response.py 16 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480
  1. from __future__ import unicode_literals
  2. import datetime
  3. import json
  4. import sys
  5. import time
  6. from email.header import Header
  7. from django.conf import settings
  8. from django.core import signals
  9. from django.core import signing
  10. from django.core.exceptions import DisallowedRedirect
  11. from django.core.serializers.json import DjangoJSONEncoder
  12. from django.http.cookie import SimpleCookie
  13. from django.utils import six, timezone
  14. from django.utils.encoding import force_bytes, force_text, iri_to_uri
  15. from django.utils.http import cookie_date
  16. from django.utils.six.moves import map
  17. from django.utils.six.moves.urllib.parse import urlparse
  18. # See http://www.iana.org/assignments/http-status-codes
  19. REASON_PHRASES = {
  20. 100: 'CONTINUE',
  21. 101: 'SWITCHING PROTOCOLS',
  22. 102: 'PROCESSING',
  23. 200: 'OK',
  24. 201: 'CREATED',
  25. 202: 'ACCEPTED',
  26. 203: 'NON-AUTHORITATIVE INFORMATION',
  27. 204: 'NO CONTENT',
  28. 205: 'RESET CONTENT',
  29. 206: 'PARTIAL CONTENT',
  30. 207: 'MULTI-STATUS',
  31. 208: 'ALREADY REPORTED',
  32. 226: 'IM USED',
  33. 300: 'MULTIPLE CHOICES',
  34. 301: 'MOVED PERMANENTLY',
  35. 302: 'FOUND',
  36. 303: 'SEE OTHER',
  37. 304: 'NOT MODIFIED',
  38. 305: 'USE PROXY',
  39. 306: 'RESERVED',
  40. 307: 'TEMPORARY REDIRECT',
  41. 308: 'PERMANENT REDIRECT',
  42. 400: 'BAD REQUEST',
  43. 401: 'UNAUTHORIZED',
  44. 402: 'PAYMENT REQUIRED',
  45. 403: 'FORBIDDEN',
  46. 404: 'NOT FOUND',
  47. 405: 'METHOD NOT ALLOWED',
  48. 406: 'NOT ACCEPTABLE',
  49. 407: 'PROXY AUTHENTICATION REQUIRED',
  50. 408: 'REQUEST TIMEOUT',
  51. 409: 'CONFLICT',
  52. 410: 'GONE',
  53. 411: 'LENGTH REQUIRED',
  54. 412: 'PRECONDITION FAILED',
  55. 413: 'REQUEST ENTITY TOO LARGE',
  56. 414: 'REQUEST-URI TOO LONG',
  57. 415: 'UNSUPPORTED MEDIA TYPE',
  58. 416: 'REQUESTED RANGE NOT SATISFIABLE',
  59. 417: 'EXPECTATION FAILED',
  60. 418: "I'M A TEAPOT",
  61. 422: 'UNPROCESSABLE ENTITY',
  62. 423: 'LOCKED',
  63. 424: 'FAILED DEPENDENCY',
  64. 426: 'UPGRADE REQUIRED',
  65. 428: 'PRECONDITION REQUIRED',
  66. 429: 'TOO MANY REQUESTS',
  67. 431: 'REQUEST HEADER FIELDS TOO LARGE',
  68. 500: 'INTERNAL SERVER ERROR',
  69. 501: 'NOT IMPLEMENTED',
  70. 502: 'BAD GATEWAY',
  71. 503: 'SERVICE UNAVAILABLE',
  72. 504: 'GATEWAY TIMEOUT',
  73. 505: 'HTTP VERSION NOT SUPPORTED',
  74. 506: 'VARIANT ALSO NEGOTIATES',
  75. 507: 'INSUFFICIENT STORAGE',
  76. 508: 'LOOP DETECTED',
  77. 510: 'NOT EXTENDED',
  78. 511: 'NETWORK AUTHENTICATION REQUIRED',
  79. }
  80. class BadHeaderError(ValueError):
  81. pass
  82. class HttpResponseBase(six.Iterator):
  83. """
  84. An HTTP response base class with dictionary-accessed headers.
  85. This class doesn't handle content. It should not be used directly.
  86. Use the HttpResponse and StreamingHttpResponse subclasses instead.
  87. """
  88. status_code = 200
  89. reason_phrase = None # Use default reason phrase for status code.
  90. def __init__(self, content_type=None, status=None, reason=None):
  91. # _headers is a mapping of the lower-case name to the original case of
  92. # the header (required for working with legacy systems) and the header
  93. # value. Both the name of the header and its value are ASCII strings.
  94. self._headers = {}
  95. self._charset = settings.DEFAULT_CHARSET
  96. self._closable_objects = []
  97. # This parameter is set by the handler. It's necessary to preserve the
  98. # historical behavior of request_finished.
  99. self._handler_class = None
  100. if not content_type:
  101. content_type = "%s; charset=%s" % (settings.DEFAULT_CONTENT_TYPE,
  102. self._charset)
  103. self.cookies = SimpleCookie()
  104. if status is not None:
  105. self.status_code = status
  106. if reason is not None:
  107. self.reason_phrase = reason
  108. elif self.reason_phrase is None:
  109. self.reason_phrase = REASON_PHRASES.get(self.status_code,
  110. 'UNKNOWN STATUS CODE')
  111. self['Content-Type'] = content_type
  112. def serialize_headers(self):
  113. """HTTP headers as a bytestring."""
  114. def to_bytes(val, encoding):
  115. return val if isinstance(val, bytes) else val.encode(encoding)
  116. headers = [
  117. (b': '.join([to_bytes(key, 'ascii'), to_bytes(value, 'latin-1')]))
  118. for key, value in self._headers.values()
  119. ]
  120. return b'\r\n'.join(headers)
  121. if six.PY3:
  122. __bytes__ = serialize_headers
  123. else:
  124. __str__ = serialize_headers
  125. def _convert_to_charset(self, value, charset, mime_encode=False):
  126. """Converts headers key/value to ascii/latin-1 native strings.
  127. `charset` must be 'ascii' or 'latin-1'. If `mime_encode` is True and
  128. `value` can't be represented in the given charset, MIME-encoding
  129. is applied.
  130. """
  131. if not isinstance(value, (bytes, six.text_type)):
  132. value = str(value)
  133. try:
  134. if six.PY3:
  135. if isinstance(value, str):
  136. # Ensure string is valid in given charset
  137. value.encode(charset)
  138. else:
  139. # Convert bytestring using given charset
  140. value = value.decode(charset)
  141. else:
  142. if isinstance(value, str):
  143. # Ensure string is valid in given charset
  144. value.decode(charset)
  145. else:
  146. # Convert unicode string to given charset
  147. value = value.encode(charset)
  148. except UnicodeError as e:
  149. if mime_encode:
  150. # Wrapping in str() is a workaround for #12422 under Python 2.
  151. value = str(Header(value, 'utf-8', maxlinelen=sys.maxsize).encode())
  152. else:
  153. e.reason += ', HTTP response headers must be in %s format' % charset
  154. raise
  155. if str('\n') in value or str('\r') in value:
  156. raise BadHeaderError("Header values can't contain newlines (got %r)" % value)
  157. return value
  158. def __setitem__(self, header, value):
  159. header = self._convert_to_charset(header, 'ascii')
  160. value = self._convert_to_charset(value, 'latin-1', mime_encode=True)
  161. self._headers[header.lower()] = (header, value)
  162. def __delitem__(self, header):
  163. try:
  164. del self._headers[header.lower()]
  165. except KeyError:
  166. pass
  167. def __getitem__(self, header):
  168. return self._headers[header.lower()][1]
  169. def __getstate__(self):
  170. # SimpleCookie is not pickleable with pickle.HIGHEST_PROTOCOL, so we
  171. # serialize to a string instead
  172. state = self.__dict__.copy()
  173. state['cookies'] = str(state['cookies'])
  174. return state
  175. def __setstate__(self, state):
  176. self.__dict__.update(state)
  177. self.cookies = SimpleCookie(self.cookies)
  178. def has_header(self, header):
  179. """Case-insensitive check for a header."""
  180. return header.lower() in self._headers
  181. __contains__ = has_header
  182. def items(self):
  183. return self._headers.values()
  184. def get(self, header, alternate=None):
  185. return self._headers.get(header.lower(), (None, alternate))[1]
  186. def set_cookie(self, key, value='', max_age=None, expires=None, path='/',
  187. domain=None, secure=False, httponly=False):
  188. """
  189. Sets a cookie.
  190. ``expires`` can be:
  191. - a string in the correct format,
  192. - a naive ``datetime.datetime`` object in UTC,
  193. - an aware ``datetime.datetime`` object in any time zone.
  194. If it is a ``datetime.datetime`` object then ``max_age`` will be calculated.
  195. """
  196. self.cookies[key] = value
  197. if expires is not None:
  198. if isinstance(expires, datetime.datetime):
  199. if timezone.is_aware(expires):
  200. expires = timezone.make_naive(expires, timezone.utc)
  201. delta = expires - expires.utcnow()
  202. # Add one second so the date matches exactly (a fraction of
  203. # time gets lost between converting to a timedelta and
  204. # then the date string).
  205. delta = delta + datetime.timedelta(seconds=1)
  206. # Just set max_age - the max_age logic will set expires.
  207. expires = None
  208. max_age = max(0, delta.days * 86400 + delta.seconds)
  209. else:
  210. self.cookies[key]['expires'] = expires
  211. if max_age is not None:
  212. self.cookies[key]['max-age'] = max_age
  213. # IE requires expires, so set it if hasn't been already.
  214. if not expires:
  215. self.cookies[key]['expires'] = cookie_date(time.time() +
  216. max_age)
  217. if path is not None:
  218. self.cookies[key]['path'] = path
  219. if domain is not None:
  220. self.cookies[key]['domain'] = domain
  221. if secure:
  222. self.cookies[key]['secure'] = True
  223. if httponly:
  224. self.cookies[key]['httponly'] = True
  225. def set_signed_cookie(self, key, value, salt='', **kwargs):
  226. value = signing.get_cookie_signer(salt=key + salt).sign(value)
  227. return self.set_cookie(key, value, **kwargs)
  228. def delete_cookie(self, key, path='/', domain=None):
  229. self.set_cookie(key, max_age=0, path=path, domain=domain,
  230. expires='Thu, 01-Jan-1970 00:00:00 GMT')
  231. # Common methods used by subclasses
  232. def make_bytes(self, value):
  233. """Turn a value into a bytestring encoded in the output charset."""
  234. # Per PEP 3333, this response body must be bytes. To avoid returning
  235. # an instance of a subclass, this function returns `bytes(value)`.
  236. # This doesn't make a copy when `value` already contains bytes.
  237. # If content is already encoded (eg. gzip), assume bytes.
  238. if self.has_header('Content-Encoding'):
  239. return bytes(value)
  240. # Handle string types -- we can't rely on force_bytes here because:
  241. # - under Python 3 it attempts str conversion first
  242. # - when self._charset != 'utf-8' it re-encodes the content
  243. if isinstance(value, bytes):
  244. return bytes(value)
  245. if isinstance(value, six.text_type):
  246. return bytes(value.encode(self._charset))
  247. # Handle non-string types (#16494)
  248. return force_bytes(value, self._charset)
  249. # These methods partially implement the file-like object interface.
  250. # See http://docs.python.org/lib/bltin-file-objects.html
  251. # The WSGI server must call this method upon completion of the request.
  252. # See http://blog.dscpl.com.au/2012/10/obligations-for-calling-close-on.html
  253. def close(self):
  254. for closable in self._closable_objects:
  255. try:
  256. closable.close()
  257. except Exception:
  258. pass
  259. signals.request_finished.send(sender=self._handler_class)
  260. def write(self, content):
  261. raise Exception("This %s instance is not writable" % self.__class__.__name__)
  262. def flush(self):
  263. pass
  264. def tell(self):
  265. raise Exception("This %s instance cannot tell its position" % self.__class__.__name__)
  266. class HttpResponse(HttpResponseBase):
  267. """
  268. An HTTP response class with a string as content.
  269. This content that can be read, appended to or replaced.
  270. """
  271. streaming = False
  272. def __init__(self, content=b'', *args, **kwargs):
  273. super(HttpResponse, self).__init__(*args, **kwargs)
  274. # Content is a bytestring. See the `content` property methods.
  275. self.content = content
  276. def serialize(self):
  277. """Full HTTP message, including headers, as a bytestring."""
  278. return self.serialize_headers() + b'\r\n\r\n' + self.content
  279. if six.PY3:
  280. __bytes__ = serialize
  281. else:
  282. __str__ = serialize
  283. @property
  284. def content(self):
  285. return b''.join(self._container)
  286. @content.setter
  287. def content(self, value):
  288. # Consume iterators upon assignment to allow repeated iteration.
  289. if hasattr(value, '__iter__') and not isinstance(value, (bytes, six.string_types)):
  290. if hasattr(value, 'close'):
  291. self._closable_objects.append(value)
  292. value = b''.join(self.make_bytes(chunk) for chunk in value)
  293. else:
  294. value = self.make_bytes(value)
  295. # Create a list of properly encoded bytestrings to support write().
  296. self._container = [value]
  297. def __iter__(self):
  298. return iter(self._container)
  299. def write(self, content):
  300. self._container.append(self.make_bytes(content))
  301. def tell(self):
  302. return len(self.content)
  303. class StreamingHttpResponse(HttpResponseBase):
  304. """
  305. A streaming HTTP response class with an iterator as content.
  306. This should only be iterated once, when the response is streamed to the
  307. client. However, it can be appended to or replaced with a new iterator
  308. that wraps the original content (or yields entirely new content).
  309. """
  310. streaming = True
  311. def __init__(self, streaming_content=(), *args, **kwargs):
  312. super(StreamingHttpResponse, self).__init__(*args, **kwargs)
  313. # `streaming_content` should be an iterable of bytestrings.
  314. # See the `streaming_content` property methods.
  315. self.streaming_content = streaming_content
  316. @property
  317. def content(self):
  318. raise AttributeError("This %s instance has no `content` attribute. "
  319. "Use `streaming_content` instead." % self.__class__.__name__)
  320. @property
  321. def streaming_content(self):
  322. return map(self.make_bytes, self._iterator)
  323. @streaming_content.setter
  324. def streaming_content(self, value):
  325. # Ensure we can never iterate on "value" more than once.
  326. self._iterator = iter(value)
  327. if hasattr(value, 'close'):
  328. self._closable_objects.append(value)
  329. def __iter__(self):
  330. return self.streaming_content
  331. class HttpResponseRedirectBase(HttpResponse):
  332. allowed_schemes = ['http', 'https', 'ftp']
  333. def __init__(self, redirect_to, *args, **kwargs):
  334. parsed = urlparse(force_text(redirect_to))
  335. if parsed.scheme and parsed.scheme not in self.allowed_schemes:
  336. raise DisallowedRedirect("Unsafe redirect to URL with protocol '%s'" % parsed.scheme)
  337. super(HttpResponseRedirectBase, self).__init__(*args, **kwargs)
  338. self['Location'] = iri_to_uri(redirect_to)
  339. url = property(lambda self: self['Location'])
  340. class HttpResponseRedirect(HttpResponseRedirectBase):
  341. status_code = 302
  342. class HttpResponsePermanentRedirect(HttpResponseRedirectBase):
  343. status_code = 301
  344. class HttpResponseNotModified(HttpResponse):
  345. status_code = 304
  346. def __init__(self, *args, **kwargs):
  347. super(HttpResponseNotModified, self).__init__(*args, **kwargs)
  348. del self['content-type']
  349. @HttpResponse.content.setter
  350. def content(self, value):
  351. if value:
  352. raise AttributeError("You cannot set content to a 304 (Not Modified) response")
  353. self._container = []
  354. class HttpResponseBadRequest(HttpResponse):
  355. status_code = 400
  356. class HttpResponseNotFound(HttpResponse):
  357. status_code = 404
  358. class HttpResponseForbidden(HttpResponse):
  359. status_code = 403
  360. class HttpResponseNotAllowed(HttpResponse):
  361. status_code = 405
  362. def __init__(self, permitted_methods, *args, **kwargs):
  363. super(HttpResponseNotAllowed, self).__init__(*args, **kwargs)
  364. self['Allow'] = ', '.join(permitted_methods)
  365. class HttpResponseGone(HttpResponse):
  366. status_code = 410
  367. class HttpResponseServerError(HttpResponse):
  368. status_code = 500
  369. class Http404(Exception):
  370. pass
  371. class JsonResponse(HttpResponse):
  372. """
  373. An HTTP response class that consumes data to be serialized to JSON.
  374. :param data: Data to be dumped into json. By default only ``dict`` objects
  375. are allowed to be passed due to a security flaw before EcmaScript 5. See
  376. the ``safe`` parameter for more information.
  377. :param encoder: Should be an json encoder class. Defaults to
  378. ``django.core.serializers.json.DjangoJSONEncoder``.
  379. :param safe: Controls if only ``dict`` objects may be serialized. Defaults
  380. to ``True``.
  381. """
  382. def __init__(self, data, encoder=DjangoJSONEncoder, safe=True, **kwargs):
  383. if safe and not isinstance(data, dict):
  384. raise TypeError('In order to allow non-dict objects to be '
  385. 'serialized set the safe parameter to False')
  386. kwargs.setdefault('content_type', 'application/json')
  387. data = json.dumps(data, cls=encoder)
  388. super(JsonResponse, self).__init__(content=data, **kwargs)