Form.Media: render inline css/js

[James Pic]

Hello list \o/

Currently, we can attach scripts and css by declaring their urls in Media. It then renders the script and link tags, allowing users to have that outside the form tag in the template, ie. in the HTML head.

A good way to pass a widget's configuration from python to js is to pass them as data- attributes, and make the js pick it up. This works fine for simple key/value options, but not for more complex data structures ie. complete JSON objects.

It would be great if we could also add generated css/js to ``{{ form.Media }}``.

Thoughts ?

Thanks for your time

Best regards

James

[Tim Graham]

I'm not exactly sure what your proposal entails. Could you give some psuedo-code to demonstrate what you have in mind?

By the way, there is some discussion that it might be best to replace the Media class, although it's not entirely clear how to do that: https://code.djangoproject.com/ticket/22298.

[James Pic]

Thanks for the heads up, a similar ticket has been closed as wontfix, because it isn't compatible with CSP: https://code.djangoproject.com/ticket/13978

While I'm all against inline scripts, I have a use case which seems be legitimate: https://github.com/yourlabs/django-autocomplete-light/pull/733/files#diff-469b501dd1f427cfe68aac4d27f28df3R84

Basically, we render a `<script type="text/dal-forward-conf">json object dump here</script>` next to the widget and use that to configure the script for that widget. IMHO, the ideal solution would be to be able to place this script tag in `{{ form.media }}` rather than next to the HTML widget.

Am I missing any CSP concern here ?

[Matthias Kestenholz]

There is precedent in Django (respectively django.contrib.admin) for adding attributes to the script tag, for example here:

https://github.com/django/django/blob/master/django/contrib/admin/templates/admin/popup_response.html

I have an admittedly ugly hack here which allows (ab)using forms.Media for custom additional attributes here: (It works well and I sleep well, but it's not nice at all.)

https://github.com/matthiask/django-content-editor/blob/master/content_editor/admin.py#L93

If this is an acceptable way of delivering additional data to the frontend code I might work on that during a sprint some time?

Thanks,

Matthias

[James Pic]

Nice one Matthias !

We might have something similar, in dal, discussion is undergoing: https://github.com/yourlabs/django-autocomplete-light/issues/756#issuecomment-252368089

Currently ddf also renders json in a script tag in the middle of the form, i think I might take the same direction as you did there too: https://github.com/yourlabs/django-dynamic-fields/blob/master/src/ddf/form.py#L28-L56

Ideally I'd have this provided by ddf.FormMixin, but I'm currently blocked by a sort of bug-to-fix or feature-to-add issue: https://code.djangoproject.com/ticket/27317 but I need to recenter the discussion there, my initial description wasn't adequate as the suggestion made in the comment isn't actually possible - or at least, is possible, but doesn't do the job.