Passing objects through Django template to javascript

Question

I am making a website using Django and I want to pass a python object from my view (where it is created) through the Django template and to a Dajax call. The problem is that by the time it gets to dajax it has been turned into type unicode.

In my Template

<script>
var emailer = "{{emailer|safe}}"; <---If I omit the quotes here then I get a javascript error.
sessionStorage.setItem('emailer',emailer);
$(document).ready(function(){

  $('.send').on('click', function(e){  
    var emailer = sessionStorage.getItem('emailer');

    Dajaxice.InterfaceApp.sendEmail(submitverify,{'emailer':emailer});
  });
});

</script>

The dajax function

@dajaxice_register(method='GET')
def sendEmail(emailer):
    logger.warning("type: %s, %s" % (type(emailer),emailer))
    email_body = "message"
    emailer.addToMessage(email_body)
    emailer.send()

    message = "Email Sent"
return json.dumps({'message':message})

Here the logger statement returns: type: <type 'unicode'>, <Utils.SIMPL_Emailer instance at 0x103142ab8>. Is there any way to fix this so that I get my emailer object instead of a unicode string?

Wait, you want to pass the actual serialized Python object into your template and back in via JavaScript? That seems terribly unsafe. Can't you pass around just the minimum necessary information to recreate the emailer object in the sendEmail function? — Peter DeGlopper
– Peter DeGlopper, Commented Sep 17, 2015 at 21:36

Ricardo Silva · Accepted Answer · 2015-09-18 01:01:23Z

1

First try to understand what is happening:

On your template you're trying to save a Python object to a Javascript var:

var emailer = "{{emailer|safe}}";`

But it's not possible. When your template is rendered by Django what you really get is a call to object __str__() method and your Javascript will store the <Utils.SIMPL_Emailer instance at 0x103142ab8> value on your emailer var. And remember: this code run in the client browser. That's why you get an error when you remove the quotes.

To solve it you need to first serialize your emailer object (Turn it into something that could be represented as a String, for example, and then turned back to Python Object). But as pointed by Peter DeGlopper it is a very insecure approach. Never, ever deserialize an whole object that was public accessible. Instead send only the email data to your template. You can create a dictionary with this data, turn it into JSON (it's a serialization too, but this time you are serializating only data) and then pass it to your template.

So do not put your emailer on the template context. Instead create a dictonary and pass it to the template.

Then in your Python sendEmail(emailer) method you'll need to instanciate a new Emailer object and feed it with the data, like:

@dajaxice_register(method='GET')
def sendEmail(email_json):
    email = json.loads(email_json) # email_json is a json with your email data only
    logger.warning("type: %s, %s" % (type(email_json),email_json))
    emailer = Emailer("<with all your params...>")
    emailer.addToMessage(email.get('body'))
    emailer.send()

    message = "Email Sent"
    return json.dumps({'message':message})

answered Sep 18, 2015 at 1:01

Ricardo Silva

83411 silver badges13 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

kdubs Over a year ago

I wanted to avoid instantiating new objects though because when the object is instantiated a lot of 'background' processes associated with the class run that slow down my website. The website I'm creating won't be accessible to the public (it's going to be on a private server) so I'm not too worried about it. How would you go about serializing an object and then turning it back into an object from say, a string or unicode?

Ricardo Silva Over a year ago

You can use the pickle module: link. But there is some objects that are "unpickable", like sockets. And your Emailer object may fall into this problem.

Peter DeGlopper Over a year ago

I'm pretty sure there's no way to use serialization to avoid the time to instantiate a new instance. All serialization does is provide a way to encapsulate all the information about an object. Think about it - if you saved out the HTML, rebooted your computer, and then parsed the serialization string again you're clearly creating a new instance. Similarly, there's no guarantee that the same thread will handle the Ajax request as handled the base view. You need to rethink your approach - probably by not instantiating the emailer in the view, if it's not actually needed until the Ajax request.

Collectives™ on Stack Overflow

Passing objects through Django template to javascript

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related