Re: unicode-branch: string handling

2007-04-17 Thread Michael Radziej
Hi Malcolm Tredinnick wrote: > What I don't think is the right answer is to suddenly start making > gettext() behave as if it were ugettext() -- using the wrong name for > something will lead to confusion for people who use Django as a tool, > not as a lifestyle choice. Certainly. Think about th

Re: Escaping in templates...

2007-04-17 Thread Malcolm Tredinnick
On Tue, 2007-04-17 at 20:35 -0700, Simon G. wrote: > Sorry - I just skim read the discussions on it in "AutoEscape" and > "AutoEscaping Alternative" where that was mentioned. Wasn't making any > value judgements :-) Unfortunately, the AutoEscapingAlternative page uses strawmen to try and make its

Re: Escaping in templates...

2007-04-17 Thread Simon G.
Sorry - I just skim read the discussions on it in "AutoEscape" and "AutoEscaping Alternative" where that was mentioned. Wasn't making any value judgements :-) --Simon On Apr 18, 2:49 pm, Malcolm Tredinnick <[EMAIL PROTECTED]> wrote: > On Tue, 2007-04-17 at 05:00 -0700, Simon G. wrote: > > If you

Re: unicode-branch: string handling

2007-04-17 Thread Malcolm Tredinnick
Hey Michael, On Tue, 2007-04-17 at 10:31 +0200, Michael Radziej wrote: > Hi Malcom and you all, > > On Tue, Apr 10, Malcolm Tredinnick wrote: > > > What I'd really like from you guys (Michael, Ivan, Gábor -- and anybody > > else who wants to play along) is to see how the code fits in with your

Re: Escaping in templates...

2007-04-17 Thread Malcolm Tredinnick
On Tue, 2007-04-17 at 09:08 -0400, Ned Batchelder wrote: > I've been following this discussion with interest. XSS fragility is a > real weak point for text-based templating engines, and we need to find a > solution. > > On the topic of HTML-escaping vs. general escaping: Absolutely the > reas

Re: Escaping in templates...

2007-04-17 Thread Malcolm Tredinnick
On Tue, 2007-04-17 at 05:00 -0700, Simon G. wrote: > This is one of those issues which is never going to please everyone. > > So - I've started a list of the various proposals (1), and could you > all add any other proposals to this page, along with any pros/cons, > and vote on the one(s) you pre

Re: Type coercion in Django

2007-04-17 Thread Russell Keith-Magee
On 4/17/07, Gulopine <[EMAIL PROTECTED]> wrote: > My main questions are these: > > * Am I right in thinking that Django's to_python method should be used > for type coercion, rather than relying solely on backend drivers? Historically, to_python existed for the manipulator framework to convert t

Re: GeoDjango query with foreign keys

2007-04-17 Thread Matt Bartolome
I wouldn't think this would actually work but I just put the objects = models.GeoManager() on my model and it now knows what to do with the spatial queries. Excellent. On 4/17/07, mattxbart <[EMAIL PROTECTED]> wrote: > Hey guys, I'm working with the GeoDjango branch and I was wondering if > ther

GeoDjango query with foreign keys

2007-04-17 Thread mattxbart
Hey guys, I'm working with the GeoDjango branch and I was wondering if there are any plans to allow something like I have below: >>> ParcelSale.objects.filter(parcel__poly__contained=cpa.get_poly_wkt()) "parcel" is a foreign key to the geometry model information: class Parcel(models.Model,model

Re: ImageField upload_to keyword could get a id wildcard

2007-04-17 Thread [EMAIL PROTECTED]
Clarification: I threw together my response really fast and it does not really get the discussion started on this, and I did not mean to recommend my extension implementation; just the opposite, it sucks. Lets try this again. I like your Idea allot and have had to do some questionable extensions

Re: Resize images on demand

2007-04-17 Thread Jacob Kaplan-Moss
Hey Michel -- Please direct questions of this nature to django-users; django-dev is used to discuss the development of Django itself, not to answer usage questions. Thanks! Jacob --~--~-~--~~~---~--~~ You received this message because you are subscribed to the G

Re: ImageField upload_to keyword could get a id wildcard

2007-04-17 Thread [EMAIL PROTECTED]
I think this is a good Idea, and even better one would be to have it use a related field name, so that any other field can be used, not just the PK or ID. I have an implementation that is no where near as useful (as it does not support pattern replacement) called RelatedFileField (could easilly b

Resize images on demand

2007-04-17 Thread Michel Thadeu Sabchuk
Hi guys! I done a cool functionality to my site, the possibility to resize images on demand. It's not 100% done yet but my goal is to do something like: ... class Article(models.Model): photo = models.ImageField(upload_to='some/path/some/where') def get_photo_200x200(self): retur

ImageField upload_to keyword could get a id wildcard

2007-04-17 Thread Michel Thadeu Sabchuk
Hi guys! I thinking on the possibility to put the id of object on the path where a image will be uploaded. Ex: class Test(models.Model): image = models.ImageField(upload_to='path/%Y/%m/%d/%(id)d') This way I can preserve the file name untouched and can be sure will have a unique filename. I

Re: Escaping in templates...

2007-04-17 Thread Michael Radziej
On Tue, Apr 17, Tom Tobin wrote: > I think you misunderstood me; I'm not saying there should be a > general-output escaping framework. I'm saying that if there *is* an > HTML escaping framework, the object/variable naming should make it > clear that we're dealing with HTML-specific escaping wher

Type coercion in Django

2007-04-17 Thread Gulopine
Hi all, I had submitted a patch recently (#3982) that forces Django to use the to_python method of individual fields when retrieving objects from a database. I'm not being impatient, but I'd like to get some additional feedback on this, in case I'm going about it all wrong, or if I'm missing some

Re: Escaping in templates...

2007-04-17 Thread Tom Tobin
On 4/17/07, Michael Radziej <[EMAIL PROTECTED]> wrote: > > > > I'm still -1 on autoescaping as implemented in the latest patch in > > #2359; the terminology used is strongly HTML-centric (e.g., > > ``convert_to_words.is_safe`` -- safe from what?). We should be using > > naming that makes it expli

Re: Escaping in templates...

2007-04-17 Thread Ned Batchelder
I've been following this discussion with interest. XSS fragility is a real weak point for text-based templating engines, and we need to find a solution. On the topic of HTML-escaping vs. general escaping: Absolutely the reason to do auto-escaping is to make it dead easy to avoid XSS problems

Re: Possible inconsistency in template tag docs

2007-04-17 Thread Jacob Kaplan-Moss
On 4/16/07, Brian Morton <[EMAIL PROTECTED]> wrote: > For "T", the docs say that it will output the "Time zone of this machine". > To me, this implies that it will read from tzdata. However, this actually > outputs the time zone specified in the project settings file, which I think > is the inten

Re: Escaping in templates...

2007-04-17 Thread Simon G.
This is one of those issues which is never going to please everyone. So - I've started a list of the various proposals (1), and could you all add any other proposals to this page, along with any pros/cons, and vote on the one(s) you prefer. This way we can get some idea of what a consensus view

Re: unicode-branch: string handling

2007-04-17 Thread Michael Radziej
Hi Malcom and you all, On Tue, Apr 10, Malcolm Tredinnick wrote: > What I'd really like from you guys (Michael, Ivan, Gábor -- and anybody > else who wants to play along) is to see how the code fits in with your > existing workflow. How do the translation functions gettext() (_()) etc. fit in?

Re: Escaping in templates...

2007-04-17 Thread Michael Radziej
Hi Tom, On Mon, Apr 16, Tom Tobin wrote: > I haven't been participating much on Django-dev over the last few > months, but this made me go "eep?". > > I'm still -1 on autoescaping as implemented in the latest patch in > #2359; the terminology used is strongly HTML-centric (e.g., > ``convert_to_