Fixes #260 -- Normalize choices keys and selected choices to strings

Closes #263

.travis.yml

@@ -1,21 +1,26 @@
 language: python
 sudo: false
 cache:
+  - apt
   - pip
 services:
   - memcached
 python:
   - "2.7"
-  - "3.3"
   - "3.4"
-  - "pypy"
-  - "pypy3"
+  - "3.5"
+addons:
+  apt:
+    packages:
+      - python3-enchant
+      - python2-enchant
+      - graphviz
 env:
   global:
     - DISPLAY=:99.0
   matrix:
-    - DJANGO="Django<1.8,>=1.7"
     - DJANGO="Django<1.9,>=1.8"
+    - DJANGO="Django<1.10,>=1.9"
     - DJANGO="-e git+https://github.com/django/django.git@master#egg=Django"
 matrix:
   fast_finish: true
@@ -32,7 +37,8 @@ install:
 script:
   - isort --check-only --recursive --diff .
   - flake8 --jobs=2 .
-  - pep257 django_select2
-  - coverage run --source=django_select2 runtests.py
+  - pep257 --explain --source --count django_select2
+  - (cd docs; make spelling)
+  - coverage run --source=django_select2 -m py.test
 after_success:
   - coveralls

CHANGELOG.md

@@ -1,6 +1,50 @@
 Changelog Summary
 =================
 
+### v5.8.2
+* Fixes #260 -- Fixes bug in render choices
+
+### v5.8.0
+* Changed signature of `render` and `render_choices` to satisfy Django 1.10 changes.
+* Changed widgets' inheritance tree to be more consistent.
+
+### v5.7.1
+* Fixes pickle bug of lazy object
+
+### v5.7.0
+* Security fix that allows a `field_id` to only be used for the intended JSON endpoint.
+  
+      Prior to that change you could use any `field_id` on any select2 JSON endpoint.
+      Even if the id was intended to be used on a private endpoint if could be used on
+      the default one and therefore leak sensitive data.
+      
+* Breaking change on how `Heavy` widgets are being cached.
+      
+      Heavy widgets used to add themselves to the cache. Now they add a dictionary to
+      the cache containing themselves and the target url.
+      
+      ```python
+      {
+          'widget': self,
+          'url': self.get_url(),
+      }
+      ```
+
+### v5.6.0
+* Added `label_from_instance` method for model widgets to define custom option labels.
+
+### v5.5.0
+* Added settings to delivery static assets from different source.
+
+### v5.4.2
+* Fixed initial data not being shown for heavy widgets.
+
+### v5.4.1
+* Fixed memory leak in `ModelSelect2Mixin` and subclasses
+
+### v5.4.0
+* Added `Select2TagWidget` a light widget with tagging support
+
 ### v5.3.0
 * Added djangoSelect2 jQuery plugin to support
   dynamic field initialisation

django_select2/__init__.py

@@ -9,4 +9,4 @@ The app includes Select2 driven Django Widgets and Form Fields.
 
 """
 
-__version__ = "5.3.1"
+__version__ = "5.8.2"

django_select2/cache.py

@@ -1,11 +1,11 @@
 # -*- coding: utf-8 -*-
 """
-Shared memory across multiple machines to the heavy ajax lookups.
+Shared memory across multiple machines to the heavy AJAX lookups.
 
 Select2 uses django.core.cache_ to share fields across
 multiple threads and even machines.
 
-Select2 uses the cabhe backend defind in the setting
+Select2 uses the cache backend defined in the setting
 ``SELECT2_CACHE_BACKEND`` [default=``default``].
 
 It is advised to always setup a separate cache server for Select2.

django_select2/conf.py

@@ -9,7 +9,6 @@ __all__ = ('settings', 'Select2Conf')
 
 
 class Select2Conf(AppConf):
-
     """Settings for Django-Select2."""
 
     CACHE_BACKEND = 'default'
@@ -49,5 +48,31 @@ class Select2Conf(AppConf):
     It has set `select2_` as a default value, which you can change if needed.
     """
 
+    JS = '//cdnjs.cloudflare.com/ajax/libs/select2/4.0.0/js/select2.min.js'
+    """
+    The URI for the Select2 JS file. By default this points to the Cloudflare CDN.
+
+    If you want to select the version of the JS library used, or want to serve it from
+    the local 'static' resources, add a line to your settings.py like so::
+
+        SELECT2_JS = 'assets/js/select2.min.js'
+
+    .. tip:: Change this setting to a local asset in your development environment to
+        develop without an Internet connection.
+    """
+
+    CSS = '//cdnjs.cloudflare.com/ajax/libs/select2/4.0.0/css/select2.min.css'
+    """
+    The URI for the Select2 CSS file. By default this points to the Cloudflare CDN.
+
+    If you want to select the version of the library used, or want to serve it from
+    the local 'static' resources, add a line to your settings.py like so::
+
+        SELECT2_CSS = 'assets/css/select2.css'
+
+    .. tip:: Change this setting to a local asset in your development environment to
+        develop without an Internet connection.
+    """
+
     class Meta:
         prefix = 'SELECT2'

django_select2/forms.py

@@ -49,10 +49,12 @@ Light widgets are normally named, i.e. there is no
 from __future__ import absolute_import, unicode_literals
 
 from functools import reduce
+from itertools import chain
+from pickle import PicklingError
 
 from django import forms
 from django.core import signing
-from django.core.urlresolvers import reverse_lazy
+from django.core.urlresolvers import reverse
 from django.db.models import Q
 from django.forms.models import ModelChoiceIterator
 from django.utils.encoding import force_text
@@ -62,7 +64,6 @@ from .conf import settings
 
 
 class Select2Mixin(object):
-
     """
     The base mixin of all Select2 widgets.
 
@@ -87,10 +88,10 @@ class Select2Mixin(object):
             attrs['class'] = 'django-select2'
         return attrs
 
-    def render_options(self, choices, selected_choices):
+    def render_options(self, *args, **kwargs):
         """Render options including an empty one, if the field is not required."""
         output = '<option></option>' if not self.is_required else ''
-        output += super(Select2Mixin, self).render_options(choices, selected_choices)
+        output += super(Select2Mixin, self).render_options(*args, **kwargs)
         return output
 
     def _get_media(self):
@@ -101,16 +102,25 @@ class Select2Mixin(object):
             https://docs.djangoproject.com/en/1.8/topics/forms/media/#media-as-a-dynamic-property
         """
         return forms.Media(
-            js=('//cdnjs.cloudflare.com/ajax/libs/select2/4.0.0/js/select2.min.js',
-                'django_select2/django_select2.js'),
-            css={'screen': ('//cdnjs.cloudflare.com/ajax/libs/select2/4.0.0/css/select2.min.css',)}
+            js=(settings.SELECT2_JS, 'django_select2/django_select2.js'),
+            css={'screen': (settings.SELECT2_CSS,)}
         )
 
     media = property(_get_media)
 
 
-class Select2Widget(Select2Mixin, forms.Select):
+class Select2TagMixin(object):
+    """Mixin to add select2 tag functionality."""
 
+    def build_attrs(self, extra_attrs=None, **kwargs):
+        """Add select2's tag attributes."""
+        self.attrs.setdefault('data-minimum-input-length', 1)
+        self.attrs.setdefault('data-tags', 'true')
+        self.attrs.setdefault('data-token-separators', [",", " "])
+        return super(Select2TagMixin, self).build_attrs(extra_attrs, **kwargs)
+
+
+class Select2Widget(Select2Mixin, forms.Select):
     """
     Select2 drop in widget.
 
@@ -135,7 +145,6 @@ class Select2Widget(Select2Mixin, forms.Select):
 
 
 class Select2MultipleWidget(Select2Mixin, forms.SelectMultiple):
-
     """
     Select2 drop in widget for multiple select.
 
@@ -145,19 +154,34 @@ class Select2MultipleWidget(Select2Mixin, forms.SelectMultiple):
     pass
 
 
-class HeavySelect2Mixin(Select2Mixin):
+class Select2TagWidget(Select2TagMixin, Select2Mixin, forms.SelectMultiple):
+    """
+    Select2 drop in widget for for tagging.
 
-    """Mixin that adds select2's ajax options and registers itself on django's cache."""
+    Example for :class:`.django.contrib.postgres.fields.ArrayField`::
+
+        class MyWidget(Select2TagWidget):
+
+            def value_from_datadict(self, data, files, name):
+                values = super(MyWidget, self).value_from_datadict(data, files, name):
+                return ",".join(values)
+
+    """
+
+    pass
+
+
+class HeavySelect2Mixin(object):
+    """Mixin that adds select2's AJAX options and registers itself on Django's cache."""
 
     def __init__(self, **kwargs):
         """
         Return HeavySelect2Mixin.
 
-        :param data_view: url pattern name
-        :type data_view: str
-        :param data_url: url
-        :type data_url: str
-        :return:
+        Args:
+            data_view (str): URL pattern name
+            data_url (str): URL
+
         """
         self.data_view = kwargs.pop('data_view', None)
         self.data_url = kwargs.pop('data_url', None)
@@ -167,13 +191,13 @@ class HeavySelect2Mixin(Select2Mixin):
         super(HeavySelect2Mixin, self).__init__(**kwargs)
 
     def get_url(self):
-        """Return url from instance or by reversing :attr:`.data_view`."""
+        """Return URL from instance or by reversing :attr:`.data_view`."""
         if self.data_url:
             return self.data_url
-        return reverse_lazy(self.data_view)
+        return reverse(self.data_view)
 
     def build_attrs(self, extra_attrs=None, **kwargs):
-        """Set select2's ajax attributes."""
+        """Set select2's AJAX attributes."""
         attrs = super(HeavySelect2Mixin, self).build_attrs(extra_attrs=extra_attrs, **kwargs)
 
         # encrypt instance Id
@@ -188,9 +212,9 @@ class HeavySelect2Mixin(Select2Mixin):
         attrs['class'] += ' django-select2-heavy'
         return attrs
 
-    def render(self, name, value, attrs=None, choices=()):
+    def render(self, *args, **kwargs):
         """Render widget and register it in Django's cache."""
-        output = super(HeavySelect2Mixin, self).render(name, value, attrs=attrs, choices=choices)
+        output = super(HeavySelect2Mixin, self).render(*args, **kwargs)
         self.set_to_cache()
         return output
 
@@ -198,21 +222,39 @@ class HeavySelect2Mixin(Select2Mixin):
         return "%s%s" % (settings.SELECT2_CACHE_PREFIX, id(self))
 
     def set_to_cache(self):
-        """Add widget object to Djnago's cache."""
-        cache.set(self._get_cache_key(), self)
+        """
+        Add widget object to Django's cache.
 
-    def render_options(self, choices, selected_choices):
+        You may need to overwrite this method, to pickle all information
+        that is required to serve your JSON response view.
+        """
+        try:
+            cache.set(self._get_cache_key(), {
+                'widget': self,
+                'url': self.get_url(),
+            })
+        except (PicklingError, AttributeError):
+            msg = "You need to overwrite \"set_to_cache\" or ensure that %s is serialisable."
+            raise NotImplementedError(msg % self.__class__.__name__)
+
+    def render_options(self, *args):
         """Render only selected options."""
+        try:
+            selected_choices, = args
+        except ValueError:  # Signature contained `choices` prior to Django 1.10
+            choices, selected_choices = args
+            choices = chain(self.choices, choices)
+        else:
+            choices = self.choices
         output = ['<option></option>' if not self.is_required else '']
-        choices = {(k, v) for k, v in choices if k in selected_choices}
         selected_choices = {force_text(v) for v in selected_choices}
+        choices = {(k, v) for k, v in choices if force_text(k) in selected_choices}
         for option_value, option_label in choices:
             output.append(self.render_option(selected_choices, option_value, option_label))
         return '\n'.join(output)
 
 
-class HeavySelect2Widget(HeavySelect2Mixin, forms.Select):
-
+class HeavySelect2Widget(HeavySelect2Mixin, Select2Widget):
     """
     Select2 widget with AJAX support that registers itself to Django's Cache.
 
@@ -235,37 +277,29 @@ class HeavySelect2Widget(HeavySelect2Mixin, forms.Select):
     pass
 
 
-class HeavySelect2MultipleWidget(HeavySelect2Mixin, forms.SelectMultiple):
-
+class HeavySelect2MultipleWidget(HeavySelect2Mixin, Select2MultipleWidget):
     """Select2 multi select widget similar to :class:`.HeavySelect2Widget`."""
 
     pass
 
 
-class HeavySelect2TagWidget(HeavySelect2MultipleWidget):
+class HeavySelect2TagWidget(HeavySelect2Mixin, Select2TagWidget):
+    """Select2 tag widget."""
 
-    """Mixin to add select2 tag functionality."""
-
-    def build_attrs(self, extra_attrs=None, **kwargs):
-        """Add select2's tag attributes."""
-        self.attrs.setdefault('data-minimum-input-length', 1)
-        self.attrs.setdefault('data-tags', 'true')
-        self.attrs.setdefault('data-token-separators', [",", " "])
-        return super(HeavySelect2TagWidget, self).build_attrs(extra_attrs, **kwargs)
+    pass
 
 
 # Auto Heavy widgets
 
 
 class ModelSelect2Mixin(object):
-
     """Widget mixin that provides attributes and methods for :class:`.AutoResponseView`."""
 
     model = None
     queryset = None
     search_fields = []
     """
-    Model lookups that are used to filter the queryset.
+    Model lookups that are used to filter the QuerySet.
 
     Example::
 
@@ -282,14 +316,12 @@ class ModelSelect2Mixin(object):
         """
         Overwrite class parameters if passed as keyword arguments.
 
-        :param model: model to select choices from
-        :type model: django.db.models.Model
-        :param queryset: queryset to select choices from
-        :type queryset: django.db.models.query.QuerySet
-        :param search_fields: list of model lookup strings
-        :type search_fields: list
-        :param max_results: max. JsonResponse view page size
-        :type max_results: int
+        Args:
+            model (django.db.models.Model): Model to select choices from.
+            queryset (django.db.models.QuerySet): QuerySet to select choices from.
+            search_fields (list): List of model lookup strings.
+            max_results (int): Max. JsonResponse view page size.
+
         """
         self.model = kwargs.pop('model', self.model)
         self.queryset = kwargs.pop('queryset', self.queryset)
@@ -301,9 +333,9 @@ class ModelSelect2Mixin(object):
 
     def set_to_cache(self):
         """
-        Add widget's attributes to Djnago's cache.
+        Add widget's attributes to Django's cache.
 
-        Split the queryset, to not pickle the result set.
+        Split the QuerySet, to not pickle the result set.
         """
         queryset = self.get_queryset()
         cache.set(self._get_cache_key(), {
@@ -315,18 +347,21 @@ class ModelSelect2Mixin(object):
             'cls': self.__class__,
             'search_fields': self.search_fields,
             'max_results': self.max_results,
+            'url': self.get_url(),
         })
 
     def filter_queryset(self, term, queryset=None):
         """
-        Return queryset filtered by search_fields matching the passed term.
+        Return QuerySet filtered by search_fields matching the passed term.
+
+        Args:
+            term (str): Search term
+
+        Returns:
+            QuerySet: Filtered QuerySet
 
-        :param term: Search term
-        :type term: str
-        :return: Filtered queryset
-        :rtype: :class:`.django.db.models.QuerySet`
         """
-        if not queryset:
+        if queryset is None:
             queryset = self.get_queryset()
         search_fields = self.get_search_fields()
         select = Q()
@@ -339,10 +374,11 @@ class ModelSelect2Mixin(object):
 
     def get_queryset(self):
         """
-        Return queryset based on :attr:`.queryset` or :attr:`.model`.
+        Return QuerySet based on :attr:`.queryset` or :attr:`.model`.
+
+        Returns:
+            QuerySet: QuerySet of available choices.
 
-        :return: queryset of available choices
-        :rtype: :class:`.django.db.models.QuerySet`
         """
         if self.queryset is not None:
             queryset = self.queryset
@@ -364,26 +400,53 @@ class ModelSelect2Mixin(object):
             return self.search_fields
         raise NotImplementedError('%s, must implement "search_fields".' % self.__class__.__name__)
 
-    def render_options(self, choices, selected_choices):
-        """Render only selected options and set queryset from :class:`ModelChoicesIterator`."""
+    def render_options(self, *args):
+        """Render only selected options and set QuerySet from :class:`ModelChoicesIterator`."""
+        try:
+            selected_choices, = args
+        except ValueError:
+            choices, selected_choices = args
+            choices = chain(self.choices, choices)
+        else:
+            choices = self.choices
+        selected_choices = {force_text(v) for v in selected_choices}
         output = ['<option></option>' if not self.is_required else '']
         if isinstance(self.choices, ModelChoiceIterator):
             if not self.queryset:
                 self.queryset = self.choices.queryset
             selected_choices = {c for c in selected_choices
                                 if c not in self.choices.field.empty_values}
-            choices = {self.choices.choice(obj)
+            choices = {(obj.pk, self.label_from_instance(obj))
                        for obj in self.choices.queryset.filter(pk__in=selected_choices)}
         else:
-            choices = {(k, v) for k, v in choices if k in selected_choices}
-        selected_choices = {force_text(v) for v in selected_choices}
+            choices = {(k, v) for k, v in choices if force_text(k) in selected_choices}
         for option_value, option_label in choices:
             output.append(self.render_option(selected_choices, option_value, option_label))
         return '\n'.join(output)
 
+    def label_from_instance(self, obj):
+        """
+        Return option label representation from instance.
+
+        Can be overridden to change the representation of each choice.
+
+        Example usage::
+
+            class MyWidget(ModelSelect2Widget):
+                def label_from_instance(obj):
+                    return force_text(obj.title).upper()
+
+        Args:
+            obj (django.db.models.Model): Instance of Django Model.
+
+        Returns:
+            str: Option label.
+
+        """
+        return force_text(obj)
+
 
 class ModelSelect2Widget(ModelSelect2Mixin, HeavySelect2Widget):
-
     """
     Select2 drop in model select widget.
 
@@ -391,7 +454,7 @@ class ModelSelect2Widget(ModelSelect2Mixin, HeavySelect2Widget):
 
         class MyWidget(ModelSelect2Widget):
             search_fields = [
-                'title__icontians',
+                'title__icontains',
             ]
 
         class MyModelForm(forms.ModelForm):
@@ -413,8 +476,8 @@ class ModelSelect2Widget(ModelSelect2Mixin, HeavySelect2Widget):
             )
 
     .. tip:: The ModelSelect2(Multiple)Widget will try
-        to get the queryset from the fields choices.
-        Therefore you don't need to define a queryset,
+        to get the QuerySet from the fields choices.
+        Therefore you don't need to define a QuerySet,
         if you just drop in the widget for a ForeignKey field.
     """
 
@@ -422,7 +485,6 @@ class ModelSelect2Widget(ModelSelect2Mixin, HeavySelect2Widget):
 
 
 class ModelSelect2MultipleWidget(ModelSelect2Mixin, HeavySelect2MultipleWidget):
-
     """
     Select2 drop in model multiple select widget.
 
@@ -433,13 +495,12 @@ class ModelSelect2MultipleWidget(ModelSelect2Mixin, HeavySelect2MultipleWidget):
 
 
 class ModelSelect2TagWidget(ModelSelect2Mixin, HeavySelect2TagWidget):
-
     """
-    Select2 model field with tag support.
+    Select2 model widget with tag support.
 
     This it not a simple drop in widget.
     It requires to implement you own :func:`.value_from_datadict`
-    that adds missing tags to you queryset.
+    that adds missing tags to you QuerySet.
 
     Example::
 
@@ -447,7 +508,7 @@ class ModelSelect2TagWidget(ModelSelect2Mixin, HeavySelect2TagWidget):
             queryset = MyModel.objects.all()
 
             def value_from_datadict(self, data, files, name):
-                values = super().value_from_datadict(self, data, files, name):
+                values = super().value_from_datadict(self, data, files, name)
                 qs = self.queryset.filter(**{'pk__in': list(values)})
                 pks = set(force_text(getattr(o, pk)) for o in qs)
                 cleaned_values = []

django_select2/urls.py

@@ -1,20 +1,19 @@
 # -*- coding: utf-8 -*-
 """
-Django-Select2 url config.
+Django-Select2 URL configuration.
 
-Add `django_select` to your urlconf **if** you use any 'Model' fields::
+Add `django_select` to your ``urlconf`` **if** you use any 'Model' fields::
 
     url(r'^select2/', include('django_select2.urls')),
 
 """
 from __future__ import absolute_import, unicode_literals
 
-from django.conf.urls import patterns, url
+from django.conf.urls import url
 
 from .views import AutoResponseView
 
-urlpatterns = patterns(
-    "",
+urlpatterns = [
     url(r"^fields/auto.json$",
         AutoResponseView.as_view(), name="django_select2-json"),
-)
+]

django_select2/views.py

@@ -5,7 +5,6 @@ from __future__ import absolute_import, unicode_literals
 from django.core import signing
 from django.core.signing import BadSignature
 from django.http import Http404, JsonResponse
-from django.utils.encoding import smart_text
 from django.views.generic.list import BaseListView
 
 from .cache import cache
@@ -13,7 +12,6 @@ from .conf import settings
 
 
 class AutoResponseView(BaseListView):
-
     """
     View that handles requests from heavy model widgets.
 
@@ -44,7 +42,7 @@ class AutoResponseView(BaseListView):
         return JsonResponse({
             'results': [
                 {
-                    'text': smart_text(obj),
+                    'text': self.widget.label_from_instance(obj),
                     'id': obj.pk,
                 }
                 for obj in context['object_list']
@@ -53,7 +51,7 @@ class AutoResponseView(BaseListView):
         })
 
     def get_queryset(self):
-        """Get queryset from cached widget."""
+        """Get QuerySet from cached widget."""
         return self.widget.filter_queryset(self.term, self.queryset)
 
     def get_paginate_by(self, queryset):
@@ -64,10 +62,12 @@ class AutoResponseView(BaseListView):
         """
         Get and return widget from cache.
 
-        Raises a 404 if the widget can not be found or no id is provided.
+        Raises:
+            Http404: If if the widget can not be found or no id is provided.
+
+        Returns:
+            ModelSelect2Mixin: Widget from cache.
 
-        :raises: Http404
-        :return: ModelSelect2Mixin
         """
         field_id = self.kwargs.get('field_id', self.request.GET.get('field_id', None))
         if not field_id:
@@ -81,6 +81,8 @@ class AutoResponseView(BaseListView):
             widget_dict = cache.get(cache_key)
             if widget_dict is None:
                 raise Http404('field_id not found')
+            if widget_dict.pop('url') != self.request.path:
+                raise Http404('field_id was issued for the view.')
         qs, qs.query = widget_dict.pop('queryset')
         self.queryset = qs.all()
         widget_dict['queryset'] = self.queryset

docs/Makefile

@@ -46,6 +46,11 @@ html:
 	@echo
 	@echo "Build finished. The HTML pages are in $(BUILDDIR)/html."
 
+spelling:
+	$(SPHINXBUILD) -b spelling -W $(ALLSPHINXOPTS) $(BUILDDIR)/spelling
+	@echo
+	@echo "Spell check finished. The results are in $(BUILDDIR)/spelling."
+
 dirhtml:
 	$(SPHINXBUILD) -b dirhtml $(ALLSPHINXOPTS) $(BUILDDIR)/dirhtml
 	@echo

docs/conf.py

@@ -41,7 +41,14 @@ sys.path.insert(0, os.path.abspath('..'))
 
 # Add any Sphinx extension module names here, as strings. They can be extensions
 # coming with Sphinx (named 'sphinx.ext.*') or your custom ones.
-extensions = ['sphinx.ext.autodoc',  'sphinx.ext.inheritance_diagram', 'sphinx.ext.intersphinx', 'sphinx.ext.viewcode']
+extensions = [
+    'sphinx.ext.autodoc',
+    'sphinx.ext.napoleon',
+    'sphinx.ext.inheritance_diagram',
+    'sphinx.ext.intersphinx',
+    'sphinx.ext.viewcode',
+    'sphinxcontrib.spelling',
+]
 
 intersphinx_mapping = {
     'python': ('http://docs.python.org/3.5', None),
@@ -49,6 +56,11 @@ intersphinx_mapping = {
                'https://docs.djangoproject.com/en/dev/_objects/'),
 }
 
+# spell check
+spelling_word_list_filename = 'spelling_wordlist.txt'
+spelling_show_suggestions = True
+
+
 # Add any paths that contain templates here, relative to this directory.
 templates_path = ['_templates']
 

docs/django_select2.rst

@@ -49,7 +49,7 @@ DjangoSelect2 handles the initialization of select2 fields automatically. Just i
 ``{{ form.media.js }}`` in your template before the closing ``body`` tag. That's it!
 
 If you insert forms after page load or if you want to handle the initialization
-yourself, DjangoSelect2 provides a jQuery-Plugin. It will handle both normal and
+yourself, DjangoSelect2 provides a jQuery plugin. It will handle both normal and
 heavy fields. Simply call ``djangoSelect2(options)`` on your select fields.::
 
         $('.django-select2').djangoSelect2();
@@ -58,3 +58,29 @@ heavy fields. Simply call ``djangoSelect2(options)`` on your select fields.::
 You can pass see `Select2 options <https://select2.github.io/options.html>`_ if needed::
 
         $('.django-select2').djangoSelect2({placeholder: 'Select an option'});
+
+Security & Authentication
+-------------------------
+
+Security is important. Therefore make sure to read and understand what
+the security measures in place and their limitations.
+
+Set up a separate cache. If you have a public form that uses a model widget
+make sure to setup a separate cache database for Select2. An attacker
+could constantly reload your site and fill up the select2 cache.
+Having a separate cache allows you to limit the effect to select2 only.
+
+You might want to add a secure select2 JSON endpoint for data you don't
+want to be accessible to the general public. Doing so is easy::
+
+    class UserSelect2View(LoginRequiredMixin, AutoResponseView):
+        pass
+
+    class UserSelect2WidgetMixin(object):
+        def __init__(self, *args, **kwargs):
+            kwargs['data_view'] = 'user-select2-view'
+            super(UserSelect2WidgetMixin, self).__init__(*args, **kwargs)
+
+    class MySecretWidget(UserSelect2WidgetMixin, Select2ModelWidget):
+        model = MySecretModel
+        search_fields = ['title__icontains']

docs/external_req.txt

@@ -1 +1,3 @@
-Django >= 1.4.1
+Django >= 1.8
+sphinxcontrib-spelling
+pyenchant

docs/get_started.rst

@@ -18,7 +18,8 @@ Installation
 2. Add ``django_select2`` to your ``INSTALLED_APPS`` in your project settings.
 
 
-3. Add ``django_select`` to your urlconf **if** you use any 'Auto' fields::
+3. Add ``django_select`` to your ``urlconf`` **if** you use any
+:class:`ModelWidgets <.django_select2.forms.ModelSelect2Mixin>`::
 
         url(r'^select2/', include('django_select2.urls')),
 

docs/spelling_wordlist.txt

@@ -0,0 +1,17 @@
+jQuery
+Django
+mixin
+backend
+redis
+memcached
+AJAX
+Cloudflare
+lookup
+QuerySet
+pre
+py
+lookups
+functionalities
+plugin
+multi
+Indices

requirements_dev.in

@@ -0,0 +1,12 @@
+django-appconf
+flake8
+pep8-naming
+mccabe
+isort
+pep257
+pytest
+pytest-django
+selenium
+sphinx
+sphinxcontrib-spelling
+pyenchant

requirements_dev.txt

@@ -1,19 +1,31 @@
--e .
+#
+# This file is autogenerated by pip-compile
+# Make changes in requirements_dev.in, then run this to update:
+#
+#    pip-compile requirements_dev.in
+#
+alabaster==0.7.7          # via sphinx
+babel==2.2.0              # via sphinx
 django-appconf==1.0.1
-django==1.8.4             # via model-mommy
-flake8==2.4.1
+docutils==0.12            # via sphinx
+flake8==2.5.2
 isort==4.2.2
-mccabe==0.3.1             # via flake8
-mock==1.3.0               # via model-mommy
-model-mommy==1.2.5
-pbr==1.8.0                # via mock
-pep257==0.5.0
+Jinja2==2.8
+MarkupSafe==0.23
+mccabe==0.4.0
+pep257==0.7.0
 pep8-naming==0.3.3
-pep8==1.5.7               # via flake8
-py==1.4.30                # via pytest
-pyflakes==0.8.1           # via flake8
-pytest-django==2.8.0
-pytest==2.7.2
-requests==2.7.0
-selenium==2.46.0
-six==1.9.0                # via django-appconf, mock, model-mommy
+pep8==1.7.0               # via flake8
+py==1.4.31                # via pytest
+pyenchant==1.6.6
+pyflakes==1.0.0           # via flake8
+Pygments==2.1
+pytest-django==2.9.1
+pytest==2.8.7
+pytz==2015.7              # via babel
+selenium==2.50.1
+six==1.10.0               # via django-appconf, sphinx, sphinxcontrib-spelling
+snowballstemmer==1.2.1    # via sphinx
+sphinx-rtd-theme==0.1.9   # via sphinx
+sphinx==1.3.5
+sphinxcontrib-spelling==2.1.2

setup.cfg

@@ -11,13 +11,12 @@ show-source = true
 exclude = docs,runtests.py,setup.py,env
 
 [pep257]
-explain = true
-count = true
 
 [isort]
 atomic = true
 multi_line_output = 5
 line_length = 79
 skip = manage.py,docs
-known_first_party = django_select2
+known_first_party = django_select2, tests
+known_third_party = django
 combine_as_imports = true

setup.py

@@ -22,23 +22,6 @@ URL = "https://github.com/applegrew/django-select2"
 VERSION = __import__(PACKAGE).__version__
 
 
-class PyTest(Command):
-    user_options = []
-
-    def initialize_options(self):
-        pass
-
-    def finalize_options(self):
-        pass
-
-    def run(self):
-        import sys
-        import subprocess
-
-        errno = subprocess.call([sys.executable, 'runtests.py'])
-        raise SystemExit(errno)
-
-
 setup(
     name=NAME,
     version=VERSION,
@@ -59,13 +42,12 @@ setup(
         "Programming Language :: Python",
         "Programming Language :: Python :: 2",
         "Programming Language :: Python :: 3",
-        "Framework :: Django :: 1.7",
-        "Framework :: Django :: 1.8",
         "Framework :: Django",
+        "Framework :: Django :: 1.8",
+        "Framework :: Django :: 1.9",
     ],
     install_requires=[
         'django-appconf>=0.6.0',
     ],
     zip_safe=False,
-    cmdclass={'test': PyTest},
 )

tests/conftest.py

@@ -2,9 +2,10 @@
 from __future__ import absolute_import, print_function, unicode_literals
 
 import os
+import random
+import string
 
 import pytest
-from model_mommy import mommy
 from selenium import webdriver
 from selenium.common.exceptions import WebDriverException
 
@@ -15,6 +16,13 @@ browsers = {
 }
 
 
+def random_string(n):
+    return ''.join(
+        random.choice(string.ascii_uppercase + string.digits)
+        for _ in range(n)
+    )
+
+
 @pytest.fixture(scope='session',
                 params=browsers.keys())
 def driver(request):
@@ -33,9 +41,16 @@ def driver(request):
 
 @pytest.fixture
 def genres(db):
-    return mommy.make('testapp.Genre', _quantity=100)
+    from .testapp.models import Genre
+
+    return Genre.objects.bulk_create(
+        [Genre(pk=pk, title=random_string(50)) for pk in range(100)]
+    )
 
 
 @pytest.fixture
 def artists(db):
-    return mommy.make('testapp.Artist', _quantity=100)
+    from .testapp.models import Artist
+    return Artist.objects.bulk_create(
+        [Artist(pk=pk, title=random_string(50)) for pk in range(100)]
+    )

tests/test_forms.py

@@ -9,14 +9,13 @@ from django.core import signing
 from django.core.urlresolvers import reverse
 from django.db.models import QuerySet
 from django.utils.encoding import force_text
-from model_mommy import mommy
 from selenium.common.exceptions import NoSuchElementException
 from six import text_type
 
 from django_select2.cache import cache
 from django_select2.forms import (
-    HeavySelect2Widget, ModelSelect2TagWidget, ModelSelect2Widget,
-    Select2Widget
+    HeavySelect2MultipleWidget, HeavySelect2Widget, ModelSelect2TagWidget,
+    ModelSelect2Widget, Select2Widget
 )
 from tests.testapp import forms
 from tests.testapp.forms import (
@@ -30,6 +29,11 @@ class TestSelect2Mixin(object):
     form = forms.AlbumSelect2WidgetForm()
     widget_cls = Select2Widget
 
+    def test_initial_data(self, genres):
+        genre = genres[0]
+        form = self.form.__class__(initial={'primary_genre': genre.pk})
+        assert text_type(genre) in form.as_p()
+
     def test_initial_form_class(self):
         widget = self.widget_cls(attrs={'class': 'my-class'})
         assert 'my-class' in widget.render('name', None)
@@ -79,11 +83,36 @@ class TestSelect2Mixin(object):
         assert widget.get_url() == '/foo/bar'
 
 
+class TestSelect2MixinSettings(object):
+    def test_default_media(self):
+        sut = Select2Widget()
+        result = sut.media.render()
+        assert '//cdnjs.cloudflare.com/ajax/libs/select2/4.0.0/js/select2.min.js' in result
+        assert '//cdnjs.cloudflare.com/ajax/libs/select2/4.0.0/css/select2.min.css' in result
+        assert 'django_select2/django_select2.js' in result
+
+    def test_js_setting(self, settings):
+        settings.SELECT2_JS = 'alternate.js'
+        sut = Select2Widget()
+        result = sut.media.render()
+        assert 'alternate.js' in result
+        assert 'django_select2/django_select2.js' in result
+
+    def test_css_setting(self, settings):
+        settings.SELECT2_CSS = 'alternate.css'
+        sut = Select2Widget()
+        result = sut.media.render()
+        assert 'alternate.css' in result
+
+
 class TestHeavySelect2Mixin(TestSelect2Mixin):
     url = reverse('heavy_select2_widget')
-    form = forms.HeavySelect2WidgetForm(initial={'primary_genre': [1]})
+    form = forms.HeavySelect2WidgetForm(initial={'primary_genre': 1})
     widget_cls = HeavySelect2Widget
 
+    def test_initial_data(self):
+        assert 'One' in self.form.as_p()
+
     def test_initial_form_class(self):
         widget = self.widget_cls(data_view='heavy_data_1', attrs={'class': 'my-class'})
         assert 'my-class' in widget.render('name', None)
@@ -94,14 +123,13 @@ class TestHeavySelect2Mixin(TestSelect2Mixin):
         not_required_field = self.form.fields['primary_genre']
         assert not_required_field.required is False
         assert '<option value="1" selected="selected">One</option>' in \
-               not_required_field.widget.render('primary_genre', 1, choices=NUMBER_CHOICES), \
-            not_required_field.widget.render('primary_genre', 1, choices=NUMBER_CHOICES)
+               not_required_field.widget.render('primary_genre', 1), \
+            not_required_field.widget.render('primary_genre', 1)
 
     def test_many_selected_option(self, db, genres):
         field = HeavySelect2MultipleWidgetForm().fields['genres']
-        widget_output = field.widget.render(
-            'genres', [1, 2],
-            choices=NUMBER_CHOICES)
+        field.widget.choices = NUMBER_CHOICES
+        widget_output = field.widget.render('genres', [1, 2])
         selected_option = '<option value="{pk}" selected="selected">{value}</option>'.format(pk=1, value='One')
         selected_option2 = '<option value="{pk}" selected="selected">{value}</option>'.format(pk=2, value='Two')
 
@@ -125,13 +153,41 @@ class TestHeavySelect2Mixin(TestSelect2Mixin):
             error = driver.find_element_by_xpath('//body[@JSError]')
             pytest.fail(error.get_attribute('JSError'))
 
+    def test_get_url(self):
+        widget = self.widget_cls(data_view='heavy_data_1', attrs={'class': 'my-class'})
+        assert isinstance(widget.get_url(), text_type)
+
+    def test_can_not_pickle(self):
+        widget = self.widget_cls(data_view='heavy_data_1', attrs={'class': 'my-class'})
+
+        class NoPickle(object):
+            pass
+
+        widget.no_pickle = NoPickle()
+        with pytest.raises(NotImplementedError):
+            widget.set_to_cache()
+
 
 class TestModelSelect2Mixin(TestHeavySelect2Mixin):
     form = forms.AlbumModelSelect2WidgetForm(initial={'primary_genre': 1})
 
+    def test_initial_data(self, genres):
+        genre = genres[0]
+        form = self.form.__class__(initial={'primary_genre': genre.pk})
+        assert text_type(genre) in form.as_p()
+
+    def test_label_from_instance_initial(self, genres):
+        genre = genres[0]
+        genre.title = genre.title.lower()
+        genre.save()
+
+        form = self.form.__class__(initial={'primary_genre': genre.pk})
+        assert genre.title not in form.as_p()
+        assert genre.title.upper() in form.as_p()
+
     @pytest.fixture(autouse=True)
-    def genres(self, db):
-        return mommy.make(Genre, 100)
+    def genres(self, genres):
+        return genres
 
     def test_selected_option(self, db, genres):
         genre = genres[0]
@@ -148,6 +204,23 @@ class TestModelSelect2Mixin(TestHeavySelect2Mixin):
         assert selected_option in widget_output, widget_output
         assert unselected_option not in widget_output
 
+    def test_selected_option_label_from_instance(self, db, genres):
+        genre = genres[0]
+        genre.title = genre.title.lower()
+        genre.save()
+
+        field = self.form.fields['primary_genre']
+        widget_output = field.widget.render('primary_genre', genre.pk)
+
+        def get_selected_option(genre):
+            return '<option value="{pk}" selected="selected">{value}</option>'.format(
+                pk=genre.pk, value=force_text(genre))
+
+        assert get_selected_option(genre) not in widget_output
+        genre.title = genre.title.upper()
+
+        assert get_selected_option(genre) in widget_output
+
     def test_get_queryset(self):
         widget = ModelSelect2Widget()
         with pytest.raises(NotImplementedError):
@@ -209,6 +282,10 @@ class TestModelSelect2Mixin(TestHeavySelect2Mixin):
         assert isinstance(cached_widget['queryset'][0], qs.__class__)
         assert text_type(cached_widget['queryset'][1]) == text_type(qs.query)
 
+    def test_get_url(self):
+        widget = ModelSelect2Widget(queryset=Genre.objects.all(), search_fields=['title__icontains'])
+        assert isinstance(widget.get_url(), text_type)
+
 
 class TestHeavySelect2TagWidget(TestHeavySelect2Mixin):
 
@@ -224,3 +301,26 @@ class TestHeavySelect2TagWidget(TestHeavySelect2Mixin):
             queryset=Genre.objects.all(), search_fields=['title__icontains'], attrs={'data-minimum-input-length': '3'})
         output = widget.render('name', 'value')
         assert 'data-minimum-input-length="3"' in output
+
+
+class TestHeavySelect2MultipleWidget(object):
+    url = reverse('heavy_select2_multiple_widget')
+    form = forms.HeavySelect2MultipleWidgetForm()
+    widget_cls = HeavySelect2MultipleWidget
+
+    def test_widgets_selected_after_validation_error(self, db, live_server, driver):
+        driver.get(live_server + self.url)
+        title = driver.find_element_by_id('id_title')
+        title.send_keys('fo')
+        genres, fartists = driver.find_elements_by_css_selector('.select2-selection--multiple')
+        genres.click()
+        genres.send_keys('o')  # results are Zero One Two Four
+        # select second element - One
+        driver.find_element_by_css_selector('.select2-results li:nth-child(2)').click()
+        genres.submit()
+        # there is a ValidationError raised, check for it
+        errstring = driver.find_element_by_css_selector('ul.errorlist li').text
+        assert errstring == "Title must have more than 3 characters."
+        # genres should still have One as selected option
+        result_title = driver.find_element_by_css_selector('.select2-selection--multiple li').get_attribute('title')
+        assert result_title == 'One'

tests/test_views.py

@@ -7,8 +7,11 @@ from django.core import signing
 from django.core.urlresolvers import reverse
 from django.utils.encoding import smart_text
 
+from django_select2.cache import cache
 from django_select2.forms import ModelSelect2Widget
-from tests.testapp.forms import AlbumModelSelect2WidgetForm
+from tests.testapp.forms import (
+    AlbumModelSelect2WidgetForm, ArtistCustomTitleWidget
+)
 from tests.testapp.models import Genre
 
 
@@ -66,3 +69,32 @@ class TestAutoResponseView(object):
         assert response.status_code == 200
         data = json.loads(response.content.decode('utf-8'))
         assert data['more'] is False
+
+    def test_label_from_instance(self, artists, client):
+        url = reverse('django_select2-json')
+
+        form = AlbumModelSelect2WidgetForm()
+        form.fields['artist'].widget = ArtistCustomTitleWidget()
+        assert form.as_p()
+        field_id = signing.dumps(id(form.fields['artist'].widget))
+
+        artist = artists[0]
+        response = client.get(url, {'field_id': field_id, 'term': artist.title})
+        assert response.status_code == 200
+
+        data = json.loads(response.content.decode('utf-8'))
+        assert data['results']
+        assert {'id': artist.pk, 'text': smart_text(artist.title.upper())} in data['results']
+
+    def test_url_check(self, client, artists):
+        artist = artists[0]
+        form = AlbumModelSelect2WidgetForm()
+        assert form.as_p()
+        field_id = signing.dumps(id(form.fields['artist'].widget))
+        cache_key = form.fields['artist'].widget._get_cache_key()
+        widget_dict = cache.get(cache_key)
+        widget_dict['url'] = 'yet/another/url'
+        cache.set(cache_key, widget_dict)
+        url = reverse('django_select2-json')
+        response = client.get(url, {'field_id': field_id, 'term': artist.title})
+        assert response.status_code == 404

tests/testapp/forms.py

@@ -2,6 +2,7 @@
 from __future__ import absolute_import, unicode_literals
 
 from django import forms
+from django.utils.encoding import force_text
 
 from django_select2.forms import (
     HeavySelect2MultipleWidget, HeavySelect2Widget, ModelSelect2MultipleWidget,
@@ -34,6 +35,26 @@ class GenreSelect2TagWidget(TitleSearchFieldMixin, ModelSelect2TagWidget):
         self.get_queryset().create(title=value)
 
 
+class ArtistCustomTitleWidget(ModelSelect2Widget):
+    model = models.Artist
+    search_fields = [
+        'title__icontains'
+    ]
+
+    def label_from_instance(self, obj):
+        return force_text(obj.title).upper()
+
+
+class GenreCustomTitleWidget(ModelSelect2Widget):
+    model = models.Genre
+    search_fields = [
+        'title__icontains'
+    ]
+
+    def label_from_instance(self, obj):
+        return force_text(obj.title).upper()
+
+
 class AlbumSelect2WidgetForm(forms.ModelForm):
     class Meta:
         model = models.Album
@@ -69,16 +90,14 @@ class AlbumModelSelect2WidgetForm(forms.ModelForm):
             'primary_genre',
         )
         widgets = {
-            'artist': ModelSelect2Widget(
-                model=models.Artist,
-                search_fields=['title__icontains']
-            ),
-            'primary_genre': ModelSelect2Widget(
-                model=models.Genre,
-                search_fields=['title__icontains']
-            ),
+            'artist': ArtistCustomTitleWidget(),
+            'primary_genre': GenreCustomTitleWidget(),
         }
 
+    def __init__(self, *args, **kwargs):
+        super(AlbumModelSelect2WidgetForm, self).__init__(*args, **kwargs)
+        self.fields['primary_genre'].initial = 2
+
 
 class AlbumModelSelect2MultipleWidgetRequiredForm(forms.ModelForm):
     class Meta:
@@ -114,23 +133,33 @@ class Select2WidgetForm(forms.Form):
 
 class HeavySelect2WidgetForm(forms.Form):
     artist = forms.ChoiceField(
-        widget=HeavySelect2Widget(data_view='heavy_data_1', choices=NUMBER_CHOICES)
+        widget=HeavySelect2Widget(data_view='heavy_data_1'),
+        choices=NUMBER_CHOICES
     )
     primary_genre = forms.ChoiceField(
-        widget=HeavySelect2Widget(data_view='heavy_data_2', choices=NUMBER_CHOICES),
-        required=False
+        widget=HeavySelect2Widget(data_view='heavy_data_2'),
+        required=False,
+        choices=NUMBER_CHOICES
     )
 
 
 class HeavySelect2MultipleWidgetForm(forms.Form):
+    title = forms.CharField(max_length=50)
     genres = forms.MultipleChoiceField(
-        widget=HeavySelect2MultipleWidget(data_view='heavy_data_1', choices=NUMBER_CHOICES)
+        widget=HeavySelect2MultipleWidget(data_view='heavy_data_1', choices=NUMBER_CHOICES),
+        choices=NUMBER_CHOICES
     )
     featured_artists = forms.MultipleChoiceField(
         widget=HeavySelect2MultipleWidget(data_view='heavy_data_2', choices=NUMBER_CHOICES),
+        choices=NUMBER_CHOICES,
         required=False
     )
 
+    def clean_title(self):
+        if len(self.cleaned_data['title']) < 3:
+            raise forms.ValidationError("Title must have more than 3 characters.")
+        return self.cleaned_data["title"]
+
 
 class ModelSelect2TagWidgetForm(forms.ModelForm):
     class Meta:

tests/testapp/settings.py

@@ -33,9 +33,12 @@ MEDIA_ROOT = os.path.join(BASE_DIR, 'media')
 SITE_ID = 1
 ROOT_URLCONF = 'tests.testapp.urls'
 
-TEMPLATE_DIRS = (
-    os.path.join(BASE_DIR, "templates"),
-)
+TEMPLATES = [
+    {
+        'BACKEND': 'django.template.backends.django.DjangoTemplates',
+        'APP_DIRS': True,
+    },
+]
 
 SECRET_KEY = '123456'
 

tests/testapp/urls.py

@@ -1,7 +1,7 @@
 # -*- conding:utf-8 -*-
 from __future__ import absolute_import, unicode_literals
 
-from django.conf.urls import include, patterns, url
+from django.conf.urls import include, url
 
 from .forms import (
     AlbumModelSelect2WidgetForm, HeavySelect2MultipleWidgetForm,
@@ -9,14 +9,13 @@ from .forms import (
 )
 from .views import TemplateFormView, heavy_data_1, heavy_data_2
 
-urlpatterns = patterns(
-    '',
+urlpatterns = [
     url(r'^select2_widget/$',
         TemplateFormView.as_view(form_class=Select2WidgetForm), name='select2_widget'),
     url(r'^heavy_select2_widget/$',
         TemplateFormView.as_view(form_class=HeavySelect2WidgetForm), name='heavy_select2_widget'),
     url(r'^heavy_select2_multiple_widget/$',
-        TemplateFormView.as_view(form_class=HeavySelect2MultipleWidgetForm),
+        TemplateFormView.as_view(form_class=HeavySelect2MultipleWidgetForm, success_url='/'),
         name='heavy_select2_multiple_widget'),
 
     url(r'^model_select2_widget/$',
@@ -31,4 +30,4 @@ urlpatterns = patterns(
     url(r'^heavy_data_2/$', heavy_data_2, name='heavy_data_2'),
 
     url(r'^select2/', include('django_select2.urls')),
-)
+]

tests/testapp/views.py

@@ -12,12 +12,16 @@ class TemplateFormView(FormView):
 
 
 def heavy_data_1(request):
+    term = request.GET.get("term", "")
     numbers = ['Zero', 'One', 'Two', 'Three', 'Four', 'Five']
+    numbers = filter(lambda num: term.lower() in num.lower(), numbers)
     results = [{'id': index, 'text': value} for (index, value) in enumerate(numbers)]
     return HttpResponse(json.dumps({'err': 'nil', 'results': results}), content_type='application/json')
 
 
 def heavy_data_2(request):
+    term = request.GET.get("term", "")
     numbers = ['Six', 'Seven', 'Eight', 'Nine', 'Ten', 'Fortytwo']
+    numbers = filter(lambda num: term.lower() in num.lower(), numbers)
     results = [{'id': index, 'text': value} for (index, value) in enumerate(numbers)]
     return HttpResponse(json.dumps({'err': 'nil', 'results': results}), content_type='application/json')