update files

src/.coveragerc

@@ -0,0 +1,10 @@
+[run]
+source = .
+include = *.py
+omit =
+    *migrations*
+    *tests*
+    *.html
+    *whoosh_cn_backend*
+    *settings.py*
+    *venv*

src/.dockerignore

@@ -8,5 +8,4 @@ settings_production.py
 *.md
 docs/
 logs/
-static/
-.github/
+static/

src/.gitignore

@@ -62,6 +62,7 @@ target/
 # http://www.jetbrains.com/pycharm/webhelp/project.html
 .idea
 .iml
+static/
 # virtualenv
 venv/
 

src/accounts/admin.py

@@ -0,0 +1,59 @@
+from django import forms
+from django.contrib.auth.admin import UserAdmin
+from django.contrib.auth.forms import UserChangeForm
+from django.contrib.auth.forms import UsernameField
+from django.utils.translation import gettext_lazy as _
+
+# Register your models here.
+from .models import BlogUser
+
+
+class BlogUserCreationForm(forms.ModelForm):
+    password1 = forms.CharField(label=_('password'), widget=forms.PasswordInput)
+    password2 = forms.CharField(label=_('Enter password again'), widget=forms.PasswordInput)
+
+    class Meta:
+        model = BlogUser
+        fields = ('email',)
+
+    def clean_password2(self):
+        # Check that the two password entries match
+        password1 = self.cleaned_data.get("password1")
+        password2 = self.cleaned_data.get("password2")
+        if password1 and password2 and password1 != password2:
+            raise forms.ValidationError(_("passwords do not match"))
+        return password2
+
+    def save(self, commit=True):
+        # Save the provided password in hashed format
+        user = super().save(commit=False)
+        user.set_password(self.cleaned_data["password1"])
+        if commit:
+            user.source = 'adminsite'
+            user.save()
+        return user
+
+
+class BlogUserChangeForm(UserChangeForm):
+    class Meta:
+        model = BlogUser
+        fields = '__all__'
+        field_classes = {'username': UsernameField}
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+
+
+class BlogUserAdmin(UserAdmin):
+    form = BlogUserChangeForm
+    add_form = BlogUserCreationForm
+    list_display = (
+        'id',
+        'nickname',
+        'username',
+        'email',
+        'last_login',
+        'date_joined',
+        'source')
+    list_display_links = ('id', 'username')
+    ordering = ('-id',)

src/accounts/apps.py

@@ -0,0 +1,5 @@
+from django.apps import AppConfig
+
+
+class AccountsConfig(AppConfig):
+    name = 'accounts'

src/accounts/forms.py

@@ -0,0 +1,117 @@
+from django import forms
+from django.contrib.auth import get_user_model, password_validation
+from django.contrib.auth.forms import AuthenticationForm, UserCreationForm
+from django.core.exceptions import ValidationError
+from django.forms import widgets
+from django.utils.translation import gettext_lazy as _
+from . import utils
+from .models import BlogUser
+
+
+class LoginForm(AuthenticationForm):
+    def __init__(self, *args, **kwargs):
+        super(LoginForm, self).__init__(*args, **kwargs)
+        self.fields['username'].widget = widgets.TextInput(
+            attrs={'placeholder': "username", "class": "form-control"})
+        self.fields['password'].widget = widgets.PasswordInput(
+            attrs={'placeholder': "password", "class": "form-control"})
+
+
+class RegisterForm(UserCreationForm):
+    def __init__(self, *args, **kwargs):
+        super(RegisterForm, self).__init__(*args, **kwargs)
+
+        self.fields['username'].widget = widgets.TextInput(
+            attrs={'placeholder': "username", "class": "form-control"})
+        self.fields['email'].widget = widgets.EmailInput(
+            attrs={'placeholder': "email", "class": "form-control"})
+        self.fields['password1'].widget = widgets.PasswordInput(
+            attrs={'placeholder': "password", "class": "form-control"})
+        self.fields['password2'].widget = widgets.PasswordInput(
+            attrs={'placeholder': "repeat password", "class": "form-control"})
+
+    def clean_email(self):
+        email = self.cleaned_data['email']
+        if get_user_model().objects.filter(email=email).exists():
+            raise ValidationError(_("email already exists"))
+        return email
+
+    class Meta:
+        model = get_user_model()
+        fields = ("username", "email")
+
+
+class ForgetPasswordForm(forms.Form):
+    new_password1 = forms.CharField(
+        label=_("New password"),
+        widget=forms.PasswordInput(
+            attrs={
+                "class": "form-control",
+                'placeholder': _("New password")
+            }
+        ),
+    )
+
+    new_password2 = forms.CharField(
+        label="确认密码",
+        widget=forms.PasswordInput(
+            attrs={
+                "class": "form-control",
+                'placeholder': _("Confirm password")
+            }
+        ),
+    )
+
+    email = forms.EmailField(
+        label='邮箱',
+        widget=forms.TextInput(
+            attrs={
+                'class': 'form-control',
+                'placeholder': _("Email")
+            }
+        ),
+    )
+
+    code = forms.CharField(
+        label=_('Code'),
+        widget=forms.TextInput(
+            attrs={
+                'class': 'form-control',
+                'placeholder': _("Code")
+            }
+        ),
+    )
+
+    def clean_new_password2(self):
+        password1 = self.data.get("new_password1")
+        password2 = self.data.get("new_password2")
+        if password1 and password2 and password1 != password2:
+            raise ValidationError(_("passwords do not match"))
+        password_validation.validate_password(password2)
+
+        return password2
+
+    def clean_email(self):
+        user_email = self.cleaned_data.get("email")
+        if not BlogUser.objects.filter(
+                email=user_email
+        ).exists():
+            # todo 这里的报错提示可以判断一个邮箱是不是注册过，如果不想暴露可以修改
+            raise ValidationError(_("email does not exist"))
+        return user_email
+
+    def clean_code(self):
+        code = self.cleaned_data.get("code")
+        error = utils.verify(
+            email=self.cleaned_data.get("email"),
+            code=code,
+        )
+        if error:
+            raise ValidationError(error)
+        return code
+
+
+class ForgetPasswordCodeForm(forms.Form):
+    email = forms.EmailField(
+        label=_('Email'),
+    )

src/accounts/migrations/0001_initial.py

@@ -0,0 +1,49 @@
+# Generated by Django 4.1.7 on 2023-03-02 07:14
+
+import django.contrib.auth.models
+import django.contrib.auth.validators
+from django.db import migrations, models
+import django.utils.timezone
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        ('auth', '0012_alter_user_first_name_max_length'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='BlogUser',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('password', models.CharField(max_length=128, verbose_name='password')),
+                ('last_login', models.DateTimeField(blank=True, null=True, verbose_name='last login')),
+                ('is_superuser', models.BooleanField(default=False, help_text='Designates that this user has all permissions without explicitly assigning them.', verbose_name='superuser status')),
+                ('username', models.CharField(error_messages={'unique': 'A user with that username already exists.'}, help_text='Required. 150 characters or fewer. Letters, digits and @/./+/-/_ only.', max_length=150, unique=True, validators=[django.contrib.auth.validators.UnicodeUsernameValidator()], verbose_name='username')),
+                ('first_name', models.CharField(blank=True, max_length=150, verbose_name='first name')),
+                ('last_name', models.CharField(blank=True, max_length=150, verbose_name='last name')),
+                ('email', models.EmailField(blank=True, max_length=254, verbose_name='email address')),
+                ('is_staff', models.BooleanField(default=False, help_text='Designates whether the user can log into this admin site.', verbose_name='staff status')),
+                ('is_active', models.BooleanField(default=True, help_text='Designates whether this user should be treated as active. Unselect this instead of deleting accounts.', verbose_name='active')),
+                ('date_joined', models.DateTimeField(default=django.utils.timezone.now, verbose_name='date joined')),
+                ('nickname', models.CharField(blank=True, max_length=100, verbose_name='昵称')),
+                ('created_time', models.DateTimeField(default=django.utils.timezone.now, verbose_name='创建时间')),
+                ('last_mod_time', models.DateTimeField(default=django.utils.timezone.now, verbose_name='修改时间')),
+                ('source', models.CharField(blank=True, max_length=100, verbose_name='创建来源')),
+                ('groups', models.ManyToManyField(blank=True, help_text='The groups this user belongs to. A user will get all permissions granted to each of their groups.', related_name='user_set', related_query_name='user', to='auth.group', verbose_name='groups')),
+                ('user_permissions', models.ManyToManyField(blank=True, help_text='Specific permissions for this user.', related_name='user_set', related_query_name='user', to='auth.permission', verbose_name='user permissions')),
+            ],
+            options={
+                'verbose_name': '用户',
+                'verbose_name_plural': '用户',
+                'ordering': ['-id'],
+                'get_latest_by': 'id',
+            },
+            managers=[
+                ('objects', django.contrib.auth.models.UserManager()),
+            ],
+        ),
+    ]

src/accounts/migrations/0002_alter_bloguser_options_remove_bloguser_created_time_and_more.py

@@ -0,0 +1,46 @@
+# Generated by Django 4.2.5 on 2023-09-06 13:13
+
+from django.db import migrations, models
+import django.utils.timezone
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('accounts', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name='bloguser',
+            options={'get_latest_by': 'id', 'ordering': ['-id'], 'verbose_name': 'user', 'verbose_name_plural': 'user'},
+        ),
+        migrations.RemoveField(
+            model_name='bloguser',
+            name='created_time',
+        ),
+        migrations.RemoveField(
+            model_name='bloguser',
+            name='last_mod_time',
+        ),
+        migrations.AddField(
+            model_name='bloguser',
+            name='creation_time',
+            field=models.DateTimeField(default=django.utils.timezone.now, verbose_name='creation time'),
+        ),
+        migrations.AddField(
+            model_name='bloguser',
+            name='last_modify_time',
+            field=models.DateTimeField(default=django.utils.timezone.now, verbose_name='last modify time'),
+        ),
+        migrations.AlterField(
+            model_name='bloguser',
+            name='nickname',
+            field=models.CharField(blank=True, max_length=100, verbose_name='nick name'),
+        ),
+        migrations.AlterField(
+            model_name='bloguser',
+            name='source',
+            field=models.CharField(blank=True, max_length=100, verbose_name='create source'),
+        ),
+    ]

src/accounts/models.py

@@ -0,0 +1,35 @@
+from django.contrib.auth.models import AbstractUser
+from django.db import models
+from django.urls import reverse
+from django.utils.timezone import now
+from django.utils.translation import gettext_lazy as _
+from djangoblog.utils import get_current_site
+
+
+# Create your models here.
+
+class BlogUser(AbstractUser):
+    nickname = models.CharField(_('nick name'), max_length=100, blank=True)
+    creation_time = models.DateTimeField(_('creation time'), default=now)
+    last_modify_time = models.DateTimeField(_('last modify time'), default=now)
+    source = models.CharField(_('create source'), max_length=100, blank=True)
+
+    def get_absolute_url(self):
+        return reverse(
+            'blog:author_detail', kwargs={
+                'author_name': self.username})
+
+    def __str__(self):
+        return self.email
+
+    def get_full_url(self):
+        site = get_current_site().domain
+        url = "https://{site}{path}".format(site=site,
+                                            path=self.get_absolute_url())
+        return url
+
+    class Meta:
+        ordering = ['-id']
+        verbose_name = _('user')
+        verbose_name_plural = verbose_name
+        get_latest_by = 'id'

src/accounts/tests.py

@@ -0,0 +1,207 @@
+from django.test import Client, RequestFactory, TestCase
+from django.urls import reverse
+from django.utils import timezone
+from django.utils.translation import gettext_lazy as _
+
+from accounts.models import BlogUser
+from blog.models import Article, Category
+from djangoblog.utils import *
+from . import utils
+
+
+# Create your tests here.
+
+class AccountTest(TestCase):
+    def setUp(self):
+        self.client = Client()
+        self.factory = RequestFactory()
+        self.blog_user = BlogUser.objects.create_user(
+            username="test",
+            email="admin@admin.com",
+            password="12345678"
+        )
+        self.new_test = "xxx123--="
+
+    def test_validate_account(self):
+        site = get_current_site().domain
+        user = BlogUser.objects.create_superuser(
+            email="liangliangyy1@gmail.com",
+            username="liangliangyy1",
+            password="qwer!@#$ggg")
+        testuser = BlogUser.objects.get(username='liangliangyy1')
+
+        loginresult = self.client.login(
+            username='liangliangyy1',
+            password='qwer!@#$ggg')
+        self.assertEqual(loginresult, True)
+        response = self.client.get('/admin/')
+        self.assertEqual(response.status_code, 200)
+
+        category = Category()
+        category.name = "categoryaaa"
+        category.creation_time = timezone.now()
+        category.last_modify_time = timezone.now()
+        category.save()
+
+        article = Article()
+        article.title = "nicetitleaaa"
+        article.body = "nicecontentaaa"
+        article.author = user
+        article.category = category
+        article.type = 'a'
+        article.status = 'p'
+        article.save()
+
+        response = self.client.get(article.get_admin_url())
+        self.assertEqual(response.status_code, 200)
+
+    def test_validate_register(self):
+        self.assertEquals(
+            0, len(
+                BlogUser.objects.filter(
+                    email='user123@user.com')))
+        response = self.client.post(reverse('account:register'), {
+            'username': 'user1233',
+            'email': 'user123@user.com',
+            'password1': 'password123!q@wE#R$T',
+            'password2': 'password123!q@wE#R$T',
+        })
+        self.assertEquals(
+            1, len(
+                BlogUser.objects.filter(
+                    email='user123@user.com')))
+        user = BlogUser.objects.filter(email='user123@user.com')[0]
+        sign = get_sha256(get_sha256(settings.SECRET_KEY + str(user.id)))
+        path = reverse('accounts:result')
+        url = '{path}?type=validation&id={id}&sign={sign}'.format(
+            path=path, id=user.id, sign=sign)
+        response = self.client.get(url)
+        self.assertEqual(response.status_code, 200)
+
+        self.client.login(username='user1233', password='password123!q@wE#R$T')
+        user = BlogUser.objects.filter(email='user123@user.com')[0]
+        user.is_superuser = True
+        user.is_staff = True
+        user.save()
+        delete_sidebar_cache()
+        category = Category()
+        category.name = "categoryaaa"
+        category.creation_time = timezone.now()
+        category.last_modify_time = timezone.now()
+        category.save()
+
+        article = Article()
+        article.category = category
+        article.title = "nicetitle333"
+        article.body = "nicecontentttt"
+        article.author = user
+
+        article.type = 'a'
+        article.status = 'p'
+        article.save()
+
+        response = self.client.get(article.get_admin_url())
+        self.assertEqual(response.status_code, 200)
+
+        response = self.client.get(reverse('account:logout'))
+        self.assertIn(response.status_code, [301, 302, 200])
+
+        response = self.client.get(article.get_admin_url())
+        self.assertIn(response.status_code, [301, 302, 200])
+
+        response = self.client.post(reverse('account:login'), {
+            'username': 'user1233',
+            'password': 'password123'
+        })
+        self.assertIn(response.status_code, [301, 302, 200])
+
+        response = self.client.get(article.get_admin_url())
+        self.assertIn(response.status_code, [301, 302, 200])
+
+    def test_verify_email_code(self):
+        to_email = "admin@admin.com"
+        code = generate_code()
+        utils.set_code(to_email, code)
+        utils.send_verify_email(to_email, code)
+
+        err = utils.verify("admin@admin.com", code)
+        self.assertEqual(err, None)
+
+        err = utils.verify("admin@123.com", code)
+        self.assertEqual(type(err), str)
+
+    def test_forget_password_email_code_success(self):
+        resp = self.client.post(
+            path=reverse("account:forget_password_code"),
+            data=dict(email="admin@admin.com")
+        )
+
+        self.assertEqual(resp.status_code, 200)
+        self.assertEqual(resp.content.decode("utf-8"), "ok")
+
+    def test_forget_password_email_code_fail(self):
+        resp = self.client.post(
+            path=reverse("account:forget_password_code"),
+            data=dict()
+        )
+        self.assertEqual(resp.content.decode("utf-8"), "错误的邮箱")
+
+        resp = self.client.post(
+            path=reverse("account:forget_password_code"),
+            data=dict(email="admin@com")
+        )
+        self.assertEqual(resp.content.decode("utf-8"), "错误的邮箱")
+
+    def test_forget_password_email_success(self):
+        code = generate_code()
+        utils.set_code(self.blog_user.email, code)
+        data = dict(
+            new_password1=self.new_test,
+            new_password2=self.new_test,
+            email=self.blog_user.email,
+            code=code,
+        )
+        resp = self.client.post(
+            path=reverse("account:forget_password"),
+            data=data
+        )
+        self.assertEqual(resp.status_code, 302)
+
+        # 验证用户密码是否修改成功
+        blog_user = BlogUser.objects.filter(
+            email=self.blog_user.email,
+        ).first()  # type: BlogUser
+        self.assertNotEqual(blog_user, None)
+        self.assertEqual(blog_user.check_password(data["new_password1"]), True)
+
+    def test_forget_password_email_not_user(self):
+        data = dict(
+            new_password1=self.new_test,
+            new_password2=self.new_test,
+            email="123@123.com",
+            code="123456",
+        )
+        resp = self.client.post(
+            path=reverse("account:forget_password"),
+            data=data
+        )
+
+        self.assertEqual(resp.status_code, 200)
+
+
+    def test_forget_password_email_code_error(self):
+        code = generate_code()
+        utils.set_code(self.blog_user.email, code)
+        data = dict(
+            new_password1=self.new_test,
+            new_password2=self.new_test,
+            email=self.blog_user.email,
+            code="111111",
+        )
+        resp = self.client.post(
+            path=reverse("account:forget_password"),
+            data=data
+        )
+
+        self.assertEqual(resp.status_code, 200)
+

src/accounts/urls.py

@@ -0,0 +1,28 @@
+from django.urls import path
+from django.urls import re_path
+
+from . import views
+from .forms import LoginForm
+
+app_name = "accounts"
+
+urlpatterns = [re_path(r'^login/$',
+                       views.LoginView.as_view(success_url='/'),
+                       name='login',
+                       kwargs={'authentication_form': LoginForm}),
+               re_path(r'^register/$',
+                       views.RegisterView.as_view(success_url="/"),
+                       name='register'),
+               re_path(r'^logout/$',
+                       views.LogoutView.as_view(),
+                       name='logout'),
+               path(r'account/result.html',
+                    views.account_result,
+                    name='result'),
+               re_path(r'^forget_password/$',
+                       views.ForgetPasswordView.as_view(),
+                       name='forget_password'),
+               re_path(r'^forget_password_code/$',
+                       views.ForgetPasswordEmailCode.as_view(),
+                       name='forget_password_code'),
+               ]

src/accounts/user_login_backend.py

@@ -0,0 +1,26 @@
+from django.contrib.auth import get_user_model
+from django.contrib.auth.backends import ModelBackend
+
+
+class EmailOrUsernameModelBackend(ModelBackend):
+    """
+    允许使用用户名或邮箱登录
+    """
+
+    def authenticate(self, request, username=None, password=None, **kwargs):
+        if '@' in username:
+            kwargs = {'email': username}
+        else:
+            kwargs = {'username': username}
+        try:
+            user = get_user_model().objects.get(**kwargs)
+            if user.check_password(password):
+                return user
+        except get_user_model().DoesNotExist:
+            return None
+
+    def get_user(self, username):
+        try:
+            return get_user_model().objects.get(pk=username)
+        except get_user_model().DoesNotExist:
+            return None

src/accounts/utils.py

@@ -0,0 +1,49 @@
+import typing
+from datetime import timedelta
+
+from django.core.cache import cache
+from django.utils.translation import gettext
+from django.utils.translation import gettext_lazy as _
+
+from djangoblog.utils import send_email
+
+_code_ttl = timedelta(minutes=5)
+
+
+def send_verify_email(to_mail: str, code: str, subject: str = _("Verify Email")):
+    """发送重设密码验证码
+    Args:
+        to_mail: 接受邮箱
+        subject: 邮件主题
+        code: 验证码
+    """
+    html_content = _(
+        "You are resetting the password, the verification code is：%(code)s, valid within 5 minutes, please keep it "
+        "properly") % {'code': code}
+    send_email([to_mail], subject, html_content)
+
+
+def verify(email: str, code: str) -> typing.Optional[str]:
+    """验证code是否有效
+    Args:
+        email: 请求邮箱
+        code: 验证码
+    Return:
+        如果有错误就返回错误str
+    Node:
+        这里的错误处理不太合理，应该采用raise抛出
+        否测调用方也需要对error进行处理
+    """
+    cache_code = get_code(email)
+    if cache_code != code:
+        return gettext("Verification code error")
+
+
+def set_code(email: str, code: str):
+    """设置code"""
+    cache.set(email, code, _code_ttl.seconds)
+
+
+def get_code(email: str) -> typing.Optional[str]:
+    """获取code"""
+    return cache.get(email)

src/accounts/views.py

@@ -0,0 +1,204 @@
+import logging
+from django.utils.translation import gettext_lazy as _
+from django.conf import settings
+from django.contrib import auth
+from django.contrib.auth import REDIRECT_FIELD_NAME
+from django.contrib.auth import get_user_model
+from django.contrib.auth import logout
+from django.contrib.auth.forms import AuthenticationForm
+from django.contrib.auth.hashers import make_password
+from django.http import HttpResponseRedirect, HttpResponseForbidden
+from django.http.request import HttpRequest
+from django.http.response import HttpResponse
+from django.shortcuts import get_object_or_404
+from django.shortcuts import render
+from django.urls import reverse
+from django.utils.decorators import method_decorator
+from django.utils.http import url_has_allowed_host_and_scheme
+from django.views import View
+from django.views.decorators.cache import never_cache
+from django.views.decorators.csrf import csrf_protect
+from django.views.decorators.debug import sensitive_post_parameters
+from django.views.generic import FormView, RedirectView
+
+from djangoblog.utils import send_email, get_sha256, get_current_site, generate_code, delete_sidebar_cache
+from . import utils
+from .forms import RegisterForm, LoginForm, ForgetPasswordForm, ForgetPasswordCodeForm
+from .models import BlogUser
+
+logger = logging.getLogger(__name__)
+
+
+# Create your views here.
+
+class RegisterView(FormView):
+    form_class = RegisterForm
+    template_name = 'account/registration_form.html'
+
+    @method_decorator(csrf_protect)
+    def dispatch(self, *args, **kwargs):
+        return super(RegisterView, self).dispatch(*args, **kwargs)
+
+    def form_valid(self, form):
+        if form.is_valid():
+            user = form.save(False)
+            user.is_active = False
+            user.source = 'Register'
+            user.save(True)
+            site = get_current_site().domain
+            sign = get_sha256(get_sha256(settings.SECRET_KEY + str(user.id)))
+
+            if settings.DEBUG:
+                site = '127.0.0.1:8000'
+            path = reverse('account:result')
+            url = "http://{site}{path}?type=validation&id={id}&sign={sign}".format(
+                site=site, path=path, id=user.id, sign=sign)
+
+            content = """
+                            <p>请点击下面链接验证您的邮箱</p>
+
+                            <a href="{url}" rel="bookmark">{url}</a>
+
+                            再次感谢您！
+                            <br />
+                            如果上面链接无法打开，请将此链接复制至浏览器。
+                            {url}
+                            """.format(url=url)
+            send_email(
+                emailto=[
+                    user.email,
+                ],
+                title='验证您的电子邮箱',
+                content=content)
+
+            url = reverse('accounts:result') + \
+                  '?type=register&id=' + str(user.id)
+            return HttpResponseRedirect(url)
+        else:
+            return self.render_to_response({
+                'form': form
+            })
+
+
+class LogoutView(RedirectView):
+    url = '/login/'
+
+    @method_decorator(never_cache)
+    def dispatch(self, request, *args, **kwargs):
+        return super(LogoutView, self).dispatch(request, *args, **kwargs)
+
+    def get(self, request, *args, **kwargs):
+        logout(request)
+        delete_sidebar_cache()
+        return super(LogoutView, self).get(request, *args, **kwargs)
+
+
+class LoginView(FormView):
+    form_class = LoginForm
+    template_name = 'account/login.html'
+    success_url = '/'
+    redirect_field_name = REDIRECT_FIELD_NAME
+    login_ttl = 2626560  # 一个月的时间
+
+    @method_decorator(sensitive_post_parameters('password'))
+    @method_decorator(csrf_protect)
+    @method_decorator(never_cache)
+    def dispatch(self, request, *args, **kwargs):
+
+        return super(LoginView, self).dispatch(request, *args, **kwargs)
+
+    def get_context_data(self, **kwargs):
+        redirect_to = self.request.GET.get(self.redirect_field_name)
+        if redirect_to is None:
+            redirect_to = '/'
+        kwargs['redirect_to'] = redirect_to
+
+        return super(LoginView, self).get_context_data(**kwargs)
+
+    def form_valid(self, form):
+        form = AuthenticationForm(data=self.request.POST, request=self.request)
+
+        if form.is_valid():
+            delete_sidebar_cache()
+            logger.info(self.redirect_field_name)
+
+            auth.login(self.request, form.get_user())
+            if self.request.POST.get("remember"):
+                self.request.session.set_expiry(self.login_ttl)
+            return super(LoginView, self).form_valid(form)
+            # return HttpResponseRedirect('/')
+        else:
+            return self.render_to_response({
+                'form': form
+            })
+
+    def get_success_url(self):
+
+        redirect_to = self.request.POST.get(self.redirect_field_name)
+        if not url_has_allowed_host_and_scheme(
+                url=redirect_to, allowed_hosts=[
+                    self.request.get_host()]):
+            redirect_to = self.success_url
+        return redirect_to
+
+
+def account_result(request):
+    type = request.GET.get('type')
+    id = request.GET.get('id')
+
+    user = get_object_or_404(get_user_model(), id=id)
+    logger.info(type)
+    if user.is_active:
+        return HttpResponseRedirect('/')
+    if type and type in ['register', 'validation']:
+        if type == 'register':
+            content = '''
+    恭喜您注册成功，一封验证邮件已经发送到您的邮箱，请验证您的邮箱后登录本站。
+    '''
+            title = '注册成功'
+        else:
+            c_sign = get_sha256(get_sha256(settings.SECRET_KEY + str(user.id)))
+            sign = request.GET.get('sign')
+            if sign != c_sign:
+                return HttpResponseForbidden()
+            user.is_active = True
+            user.save()
+            content = '''
+            恭喜您已经成功的完成邮箱验证，您现在可以使用您的账号来登录本站。
+            '''
+            title = '验证成功'
+        return render(request, 'account/result.html', {
+            'title': title,
+            'content': content
+        })
+    else:
+        return HttpResponseRedirect('/')
+
+
+class ForgetPasswordView(FormView):
+    form_class = ForgetPasswordForm
+    template_name = 'account/forget_password.html'
+
+    def form_valid(self, form):
+        if form.is_valid():
+            blog_user = BlogUser.objects.filter(email=form.cleaned_data.get("email")).get()
+            blog_user.password = make_password(form.cleaned_data["new_password2"])
+            blog_user.save()
+            return HttpResponseRedirect('/login/')
+        else:
+            return self.render_to_response({'form': form})
+
+
+class ForgetPasswordEmailCode(View):
+
+    def post(self, request: HttpRequest):
+        form = ForgetPasswordCodeForm(request.POST)
+        if not form.is_valid():
+            return HttpResponse("错误的邮箱")
+        to_email = form.cleaned_data["email"]
+
+        code = generate_code()
+        utils.send_verify_email(to_email, code)
+        utils.set_code(to_email, code)
+
+        return HttpResponse("ok")

src/blog/admin.py

@@ -6,7 +6,7 @@ from django.utils.html import format_html
 from django.utils.translation import gettext_lazy as _
 
 # Register your models here.
-from .models import Article, Category, Tag, Links, SideBar, BlogSettings
+from .models import Article
 
 
 class ArticleForm(forms.ModelForm):
@@ -55,7 +55,6 @@ class ArticlelAdmin(admin.ModelAdmin):
         'article_order')
     list_display_links = ('id', 'title')
     list_filter = ('status', 'type', 'category')
-    date_hierarchy = 'creation_time'
     filter_horizontal = ('tags',)
     exclude = ('creation_time', 'last_modify_time')
     view_on_site = True
@@ -64,7 +63,6 @@ class ArticlelAdmin(admin.ModelAdmin):
         draft_article,
         close_article_commentstatus,
         open_article_commentstatus]
-    raw_id_fields = ('author', 'category',)
 
     def link_to_category(self, obj):
         info = (obj.category._meta.app_label, obj.category._meta.model_name)

src/blog/management/commands/build_index.py

@@ -0,0 +1,18 @@
+from django.core.management.base import BaseCommand
+
+from blog.documents import ElapsedTimeDocument, ArticleDocumentManager, ElaspedTimeDocumentManager, \
+    ELASTICSEARCH_ENABLED
+
+
+# TODO 参数化
+class Command(BaseCommand):
+    help = 'build search index'
+
+    def handle(self, *args, **options):
+        if ELASTICSEARCH_ENABLED:
+            ElaspedTimeDocumentManager.build_index()
+            manager = ElapsedTimeDocument()
+            manager.init()
+            manager = ArticleDocumentManager()
+            manager.delete_index()
+            manager.rebuild()

src/blog/management/commands/build_search_words.py

@@ -0,0 +1,13 @@
+from django.core.management.base import BaseCommand
+
+from blog.models import Tag, Category
+
+
+# TODO 参数化
+class Command(BaseCommand):
+    help = 'build search words'
+
+    def handle(self, *args, **options):
+        datas = set([t.name for t in Tag.objects.all()] +
+                    [t.name for t in Category.objects.all()])
+        print('\n'.join(datas))

src/blog/management/commands/clear_cache.py

@@ -0,0 +1,11 @@
+from django.core.management.base import BaseCommand
+
+from djangoblog.utils import cache
+
+
+class Command(BaseCommand):
+    help = 'clear the whole cache'
+
+    def handle(self, *args, **options):
+        cache.clear()
+        self.stdout.write(self.style.SUCCESS('Cleared cache\n'))

src/blog/management/commands/create_testdata.py

@@ -0,0 +1,40 @@
+from django.contrib.auth import get_user_model
+from django.contrib.auth.hashers import make_password
+from django.core.management.base import BaseCommand
+
+from blog.models import Article, Tag, Category
+
+
+class Command(BaseCommand):
+    help = 'create test datas'
+
+    def handle(self, *args, **options):
+        user = get_user_model().objects.get_or_create(
+            email='test@test.com', username='测试用户', password=make_password('test!q@w#eTYU'))[0]
+
+        pcategory = Category.objects.get_or_create(
+            name='我是父类目', parent_category=None)[0]
+
+        category = Category.objects.get_or_create(
+            name='子类目', parent_category=pcategory)[0]
+
+        category.save()
+        basetag = Tag()
+        basetag.name = "标签"
+        basetag.save()
+        for i in range(1, 20):
+            article = Article.objects.get_or_create(
+                category=category,
+                title='nice title ' + str(i),
+                body='nice content ' + str(i),
+                author=user)[0]
+            tag = Tag()
+            tag.name = "标签" + str(i)
+            tag.save()
+            article.tags.add(tag)
+            article.tags.add(basetag)
+            article.save()
+
+        from djangoblog.utils import cache
+        cache.clear()
+        self.stdout.write(self.style.SUCCESS('created test datas \n'))

src/blog/management/commands/ping_baidu.py

@@ -0,0 +1,50 @@
+from django.core.management.base import BaseCommand
+
+from djangoblog.spider_notify import SpiderNotify
+from djangoblog.utils import get_current_site
+from blog.models import Article, Tag, Category
+
+site = get_current_site().domain
+
+
+class Command(BaseCommand):
+    help = 'notify baidu url'
+
+    def add_arguments(self, parser):
+        parser.add_argument(
+            'data_type',
+            type=str,
+            choices=[
+                'all',
+                'article',
+                'tag',
+                'category'],
+            help='article : all article,tag : all tag,category: all category,all: All of these')
+
+    def get_full_url(self, path):
+        url = "https://{site}{path}".format(site=site, path=path)
+        return url
+
+    def handle(self, *args, **options):
+        type = options['data_type']
+        self.stdout.write('start get %s' % type)
+
+        urls = []
+        if type == 'article' or type == 'all':
+            for article in Article.objects.filter(status='p'):
+                urls.append(article.get_full_url())
+        if type == 'tag' or type == 'all':
+            for tag in Tag.objects.all():
+                url = tag.get_absolute_url()
+                urls.append(self.get_full_url(url))
+        if type == 'category' or type == 'all':
+            for category in Category.objects.all():
+                url = category.get_absolute_url()
+                urls.append(self.get_full_url(url))
+
+        self.stdout.write(
+            self.style.SUCCESS(
+                'start notify %d urls' %
+                len(urls)))
+        SpiderNotify.baidu_notify(urls)
+        self.stdout.write(self.style.SUCCESS('finish notify'))

src/blog/management/commands/sync_user_avatar.py

@@ -0,0 +1,47 @@
+import requests
+from django.core.management.base import BaseCommand
+from django.templatetags.static import static
+
+from djangoblog.utils import save_user_avatar
+from oauth.models import OAuthUser
+from oauth.oauthmanager import get_manager_by_type
+
+
+class Command(BaseCommand):
+    help = 'sync user avatar'
+
+    def test_picture(self, url):
+        try:
+            if requests.get(url, timeout=2).status_code == 200:
+                return True
+        except:
+            pass
+
+    def handle(self, *args, **options):
+        static_url = static("../")
+        users = OAuthUser.objects.all()
+        self.stdout.write(f'开始同步{len(users)}个用户头像')
+        for u in users:
+            self.stdout.write(f'开始同步:{u.nickname}')
+            url = u.picture
+            if url:
+                if url.startswith(static_url):
+                    if self.test_picture(url):
+                        continue
+                    else:
+                        if u.metadata:
+                            manage = get_manager_by_type(u.type)
+                            url = manage.get_picture(u.metadata)
+                            url = save_user_avatar(url)
+                        else:
+                            url = static('blog/img/avatar.png')
+                else:
+                    url = save_user_avatar(url)
+            else:
+                url = static('blog/img/avatar.png')
+            if url:
+                self.stdout.write(
+                    f'结束同步:{u.nickname}.url:{url}')
+                u.picture = url
+                u.save()
+        self.stdout.write('结束同步')

src/blog/static/blog/css/style.css

@@ -2017,7 +2017,12 @@ img#wpstats {
         width: auto;
     }
 
-
+    .commentlist .avatar {
+        height: 39px;
+        left: 2.2em;
+        top: 2.2em;
+        width: 39px;
+    }
 
     .comments-area article header cite,
     .comments-area article header time {
@@ -2145,70 +2150,17 @@ div {
     word-break: break-all;
 }
 
-/* 评论整体布局 - 使用相对定位实现头像左侧布局 */
-.commentlist .comment-body {
-    position: relative;
-    padding-left: 60px; /* 为48px头像 + 12px间距留出空间 */
-    min-height: 48px; /* 确保有足够高度容纳头像 */
-}
-
-/* 评论作者信息 - 用户名和时间在同一行 */
-.commentlist .comment-author {
-    display: inline-block;
-    margin: 0 10px 5px 0;
-    font-size: 13px;
-    position: relative;
-}
-
-.commentlist .comment-meta {
-    display: inline-block;
-    margin: 0 0 8px 0;
-    font-size: 12px;
-    color: #666;
-}
-
+.commentlist .comment-author,
+.commentlist .comment-meta,
 .commentlist .comment-awaiting-moderation {
+    float: left;
     display: block;
     font-size: 13px;
     line-height: 22px;
 }
 
-/* 头像样式 - 绝对定位到左侧 */
-.commentlist .comment-author .avatar {
-    position: absolute !important;
-    left: -60px; /* 定位到容器左侧 */
-    top: 0;
-    width: 48px !important;
-    height: 48px !important;
-    border-radius: 50%;
-    display: block;
-    object-fit: cover;
-    background-color: #f5f5f5;
-    border: 1px solid #ddd;
-}
-
-/* 评论作者名称样式 */
-.commentlist .comment-author .fn {
-    display: inline;
-    margin: 0;
-    font-weight: 600;
-    color: #2e7bb8;
-    font-size: 13px;
-}
-
-.commentlist .comment-author .fn a {
-    color: #2e7bb8;
-    text-decoration: none;
-}
-
-.commentlist .comment-author .fn a:hover {
-    text-decoration: underline;
-}
-
-/* 评论内容样式 */
-.commentlist .comment-body p {
-    margin: 5px 0 10px 0;
-    line-height: 1.5;
+.commentlist .comment-author {
+    margin-right: 6px;
 }
 
 .commentlist .fn, .pinglist .ping-link {
@@ -2222,15 +2174,13 @@ div {
     display: none;
 }
 
-/* 通用头像样式 */
 .commentlist .avatar {
-    width: 48px !important;
-    height: 48px !important;
-    border-radius: 50%;
-    display: block;
-    object-fit: cover;
-    background-color: #f5f5f5;
-    border: 1px solid #ddd;
+    position: absolute;
+    left: -60px;
+    top: 0;
+    width: 48px;
+    height: 48px;
+    border-radius: 100%;
 }
 
 .commentlist .comment-meta:before, .pinglist .ping-meta:before {
@@ -2340,87 +2290,15 @@ div {
     padding-left: 48px;
 }
 
-/* 嵌套评论整体布局 */
-.commentlist li li .comment-body {
-    padding-left: 60px; /* 为48px头像 + 12px间距留出空间 */
-    min-height: 48px; /* 确保有足够高度容纳头像 */
-}
-
-/* 嵌套评论作者信息 */
-.commentlist li li .comment-author {
-    display: inline-block;
-    margin: 0 8px 5px 0;
-    font-size: 12px; /* 稍小一点 */
+.commentlist li li .avatar {
+    top: 0;
+    left: -48px;
+    width: 36px;
+    height: 36px;
 }
 
 .commentlist li li .comment-meta {
-    display: inline-block;
-    margin: 0 0 8px 0;
-    font-size: 11px; /* 稍小一点 */
-    color: #666;
-}
-
-/* 评论容器整体左移 - 使用更高优先级 */
-#comments #commentlist-container.comment-tab {
-    margin-left: -15px !important; /* 在小屏幕上向左移动15px */
-    padding-left: 0 !important; /* 移除左内边距 */
-    position: relative !important; /* 确保定位正确 */
-}
-
-/* 在较大屏幕上进一步左移 */
-@media screen and (min-width: 600px) {
-    #comments #commentlist-container.comment-tab {
-        margin-left: -30px !important; /* 在大屏幕上向左移动30px */
-    }
-    
-    /* 响应式设计下的评论布局 - 保持48px头像 */
-    .commentlist .comment-body {
-        padding-left: 60px !important; /* 为48px头像 + 12px间距留出空间 */
-        min-height: 48px !important;
-    }
-    
-    .commentlist .comment-author {
-        display: inline-block !important;
-        margin: 0 8px 5px 0 !important;
-    }
-    
-    .commentlist .comment-meta {
-        display: inline-block !important;
-        margin: 0 0 8px 0 !important;
-    }
-    
-    /* 响应式设计下头像保持48px */
-    .commentlist .comment-author .avatar {
-        left: -60px !important;
-        width: 48px !important;
-        height: 48px !important;
-    }
-    
-    /* 嵌套评论在响应式设计下也保持48px头像 */
-    .commentlist li li .comment-body {
-        padding-left: 60px !important;
-        min-height: 48px !important;
-    }
-    
-    .commentlist li li .comment-author .avatar {
-        left: -60px !important;
-        width: 48px !important;
-        height: 48px !important;
-    }
-}
-
-/* 嵌套评论头像 */
-.commentlist li li .comment-author .avatar {
-    position: absolute !important;
-    left: -60px; /* 定位到容器左侧 */
-    top: 0;
-    width: 48px !important;
-    height: 48px !important;
-    border-radius: 50%;
-    display: block;
-    object-fit: cover;
-    background-color: #f5f5f5;
-    border: 1px solid #ddd;
+    left: 70px;
 }
 
 /*  comments : nav
@@ -2623,206 +2501,4 @@ li #reply-title {
     height: 1px;
     border: none;
     /*border-top: 1px dashed #f5d6d6;*/
-}
-
-/* =============================================================================
-   评论内容溢出修复样式
-   解决代码块和长文本撑开页面布局的问题
-   ============================================================================= */
-
-/* 评论容器基础样式 */
-.comment-body {
-    overflow-wrap: break-word;
-    word-wrap: break-word;
-    word-break: break-word;
-    max-width: 100%;
-    box-sizing: border-box;
-}
-
-/* 修复评论中的代码块溢出 */
-.comment-content pre,
-.comment-body pre {
-    white-space: pre-wrap !important;
-    word-wrap: break-word !important;
-    overflow-wrap: break-word !important;
-    max-width: 100% !important;
-    overflow-x: auto;
-    padding: 10px;
-    background-color: #f8f8f8;
-    border: 1px solid #ddd;
-    border-radius: 4px;
-    font-size: 12px;
-    line-height: 1.4;
-    margin: 10px 0;
-}
-
-/* 修复评论中的行内代码 */
-.comment-content code,
-.comment-body code {
-    word-wrap: break-word !important;
-    overflow-wrap: break-word !important;
-    white-space: pre-wrap;
-    max-width: 100%;
-    display: inline-block;
-    vertical-align: top;
-}
-
-/* 修复评论中的长链接 */
-.comment-content a,
-.comment-body a {
-    word-wrap: break-word !important;
-    overflow-wrap: break-word !important;
-    word-break: break-all;
-    max-width: 100%;
-}
-
-/* 修复评论段落 */
-.comment-content p,
-.comment-body p {
-    word-wrap: break-word !important;
-    overflow-wrap: break-word !important;
-    max-width: 100%;
-    margin: 10px 0;
-}
-
-/* 特殊处理代码高亮块 - 关键修复！ */
-.comment-content .codehilite,
-.comment-body .codehilite {
-    max-width: 100% !important;
-    overflow-x: auto;
-    margin: 10px 0;
-    background: #f8f8f8 !important;
-    border: 1px solid #ddd;
-    border-radius: 4px;
-    padding: 10px;
-    font-size: 12px;
-    line-height: 1.4;
-    /* 关键：防止内容撑开容器 */
-    width: 100%;
-    box-sizing: border-box;
-    display: block;
-}
-
-.comment-content .codehilite pre,
-.comment-body .codehilite pre {
-    white-space: pre-wrap !important;
-    word-wrap: break-word !important;
-    overflow-wrap: break-word !important;
-    margin: 0 !important;
-    padding: 0 !important;
-    background: transparent !important;
-    border: none !important;
-    font-size: inherit;
-    line-height: inherit;
-    /* 确保pre标签不会超出父容器 */
-    max-width: 100%;
-    width: 100%;
-    box-sizing: border-box;
-}
-
-/* 修复代码高亮中的span标签 */
-.comment-content .codehilite span,
-.comment-body .codehilite span {
-    word-wrap: break-word !important;
-    overflow-wrap: break-word !important;
-    /* 防止行内元素导致的溢出 */
-    display: inline;
-    max-width: 100%;
-}
-
-/* 针对特定的代码高亮类 */
-.comment-content .codehilite .kt,
-.comment-content .codehilite .nf,
-.comment-content .codehilite .n,
-.comment-content .codehilite .p,
-.comment-content .codehilite .w,
-.comment-content .codehilite .o,
-.comment-body .codehilite .kt,
-.comment-body .codehilite .nf,
-.comment-body .codehilite .n,
-.comment-body .codehilite .p,
-.comment-body .codehilite .w,
-.comment-body .codehilite .o {
-    word-break: break-all;
-    overflow-wrap: break-word;
-}
-
-/* 修复评论列表项 */
-.commentlist li {
-    max-width: 100%;
-    overflow: hidden;
-    box-sizing: border-box;
-}
-
-/* 确保评论内容不超出容器 */
-.commentlist .comment-body {
-    max-width: calc(100% - 20px); /* 留出一些边距 */
-    margin-left: 10px;
-    margin-right: 10px;
-    overflow: hidden; /* 防止内容溢出 */
-    word-wrap: break-word;
-}
-
-/* 重要：限制评论列表项的最大宽度 */
-.commentlist li[style*="margin-left"] {
-    max-width: calc(100% - 2rem) !important;
-    overflow: hidden;
-    box-sizing: border-box;
-}
-
-/* 特别处理深层嵌套的评论 */
-.commentlist li[style*="margin-left: 3rem"],
-.commentlist li[style*="margin-left: 6rem"],
-.commentlist li[style*="margin-left: 9rem"] {
-    max-width: calc(100% - 1rem) !important;
-}
-
-/* 移动端优化 */
-@media (max-width: 768px) {
-    .comment-content pre,
-    .comment-body pre {
-        font-size: 11px;
-        padding: 8px;
-        margin: 8px 0;
-    }
-    
-    .commentlist .comment-body {
-        max-width: calc(100% - 10px);
-        margin-left: 5px;
-        margin-right: 5px;
-    }
-    
-    /* 移动端评论缩进调整 */
-    .commentlist li[style*="margin-left"] {
-        margin-left: 1rem !important;
-        max-margin-left: 2rem !important;
-    }
-}
-
-/* 防止表格溢出 */
-.comment-content table,
-.comment-body table {
-    max-width: 100%;
-    overflow-x: auto;
-    display: block;
-    white-space: nowrap;
-}
-
-/* 修复图片溢出 */
-.comment-content img,
-.comment-body img {
-    max-width: 100% !important;
-    height: auto !important;
-}
-
-/* 修复引用块 */
-.comment-content blockquote,
-.comment-body blockquote {
-    max-width: 100%;
-    overflow-wrap: break-word;
-    word-wrap: break-word;
-    padding: 10px 15px;
-    margin: 10px 0;
-    border-left: 4px solid #ddd;
-    background-color: #f9f9f9;
 }

src/blog/templatetags/blog_tags.py

@@ -51,75 +51,7 @@ def datetimeformat(data):
 @register.filter()
 @stringfilter
 def custom_markdown(content):
-    """
-    通用markdown过滤器，应用文章内容插件
-    主要用于文章内容处理
-    """
-    html_content = CommonMarkdown.get_markdown(content)
-    
-    # 然后应用插件过滤器优化HTML
-    from djangoblog.plugin_manage import hooks
-    from djangoblog.plugin_manage.hook_constants import ARTICLE_CONTENT_HOOK_NAME
-    optimized_html = hooks.apply_filters(ARTICLE_CONTENT_HOOK_NAME, html_content)
-    
-    return mark_safe(optimized_html)
-
-
-@register.filter()
-@stringfilter
-def sidebar_markdown(content):
-    html_content = CommonMarkdown.get_markdown(content)
-    return mark_safe(html_content)
-
-
-@register.simple_tag(takes_context=True)
-def render_article_content(context, article, is_summary=False):
-    """
-    渲染文章内容，包含完整的上下文信息供插件使用
-    
-    Args:
-        context: 模板上下文
-        article: 文章对象
-        is_summary: 是否为摘要模式（首页使用）
-    """
-    if not article or not hasattr(article, 'body'):
-        return ''
-    
-    # 先转换Markdown为HTML
-    html_content = CommonMarkdown.get_markdown(article.body)
-    
-    # 如果是摘要模式，先截断内容再应用插件
-    if is_summary:
-        # 截断HTML内容到合适的长度（约300字符）
-        from django.utils.html import strip_tags
-        from django.template.defaultfilters import truncatechars
-        
-        # 先去除HTML标签，截断纯文本，然后重新转换为HTML
-        plain_text = strip_tags(html_content)
-        truncated_text = truncatechars(plain_text, 300)
-        
-        # 重新转换截断后的文本为HTML（简化版，避免复杂的插件处理）
-        html_content = CommonMarkdown.get_markdown(truncated_text)
-    
-    # 然后应用插件过滤器，传递完整的上下文
-    from djangoblog.plugin_manage import hooks
-    from djangoblog.plugin_manage.hook_constants import ARTICLE_CONTENT_HOOK_NAME
-    
-    # 获取request对象
-    request = context.get('request')
-    
-    # 应用所有文章内容相关的插件
-    # 注意：摘要模式下某些插件（如版权声明）可能不适用
-    optimized_html = hooks.apply_filters(
-        ARTICLE_CONTENT_HOOK_NAME, 
-        html_content, 
-        article=article, 
-        request=request,
-        context=context,
-        is_summary=is_summary  # 传递摘要标志，插件可以据此调整行为
-    )
-    
-    return mark_safe(optimized_html)
+    return mark_safe(CommonMarkdown.get_markdown(content))
 
 
 @register.simple_tag
@@ -360,49 +292,38 @@ def load_article_detail(article, isindex, user):
     }
 
 
-# 返回用户头像URL
-# 模板使用方法:  {{ email|gravatar_url:150 }}
+# return only the URL of the gravatar
+# TEMPLATE USE:  {{ email|gravatar_url:150 }}
 @register.filter
 def gravatar_url(email, size=40):
-    """获得用户头像 - 优先使用OAuth头像，否则使用默认头像"""
-    cachekey = 'avatar/' + email
+    """获得gravatar头像"""
+    cachekey = 'gravatat/' + email
     url = cache.get(cachekey)
     if url:
         return url
-    
-    # 检查OAuth用户是否有自定义头像
-    usermodels = OAuthUser.objects.filter(email=email)
-    if usermodels:
-        # 过滤出有头像的用户
-        users_with_picture = list(filter(lambda x: x.picture is not None, usermodels))
-        if users_with_picture:
-            # 获取默认头像路径用于比较
-            default_avatar_path = static('blog/img/avatar.png')
-            
-            # 优先选择非默认头像的用户，否则选择第一个
-            non_default_users = [u for u in users_with_picture if u.picture != default_avatar_path and not u.picture.endswith('/avatar.png')]
-            selected_user = non_default_users[0] if non_default_users else users_with_picture[0]
-            
-            url = selected_user.picture
-            cache.set(cachekey, url, 60 * 60 * 24)  # 缓存24小时
-            
-            avatar_type = 'non-default' if non_default_users else 'default'
-            logger.info('Using {} OAuth avatar for {} from {}'.format(avatar_type, email, selected_user.type))
-            return url
-    
-    # 使用默认头像
-    url = static('blog/img/avatar.png')
-    cache.set(cachekey, url, 60 * 60 * 24)  # 缓存24小时
-    logger.info('Using default avatar for {}'.format(email))
-    return url
+    else:
+        usermodels = OAuthUser.objects.filter(email=email)
+        if usermodels:
+            o = list(filter(lambda x: x.picture is not None, usermodels))
+            if o:
+                return o[0].picture
+        email = email.encode('utf-8')
+
+        default = static('blog/img/avatar.png')
+
+        url = "https://www.gravatar.com/avatar/%s?%s" % (hashlib.md5(
+            email.lower()).hexdigest(), urllib.parse.urlencode({'d': default, 's': str(size)}))
+        cache.set(cachekey, url, 60 * 60 * 10)
+        logger.info('set gravatar cache.key:{key}'.format(key=cachekey))
+        return url
 
 
 @register.filter
 def gravatar(email, size=40):
-    """获得用户头像HTML标签"""
+    """获得gravatar头像"""
     url = gravatar_url(email, size)
     return mark_safe(
-        '<img src="%s" height="%d" width="%d" class="avatar" alt="用户头像">' %
+        '<img src="%s" height="%d" width="%d">' %
         (url, size, size))
 
 

src/blog/views.py

@@ -154,6 +154,10 @@ class ArticleDetailView(DetailView):
         article = self.object
         # Action Hook, 通知插件"文章详情已获取"
         hooks.run_action('after_article_body_get', article=article, request=self.request)
+        # # Filter Hook, 允许插件修改文章正文
+        article.body = hooks.apply_filters(ARTICLE_CONTENT_HOOK_NAME, article.body, article=article,
+                                           request=self.request)
+
         return context
 
 

src/comments/admin.py

@@ -29,8 +29,6 @@ class CommentAdmin(admin.ModelAdmin):
     list_filter = ('is_enable',)
     exclude = ('creation_time', 'last_modify_time')
     actions = [disable_commentstatus, enable_commentstatus]
-    raw_id_fields = ('author', 'article')
-    search_fields = ('body',)
 
     def link_to_userinfo(self, obj):
         info = (obj.author._meta.app_label, obj.author._meta.model_name)

src/deploy/k8s/deployment.yaml

@@ -26,13 +26,13 @@ spec:
             name: djangoblog-env
         readinessProbe:
           httpGet:
-            path: /health/
+            path: /
             port: 8000
           initialDelaySeconds: 10
           periodSeconds: 30
         livenessProbe:
           httpGet:
-            path: /health/
+            path: /
             port: 8000
           initialDelaySeconds: 10
           periodSeconds: 30

src/djangoblog/settings.py

@@ -109,13 +109,15 @@ WSGI_APPLICATION = 'djangoblog.wsgi.application'
 DATABASES = {
     'default': {
         'ENGINE': 'django.db.backends.mysql',
-        'NAME': 'djangoblog',
-        'USER': 'root',
-        'PASSWORD': 'root',
-        'HOST': '127.0.0.1',
-        'PORT': 3306,
-    }
-}
+        'NAME': os.environ.get('DJANGO_MYSQL_DATABASE') or 'djangoblog',
+        'USER': os.environ.get('DJANGO_MYSQL_USER') or 'root',
+        'PASSWORD': os.environ.get('DJANGO_MYSQL_PASSWORD') or 'root',
+        'HOST': os.environ.get('DJANGO_MYSQL_HOST') or '127.0.0.1',
+        'PORT': int(
+            os.environ.get('DJANGO_MYSQL_PORT') or 3306),
+        'OPTIONS': {
+            'charset': 'utf8mb4'},
+    }}
 
 # Password validation
 # https://docs.djangoproject.com/en/1.10/ref/settings/#auth-password-validators
@@ -316,21 +318,6 @@ MEDIA_ROOT = os.path.join(BASE_DIR, 'uploads')
 MEDIA_URL = '/media/'
 X_FRAME_OPTIONS = 'SAMEORIGIN'
 
-# 安全头部配置 - 防XSS和其他攻击
-SECURE_BROWSER_XSS_FILTER = True
-SECURE_CONTENT_TYPE_NOSNIFF = True
-SECURE_REFERRER_POLICY = 'strict-origin-when-cross-origin'
-
-# 内容安全策略 (CSP) - 防XSS攻击
-CSP_DEFAULT_SRC = ["'self'"]
-CSP_SCRIPT_SRC = ["'self'", "'unsafe-inline'", "cdn.mathjax.org", "*.googleapis.com"]
-CSP_STYLE_SRC = ["'self'", "'unsafe-inline'", "*.googleapis.com", "*.gstatic.com"]
-CSP_IMG_SRC = ["'self'", "data:", "*.lylinux.net", "*.gravatar.com", "*.githubusercontent.com"]
-CSP_FONT_SRC = ["'self'", "*.googleapis.com", "*.gstatic.com"]
-CSP_CONNECT_SRC = ["'self'"]
-CSP_FRAME_SRC = ["'none'"]
-CSP_OBJECT_SRC = ["'none'"]
-
 DEFAULT_AUTO_FIELD = 'django.db.models.BigAutoField'
 
 if os.environ.get('DJANGO_ELASTICSEARCH_HOST'):
@@ -352,7 +339,5 @@ ACTIVE_PLUGINS = [
     'reading_time',
     'external_links',
     'view_count',
-    'seo_optimizer',
-    'image_lazy_loading',
-]
-DATABASES
+    'seo_optimizer'
+]

src/djangoblog/urls.py

@@ -20,8 +20,6 @@ from django.contrib.sitemaps.views import sitemap
 from django.urls import path, include
 from django.urls import re_path
 from haystack.views import search_view_factory
-from django.http import JsonResponse
-import time
 
 from blog.views import EsSearchView
 from djangoblog.admin_site import admin_site
@@ -42,20 +40,8 @@ handler404 = 'blog.views.page_not_found_view'
 handler500 = 'blog.views.server_error_view'
 handle403 = 'blog.views.permission_denied_view'
 
-
-def health_check(request):
-    """
-    健康检查接口
-    简单返回服务健康状态
-    """
-    return JsonResponse({
-        'status': 'healthy',
-        'timestamp': time.time()
-    })
-
 urlpatterns = [
     path('i18n/', include('django.conf.urls.i18n')),
-    path('health/', health_check, name='health_check'),
 ]
 urlpatterns += i18n_patterns(
     re_path(r'^admin/', admin_site.urls),

src/djangoblog/utils.py

@@ -224,49 +224,9 @@ def get_resource_url():
 
 
 ALLOWED_TAGS = ['a', 'abbr', 'acronym', 'b', 'blockquote', 'code', 'em', 'i', 'li', 'ol', 'pre', 'strong', 'ul', 'h1',
-                'h2', 'p', 'span', 'div']
-
-# 安全的class值白名单 - 只允许代码高亮相关的class
-ALLOWED_CLASSES = [
-    'codehilite', 'highlight', 'hll', 'c', 'err', 'k', 'l', 'n', 'o', 'p', 'cm', 'cp', 'c1', 'cs',
-    'gd', 'ge', 'gr', 'gh', 'gi', 'go', 'gp', 'gs', 'gu', 'gt', 'kc', 'kd', 'kn', 'kp', 'kr', 'kt',
-    'ld', 'm', 'mf', 'mh', 'mi', 'mo', 'na', 'nb', 'nc', 'no', 'nd', 'ni', 'ne', 'nf', 'nl', 'nn',
-    'nt', 'nv', 'ow', 'w', 'mb', 'mh', 'mi', 'mo', 'sb', 'sc', 'sd', 'se', 'sh', 'si', 'sx', 's2',
-    's1', 'ss', 'bp', 'vc', 'vg', 'vi', 'il'
-]
-
-def class_filter(tag, name, value):
-    """自定义class属性过滤器"""
-    if name == 'class':
-        # 只允许预定义的安全class值
-        allowed_classes = [cls for cls in value.split() if cls in ALLOWED_CLASSES]
-        return ' '.join(allowed_classes) if allowed_classes else False
-    return value
-
-# 安全的属性白名单
-ALLOWED_ATTRIBUTES = {
-    'a': ['href', 'title'], 
-    'abbr': ['title'], 
-    'acronym': ['title'],
-    'span': class_filter,
-    'div': class_filter,
-    'pre': class_filter,
-    'code': class_filter
-}
-
-# 安全的协议白名单 - 防止javascript:等危险协议
-ALLOWED_PROTOCOLS = ['http', 'https', 'mailto']
+                'h2', 'p']
+ALLOWED_ATTRIBUTES = {'a': ['href', 'title'], 'abbr': ['title'], 'acronym': ['title']}
+
 
 def sanitize_html(html):
-    """
-    安全的HTML清理函数
-    使用bleach库进行白名单过滤，防止XSS攻击
-    """
-    return bleach.clean(
-        html, 
-        tags=ALLOWED_TAGS, 
-        attributes=ALLOWED_ATTRIBUTES,
-        protocols=ALLOWED_PROTOCOLS,  # 限制允许的协议
-        strip=True,  # 移除不允许的标签而不是转义
-        strip_comments=True  # 移除HTML注释
-    )
+    return bleach.clean(html, tags=ALLOWED_TAGS, attributes=ALLOWED_ATTRIBUTES)

src/plugins/article_copyright/plugin.py

@@ -22,11 +22,6 @@ class ArticleCopyrightPlugin(BasePlugin):
         article = kwargs.get('article')
         if not article:
             return content
-        
-        # 如果是摘要模式（首页），不添加版权声明
-        is_summary = kwargs.get('is_summary', False)
-        if is_summary:
-            return content
 
         copyright_info = f"\n<hr><p>本文由 {article.author.username} 原创，转载请注明出处。</p>"
         return content + copyright_info

src/plugins/reading_time/plugin.py

@@ -17,15 +17,7 @@ class ReadingTimePlugin(BasePlugin):
     def add_reading_time(self, content, *args, **kwargs):
         """
         计算阅读时间并添加到内容开头。
-        只在文章详情页显示，首页（文章列表页）不显示。
         """
-        # 检查是否为摘要模式（首页/文章列表页）
-        # 通过kwargs中的is_summary参数判断
-        is_summary = kwargs.get('is_summary', False)
-        if is_summary:
-            # 如果是摘要模式（首页），直接返回原内容，不添加阅读时间
-            return content
-        
         # 移除HTML标签和空白字符，以获得纯文本
         clean_content = re.sub(r'<[^>]*>', '', content)
         clean_content = clean_content.strip()

src/plugins/seo_optimizer/plugin.py

@@ -97,8 +97,6 @@ class SeoOptimizerPlugin(BasePlugin):
         structured_data = {
             "@context": "https://schema.org",
             "@type": "WebSite",
-            "name": blog_setting.site_name,
-            "description": blog_setting.site_description,
             "url": request.build_absolute_uri('/'),
             "potentialAction": {
                 "@type": "SearchAction",
@@ -133,15 +131,12 @@ class SeoOptimizerPlugin(BasePlugin):
 
         json_ld_script = f'<script type="application/ld+json">{json.dumps(seo_data.get("json_ld", {}), ensure_ascii=False, indent=4)}</script>'
 
-        seo_html = f"""
+        return f"""
         <title>{seo_data.get("title", "")}</title>
         <meta name="description" content="{seo_data.get("description", "")}">
         <meta name="keywords" content="{seo_data.get("keywords", "")}">
         {seo_data.get("meta_tags", "")}
         {json_ld_script}
         """
-        
-        # 将SEO内容追加到现有的metas内容上
-        return metas + seo_html
 
 plugin = SeoOptimizerPlugin()

src/templates/blog/tags/article_info.html

@@ -48,7 +48,7 @@
 
     <div class="entry-content" itemprop="articleBody">
         {% if  isindex %}
-            {% render_article_content article True %}
+            {{ article.body|custom_markdown|escape|truncatechars_content }}
             <p class='read-more'><a
                     href=' {{ article.get_absolute_url }}'>Read more</a></p>
         {% else %}
@@ -62,7 +62,7 @@
             {% endif %}
             <div class="article">
 
-                {% render_article_content article False %}
+                {{ article.body|custom_markdown|escape }}
 
             </div>
         {% endif %}

src/templates/blog/tags/sidebar.html

@@ -16,7 +16,7 @@
             <aside class="widget_text widget widget_custom_html"><p class="widget-title">
                 {{ sidebar.name }}</p>
                 <div class="textwidget custom-html-widget">
-                    {{ sidebar.content|sidebar_markdown|safe }}
+                    {{ sidebar.content|custom_markdown|safe }}
                 </div>
             </aside>
         {% endfor %}

src/templates/comments/tags/comment_item.html

@@ -2,13 +2,10 @@
 <li class="comment even thread-even depth-{{ depth }} parent" id="comment-{{ comment_item.pk }}">
     <div id="div-comment-{{ comment_item.pk }}" class="comment-body">
         <div class="comment-author vcard">
-            <img alt="{{ comment_item.author.username }}的头像"
+            <img alt=""
                  src="{{ comment_item.author.email|gravatar_url:150 }}"
                  srcset="{{ comment_item.author.email|gravatar_url:150 }}"
-                 class="avatar avatar-96 photo"
-                 loading="lazy"
-                 decoding="async"
-                 style="max-width:100%;height:auto;">
+                 class="avatar avatar-96 photo" height="96" width="96">
             <cite class="fn">
                 <a rel="nofollow"
                         {% if comment_item.author.is_superuser %}

src/templates/comments/tags/comment_item_tree.html

@@ -3,13 +3,10 @@
     style="margin-left: {% widthratio depth 1 3 %}rem">
     <div id="div-comment-{{ comment_item.pk }}" class="comment-body">
         <div class="comment-author vcard">
-            <img alt="{{ comment_item.author.username }}的头像"
+            <img alt=""
                  src="{{ comment_item.author.email|gravatar_url:150 }}"
                  srcset="{{ comment_item.author.email|gravatar_url:150 }}"
-                 class="avatar avatar-96 photo"
-                 loading="lazy"
-                 decoding="async"
-                 style="max-width:100%;height:auto;">
+                 class="avatar avatar-96 photo" height="96" width="96">
             <cite class="fn">
                 <a rel="nofollow"
                         {% if comment_item.author.is_superuser %}

src/templates/share_layout/base.html

@@ -16,33 +16,29 @@
 <!--<![endif]-->
 <head>
     <meta charset="UTF-8"/>
-    <meta name="viewport" content="width=device-width, initial-scale=1.0"/>
-    <meta name="format-detection" content="telephone=no"/>
-    <meta name="theme-color" content="#21759b"/>
-    {% load blog_tags %}
-    {% head_meta %}
+    <meta name="viewport" content="width=device-width"/>
     {% block header %}
-        <!-- SEO插件会自动生成title、description、keywords等标签 -->
+        <title>{% block title %}{{ SITE_NAME }}{% endblock %}</title>
+        <meta name="description" content="{{ SITE_DESCRIPTION }}">
+        <meta name="keywords" content="{{ SITE_KEYWORDS }}">
     {% endblock %}
+    {% load blog_tags %}
+    {% head_meta %}
     <link rel="profile" href="http://gmpg.org/xfn/11"/>
-    
-    <!-- DNS预解析 -->
-    <link rel="dns-prefetch" href="//cdn.mathjax.org"/>
-    <link rel="dns-prefetch" href="//cdn.jsdelivr.net"/>
-    <link rel="preconnect" href="https://cdn.jsdelivr.net" crossorigin/>
 
     <!--[if lt IE 9]>
     <script src="{% static 'blog/js/html5.js' %}" type="text/javascript"></script>
     <![endif]-->
 
-    <!-- RSS和图标 -->
-    <link rel="alternate" type="application/rss+xml" title="{{ SITE_NAME }} &raquo; Feed" href="/feed"/>
+    <link rel="alternate" type="application/rss+xml" title="{{ SITE_NAME }} &raquo; Feed"
+          href="/feed"/>
+    <link rel='stylesheet preload' as="font" id='twentytwelve-fonts-css'
+          href='{% static 'blog/fonts/fonts.css' %}'
+          type='text/css' media='all'/>
+    <link rel="dns-prefetch" href="//cdn.mathjax.org"/>
     <link rel="shortcut icon" href="/favicon.ico" type="image/x-icon"/>
     <link rel="icon" href="/favicon.ico" type="image/x-icon"/>
     <link rel="apple-touch-icon" href="/favicon.ico"/>
-    
-        <!-- 本地字体加载 -->
-        <link rel="stylesheet" href="{% static 'blog/fonts/open-sans.css' %}">
     {% compress css %}
 
         <link rel='stylesheet' id='twentytwelve-style-css' href='{% static 'blog/css/style.css' %}' type='text/css'
@@ -57,7 +53,6 @@
         {% block compress_css %}
         {% endblock %}
     {% endcompress %}
-    
     {% if GLOBAL_HEADER %}
         {{ GLOBAL_HEADER|safe }}
     {% endif %}
@@ -72,6 +67,26 @@
             <h2 class="site-description">{{ SITE_DESCRIPTION }}</h2>
         </hgroup>
         {% load i18n %}
+
+
+        {#        <div class="i18n-selector">#}
+        {#            <form action="{% url 'set_language' %}" method="post" id="i18n-form">{% csrf_token %}#}
+        {#                <input name="next" type="hidden" value="{{ redirect_to }}">#}
+        {#                <select name="language" class="i18n-select" >#}
+        {#                    {% get_current_language as LANGUAGE_CODE %}#}
+        {#                    {% get_available_languages as LANGUAGES %}#}
+        {#                    {% get_language_info_list for LANGUAGES as languages %}#}
+        {#                    {% for language in languages %}#}
+        {#                        <option value="{{ language.code }}"{% if language.code == LANGUAGE_CODE %} selected{% endif %}>#}
+        {#                            {{ language.name_local }} ({{ language.code }})#}
+        {#                        </option>#}
+        {#                    {% endfor %}#}
+        {#                </select>#}
+        {#                                <input type="submit" value="Go">#}
+        {#            </form>#}
+        {#        </div>#}
+
+
         {% include 'share_layout/nav.html' %}
 
 
@@ -90,20 +105,19 @@
     {% include 'share_layout/footer.html' %}
 </div><!-- #page -->
 
-    <!-- JavaScript资源 -->
+</body>
+<footer>
+    <script src="//cdn.bootcss.com/mathjax/2.7.0/MathJax.js?config=TeX-AMS-MML_HTMLorMML"></script>
     {% compress js %}
-        <script src="{% static 'blog/js/jquery-3.6.0.min.js' %}"></script>
-        <script src="{% static 'blog/js/nprogress.js' %}"></script>
-        <script src="{% static 'blog/js/blog.js' %}"></script>
-        <script src="{% static 'blog/js/navigation.js' %}"></script>
+        <script type="text/javascript" src="{% static 'blog/js/jquery-3.6.0.min.js' %}"></script>
+        <script type="text/javascript" src="{% static 'blog/js/nprogress.js' %}"></script>
+        <script src="{% static 'blog/js/blog.js' %}" type="application/javascript"></script>
+        <script src="{% static 'blog/js/navigation.js' %}" type="application/javascript"></script>
+        <script src="{% static 'mathjax/js/mathjax-config.js' %}" type="application/javascript"></script>
         {% block compress_js %}
         {% endblock %}
     {% endcompress %}
-    
-    <!-- MathJax智能加载器 -->
-    <script src="{% static 'blog/js/mathjax-loader.js' %}" async defer></script>
-    
     {% block footer %}
     {% endblock %}
-</body>
+</footer>
 </html>