将对象通过 Django 模板传递给 javascript

Question

I am making a website using Django and I want to pass a python object from my view (where it is created) through the Django template and to a Dajax call. The problem is that by the time it gets to dajax it has been turned into type unicode.

In my Template

<script>
var emailer = "{{emailer|safe}}"; <---If I omit the quotes here then I get a javascript error.
sessionStorage.setItem('emailer',emailer);
$(document).ready(function(){

  $('.send').on('click', function(e){  
    var emailer = sessionStorage.getItem('emailer');

    Dajaxice.InterfaceApp.sendEmail(submitverify,{'emailer':emailer});
  });
});

</script>

The dajax function

@dajaxice_register(method='GET')
def sendEmail(emailer):
    logger.warning("type: %s, %s" % (type(emailer),emailer))
    email_body = "message"
    emailer.addToMessage(email_body)
    emailer.send()

    message = "Email Sent"
return json.dumps({'message':message})

Here the logger statement returns: type: <type 'unicode'>, <Utils.SIMPL_Emailer instance at 0x103142ab8> . Is there any way to fix this so that I get my emailer object instead of a unicode string?

Answer 1

First try to understand what is happening:

On your template you're trying to save a Python object to a Javascript var:

var emailer = "{{emailer|safe}}";`

But it's not possible. When your template is rendered by Django what you really get is a call to object __str__() method and your Javascript will store the <Utils.SIMPL_Emailer instance at 0x103142ab8> value on your emailer var. And remember: this code run in the client browser. That's why you get an error when you remove the quotes.

To solve it you need to first serialize your emailer object (Turn it into something that could be represented as a String, for example, and then turned back to Python Object). But as pointed by Peter DeGlopper it is a very insecure approach. Never, ever deserialize an whole object that was public accessible. Instead send only the email data to your template. You can create a dictionary with this data, turn it into JSON (it's a serialization too, but this time you are serializating only data) and then pass it to your template.

So do not put your emailer on the template context. Instead create a dictonary and pass it to the template.

Then in your Python sendEmail(emailer) method you'll need to instanciate a new Emailer object and feed it with the data, like:

@dajaxice_register(method='GET')
def sendEmail(email_json):
    email = json.loads(email_json) # email_json is a json with your email data only
    logger.warning("type: %s, %s" % (type(email_json),email_json))
    emailer = Emailer("<with all your params...>")
    emailer.addToMessage(email.get('body'))
    emailer.send()

    message = "Email Sent"
    return json.dumps({'message':message})