a witch posted:

Did you include

code:

{% load static %}

in your template?

COOL CORN posted:

I'm having trouble piecing something together in my head.

So, say I have a game, and each scenario in that game requires certain maps. A user can have certain maps in their collection, and I'm trying to show if a scenario is playable or not based on if the user has those maps in their collection.

So...
model Map has a property "mapnumber" that is tied by foreignkey to model Scenario
model UserMap has a property "mapnumber" that is tied by foreignkey to model User

What I'm having trouble with is checking "do the Scenario.Maps exist in User.UserMaps".

I'm toying with something along the lines of (very abridged and off the top of my head)

code:

scen = Scenario.object.get(pk=1)
maps = scen.map_set.all()
user = User.object.get(pk=1)
user_maps = UserMap.object.filter(user=user)

playable = True
for map in maps:
   if map not in user_maps:
      playable = False

...but the syntax is escaping me based on working with the model objects. Something like "if map.name not in user_maps.name_set" doesn't work, but that's the sort of functionality I need, I guess. Do I just need two nested for loops?

Hed posted:

Is there an app that will plug in advanced search? I basically want this:

• if someone puts "asdf" in the search field, do an icontains for asdf across several model fields and OR them (can do this pretty easily with Q objects in the query set)
  
• if someone puts something like "remark:asdf" in the search field, just do an icontains in the model's remarks field
  

It would be straightforward enough to code in a mixin or whatever, but I'm surprised I haven't found anything searching so far.

Rocko Bonaparte posted:

How might I stream log messages from a celery task to an end user through a REST API? I wanted to centralize these logs in one spot just to know what went on, but it looks like I could go an extra step and start streaming it as it comes in to any users that care. As it stands, I figured I'd set up the built-in Python logger as Celery uses it to stream logging messages using the rabbitmq message broker and have this central location receive these and dump them to disk. After that, I have no idea.

Data Graham posted:

Add a success: callback function in your ajax call, and do a document.location.reload() in it.

Thermopyle posted:

Well, REST isn't really a streaming sort of thing. You'll probably want websockets. Or I don't understand what you're asking and you can forget what I say.

Also, you might be going about it the wrong way. When I think streaming centralized logging, I think ELK or a hosted solution like logentries/papertrail/loggly. Kind of depends on exactly what type of users you have and what your goals here are.

Rocko Bonaparte posted:

I was hoping to have them all at a REST URL even if it isn't a REST application under the hood. I don't know if that's worth the effort. I wanted me front end to have a text box that showed all the messages the Celery task was generating--including ones that were generated before the user first connected to it. So if the user looks at the status well after it completed, they'd see all the messages for that task. If they connect midway, it would show what was already written to a file and then receive new messages in real time.

ELK looks like it can be hooked up to Django as a separate app. I could compromise on using a different URL.

Thermopyle posted:

Hmm. I think I'd consider using django-channels with websockets.

I think I saw a tutorial for doing something similar come across my rss feeds earlier today, give me a few minutes...

edit: https://realpython.com/blog/python/getting-started-with-django-channels/

Rocko Bonaparte posted:

Given I haven't done a Django deployment yet and am still just trying the site from runserver, you all are scaring the poo poo out of me.

a witch posted:

django-channels is not very good, for a lot of reasons that have been covered at great length on django-developers.

You'll be better off running websockets in a separate process entirely than trying to make them fit into django. There are still great python options for this like Twisted or asyncio, you can even use continue to use the django ORM with them.

Feral Integral posted:

Having trouble with some django migrations. I have this pretty simple baseball app that models a 'player', 'stat', and 'pitch', and one of the fields on the player is

code:

bbref_id = models.CharField(max_length=30, default=fake.first_name())

. To try and work out the problem, I dropped my postgres database, recreated it, deleted the migrations folder and all .pyc files in the app directory and ran:

code:

python manage.py makemigrations baseball

Migrations for 'baseball':
  0001_initial.py:
    - Create model Match
    - Create model Pitch
    - Create model Player
    - Create model Stat
    - Add field batter to pitch
    - Add field pitcher to pitch

which turns out fine. Then I run migrate and it tells me I still have some migrations so I do that:

code:

python manage.py makemigrations

Migrations for 'baseball':
  0002_auto_20170301_2040.py:
    - Alter field bbref_id on player
    - Alter field birth_city on player
    - Alter field birth_country on player
    - Alter field birth_state on player
    - Alter field death_city on player
    - Alter field death_country on player
    - Alter field death_state on player
    - Alter field first_name on player
    - Alter field last_name on player
    - Alter field middle_name on player
    - Alter field player_id on player
    - Alter field retro_id on player

then I try migrate and I get:

code:

python manage.py migrate

...
django.db.utils.ProgrammingError: column "bbref_id" of relation
"baseball_player" does not exist

But in the above makemigrations it says that this field was altered, so why doesn't the column exist? I think I'm suffering from a lack of understanding of what the migration is actually doing, anyone know what I'm loving up here?

Thermopyle posted:

edit: this post made more sense in relation to the previous post that was removed! I'll leave it as commiseration.

Dominoes posted:

-If there's real data saved, update the DB with SQL from a console for the app that's broken (Ie other apps might still work with migrations). Migrations will never work again for that app, but your website and database will work.

Tomie knows me posted:

Wouldn't it be better to add this to a custom migration with RunSQL? That way you'll at least have a record of what was run in version control.

e: this is also a good way to add indexes that the orm doesn't natively support!

Dominoes posted:

-Use migrations until they break. Adding tables and fields is usually fine; modifications are a gamble.

Dominoes posted:

And there's no official guidance about what unsuitable means, and django doesn't warn you, or provide an undo option if it doesn't work. So yes, I expect them to break. And I expect there's room for improvement, ie this will be fixed within a few years.

Data Graham posted:

Hey guys. I'm getting myself embroiled in a bit of a philosophical war with a business associate over whether I can use Django for production apps, or (his preference) that we use Java for everything.

His objections to Django are that it's a "toy", that it's hardly better than WordPress from an architectural standpoint, and (probably the biggest sticking point right now) that there's no way to protect secret strings like the database password.

In his ideal world there's no way for a local user on the server to be able to extract those secret strings from the web app, because they're compiled into an executable binary or archive. In Django you have to have your secret strings either sitting in plaintext in the settings.py file, or imported from some other file that's readable by the www user anyway, which means anyone who's able to hijack a login shell of a user who has access to those files would get the keys to the kingdom.

I know this is kind of a wacky irrational position to take and that best practices are such that basically if anyone gets local shell access you should consider your system totally compromised, but that's not good enough for him. I want to see if there's any possible way I can harden a Django/Apache/mod_wsgi installation to his satisfaction.

The best solution I've been able to come up with has been to set the secret strings in the httpd.conf (in the vhost), setting them as environment variables with SetEnv statements, and then importing them into the application with a custom call to get_wsgi_application() in wsgi.py. Theoretically that was good because you could then make your httpd.conf readable only by root and it would pass the variables at startup and be inaccessible to no non-root users; but turns out that's not good enough either because he doesn't want to run apache as root either, for security reasons. I'm back to having the strings in a file readable by the www user, which there doesn't seem to be a way around.

Has anyone been able to figure out an ingenious way around this? I would very very very much like to continue using Django for our projects and not have to use ColdFusion (which he loves because all the sensitive strings are encrypted at the app server level and a local user has no access to it), or some JSP platform which I'm not sure why he thinks would be any more secure because to my knowledge all the JSP frameworks involve storing passwords and such in cleartext just like in Django. I'd rather not fall back on that argument either; I'd want to know if there's some way of locking down Django itself.

Data Graham posted:

epalm posted:

I get the feeling that, even if you convince your associate of a solution to the secret-hiding problem, he/she is just going to find more "reasons" to use the thing they've already decided they want to use.