"""
views.py
"""
from django.views.generic.base import View
from django.template.response import TemplateResponse
from django.template.base import TemplateDoesNotExist
from django.http import Http404
class PageView(View):
def get(self, request, *args, **kwargs):
slug = kwargs['slug']
# Fallback to search a index page if url ends with '/'
slug = '%sindex' % slug if slug.endswith('/') else slug
template = 'pages/%s.html' % slug
response = TemplateResponse(request, template, {})
# test if the template exists before the common middleware
# try to automatically render the response
try:
response.resolve_template(template)
except TemplateDoesNotExist:
raise Http404('Page "%s" is not found' % slug)
return response
"""
urls.py
"""
from django.conf.urls import patterns, url
from project.pages import views
urlpatterns = patterns('',
url(r'^(?P<slug>.+)$', views.PageView.as_view()),
url(r'^$', views.PageView.as_view(), {'slug':'welcome'}) # Easy to add aliases
)
Comments
Does this not have a path vulnerability in it? Slug could be ../../../../../etc/passwd for example.
#