Updated all apps and widgets with explicit safely marked strings

apps/common/utils.py

@@ -103,20 +103,6 @@ def pretty_size_10(size):
         ])
 
 
-def exists_with_famfam(path):
-    try:
-        return two_state_template(os.path.exists(path))
-    except Exception, exc:
-        return exc
-
-
-def two_state_template(state, famfam_ok_icon=u'tick', famfam_fail_icon=u'cross'):
-    if state:
-        return u'<span class="famfam active famfam-%s"></span>' % famfam_ok_icon
-    else:
-        return u'<span class="famfam active famfam-%s"></span>' % famfam_fail_icon
-
-
 # The code here is based loosely on John Cardinal's notes found at:
 # http://www.johncardinal.com/tmgutil/capitalizenames.htm
 

apps/common/widgets.py

@@ -47,3 +47,17 @@ class DetailSelectMultiple(forms.widgets.SelectMultiple):
         else:
             output += u'<li>%s</li>' % _(u"None")
         return mark_safe(output + u'</ul>\n')
+
+
+def exists_with_famfam(path):
+    try:
+        return two_state_template(os.path.exists(path))
+    except Exception, exc:
+        return exc
+
+
+def two_state_template(state, famfam_ok_icon=u'tick', famfam_fail_icon=u'cross'):
+    if state:
+        return mark_safe(u'<span class="famfam active famfam-%s"></span>' % famfam_ok_icon)
+    else:
+        return mark_safe(u'<span class="famfam active famfam-%s"></span>' % famfam_fail_icon)

apps/document_indexing/views.py

@@ -13,12 +13,7 @@ from document_indexing import PERMISSION_DOCUMENT_INDEXING_VIEW, \
 from document_indexing.models import IndexInstance
 from document_indexing.api import get_breadcrumbs, get_instance_link, \
     do_rebuild_all_indexes
-
+from document_indexing.widgets import index_instance_item_link
-
-def _index_instance_item_link(index_instance_item):
-    icon = u'folder_page' if isinstance(index_instance_item, IndexInstance) else u'page'
-    return u'<span class="famfam active famfam-%(icon)s"></span><a href="%(url)s">%(text)s</a>' % {
-        'url': index_instance_item.get_absolute_url(), 'icon': icon, 'text': index_instance_item}
 
 
 def index_instance_list(request, index_id=None):
@@ -42,7 +37,7 @@ def index_instance_list(request, index_id=None):
         'extra_columns_preffixed': [
             {
                 'name': _(u'item'),
-                'attribute': lambda x: _index_instance_item_link(x)
+                'attribute': lambda x: index_instance_item_link(x)
             }
         ],
         'title': title,

apps/document_indexing/widgets.py

@@ -0,0 +1,9 @@
+from django.utils.safestring import mark_safe
+
+from document_indexing.models import IndexInstance
+
+
+def index_instance_item_link(index_instance_item):
+    icon = u'folder_page' if isinstance(index_instance_item, IndexInstance) else u'page'
+    return mark_safe(u'<span class="famfam active famfam-%(icon)s"></span><a href="%(url)s">%(text)s</a>' % {
+        'url': index_instance_item.get_absolute_url(), 'icon': icon, 'text': index_instance_item})

apps/documents/__init__.py

@@ -9,7 +9,6 @@ from main.api import register_diagnostic, register_tool
 from permissions.api import register_permission, set_namespace_title
 from tags.widgets import get_tags_inline_widget_simple
 from history.api import register_history_type
-#from document_comments import comments_for_object
 
 from documents.models import Document, DocumentPage, \
     DocumentPageTransformation, DocumentType, DocumentTypeFilename
@@ -27,6 +26,7 @@ from documents.literals import HISTORY_DOCUMENT_CREATED, \
     HISTORY_DOCUMENT_EDITED, HISTORY_DOCUMENT_DELETED
 from documents.conf.settings import ZOOM_MAX_LEVEL
 from documents.conf.settings import ZOOM_MIN_LEVEL
+from documents.widgets import document_thumbnail
 
 # Permission setup
 set_namespace_title('documents', _(u'Documents'))
@@ -137,9 +137,6 @@ register_links(['document_type_filename_create', 'document_type_filename_list',
 register_links(['document_type_filename_edit', 'document_type_filename_delete'], [document_type_filename_return_to_document_type], menu_name='sidebar')
 
 # Register document links 
-#register_links(Document, [document_view_simple, document_view_advanced, document_edit, document_print, document_delete, document_download, document_find_duplicates, document_clear_transformations, document_history_view, document_create_siblings])
-#register_links(Document, [document_view_advanced, document_edit, document_print, document_delete, document_download, document_find_duplicates, document_clear_transformations, document_history_view, document_create_siblings])
-#register_links(Document, [document_view_advanced, document_edit, document_print, document_delete, document_download, document_find_duplicates, document_clear_transformations, document_create_siblings])
 register_links(Document, [document_edit, document_print, document_delete, document_download, document_find_duplicates, document_clear_transformations, document_create_siblings])
 register_multi_item_links(['document_type_document_list', 'search', 'results', 'document_group_view', 'document_list', 'document_list_recent'], [document_multiple_clear_transformations, document_multiple_delete])
 
@@ -186,12 +183,7 @@ def document_exists(document):
 
 register_model_list_columns(Document, [
         {'name':_(u'thumbnail'), 'attribute':
-            lambda x: u'<a class="fancybox" href="%(url)s"><img class="lazy-load" data-href="%(thumbnail)s" src="%(media_url)s/images/ajax-loader.gif" alt="%(string)s" /><noscript><img src="%(thumbnail)s" alt="%(string)s" /></noscript></a>' % {
+            lambda x: document_thumbnail(x)
-                'url': reverse('document_preview', args=[x.pk]),
-                'thumbnail': reverse('document_thumbnail', args=[x.pk]),
-                'media_url': settings.MEDIA_URL,
-                'string': _(u'thumbnail')
-            }
         },
         {'name':_(u'tags'), 'attribute':
             lambda x: get_tags_inline_widget_simple(x)

apps/documents/views.py

@@ -14,11 +14,11 @@ from django.views.generic.create_update import delete_object, update_object
 from django.conf import settings
 from django.utils.http import urlencode
 from django.core.files.uploadedfile import SimpleUploadedFile
-#from django.contrib.comments.models import Comment
 
 import sendfile
 from common.utils import pretty_size, parse_range, urlquote, \
-    return_diff, two_state_template
+    return_diff
+from common.widgets import two_state_template
 from common.literals import PAGE_SIZE_DIMENSIONS, \
     PAGE_ORIENTATION_PORTRAIT, PAGE_ORIENTATION_LANDSCAPE
 from common.conf.settings import DEFAULT_PAPER_SIZE

apps/documents/widgets.py

@@ -0,0 +1,20 @@
+from django.utils.safestring import mark_safe
+from django.conf import settings
+from django.utils.translation import ugettext_lazy as _
+from django.core.urlresolvers import reverse
+
+
+def document_thumbnail(document):
+    try:
+        return mark_safe(u'<a class="fancybox" href="%(url)s"><img class="lazy-load" data-href="%(thumbnail)s" src="%(media_url)s/images/ajax-loader.gif" alt="%(string)s" /><noscript><img src="%(thumbnail)s" alt="%(string)s" /></noscript></a>' % {
+            'url': reverse('document_preview', args=[document.pk]),
+            'thumbnail': reverse('document_thumbnail', args=[document.pk]),
+            'media_url': settings.MEDIA_URL,
+            'string': _(u'thumbnail')
+        })
+    except:
+        return u''
+
+
+def document_link(document):
+    return mark_safe(u'<a href="%s">%s</a>' % (reverse('document_view_simple', args=[document.pk]), document))

apps/folders/views.py

@@ -9,6 +9,7 @@ from django.core.exceptions import PermissionDenied
 
 from documents import PERMISSION_DOCUMENT_VIEW
 from documents.models import Document
+from documents.widgets import document_thumbnail, document_link
 from permissions.api import check_permissions
 
 from folders.models import Folder, FolderDocument
@@ -124,11 +125,10 @@ def folder_view(request, folder_id):
         'object_list': folder.folderdocument_set.all(),
         'extra_columns': [
             {'name': _(u'document'), 'attribute':
-                lambda x: '<a href="%s">%s</a>' % (reverse('document_view_simple', args=[x.document.pk]), x.document)
+                lambda x: document_link(x.document)
             },
             {'name': _(u'thumbnail'), 'attribute':
-                lambda x: '<a class="fancybox" href="%s"><img src="%s" /></a>' % (reverse('document_preview', args=[x.document.pk]),
+                lambda x: document_thumbnail(x.document)
-                    reverse('document_thumbnail', args=[x.document.pk]))
             },
         ],
         'hide_link': True,

apps/history/views.py

@@ -11,6 +11,7 @@ from permissions.api import check_permissions
 from history.models import History
 from history.forms import HistoryDetailForm
 from history import PERMISSION_HISTORY_VIEW
+from history.widgets import history_entry_object_link, history_entry_summary
 
 
 def history_list(request):
@@ -26,17 +27,11 @@ def history_list(request):
             },
             {
                 'name': _(u'object'),
-                'attribute': lambda x: '<a href="%(url)s">%(label)s</a>' % {
+                'attribute': lambda x: history_entry_object_link(x)
-                    'url': x.content_object.get_absolute_url() if x.content_object else u'#',
-                    'label': unicode(x.content_object) if x.content_object else u''
-                }
             },
             {
                 'name': _(u'summary'),
-                'attribute': lambda x: '<a href="%(url)s">%(label)s</a>' % {
+                'attribute': lambda x: history_entry_summary(x)
-                    'url': x.get_absolute_url(),
-                    'label': unicode(x.get_processed_summary())
-                }
             }
         ],
         'hide_object': True,
@@ -66,10 +61,7 @@ def history_for_object(request, app_label, module_name, object_id):
             },
             {
                 'name': _(u'summary'),
-                'attribute': lambda x: '<a href="%(url)s">%(label)s</a>' % {
+                'attribute': lambda x: history_entry_summary(x)
-                    'url': x.get_absolute_url(),
-                    'label': unicode(x.get_processed_summary())
-                }
             }
         ],
         'hide_object': True,

apps/history/widgets.py

@@ -0,0 +1,16 @@
+from django.utils.safestring import mark_safe
+
+
+def history_entry_object_link(entry):
+    return mark_safe(u'<a href="%(url)s">%(label)s</a>' % {
+            'url': entry.content_object.get_absolute_url() if entry.content_object else u'#',
+            'label': unicode(entry.content_object) if entry.content_object else u''
+        }
+    )
+
+
+def history_entry_summary(entry):
+    return mark_safe(u'<a href="%(url)s">%(label)s</a>' % {
+        'url': entry.get_absolute_url(),
+        'label': unicode(entry.get_processed_summary())
+    })

apps/ocr/views.py

@@ -13,6 +13,7 @@ from django.conf import settings
 from celery.task.control import inspect
 from permissions.api import check_permissions
 from documents.models import Document
+from documents.widgets import document_link, document_thumbnail
 
 from ocr import PERMISSION_OCR_DOCUMENT, PERMISSION_OCR_DOCUMENT_DELETE, \
     PERMISSION_OCR_QUEUE_ENABLE_DISABLE, PERMISSION_OCR_CLEAN_ALL_PAGES
@@ -25,18 +26,6 @@ from ocr.exceptions import AlreadyQueued
 from ocr.api import clean_pages
 
 
-def _display_thumbnail(ocr_document):
-    try:
-        return u'<a class="fancybox" href="%(url)s"><img class="lazy-load" data-href="%(thumbnail_url)s" src="%(media_url)s/images/ajax-loader.gif" alt="%(string)s" /><noscript><img src="%(thumbnail_url)s" alt="%(string)s" /></noscript></a>' % {
-            'url': reverse('document_preview', args=[ocr_document.document.pk]),
-            'thumbnail_url': reverse('document_thumbnail', args=[ocr_document.document.pk]),
-            'media_url': settings.MEDIA_URL,
-            'string': _(u'thumbnail')
-        }
-    except:
-        return u''
-
-
 def queue_document_list(request, queue_name='default'):
     check_permissions(request.user, [PERMISSION_OCR_DOCUMENT])
 
@@ -52,8 +41,8 @@ def queue_document_list(request, queue_name='default'):
             'object': document_queue,
             'object_name': _(u'document queue'),
             'extra_columns': [
-                {'name': 'document', 'attribute': lambda x: '<a href="%s">%s</a>' % (x.document.get_absolute_url(), x.document) if hasattr(x, 'document') else _(u'Missing document.')},
+                {'name': 'document', 'attribute': lambda x: document_link(x.document) if hasattr(x, 'document') else _(u'Missing document.')},
-                {'name': _(u'thumbnail'), 'attribute': lambda x: _display_thumbnail(x)},
+                {'name': _(u'thumbnail'), 'attribute': lambda x: document_thumbnail(x.document)},
                 {'name': 'submitted', 'attribute': lambda x: unicode(x.datetime_submitted).split('.')[0], 'keep_together':True},
                 {'name': 'delay', 'attribute': 'delay'},
                 {'name': 'state', 'attribute': lambda x: x.get_state_display()},

apps/permissions/views.py

@@ -20,6 +20,7 @@ from permissions import PERMISSION_ROLE_VIEW, PERMISSION_ROLE_EDIT, \
     PERMISSION_ROLE_CREATE, PERMISSION_ROLE_DELETE, PERMISSION_PERMISSION_GRANT, \
     PERMISSION_PERMISSION_REVOKE
 from permissions.api import check_permissions, namespace_titles
+from permissions.widgets import role_permission_link
 
 
 def role_list(request):
@@ -36,23 +37,6 @@ def role_list(request):
     )
 
 
-def _role_permission_link(requester, permission, permission_list):
-    ct = ContentType.objects.get_for_model(requester)
-
-    template = u'<span class="nowrap"><a href="%(url)s"><span class="famfam active famfam-%(icon)s"></span>%(text)s</a></span>'
-
-    if permission in permission_list:
-        return template % {
-            'url': reverse('permission_revoke',
-                args=[permission.pk, ct.app_label, ct.model, requester.pk]),
-            'icon': u'key_delete', 'text': ugettext(u'Revoke')}
-    else:
-        return template % {
-            'url': reverse('permission_grant',
-                args=[permission.pk, ct.app_label, ct.model, requester.pk]),
-            'icon': u'key_add', 'text': ugettext(u'Grant')}
-
-
 def role_permissions(request, role_id):
     check_permissions(request.user, [PERMISSION_PERMISSION_GRANT, PERMISSION_PERMISSION_REVOKE])
 
@@ -71,7 +55,7 @@ def role_permissions(request, role_id):
                     {'name': _(u'name'), 'attribute': u'label'},
                     {
                         'name':_(u'state'),
-                        'attribute': lambda x: _role_permission_link(role, x, role_permissions_list),
+                        'attribute': lambda x: role_permission_link(role, x, role_permissions_list),
                     }
                 ],
                 'hide_link': True,

apps/permissions/widgets.py

@@ -0,0 +1,21 @@
+from django.utils.translation import ugettext
+from django.utils.safestring import mark_safe
+from django.contrib.contenttypes.models import ContentType
+from django.core.urlresolvers import reverse
+
+
+def role_permission_link(requester, permission, permission_list):
+    ct = ContentType.objects.get_for_model(requester)
+
+    template = u'<span class="nowrap"><a href="%(url)s"><span class="famfam active famfam-%(icon)s"></span>%(text)s</a></span>'
+
+    if permission in permission_list:
+        return mark_safe(template % {
+            'url': reverse('permission_revoke',
+                args=[permission.pk, ct.app_label, ct.model, requester.pk]),
+            'icon': u'key_delete', 'text': ugettext(u'Revoke')})
+    else:
+        return mark_safe(template % {
+            'url': reverse('permission_grant',
+                args=[permission.pk, ct.app_label, ct.model, requester.pk]),
+            'icon': u'key_add', 'text': ugettext(u'Grant')})

apps/smart_settings/views.py

@@ -2,7 +2,8 @@ from django.shortcuts import render_to_response
 from django.template import RequestContext
 from django.utils.translation import ugettext_lazy as _
 
-from common.utils import exists_with_famfam, return_type
+from common.utils import return_type
+from common.widgets import exists_with_famfam
 
 from smart_settings.api import settings
 

apps/tags/__init__.py

@@ -9,6 +9,8 @@ from documents.models import Document
 
 from taggit.models import Tag
 
+from tags.widgets import tag_color_block
+
 PERMISSION_TAG_CREATE = {'namespace': 'tags', 'name': 'tag_create', 'label': _(u'Create new tags')}
 PERMISSION_TAG_ATTACH = {'namespace': 'tags', 'name': 'tag_attach', 'label': _(u'Attach exising tags')}
 PERMISSION_TAG_REMOVE = {'namespace': 'tags', 'name': 'tag_remove', 'label': _(u'Remove tags from documents')}
@@ -33,8 +35,7 @@ tag_multiple_delete = {'text': _(u'delete'), 'view': 'tag_multiple_delete', 'fam
 register_model_list_columns(Tag, [
     {
         'name': _(u'color'),
-        'attribute': lambda x: u'<div style="width: 20px; height: 20px; border: 1px solid black; background: %s;"></div>' %
+        'attribute': lambda x: tag_color_block(x)
-            x.tagproperties_set.get().get_color_code(),
     },
     {
         'name': _(u'color name'),

apps/tags/widgets.py

@@ -1,7 +1,11 @@
 from django.utils.translation import ugettext_lazy as _
+from django.utils.safestring import mark_safe
 
 
 def get_tags_inline_widget(document):
+    """
+    A tag widget that includes the total tag count for a given document
+    """
     tags_template = []
     tag_block_template = u'<div style="padding: 0px 5px 0px 5px; border: 1px solid black; background: %s;">%s</div>'
     tag_count = document.tags.count()
@@ -14,10 +18,14 @@ def get_tags_inline_widget(document):
             tags_template.append(tag_block_template % (tag.tagproperties_set.get().get_color_code(), tag.name))
 
         tags_template.append(u'</div>')
-    return u''.join(tags_template)
+    return mark_safe(u''.join(tags_template))
 
 
 def get_tags_inline_widget_simple(document):
+    """
+    A tag widget that only displayes the rectangular colored boxes for a
+    given document
+    """
     tags_template = []
     tag_block_template = u'<div style="padding: 0px 5px 0px 5px; border: 1px solid black; background: %s;">%s</div>'
     tag_count = document.tags.count()
@@ -28,4 +36,8 @@ def get_tags_inline_widget_simple(document):
             tags_template.append(tag_block_template % (tag.tagproperties_set.get().get_color_code(), tag.name))
 
         tags_template.append(u'</div>')
-    return u''.join(tags_template)
+    return mark_safe(u''.join(tags_template))
+
+
+def tag_color_block(tag):
+    return mark_safe(u'<div style="width: 20px; height: 20px; border: 1px solid black; background: %s;"></div>' % tag.tagproperties_set.get().get_color_code())

apps/user_management/views.py

@@ -8,7 +8,8 @@ from django.core.urlresolvers import reverse
 from django.contrib.auth.models import User, Group
 
 from permissions.api import check_permissions
-from common.utils import generate_choices_w_labels, two_state_template
+from common.utils import generate_choices_w_labels
+from common.widgets import two_state_template
 from common.views import assign_remove
 
 from user_management import PERMISSION_USER_VIEW, \