will using .htaccess still work?
As noted above, it works for static content just the same. For dynamic pages, you'd want to implement some other form of authentication or redirection for clients you want to block, as far as I know.
4) Cronjobs
There's no reason why you can't use cron for whatever, as you still have a normal Linux system.
5) Running Third party perl/other scripts
You'll want to use the Python versions of those libraries, of course. For instance
FFMpeg
PythonMagick
I replaced most of my need for Curl with the built-in urllib and urrlib2 libraries, but there is also PyCurl if you need it.
6) Admin screen
The Admin screen is intended to be used by your own admins, i.e. site staff. It may be possible to do so, but it's not supposed to be the scaffolding on which you build your public facing project.
7) Integration with Discuss, Facebook, Twitter, OpenID, captcha, etc.
There are a lot of people out there using Python and Django, and I haven't had any problem finding libraries. In my experience there is a bit less support for something than PHP, but what is there is often higher quality.
8) E-commerce, SSL
I haven't tried payment integration, so I can't say. Not sure about the other sites, but the Paypal Sandbox is run by Paypal, isn't it? I don't think it's related to what you're using on the server, so sure, you can access it like normal.
9) Is it worth it? Is it worth moving to Django from an XAMPP background? Will it really make things faster, or is that just marketing hype?
I moved to Django because Python is truly a more compelling language than PHP. Will it make things faster? I'm not sure what the advantages in that respect would be for Django vs.the PHP MVC frameworks. There are no magic bullets.
You do have to keep in mind that you're not just learning a new framework, but also a new language. There will be a bit of a learning curve if you've never used Python before. but I've found both Python and Django to be fairly easy to learn. The clean design of the language is fantastic and Django is veryt well designed, too. I do feel that it's boosting my productivity. I've found snippets for or articles about most everything I need to do in Django as I've been learning, so adapting has been pretty simple.