验证码

在用户注册、登陆页面为了防止暴力请求，可以加入验证码。如果验证码错误，则不需要继续处理，可以减轻服务器的压力

使用验证码也是一种有效防止csrf的方法

def verifycode(request):#引入绘图模块from PIL import Image, ImageDraw, ImageFont#引入随机函数模块import random#定义变量，用于画面的背景色、宽、高bgcolor = (random.randrange(20, 100), random.randrange(20, 100), random.randrange(20, 100))width = 100height = 50#创建画面对象im = Image.new('RGB', (width, height), bgcolor)#创建画笔对象draw = ImageDraw.Draw(im)#调用画笔的point()函数绘制噪点for i in range(0, 100):xy = (random.randrange(0, width), random.randrange(0, height))fill = (random.randrange(0, 255), 255, random.randrange(0, 255))draw.point(xy, fill=fill)#定义验证码的备选值str = '1234567890QWERTYUIOPASDFGHJKLZXCVBNMqwertyuiopasdfghjklzxcvbnm'#随机选取4个值作为验证码rand_str = ''for i in range(0, 4):rand_str += str[random.randrange(0, len(str))]#构造字体对象font = ImageFont.truetype(r'C:\Windows\Fonts\AdobeArabic-Bold.otf', 40)#构造字体颜色fontcolor1 = (255, random.randrange(0, 255), random.randrange(0, 255))fontcolor2 = (255, random.randrange(0, 255), random.randrange(0, 255))fontcolor3 = (255, random.randrange(0, 255), random.randrange(0, 255))fontcolor4 = (255, random.randrange(0, 255), random.randrange(0, 255))#绘制4个字draw.text((5, 2), rand_str[0], font=font, fill=fontcolor1)draw.text((25, 2), rand_str[1], font=font, fill=fontcolor2)draw.text((50, 2), rand_str[2], font=font, fill=fontcolor3)draw.text((75, 2), rand_str[3], font=font, fill=fontcolor4)#释放画笔del draw#内存文件操作import iobuf = io.BytesIO()#将图片保存在内存中，文件类型为pngim.save(buf, 'png')#将内存中的图片数据返回给客户端，MIME类型为图片pngresponse = HttpResponse(buf.getvalue(), 'image/png')#将验证码的值写入cookie，以被前端浏览器验证验证码# response.set_cookie("verifycode", rand_str)# 存入session，用于做进一步验证request.session['verifycode'] = rand_strreturn response

def login(request):if request.method == "GET":infoStr = "<h1>sunck is a good man</h1>"# infoStr = "<script>alert('sunck good')</script>"return render(request, "login.html", {"infoStr":infoStr})else:#判断验证码verifycode = request.POST.get("verifycode")if not verifycode.upper() == request.session.get("verifycode").upper():return redirect("/login/")username = request.POST.get("username")password = request.POST.get("password")if username == "sunck" and password == "sunck1999":return redirect("/index/")else:return redirect("/login/")

中间件

概述

一个轻量级、底层的插件系统，可以介入Django的请求和响应过程，处理Django的输入或输出

每个中间件组件都是一个独立的Python类

django中间件简单图解

方法

自定义中间件

在App目录下创建名为middlewares的包

在包中创建自己的中间件类文件

verifycodeMiddleware.py

from django.utils.deprecation import MiddlewareMixin
from django.shortcuts import redirectclass VerifycodeMiddleware(MiddlewareMixin):def process_request(self, request):print("***************", request.path)if request.path == "/login/" and request.method == "POST":# 判断验证码verifycode = request.POST.get("verifycode")if not verifycode.upper() == request.session.get("verifycode").upper():return redirect("/login/")

在settings.py文件中配阿置MIDDLEWARE

'myApp.middlewares.verifycodeMiddleware.VerifycodeMiddleware'

6-django——admin站点管理