When writing a custom filter, give some thought to how the filter will interact\nwith Django's auto-escaping behavior. Note that two types of strings can be\npassed around inside the template code:
\n
\n
Raw strings are the native Python strings. On output, they're escaped if\nauto-escaping is in effect and presented unchanged, otherwise.
\n
Safe strings are strings that have been marked safe from further\nescaping at output time. Any necessary escaping has already been done.\nThey're commonly used for output that contains raw HTML that is intended\nto be interpreted as-is on the client side.
\n
Internally, these strings are of type\nSafeText. You can test for them\nusing code like:
\n
Code
fromdjango.utils.safestringimportSafeText\n\nifisinstance(value,SafeText):\n # Do something with the "safe" string.\n ...\n
\n
\n
\n
Template filter code falls into one of two situations:
\n\n
Your filter does not introduce any HTML-unsafe characters (<, >,\n', " or &) into the result that were not already present. In\nthis case, you can let Django take care of all the auto-escaping\nhandling for you. All you need to do is set the is_safe flag to True\nwhen you register your filter function, like so:
This flag tells Django that if a "safe" string is passed into your\nfilter, the result will still be "safe" and if a non-safe string is\npassed in, Django will automatically escape it, if necessary.
\n
You can think of this as meaning "this filter is safe -- it doesn't\nintroduce any possibility of unsafe HTML."
\n
The reason is_safe is necessary is because there are plenty of\nnormal string operations that will turn a SafeData object back into\na normal str object and, rather than try to catch them all, which would\nbe very difficult, Django repairs the damage after the filter has completed.
\n
For example, suppose you have a filter that adds the string xx to\nthe end of any input. Since this introduces no dangerous HTML characters\nto the result (aside from any that were already present), you should\nmark your filter with is_safe:
When this filter is used in a template where auto-escaping is enabled,\nDjango will escape the output whenever the input is not already marked\nas "safe".
\n
By default, is_safe is False, and you can omit it from any filters\nwhere it isn't required.
\n
Be careful when deciding if your filter really does leave safe strings\nas safe. If you're removing characters, you might inadvertently leave\nunbalanced HTML tags or entities in the result. For example, removing a\n> from the input might turn <a> into <a, which would need to\nbe escaped on output to avoid causing problems. Similarly, removing a\nsemicolon (;) can turn & into &, which is no longer a\nvalid entity and thus needs further escaping. Most cases won't be nearly\nthis tricky, but keep an eye out for any problems like that when\nreviewing your code.
\n
Marking a filter is_safe will coerce the filter's return value to\na string. If your filter should return a boolean or other non-string\nvalue, marking it is_safe will probably have unintended\nconsequences (such as converting a boolean False to the string\n'False').
\n
\n
Alternatively, your filter code can manually take care of any necessary\nescaping. This is necessary when you're introducing new HTML markup into\nthe result. You want to mark the output as safe from further\nescaping so that your HTML markup isn't escaped further, so you'll need\nto handle the input yourself.
Be careful, though. You need to do more than just mark the output as\nsafe. You need to ensure it really is safe, and what you do depends on\nwhether auto-escaping is in effect. The idea is to write filters that\ncan operate in templates where auto-escaping is either on or off in\norder to make things easier for your template authors.
\n
In order for your filter to know the current auto-escaping state, set the\nneeds_autoescape flag to True when you register your filter function.\n(If you don't specify this flag, it defaults to False). This flag tells\nDjango that your filter function wants to be passed an extra keyword\nargument, called autoescape, that is True if auto-escaping is in\neffect and False otherwise. It is recommended to set the default of the\nautoescape parameter to True, so that if you call the function\nfrom Python code it will have escaping enabled by default.
\n
For example, let's write a filter that emphasizes the first character of\na string:
The needs_autoescape flag and the autoescape keyword argument mean\nthat our function will know whether automatic escaping is in effect when the\nfilter is called. We use autoescape to decide whether the input data\nneeds to be passed through django.utils.html.conditional_escape or not.\n(In the latter case, we just use the identity function as the "escape"\nfunction.) The conditional_escape() function is like escape() except\nit only escapes input that is not a SafeData instance. If a\nSafeData instance is passed to conditional_escape(), the data is\nreturned unchanged.
\n
Finally, in the above example, we remember to mark the result as safe\nso that our HTML is inserted directly into the template without further\nescaping.
\n
There's no need to worry about the is_safe flag in this case\n(although including it wouldn't hurt anything). Whenever you manually\nhandle the auto-escaping issues and return a safe string, the\nis_safe flag won't change anything either way.
When this flag is set, if the first argument to your filter is a time zone\naware datetime, Django will convert it to the current time zone before passing\nit to your filter when appropriate, according to rules for time zones\nconversions in templates.
Checking for the required number of arguments, etc., has already been\ndone by the time our function is called, so we don't need to do that.
\n
The quotes around the argument (if any) have already been stripped away,\nso we just receive a plain string.
\n
If the argument was a template variable, our function is passed the\ncurrent value of the variable, not the variable itself.
\n
\n
Unlike other tag utilities, simple_tag passes its output through\nconditional_escape() if the template context is in\nautoescape mode, to ensure correct HTML and protect you from XSS\nvulnerabilities.
\n
If additional escaping is not desired, you will need to use\nmark_safe() if you are absolutely sure that your\ncode does not contain XSS vulnerabilities. For building small HTML snippets,\nuse of format_html() instead of mark_safe() is\nstrongly recommended.
\n
If your template tag needs to access the current context, you can use the\ntakes_context argument when registering your tag:
Then in the template any number of arguments, separated by spaces, may be\npassed to the template tag. Like in Python, the values for keyword arguments\nare set using the equal sign ("=") and must be provided after the\npositional arguments. For example:
It's possible to store the tag results in a template variable rather than\ndirectly outputting it. This is done by using the as argument followed by\nthe variable name. Doing so enables you to output the content yourself where\nyou see fit:
\n
Django template
{%current_time"%Y-%m-%d %I:%M %p"asthe_time%}\n<p>The time is {{the_time}}.</p>\n
Another common type of template tag is the type that displays some data by\nrendering another template. For example, Django's admin interface uses custom\ntemplate tags to display the buttons along the bottom of the "add/change" form\npages. Those buttons always look the same, but the link targets change\ndepending on the object being edited -- so they're a perfect case for using a\nsmall template that is filled with details from the current object. (In the\nadmin's case, this is the submit_row tag.)
\n
These sorts of tags are called "inclusion tags".
\n
Writing inclusion tags is probably best demonstrated by example. Let's write a\ntag that outputs a list of choices for a given Poll object, such as was\ncreated in the tutorials. We'll use the tag like this:
First, define the function that takes the argument and produces a dictionary of\ndata for the result. The important point here is we only need to return a\ndictionary, not anything more complex. This will be used as a template context\nfor the template fragment. Example:
Next, create the template used to render the tag's output. This template is a\nfixed feature of the tag: the tag writer specifies it, not the template\ndesigner. Following our example, the template is very simple:
Now, create and register the inclusion tag by calling the inclusion_tag()\nmethod on a Library object. Following our example, if the above template is\nin a file called results.html in a directory that's searched by the\ntemplate loader, we'd register the tag like this:
\n
Code
# Here, register is a django.template.Library instance, as before\n@register.inclusion_tag('results.html')\ndefshow_results(poll):\n ...\n
\n
Alternatively it is possible to register the inclusion tag using a\ndjango.template.Template instance:
Sometimes, your inclusion tags might require a large number of arguments,\nmaking it a pain for template authors to pass in all the arguments and remember\ntheir order. To solve this, Django provides a takes_context option for\ninclusion tags. If you specify takes_context in creating a template tag,\nthe tag will have no required arguments, and the underlying Python function\nwill have one argument -- the template context as of when the tag was called.
\n
For example, say you're writing an inclusion tag that will always be used in a\ncontext that contains home_link and home_title variables that point\nback to the main page. Here's what the Python function would look like:
Note that the first parameter to the function must be called context.
\n
In that register.inclusion_tag() line, we specified takes_context=True\nand the name of the template. Here's what the template link.html might look\nlike:
\n
Django template
Jump directly to <ahref="{{link}}">{{title}}</a>.\n
\n
Then, any time you want to use that custom tag, load its library and call it\nwithout any arguments, like so:
\n
Django template
{%jump_link%}\n
\n
Note that when you're using takes_context=True, there's no need to pass\narguments to the template tag. It automatically gets access to the context.
\n
The takes_context parameter defaults to False. When it's set to\nTrue, the tag is passed the context object, as in this example. That's the\nonly difference between this case and the previous inclusion_tag example.
\n
inclusion_tag functions may accept any number of positional or keyword\narguments. For example:
Then in the template any number of arguments, separated by spaces, may be\npassed to the template tag. Like in Python, the values for keyword arguments\nare set using the equal sign ("=") and must be provided after the\npositional arguments. For example:
Sometimes the basic features for custom template tag creation aren't enough.\nDon't worry, Django gives you complete access to the internals required to build\na template tag from the ground up.
The template system works in a two-step process: compiling and rendering. To\ndefine a custom template tag, you specify how the compilation works and how\nthe rendering works.
\n
When Django compiles a template, it splits the raw template text into\n''nodes''. Each node is an instance of django.template.Node and has\na render() method. A compiled template is, simply, a list of Node\nobjects. When you call render() on a compiled template object, the template\ncalls render() on each Node in its node list, with the given context.\nThe results are all concatenated together to form the output of the template.
\n
Thus, to define a custom template tag, you specify how the raw template tag is\nconverted into a Node (the compilation function), and what the node's\nrender() method does.
For each template tag the template parser encounters, it calls a Python\nfunction with the tag contents and the parser object itself. This function is\nresponsible for returning a Node instance based on the contents of the tag.
\n
For example, let's write a full implementation of our simple template tag,\n{%current_time%}, that displays the current date/time, formatted according\nto a parameter given in the tag, in strftime() syntax. It's a good\nidea to decide the tag syntax before anything else. In our case, let's say the\ntag should be used like this:
\n
Django template
<p>The time is {%current_time"%Y-%m-%d %I:%M %p"%}.</p>\n
\n
The parser for this function should grab the parameter and create a Node\nobject:
\n
Code
fromdjangoimporttemplate\n\ndefdo_current_time(parser,token):\n try:\n # split_contents() knows not to split quoted strings.\n tag_name,format_string=token.split_contents()\n exceptValueError:\n raisetemplate.TemplateSyntaxError(\n "%r tag requires a single argument"%token.contents.split()[0]\n )\n ifnot(format_string[0]==format_string[-1]andformat_string[0]in('"',"'")):\n raisetemplate.TemplateSyntaxError(\n "%r tag's argument should be in quotes"%tag_name\n )\n returnCurrentTimeNode(format_string[1:-1])\n
\n
メモ:
\n
\n
parser is the template parser object. We don't need it in this\nexample.
\n
token.contents is a string of the raw contents of the tag. In our\nexample, it's 'current_time"%Y-%m-%d%I:%M%p"'.
\n
The token.split_contents() method separates the arguments on spaces\nwhile keeping quoted strings together. The more straightforward\ntoken.contents.split() wouldn't be as robust, as it would naively\nsplit on all spaces, including those within quoted strings. It's a good\nidea to always use token.split_contents().
\n
This function is responsible for raising\ndjango.template.TemplateSyntaxError, with helpful messages, for\nany syntax error.
\n
The TemplateSyntaxError exceptions use the tag_name variable.\nDon't hard-code the tag's name in your error messages, because that\ncouples the tag's name to your function. token.contents.split()[0]\nwill ''always'' be the name of your tag -- even when the tag has no\narguments.
\n
The function returns a CurrentTimeNode with everything the node needs\nto know about this tag. In this case, it just passes the argument --\n"%Y-%m-%d%I:%M%p". The leading and trailing quotes from the\ntemplate tag are removed in format_string[1:-1].
\n
The parsing is very low-level. The Django developers have experimented\nwith writing small frameworks on top of this parsing system, using\ntechniques such as EBNF grammars, but those experiments made the template\nengine too slow. It's low-level because that's fastest.
__init__() gets the format_string from do_current_time().\nAlways pass any options/parameters/arguments to a Node via its\n__init__().
\n
The render() method is where the work actually happens.
\n
render() should generally fail silently, particularly in a production\nenvironment. In some cases however, particularly if\ncontext.template.engine.debug is True, this method may raise an\nexception to make debugging easier. For example, several core tags raise\ndjango.template.TemplateSyntaxError if they receive the wrong number or\ntype of arguments.
\n
\n
Ultimately, this decoupling of compilation and rendering results in an\nefficient template system, because a template can render multiple contexts\nwithout having to be parsed multiple times.
The output from template tags is not automatically run through the\nauto-escaping filters (with the exception of\nsimple_tag() as described above). However, there\nare still a couple of things you should keep in mind when writing a template\ntag.
\n
If the render() function of your template stores the result in a context\nvariable (rather than returning the result in a string), it should take care\nto call mark_safe() if appropriate. When the variable is ultimately\nrendered, it will be affected by the auto-escape setting in effect at the\ntime, so content that should be safe from further escaping needs to be marked\nas such.
\n
Also, if your template tag creates a new context for performing some\nsub-rendering, set the auto-escape attribute to the current context's value.\nThe __init__ method for the Context class takes a parameter called\nautoescape that you can use for this purpose. For example:
\n
Code
fromdjango.templateimportContext\n\ndefrender(self,context):\n # ...\n new_context=Context({'var':obj},autoescape=context.autoescape)\n # ... Do something with new_context ...\n
\n
This is not a very common situation, but it's useful if you're rendering a\ntemplate yourself. For example:
If we had neglected to pass in the current context.autoescape value to our\nnew Context in this example, the results would have always been\nautomatically escaped, which may not be the desired behavior if the template\ntag is used inside a {%autoescapeoff%} block.
Once a node is parsed, its render method may be called any number of times.\nSince Django is sometimes run in multi-threaded environments, a single node may\nbe simultaneously rendering with different contexts in response to two separate\nrequests. Therefore, it's important to make sure your template tags are thread\nsafe.
\n
To make sure your template tags are thread safe, you should never store state\ninformation on the node itself. For example, Django provides a builtin\ncycle template tag that cycles among a list of given strings each time\nit's rendered:
But, suppose we have two templates rendering the template snippet from above at\nthe same time:
\n\n
Thread 1 performs its first loop iteration, CycleNode.render()\nreturns 'row1'
\n
Thread 2 performs its first loop iteration, CycleNode.render()\nreturns 'row2'
\n
Thread 1 performs its second loop iteration, CycleNode.render()\nreturns 'row1'
\n
Thread 2 performs its second loop iteration, CycleNode.render()\nreturns 'row2'
\n\n
The CycleNode is iterating, but it's iterating globally. As far as Thread 1\nand Thread 2 are concerned, it's always returning the same value. This is\nobviously not what we want!
\n
To address this problem, Django provides a render_context that's associated\nwith the context of the template that is currently being rendered. The\nrender_context behaves like a Python dictionary, and should be used to\nstore Node state between invocations of the render method.
\n
Let's refactor our CycleNode implementation to use the render_context:
Note that it's perfectly safe to store global information that will not change\nthroughout the life of the Node as an attribute. In the case of\nCycleNode, the cyclevars argument doesn't change after the Node is\ninstantiated, so we don't need to put it in the render_context. But state\ninformation that is specific to the template that is currently being rendered,\nlike the current iteration of the CycleNode, should be stored in the\nrender_context.
Although you can pass any number of arguments to a template tag using\ntoken.split_contents(), the arguments are all unpacked as\nstring literals. A little more work is required in order to pass dynamic\ncontent (a template variable) to a template tag as an argument.
\n
While the previous examples have formatted the current time into a string and\nreturned the string, suppose you wanted to pass in a\nDateTimeField from an object and have the template\ntag format that date-time:
\n
Django template
<p>This post was last updated at {%format_timeblog_entry.date_updated"%Y-%m-%d %I:%M %p"%}.</p>\n
\n
Initially, token.split_contents() will return three values:
\n\n
The tag name format_time.
\n
The string 'blog_entry.date_updated' (without the surrounding\nquotes).
\n
The formatting string '"%Y-%m-%d%I:%M%p"'. The return value from\nsplit_contents() will include the leading and trailing quotes for\nstring literals like this.
\n\n
Now your tag should begin to look like this:
\n
Code
fromdjangoimporttemplate\n\ndefdo_format_time(parser,token):\n try:\n # split_contents() knows not to split quoted strings.\n tag_name,date_to_be_formatted,format_string=token.split_contents()\n exceptValueError:\n raisetemplate.TemplateSyntaxError(\n "%r tag requires exactly two arguments"%token.contents.split()[0]\n )\n ifnot(format_string[0]==format_string[-1]andformat_string[0]in('"',"'")):\n raisetemplate.TemplateSyntaxError(\n "%r tag's argument should be in quotes"%tag_name\n )\n returnFormatTimeNode(date_to_be_formatted,format_string[1:-1])\n
\n
You also have to change the renderer to retrieve the actual contents of the\ndate_updated property of the blog_entry object. This can be\naccomplished by using the Variable() class in django.template.
\n
To use the Variable class, simply instantiate it with the name of the\nvariable to be resolved, and then call variable.resolve(context). So,\nfor example:
The above examples simply output a value. Generally, it's more flexible if your\ntemplate tags set template variables instead of outputting values. That way,\ntemplate authors can reuse the values that your template tags create.
\n
To set a variable in the context, just use dictionary assignment on the context\nobject in the render() method. Here's an updated version of\nCurrentTimeNode that sets a template variable current_time instead of\noutputting it:
Note that render() returns the empty string. render() should always\nreturn string output. If all the template tag does is set a variable,\nrender() should return the empty string.
\n
Here's how you'd use this new version of the tag:
\n
Django template
{%current_time"%Y-%m-%d %I:%M %p"%}<p>The time is {{current_time}}.</p>\n
\n\n
But, there's a problem with CurrentTimeNode2: The variable name\ncurrent_time is hard-coded. This means you'll need to make sure your\ntemplate doesn't use {{current_time}} anywhere else, because the\n{%current_time%} will blindly overwrite that variable's value. A cleaner\nsolution is to make the template tag specify the name of the output variable,\nlike so:
\n
Django template
{%current_time"%Y-%m-%d %I:%M %p"asmy_current_time%}\n<p>The current time is {{my_current_time}}.</p>\n
\n
To do that, you'll need to refactor both the compilation function and Node\nclass, like so:
\n
Code
importre\n\nclassCurrentTimeNode3(template.Node):\n def__init__(self,format_string,var_name):\n self.format_string=format_string\n self.var_name=var_name\n defrender(self,context):\n context[self.var_name]=datetime.datetime.now().strftime(self.format_string)\n return''\n\ndefdo_current_time(parser,token):\n # This version uses a regular expression to parse tag contents.\n try:\n # Splitting by None == splitting by spaces.\n tag_name,arg=token.contents.split(None,1)\n exceptValueError:\n raisetemplate.TemplateSyntaxError(\n "%r tag requires arguments"%token.contents.split()[0]\n )\n m=re.search(r'(.*?) as (\\w+)',arg)\n ifnotm:\n raisetemplate.TemplateSyntaxError("%r tag had invalid arguments"%tag_name)\n format_string,var_name=m.groups()\n ifnot(format_string[0]==format_string[-1]andformat_string[0]in('"',"'")):\n raisetemplate.TemplateSyntaxError(\n "%r tag's argument should be in quotes"%tag_name\n )\n returnCurrentTimeNode3(format_string[1:-1],var_name)\n
\n
The difference here is that do_current_time() grabs the format string and\nthe variable name, passing both to CurrentTimeNode3.
\n
Finally, if you only need to have a simple syntax for your custom\ncontext-updating template tag, consider using the\nsimple_tag() shortcut, which supports assigning\nthe tag results to a template variable.
Template tags can work in tandem. For instance, the standard\n{%comment%} tag hides everything until {%endcomment%}.\nTo create a template tag such as this, use parser.parse() in your\ncompilation function.
\n
Here's how a simplified {%comment%} tag might be implemented:
parser.parse() takes a tuple of names of block tags ''to parse until''. It\nreturns an instance of django.template.NodeList, which is a list of\nall Node objects that the parser encountered ''before'' it encountered\nany of the tags named in the tuple.
\n
In "nodelist=parser.parse(('endcomment',))" in the above example,\nnodelist is a list of all nodes between the {%comment%} and\n{%endcomment%}, not counting {%comment%} and {%endcomment%}\nthemselves.
\n
After parser.parse() is called, the parser hasn't yet "consumed" the\n{%endcomment%} tag, so the code needs to explicitly call\nparser.delete_first_token().
\n
CommentNode.render() simply returns an empty string. Anything between\n{%comment%} and {%endcomment%} is ignored.
In the previous example, do_comment() discarded everything between\n{%comment%} and {%endcomment%}. Instead of doing that, it's\npossible to do something with the code between block tags.
\n
For example, here's a custom template tag, {%upper%}, that capitalizes\neverything between itself and {%endupper%}.
\n
Usage:
\n
Django template
{%upper%}This will appear in uppercase, {{your_name}}.{%endupper%}\n
\n
As in the previous example, we'll use parser.parse(). But this time, we\npass the resulting nodelist to the Node:
The only new concept here is the self.nodelist.render(context) in\nUpperNode.render().
\n
For more examples of complex rendering, see the source code of\n{%for%} in django/template/defaulttags.py and\n{%if%} in django/template/smartif.py.
\n\n","rootId":"custom-template-tags-and-filters","toc":[{"title":"コードのレイアウト","anchor":"code-layout","children":[]},{"title":"独自のテンプレートフィルタを記述する","anchor":"writing-custom-template-filters","children":[{"title":"独自のフィルタを登録する","anchor":"registering-custom-filters","children":[]},{"title":"文字列を要するテンプレートフィルタ","anchor":"template-filters-that-expect-strings","children":[]},{"title":"フィルタと自動エスケープ","anchor":"filters-and-auto-escaping","children":[]},{"title":"Filters and time zones","anchor":"filters-and-time-zones","children":[]}]},{"title":"独自のテンプレートタグを記述する","anchor":"writing-custom-template-tags","children":[{"title":"シンプルなタグ","anchor":"simple-tags","children":[]},{"title":"Inclusion tags","anchor":"inclusion-tags","children":[]},{"title":"Advanced custom template tags","anchor":"advanced-custom-template-tags","children":[]},{"title":"A quick overview","anchor":"a-quick-overview","children":[]},{"title":"Writing the compilation function","anchor":"writing-the-compilation-function","children":[]},{"title":"Writing the renderer","anchor":"writing-the-renderer","children":[]},{"title":"Auto-escaping considerations","anchor":"auto-escaping-considerations","children":[]},{"title":"Thread-safety considerations","anchor":"thread-safety-considerations","children":[]},{"title":"Registering the tag","anchor":"registering-the-tag","children":[]},{"title":"Passing template variables to the tag","anchor":"passing-template-variables-to-the-tag","children":[]},{"title":"Setting a variable in the context","anchor":"setting-a-variable-in-the-context","children":[]},{"title":"Parsing until another block tag","anchor":"parsing-until-another-block-tag","children":[]},{"title":"Parsing until another block tag, and saving contents","anchor":"parsing-until-another-block-tag-and-saving-contents","children":[]}]}],"breadcrumbs":[{"docname":"howto/index","title":"「How-to」ガイド","url":"/ja/2.2/howto/"}],"prev":{"docname":"howto/custom-lookups","title":"カスタムのルックアップ","url":"/ja/2.2/howto/custom-lookups/"},"next":{"docname":"howto/custom-file-storage","title":"カスタムストレージシステムの作成","url":"/ja/2.2/howto/custom-file-storage/"},"formats":{"html":"/ja/2.2/howto/custom-template-tags/","markdown":"/ja/2.2/howto/custom-template-tags.md","json":"/ja/2.2/howto/custom-template-tags.json"},"source":"https://github.com/django/django/blob/stable/2.2.x/docs/howto/custom-template-tags.txt","official":"https://docs.djangoproject.com/ja/2.2/howto/custom-template-tags/","inVersions":["6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2","2.1","2.0","1.11","1.10","1.9"],"inLocales":["en","zh-hans","fr","ja","id","pt-br","ko","es","el","pl"]}