Simon Willison’s Weblog

Django Changeset 6671. Malcolm Tredinnick: “Implemented auto-escaping of variable output in templates”. Fantastic—Django now has protection against accidental XSS holes, turned on by default.

# 14th November 2007, 5:05 pm / malcolmtredinnick, django, autoescaping, xss, security, python, templating

Django Book Update. It’s done! Went to the printer on Friday, due in bookstores in the second week of December (just in time for Christmas). Congrats to Adrian and Jacob.

# 14th November 2007, 12:59 am / django-book, django, python, adrian-holovaty, jacob-kaplan-moss

Django documentation bookmarklets. James Bennett continues his month-long series of daily Django tutorials with documentation for one of Django’s best kept secrets: application introspection HTTP headers and bookmarklets that make use of them.

# 8th November 2007, 10:59 am / bookmarklets, django, james-bennett, python, introspection

Hello Revver.com 2.0. Revver, one of the more established video startups, have launched their new version which is powered by Django.

# 2nd November 2007, 7:03 am / django, revver, video, startups, python

Django security fix released. Django’s internationalisation system has a denial of service hole in it; you’re vulnerable if you are using the i18n middleware. Fixes have been made available for trunk, 0.96, 0.95 and 0.91.

# 26th October 2007, 9:47 pm / django, security, vulnerability, python, i18n, internationalisation, denialofservice

Using the extra() QuerySet modifier in Django for WeGoEat. You can use select() on a QuerySet to obtain extra values using subqueries.

# 24th October 2007, 7:28 pm / django, orm, queryset, python, subqueries, ryan-kanno

ASP.NET MVC Framework. This looks pretty good. It includes clean URL support that’s very similar to how Django does things (with a nice alternative syntax for developers who don’t like regular expressions).

# 22nd October 2007, 1:45 pm / aspnet, django, microsoft, mvc, scott-guthrie, urls

LastGraph. Now Available. Andrew Godwin has relaunched his LastGraph Last.fm graphing application. The new version is built on Django and S3 and uses Andrew’s Graphication graphing library based on Cairo.

# 15th October 2007, 10:02 pm / graphication, django, andrew-godwin, cairo, lastfm, lastgraph, python, s3, graphing

Two Weeks With Django. A Rails developer tries Django but ends up switching back to Rails. I think we could definitely take some steps towards making the initial user experience a bit smoother—currently you have to decide things like how you’ll serve static files and where you’ll keep your templates. Once you’ve got that lot set up it’s mostly plain sailing but it does mean there’s a bit of a bump in the learning curve.

# 15th October 2007, 9:51 pm / django, rails, john-taber

Two months with Ruby on Rails. Good rant—covers both the good and the bad. The first complaint is the lack of XSS protection by default in the template language. Django has the same problem, but the solution was 90% there when I saw Malcolm at OSCON.

# 9th October 2007, 12:23 pm / rails, django, python, ruby, xss, security

tranquil. Inspired take on the Django ORM to SQLAlchemy problem: lets you define your models with the Django ORM but use SQLAlchemy to run queries against them.

# 9th October 2007, 2:30 am / sqlalchemy, python, django, orm, djangoorm, models, tranquil

DbMigration—a schema migration tool for Django. Nice and simple tool for adding schema migrations to a Django application.

# 27th September 2007, 3:04 pm / django, orm, djangoorm, migrations, sql, python

djangogigs.com—from idea to release in 6 hours. Now that’s what I call rapid development.

# 26th September 2007, 4:53 pm / django, django-gigs, rapiddevelopment

Django GridContainer. Media Temple’s virtualized Django hosting is now accepting applications for beta testers.

# 22nd September 2007, 12:01 pm / mediatemple, django, hosting, virtualization, gridcontainer

Zope3 for Djangoers. I prefer “Djangonauts”, personally. Useful overview of Zope 3 for people with Django experience (first of a multi-part series).

# 14th September 2007, 3:20 pm / django, djangonauts, zope, zope3, python

Restructured Text to Anything. Slick set of online tools for converting Restructured Text (one of the more mature wiki-style markup languages) to HTML or PDF. Includes a nice looking API. Powered by Django.

# 13th September 2007, 3:54 pm / django, restructuredtext, python, html, pdf

django-sphinx (via) More code from Curse Gaming; this time a really nice API for adding Sphinx full-text search to a Django model.

# 9th September 2007, 12:35 am / django, python, orm, search, sphinx-search, cursegaming, david-cramer, full-text-search

Advanced Django. Slides from my hour long tutorial at PyCon UK this morning. Most of the material was adapted from OSCON, but I also added a new section covering newforms.

# 8th September 2007, 1 pm / slides, pyconuk, newforms, django, pyconuk2007, slideshare, talks, tutorial, python

Django on Jython: What I’ve done until now. It’s not quite there yet (the new Jython is Python 2.2 with a few 2.3 features; Django requires 2.3 at least) but it’s looking pretty promising.

# 4th September 2007, 2:53 am / django, python, jython, java

Django vs feedparser on dates. Some useful tips in the comments. I find Python’s timezone stuff endlessly frustrating: I know it can do what I want, but it always takes me a ridiculously long time to figure out the necessary incantations.

# 2nd September 2007, 10:17 am / python, datetime, django, feedparser, timezones

A Django Cache Status. Django view to display stats pulled from your memcached server.

# 25th August 2007, 2:08 pm / memcached, django, fredrik-lundh

Satchmo 0.5 Release. Django powered e-commerce application, “the webshop for perfectionists with deadlines”.

# 22nd August 2007, 10:36 pm / django, satchmo, releases, python

Django and the iPhone tutorial. How to install SSH, Python and Django on your iPhone and get Django running against the call database. Less complicated than I expected.

# 21st August 2007, 11:34 am / django, iphone, tutorial, jay-baird

BabelDjango. Tools for integrating Christopher Lenz’s Babel i18n framework with Django.

# 20th August 2007, 2:59 pm / christopher-lenz, django, babel, python, i18n

Django on the iPhone. Jacob got it working. The next image in his photostream shows the Django admin application querying his phone’s local database of calls.

# 19th August 2007, 7:58 am / jacob-kaplan-moss, django, python, iphone, apple

Changeset 5925. You can now register custom commands for your application with Django’s manage.py script. More sensible than littering your application’s root directory with shell scripts.

# 18th August 2007, 11:06 am / django, python, managepy

AuditTrail. Add change tracking and history to a Django model with a single line of code. Doesn’t handle relationships though, which is definitely the toughest part of this problem.

# 15th August 2007, 1 pm / django, orm, history, audittrail, python

Finding Lookup Items that Are Not Used. How to do left outer joins (and other custom SQL) using the Django ORM.

# 13th August 2007, 5:08 pm / django, orm, sql, michael-trier, python

Ubuntu -- python-django. Sweet, Django 0.96 is packaged for Ubuntu Gutsy.

# 11th August 2007, 8:47 am / django, python, ubuntu, gutsy