This is the second installment of the lecture I gave at the Israeli Pythoneers Meeting. In case that you missed it, it is recommended that you read the first part of it.
At this point, I closed OpenOffice Impress and said that I would demonstrate how quickly you could get a functional Web application up and running with TurboGears.
Setting Things Up
I’ve quick-started a new project called TurboGallery…
$ tg-admin quickstart
Enter project name: TurboGallery
Enter package name [turbogallery]: <Enter>
Do you need Identity (usernames/passwords) in this project? [no] <Enter>
…and gone inside its directory to run it:
$ cd TurboGallery
$ python start-turbogallery.py
I started Firefox and browsed to http://localhost:8080. “There is already something to see on the site,” I said. The TurboGears’ default welcome page was showing up.
“The next thing I always do is to delete the entire body of the welcome template.” So, I opened welcome.kid in my favorite text editor and did just that. I then refreshed the page in Firefox. All the contents were gone except for the TurboGears’ header and the footer, which said, “TurboGears under the hood.” Someone asked if there was any way to remove those two remaining items. “Absolutely,” I said. It was time to mention master.kid. I opened the file and explained that it is used to render the layout that is common to all pages. As such, you do not have to duplicate it in all your templates. I next removed the TurboGears’ footer but left the header in its place.
I then opened model.py and added a class that would represent a single photo:
from datetime import datetime
class Photo(SQLObject):
title = UnicodeCol()
date = DateTimeCol(default=datetime.now)
image = BLOBCol()
thumbnail = BLOBCol()
A photo will have a title and a date field, which indicates the time it was uploaded. The field’s default argument makes the date of a newly created photo object be the current date. That way, you don’t need to specify this information every time you create a new photo. In the above definition, we don’t give the date field the current time. Rather, we give it a function that returns the current time. Whenever a photo is created, this function will be called to determine the value for this field. We store the images inside the database together with a thumbnail. BLOB stands for binary large object. The thumbnail part was not actually used in the tutorial.
Next, I created a database with
$ tg-admin sql create
I was then asked how TurboGears knows where and how to access the database. I replied that the default TurboGears’ setting uses SQLite, which creates a database-in-a-file. It is very convenient to have your database readily available as a normal file while your project is in its development and testing phases.
To save time, I have prepared in advance a database that contains four photos. I replaced the database file that was just created with my copy. The next thing to do will be to display the photos on the main page. I modified the index() method into…
@expose(template="turbogallery.templates.welcome")
def index(self):
photos = Photo.select()
return dict(photos=photos)
…and uncommented the “from model import *” line. The index() method is called whenever the front page of the Web site is viewed. I explained the expose() decorator, which makes a method available to the outside world. Without it, the method could not be accessed from the Web. The template argument specifies which template should be used to render the page.
The index() method gets a list of all photos from the database and returns it inside a dictionary. TurboGears passes this dictionary to the template. I then moved back to welcome.kid and added the following to the body:
<ul>
<li py:for="photo in photos">${photo.title}</li>
</ul>
<hr/>
I refreshed the page, and the list of photos was displayed. It is educational to view the source of the resulting page, but the people who were listening to my lecture wanted to see the photos straightaway.
Seeing Some Photos
To see the photos, we’ll have to add an IMG element to the list. The IMG element will get the photo file from another URL. I’ve changed the welcome.kid list into…
<ul class="photo_list">
<li py:for="photo in photos">
<img src="/images/${photo.id}"
id="image${photo.id}" width="160"/><br/>
<a href="/photo_info/${photo.id}">${photo.title}</a>
</li>
</ul>
<hr/>
…and then added the following photo_info() method to the controller:
@expose()
def images(self, photo_id):
return "Hello "+photo_id
I next browsed to /images/world, and the browser displayed “Hello world.” The goal of this step was to demonstrate to the audience how TurboGears (CherryPy) maps URLs to methods. It was also intended to illustrate how easily a part of the URL can be transformed into positional arguments.
The right thing to put in this function would be a query that would obtain the photo from the database and return the associated jpeg file. Here is the code:
@expose(content_type=‘image/jpeg’)
def images(self, photo_id):
photo = Photo.get(photo_id)
return photo.image
I refreshed the page, and the photos I’d prepared were now showing. (I also changed the CSS file when no one was looking to have this layout.)
In the second picture, you can see me evangelizing for the use of Firefox in Thailand.
Since this is just an example application to make things simple, the image is sent in full size and is resized by the browser.
Clicking on the caption below the images sends us to a page we haven’t yet created. This page will display the photo in full size together with some statistics on it. I saved welcome.kid as photo_info.kid and changed the body contents to:
<h1>Photo Details for "${photo.title}"
<img id="image${photo.id}" src="/images/${photo.id}"/>
<ul>
<li>Image size: ${len(photo.image)} bytes</li>
<li>Uploaded at: ${photo.date}</li>
</ul>
The corresponding method in controllers.py() would be:
@expose(template="turbogallery.templates.photo_info")
def photo_info(self, photo_id):
photo = Photo.get(photo_id)
return dict(photo=photo)
Share Your Photos
An online gallery application is quite useless if its users can’t upload photos from their own computers. As such, we need to create an image upload form. In TurboGears, creating forms and validating user input is very easy. I’ve added a form definition to the top of controllers.py. The first part defines the fields:
from turbogears.
widgets import *
from turbogears
import *
class AddPhotoFields(WidgetsList):
title = TextField(label=‘Title:’)
image = FileField(label=‘Photo:’)
The form will have a text input field for the title of the photo as well as a field that enables the selection of an image file from the user’s computer. The second part of the definition is the validation schema for this form:
class AddPhotoSchema(validators.Schema):
title = validators.String(not_empty=True, max=16)
“The touchiest issue with any Web application is its users,” I said. “Without them, there is no need to worry about bugs or invalid input.” The validation makes sure the input your Web application receives is a sound one. In many cases, further validation is needed. The above validator makes sure the title is not empty and is no longer than 16 letters. One audience member asked if the validation can be specified inside the fields definition. Yes, it is possible to specify a validator as a keyword argument to a field definition, but making the validation schema exterior to the fields definition renders it possible to define a more complex schema that involves field dependency or logical operators. A common instance where such a schema is useful is in the validation of a registration form, where you have to check whether or not the entered password field text and the “reenter password field” match.
The last part of the form definition ties the previous two parts together, with text for the submit button and a URL that will handle the form data:
add_photo_form = TableForm(fields=AddPhotoFields(),
validator=AddPhotoSchema(),
submit_text=‘Upload!’,
action=‘/upload’,
)
I’ve created a template named add.kid that will display just the form:
<h1>Add New Photo</h1>
${form()}
I’ve also added a controller method to make this page accessible…
@expose(template="turbogallery.templates.add")
def add(self):
return dict(form=add_photo_form)
…and I’ve linked to it from welcome.kid.
Here is a screenshot of this page:
As you can see, TurboGears gives us a nice form without us having to type in any HTML at all. Clicking the Upload! Button posts the data to the /upload URL. To test the form, I’ve added the corresponding method to the controller:
@expose()
@validate(form=add_photo_form)
@error_handler(add)
def upload(self, title, image):
return "hi"
The decorators that are attached to this method make TurboGears validate its input using the add_photo_form. If a validation error occurs, the response is handled by the add() method, which just displays the form again along with the validation errors. So if, for example, we type in a too-long title, we will get the following:
I would now really like to make the method save the image in a new photo object. The following code will do:
@expose()
@validate(form=add_photo_form)
@error_handler(add)
def upload(self, title, image):
image = image.file.read()
Photo(title=title, image=image, thumbnail=None)
flash("Image successfully added!")
raise redirect(‘/’)
Yes, handling a file upload in TurboGears is just a matter of reading from a file-like object. It is that simple. The next line creates a photo object with the title and the image data. The flash() method makes the given message appear on the next page, and we redirect to the main page. I filled out the form to upload an image that was downloaded from my camera. Here’s what I got:
Damn! I hate it when my camera decides to rotate an image that has already been uploaded. So, let’s add an AJAX image-rotation tool. A click on the rotate link will rotate the image in place without requiring the entire page to be reloaded. We first add a method to rotate the image to our controller:
@expose(‘json’)
def rotate(self, photo_id):
import Image
from cStringIO import StringIO
photo = Photo.get(photo_id)
image = Image.open(StringIO(photo.image))
rotated = image.rotate(90)
photo.image = rotated.tostring(‘jpeg’, ‘RGB’)
return dict(photo_id=photo_id, size=rotated.size)
The method uses PIL – Python Imaging Library. It loads the image from the database, rotates it, and then stores it again in the database. The method returns a dictionary containing the photo_id and the new photo dimensions. It is set to return the data in JSON format, which makes it extremely easy to use in Javascript. I directly entered http://localhost:8080/rotate/2 to show what the JSON object looks like. I then refreshed the main page to verify that the photo had been rotated. Next, I rotated it three more times until it was straight again.
I then went back to welcome.kid and added a rotate link for each photo:
<ul class="photo_list">
<li py:for="photo in photos">
<img src="/images/${photo.id}"
id="image${photo.id}" width="160"/><br/>
<a href="/photo_info/${photo.id}">${photo.title}</a>
<a href="#" onclick="rotate_photo(${photo.id}); return false;">(rotate)</a>
</li>
</ul>
Clicking on the “rotate” text located next to a photo will call a Javascript function that receives the corresponding photo ID. I’ve added the implementation of rotate_photo() to the top of the welcome.kid template. It uses MochiKit, which must be enabled in config/app.cfg (it is explained how to do so in that file).
<script type=
"text/javascript">
function rotate_photo
(photo_id
) {
d = loadJSONDoc
(‘/rotate/’+photo_id
);
d.
addCallback(update
);
}
function update(r) {
$(‘image’+r.photo_id).src=‘/images/’+(r.photo_id)+‘?random=’+Math.random();
}
</script>
The function makes an asynchronous call to the rotate URL, providing it with the photo ID. Once the response arrives, update() is called and is provided with the JSON object we returned from the controller’s rotate() method. In Javascript, you can use dot notation to access the keys in that dictionary. When update() is called, the image has already been rotated at the server. Therefore it is the right time for the browser to fetch it again. To perform this re-fetching, update() sets the image src attribute to the image URL, but in order to prevent the browser from displaying the cached old image, we add a random argument to the URL. You can see a related post describing how to prevent browsers from caching. To make the image() controller method accept this argument and ignore it, its definition becomes:
def images(self, photo_id, random=None):
I then refreshed the main page and rotated the photos a few times to demonstrate how slick this functionality is (especially when you’re working on the server). You can see it in the video below:
Next, I uploaded another image I had prepared in advance, this one called questions.jpg, using the upload form. Here it is:
It says “Questions?” in Hebrew, signifying that the lecture was over and it was time to ask questions.
Download the full source code of TurboGallery.
emoticon. From a mysterious reason, a few dozens of sad emoticons made Gaim choke. CPU usage was at 100% and the system felt highly unresponsive. It was impossible to use Gaim at all.
What good is an application—not matter how much information it contains—if the inability to easily search it renders it useless?
Following is the indexer code. It is tailored to TurboGears and SQLAlchemy, but it can be easily adapted to suit any ORM. It accepts three command line arguments: the configuration file, which helps it find the database (either dev.cfg or prod.cfg); the Xapian database location, which is simply a directory name; and a number of hours (such that all documents that were created or modified within this number of hours will be indexed). If you run the indexer every hour, you can safely give 2 as the third argument. If you’d like to re-index all articles, pass in 0 as the third argument.
Arm yourself and prepare for battle! This post is intended as a reminder about the possible security attacks your Web application may be vulnerable to. While it is not meant as a comprehensive guide to Web-application security, it can give you some ideas on how to better protect your applications.