this view is called from flatpagefallbackmiddleware processresponse when a 404 is raised which often means csrfviewmiddleware processview has not been called even if csrfviewmiddleware is installed so we need to use csrfprotect in case the template needs csrftoken however we can t just wrap this view if no matching flatpage exists or a redirect is required for authentication the 404 needs to be returned without any csrf checks therefore we only csrf protect the internal implementation public interface to the flat page view models flatpages flatpages templates uses the template defined by the templatename field or template flatpagesdefault html if templatename is not defined context flatpage flatpages flatpages object internal interface to the flat page view if registration is required for accessing this page and the user isn t logged in redirect to the login page to avoid having to always use the safe filter in flatpage templates mark the title and content as already safe since they are raw html content in the first place this view is called from flatpagefallbackmiddleware process_response when a 404 is raised which often means csrfviewmiddleware process_view has not been called even if csrfviewmiddleware is installed so we need to use csrf_protect in case the template needs csrf_token however we can t just wrap this view if no matching flatpage exists or a redirect is required for authentication the 404 needs to be returned without any csrf checks therefore we only csrf protect the internal implementation public interface to the flat page view models flatpages flatpages templates uses the template defined by the template_name field or template flatpages default html if template_name is not defined context flatpage flatpages flatpages object internal interface to the flat page view if registration is required for accessing this page and the user isn t logged in redirect to the login page to avoid having to always use the safe filter in flatpage templates mark the title and content as already safe since they are raw html content in the first place
from django.conf import settings
from django.contrib.flatpages.models import FlatPage
from django.contrib.sites.shortcuts import get_current_site
from django.http import Http404, HttpResponse, HttpResponsePermanentRedirect
from django.shortcuts import get_object_or_404
from django.template import loader
from django.utils.safestring import mark_safe
from django.views.decorators.csrf import csrf_protect

DEFAULT_TEMPLATE = "flatpages/default.html"











def flatpage(request, url):
    
    if not url.startswith("/"):
        url = "/" + url
    site_id = get_current_site(request).id
    try:
        f = get_object_or_404(FlatPage, url=url, sites=site_id)
    except Http404:
        if not url.endswith("/") and settings.APPEND_SLASH:
            url += "/"
            f = get_object_or_404(FlatPage, url=url, sites=site_id)
            return HttpResponsePermanentRedirect("%s/" % request.path)
        else:
            raise
    return render_flatpage(request, f)


@csrf_protect
def render_flatpage(request, f):
    
    
    
    if f.registration_required and not request.user.is_authenticated:
        from django.contrib.auth.views import redirect_to_login

        return redirect_to_login(request.path)
    if f.template_name:
        template = loader.select_template((f.template_name, DEFAULT_TEMPLATE))
    else:
        template = loader.get_template(DEFAULT_TEMPLATE)

    
    
    
    f.title = mark_safe(f.title)
    f.content = mark_safe(f.content)

    return HttpResponse(template.render({"flatpage": f}, request))