Bài 04 Part 2: Views

Views Trong Django

View Là Gì?

View là Python function hoặc class nhận web request và trả về web response. View chứa logic xử lý request và chuẩn bị data để render.

Request-Response Cycle:

1. User request → URL2. Django finds matching URL pattern3. Django calls corresponding view4. View processes request5. View returns response (HTML, JSON, redirect, etc.)6. Response → User

View Types:

# 1. Function-Based Views (FBV)def my_view(request):    return HttpResponse("Hello") # 2. Class-Based Views (CBV)class MyView(View):    def get(self, request):        return HttpResponse("Hello") # 3. Generic Viewsclass PostList(ListView):    model = Post

Function-Based Views (FBV)

Basic FBV Structure

# blog/views.pyfrom django.shortcuts import renderfrom django.http import HttpResponse def simple_view(request):    """Simplest view - returns plain text."""    return HttpResponse("Hello, Django!") def template_view(request):    """View that renders template."""    context = {'message': 'Hello from view'}    return render(request, 'blog/hello.html', context) def data_view(request):    """View that processes data."""    posts = Post.objects.all()    context = {'posts': posts}    return render(request, 'blog/post_list.html', context)

HttpRequest Object

def my_view(request):    """    request object contains:    - request.method: 'GET', 'POST', 'PUT', 'DELETE', etc.    - request.GET: GET parameters    - request.POST: POST data    - request.FILES: Uploaded files    - request.user: Current user    - request.path: URL path    - request.META: Headers and metadata    """        # Access request data    method = request.method  # 'GET' or 'POST'    path = request.path  # '/blog/posts/'    user = request.user  # Current user object        # GET parameters    page = request.GET.get('page', 1)    search = request.GET.get('q', '')        # POST data    if request.method == 'POST':        title = request.POST.get('title')        content = request.POST.get('content')        # Headers    user_agent = request.META.get('HTTP_USER_AGENT')    ip_address = request.META.get('REMOTE_ADDR')        return HttpResponse(f"Method: {method}")

HttpResponse Types

from django.http import (    HttpResponse,     JsonResponse,     HttpResponseRedirect,    HttpResponseNotFound,    HttpResponseForbidden,    FileResponse)from django.shortcuts import render, redirect # 1. HttpResponse - Plain text/HTMLdef plain_response(request):    return HttpResponse("Plain text response") def html_response(request):    html = "<h1>Hello Django</h1>"    return HttpResponse(html) # 2. render() - Template renderingdef template_response(request):    context = {'title': 'My Page'}    return render(request, 'blog/page.html', context) # 3. JsonResponse - JSON datadef json_response(request):    data = {        'status': 'success',        'posts': list(Post.objects.values('title', 'slug'))    }    return JsonResponse(data) # 4. redirect() - Redirect to another URLdef redirect_response(request):    return redirect('blog:post_list') # 5. HttpResponseNotFound - 404def not_found_response(request):    return HttpResponseNotFound("Page not found") # 6. FileResponse - Download filedef download_file(request):    file_path = '/path/to/file.pdf'    return FileResponse(open(file_path, 'rb'), as_attachment=True)

Complete CRUD with FBV

# blog/views.pyfrom django.shortcuts import render, redirect, get_object_or_404from django.http import HttpResponsefrom .models import Postfrom .forms import PostForm # CREATEdef post_create(request):    """Create new post."""    if request.method == 'POST':        form = PostForm(request.POST)        if form.is_valid():            post = form.save(commit=False)            post.author = request.user            post.save()            return redirect('blog:post_detail', slug=post.slug)    else:        form = PostForm()        context = {'form': form}    return render(request, 'blog/post_form.html', context) # READ (List)def post_list(request):    """List all posts."""    posts = Post.objects.filter(published=True).order_by('-created')        # Pagination    from django.core.paginator import Paginator    paginator = Paginator(posts, 10)  # 10 posts per page    page_number = request.GET.get('page')    page_obj = paginator.get_page(page_number)        context = {'page_obj': page_obj}    return render(request, 'blog/post_list.html', context) # READ (Detail)def post_detail(request, slug):    """Display single post."""    post = get_object_or_404(Post, slug=slug, published=True)    comments = post.comments.filter(approved=True)        context = {        'post': post,        'comments': comments,    }    return render(request, 'blog/post_detail.html', context) # UPDATEdef post_edit(request, slug):    """Edit existing post."""    post = get_object_or_404(Post, slug=slug)        # Check permission    if post.author != request.user:        return HttpResponseForbidden("You can't edit this post")        if request.method == 'POST':        form = PostForm(request.POST, instance=post)        if form.is_valid():            form.save()            return redirect('blog:post_detail', slug=post.slug)    else:        form = PostForm(instance=post)        context = {'form': form, 'post': post}    return render(request, 'blog/post_form.html', context) # DELETEdef post_delete(request, slug):    """Delete post."""    post = get_object_or_404(Post, slug=slug)        # Check permission    if post.author != request.user:        return HttpResponseForbidden("You can't delete this post")        if request.method == 'POST':        post.delete()        return redirect('blog:post_list')        context = {'post': post}    return render(request, 'blog/post_confirm_delete.html', context)

Handling Different HTTP Methods

def contact_view(request):    """Handle GET and POST differently."""        if request.method == 'POST':        # Process form submission        name = request.POST.get('name')        email = request.POST.get('email')        message = request.POST.get('message')                # Save to database or send email        # ...                return redirect('contact_success')        # GET request - show form    return render(request, 'contact.html') def api_view(request):    """Handle multiple HTTP methods."""        if request.method == 'GET':        # List items        items = Item.objects.all()        data = list(items.values())        return JsonResponse({'items': data})        elif request.method == 'POST':        # Create item        title = request.POST.get('title')        item = Item.objects.create(title=title)        return JsonResponse({'id': item.id, 'title': item.title})        elif request.method == 'DELETE':        # Delete item        item_id = request.GET.get('id')        Item.objects.filter(id=item_id).delete()        return JsonResponse({'status': 'deleted'})        else:        return HttpResponse(status=405)  # Method Not Allowed

Class-Based Views (CBV)

Basic CBV Structure

# blog/views.pyfrom django.views import Viewfrom django.http import HttpResponsefrom django.shortcuts import render class MyView(View):    """Basic class-based view."""        def get(self, request):        """Handle GET request."""        return HttpResponse("Hello from CBV")        def post(self, request):        """Handle POST request."""        return HttpResponse("POST received") # blog/urls.pyurlpatterns = [    path('my-view/', MyView.as_view(), name='my_view'),]

Why Use CBV?

Advantages:

# ✅ Code reusability via inheritanceclass BasePostView(View):    model = Post        def get_queryset(self):        return self.model.objects.filter(published=True) class PostListView(BasePostView):    def get(self, request):        posts = self.get_queryset()        # ... class FeaturedPostsView(BasePostView):    def get_queryset(self):        return super().get_queryset().filter(featured=True) # ✅ Mixins for shared functionalityclass LoginRequiredMixin:    def dispatch(self, request, *args, **kwargs):        if not request.user.is_authenticated:            return redirect('login')        return super().dispatch(request, *args, **kwargs) # ✅ Less code with generic viewsclass PostList(ListView):    model = Post  # Just 1 line!    # vs 10+ lines with FBV

When to use FBV vs CBV:

# Use FBV when:# - Simple views# - One-off functionality# - Learning Django# - Team prefers functions # Use CBV when:# - CRUD operations# - Code reusability needed# - Using generic views# - Complex inheritance

HTTP Method Handlers

from django.views import Viewfrom django.http import JsonResponse class PostAPIView(View):    """Handle different HTTP methods."""        def get(self, request, *args, **kwargs):        """List or retrieve posts."""        posts = Post.objects.all()        data = list(posts.values('id', 'title', 'slug'))        return JsonResponse({'posts': data})        def post(self, request, *args, **kwargs):        """Create new post."""        title = request.POST.get('title')        content = request.POST.get('content')        post = Post.objects.create(title=title, content=content)        return JsonResponse({'id': post.id, 'title': post.title})        def put(self, request, *args, **kwargs):        """Update post."""        # Parse PUT data        import json        data = json.loads(request.body)        post_id = kwargs.get('pk')        post = Post.objects.get(id=post_id)        post.title = data.get('title', post.title)        post.save()        return JsonResponse({'status': 'updated'})        def delete(self, request, *args, **kwargs):        """Delete post."""        post_id = kwargs.get('pk')        Post.objects.filter(id=post_id).delete()        return JsonResponse({'status': 'deleted'})

View Attributes and Methods

from django.views import Viewfrom django.shortcuts import render class PostListView(View):    """View with attributes."""        # Class attributes    template_name = 'blog/post_list.html'    context_object_name = 'posts'    paginate_by = 10        def get_queryset(self):        """Get queryset - can be overridden."""        return Post.objects.filter(published=True)        def get_context_data(self, **kwargs):        """Get context data."""        context = {}        context['posts'] = self.get_queryset()        context['total'] = context['posts'].count()        return context        def get(self, request, *args, **kwargs):        """Handle GET request."""        context = self.get_context_data()        return render(request, self.template_name, context)

Generic Views

ListView - List Objects

from django.views.generic import ListViewfrom .models import Post class PostListView(ListView):    """Display list of posts."""    model = Post    template_name = 'blog/post_list.html'    context_object_name = 'posts'    paginate_by = 10    ordering = ['-created']        def get_queryset(self):        """Filter published posts only."""        queryset = super().get_queryset()        return queryset.filter(published=True)        def get_context_data(self, **kwargs):        """Add extra context."""        context = super().get_context_data(**kwargs)        context['total_posts'] = Post.objects.count()        context['categories'] = Category.objects.all()        return context # Template: blog/post_list.html"""{{ posts }}  or {{ object_list }}{{ page_obj }}{{ is_paginated }}{{ total_posts }}{{ categories }}"""

DetailView - Display Single Object

from django.views.generic import DetailView class PostDetailView(DetailView):    """Display single post."""    model = Post    template_name = 'blog/post_detail.html'    context_object_name = 'post'    slug_field = 'slug'    slug_url_kwarg = 'slug'        def get_queryset(self):        """Only published posts."""        return Post.objects.filter(published=True)        def get_context_data(self, **kwargs):        """Add related data."""        context = super().get_context_data(**kwargs)        post = self.get_object()        context['comments'] = post.comments.filter(approved=True)        context['related_posts'] = Post.objects.filter(            category=post.category        ).exclude(id=post.id)[:5]        return context # URLsurlpatterns = [    path('<slug:slug>/', PostDetailView.as_view(), name='post_detail'),] # Template: blog/post_detail.html"""{{ post }}  or {{ object }}{{ comments }}{{ related_posts }}"""

CreateView - Create Object

from django.views.generic.edit import CreateViewfrom django.urls import reverse_lazyfrom .models import Postfrom .forms import PostForm class PostCreateView(CreateView):    """Create new post."""    model = Post    form_class = PostForm    template_name = 'blog/post_form.html'    success_url = reverse_lazy('blog:post_list')        def form_valid(self, form):        """Set author before saving."""        form.instance.author = self.request.user        return super().form_valid(form)        def get_context_data(self, **kwargs):        """Add context."""        context = super().get_context_data(**kwargs)        context['action'] = 'Create'        return context # Alternative: success_url with get_success_url()class PostCreateView(CreateView):    model = Post    form_class = PostForm        def get_success_url(self):        """Redirect to created post."""        return reverse('blog:post_detail', kwargs={'slug': self.object.slug})

UpdateView - Update Object

from django.views.generic.edit import UpdateView class PostUpdateView(UpdateView):    """Edit existing post."""    model = Post    form_class = PostForm    template_name = 'blog/post_form.html'    slug_field = 'slug'    slug_url_kwarg = 'slug'        def get_queryset(self):        """Only allow author to edit."""        queryset = super().get_queryset()        return queryset.filter(author=self.request.user)        def get_success_url(self):        return reverse('blog:post_detail', kwargs={'slug': self.object.slug})        def get_context_data(self, **kwargs):        context = super().get_context_data(**kwargs)        context['action'] = 'Update'        return context # URLsurlpatterns = [    path('<slug:slug>/edit/', PostUpdateView.as_view(), name='post_edit'),]

DeleteView - Delete Object

from django.views.generic.edit import DeleteView class PostDeleteView(DeleteView):    """Delete post."""    model = Post    template_name = 'blog/post_confirm_delete.html'    success_url = reverse_lazy('blog:post_list')    slug_field = 'slug'    slug_url_kwarg = 'slug'        def get_queryset(self):        """Only allow author to delete."""        queryset = super().get_queryset()        return queryset.filter(author=self.request.user) # Template: blog/post_confirm_delete.html"""<form method="post">    {% csrf_token %}    <p>Are you sure you want to delete "{{ post.title }}"?</p>    <button type="submit">Delete</button>    <a href="{{ post.get_absolute_url }}">Cancel</a></form>""" # URLsurlpatterns = [    path('<slug:slug>/delete/', PostDeleteView.as_view(), name='post_delete'),]

FormView - Handle Forms

from django.views.generic.edit import FormViewfrom .forms import ContactForm class ContactView(FormView):    """Contact form."""    template_name = 'contact.html'    form_class = ContactForm    success_url = reverse_lazy('contact_success')        def form_valid(self, form):        """Process form data."""        name = form.cleaned_data['name']        email = form.cleaned_data['email']        message = form.cleaned_data['message']                # Send email        from django.core.mail import send_mail        send_mail(            subject=f'Contact from {name}',            message=message,            from_email=email,            recipient_list=['admin@example.com'],        )                return super().form_valid(form)

Mixins

Built-in Mixins

from django.contrib.auth.mixins import (    LoginRequiredMixin,    PermissionRequiredMixin,    UserPassesTestMixin)from django.views.generic import CreateView # 1. LoginRequiredMixin - Require authenticationclass PostCreateView(LoginRequiredMixin, CreateView):    model = Post    form_class = PostForm    login_url = '/login/'  # Redirect if not logged in    redirect_field_name = 'next' # 2. PermissionRequiredMixin - Require permissionclass PostDeleteView(PermissionRequiredMixin, DeleteView):    model = Post    permission_required = 'blog.delete_post'    # permission_required = ['blog.delete_post', 'blog.view_post']  # Multiple # 3. UserPassesTestMixin - Custom testclass PostUpdateView(UserPassesTestMixin, UpdateView):    model = Post    form_class = PostForm        def test_func(self):        """Only author can edit."""        post = self.get_object()        return post.author == self.request.user

Custom Mixins

# blog/mixins.pyfrom django.shortcuts import redirectfrom django.contrib import messages class AuthorRequiredMixin:    """Only allow author to access."""        def dispatch(self, request, *args, **kwargs):        obj = self.get_object()        if obj.author != request.user:            messages.error(request, "You don't have permission")            return redirect('blog:post_list')        return super().dispatch(request, *args, **kwargs) class FormMessageMixin:    """Add success message after form submission."""    success_message = "Successfully saved!"        def form_valid(self, form):        messages.success(self.request, self.success_message)        return super().form_valid(form) class AjaxFormMixin:    """Handle AJAX form submissions."""        def form_valid(self, form):        if self.request.is_ajax():            return JsonResponse({'status': 'success'})        return super().form_valid(form)        def form_invalid(self, form):        if self.request.is_ajax():            return JsonResponse({'errors': form.errors}, status=400)        return super().form_invalid(form) # Usage:class PostUpdateView(    LoginRequiredMixin,    AuthorRequiredMixin,    FormMessageMixin,    UpdateView):    model = Post    form_class = PostForm    success_message = "Post updated successfully!"

Mixin Order Matters

# ✅ CORRECT orderclass PostUpdateView(    LoginRequiredMixin,      # 1. Check authentication first    AuthorRequiredMixin,     # 2. Then check ownership    FormMessageMixin,        # 3. Add message    UpdateView               # 4. Base view last):    pass # ❌ WRONG orderclass PostUpdateView(    UpdateView,              # Base first - overrides everything!    FormMessageMixin,    AuthorRequiredMixin,    LoginRequiredMixin,):    pass # Rule: Most specific → Most generic (left to right)

Bài Tập

Bài 1: FBV CRUD

Task: Implement complete CRUD với Function-Based Views

# Requirements:# - post_list: Display all posts# - post_detail: Display single post# - post_create: Create new post (login required)# - post_edit: Edit post (only author)# - post_delete: Delete post (only author) # Implement:# blog/views.py# blog/urls.py# templates/

Bài 2: Convert FBV to CBV

Task: Convert FBV CRUD từ Bài 1 sang Class-Based Views

# Use generic views:# - ListView# - DetailView# - CreateView# - UpdateView# - DeleteView

Bài 3: Custom Mixins

Task: Tạo custom mixins:

# 1. TimestampMixin#    - Automatically set created/updated timestamps # 2. SlugifyMixin#    - Auto-generate slug from title # 3. OwnerRequiredMixin#    - Check if user is owner # Usage:class PostCreateView(    LoginRequiredMixin,    TimestampMixin,    SlugifyMixin,    CreateView):    pass

Bài 4: Search và Filter

Task: Implement search và filtering:

class PostListView(ListView):    model = Post        def get_queryset(self):        queryset = super().get_queryset()                # Search        query = self.request.GET.get('q')        if query:            queryset = queryset.filter(title__icontains=query)                # Filter by category        category = self.request.GET.get('category')        if category:            queryset = queryset.filter(category__slug=category)                # Filter by author        author = self.request.GET.get('author')        if author:            queryset = queryset.filter(author__username=author)                return queryset

Tài Liệu Tham Khảo

Writing views
Class-based views
Built-in class-based views
Mixins
Classy Class-Based Views - CBV Inspector

Previous: Bài 04: URLs và Routing | Next: Bài 05: Templates

#fbv

Views - Function-Based và Class-Based Views