Hey, Miguel. This is a start for adding in docs and addressing #22. I have not worked with Sphinx very much, so any advice you can give me about how to best document this project will be appreciated, and I'll gladly make changes. For example I am not sure how to use these :code:, :class:, or :func: tags and I am also not sure how to use "autodoc". I'm thinking those tags and autodoc probably are work together somehow.

I used the sphinx-quickstart and based the remaining configuration off of how Flask-Misaka did their docs. As you'll see all I've done is copy the readme into index.rst.

I figure at this point I should try to get some feedback before going forward. In meantime, I'll look some more into Sphinx.

Oh, and building the docs should work with:

pip install sphinx
pip install Flask-Sphinx-Themes
make html

Hi -

I'm learning Python Flask and I've built my first simple website. In one of the HTML templates I've included the line: <p>The current date and time is: {{ moment().format('MMMM Do YYYY, h:mm:ss a') }}.</p>

My init.py file contains the lines: from flask_moment import Moment

moment = Moment(app)

My base.html file contains: {% block scripts %} {{ super() }} {{ moment.include_moment() }} {{ moment.locale(auto_detect=True) }} {% endblock %}

This works fine in Firefox and Chrome, but returns no datetime information in IE11 or Edge.

I'm running the Flask app on localhost:5000.

I've attached screenshots from the four browsers to illustrate the problem.

I'm running MS Windows 10 Home (64-bit) on a Lenovo ThinkPad laptop with Python 3.8.2 (32-bit) and Flask 1.1.2. I'm using Flask_Bootstrap4 4.0.2.

Apologies if this isn't the right place to raise this question, but I've searched extensively online (stackoverflow, etc) and I haven't been able to find any information that has helped me to resolve it.

Please let me know if you need any further information.

Many thanks

Firefox Chrome IE11 Edge

I added Talisman to my Flask project and tried to properly configure TALISMAN_SECURITY_POLICY but I can't figure out how to get Moment scripts accepted.

I got the following message(s): Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' cdnjs.cloudflare.com maxcdn.bootstrapcdn.com code.jquery.com 'nonce-gOu5h3Vkvkid_uTOnxjYsw'". Note that 'unsafe-inline' is ignored if either a hash or nonce value is present in the source list.

I tried to investigate things a bit further and it looks like it comes from moment.include_jquery() and moment.include_moment(). I wonder if someone (@miguelgrinberg ?) could add an option to include a SHA or a nonce to the script tag (if that's the proper way to do it) or let me know how to circumvent the issue(s).

If the user has set up a CSP like:

Content-Security-Policy:
  script-src 'nonce-{random}'
  script-src-elem 'nonce-{random}'

The random is substituted with the provided nonce.

It is recommended that the user use an extension like Flask-Talisman and set it up as:

talisman = Talisman()

CSP = {
    # your preferred CSP goes here
}

talisman.init_app(
    app,
    csp=CSP,
    content_security_policy_nonce_in=["script-src-elem"],
    # ...
)

and then load Flask-Moment like:

{% block scripts %}
{# ... #}
{{ moment.include_moment(csp_nonce=csp_nonce()) }}
{# ... #}
{% endblock %}

Valuable resources:

• Mitigate cross-site scripting (XSS) with a strict Content Security Policy (CSP)
• How to use csp_nonce() function
• Flask-Talisman project

I'm not sure whether this is properly an error in flask-moment. Apologies if this is the wrong place.

Using an extremely simple app, I can't seem to get dates to display properly in Safari (13.0.2) with flask-moment (0.9.0) unless I set sri to False in include_moment(). Otherwise, moment.js fails to load and no dates display. In the JavaScript console I see errors related to Access-Control-Allow-Origin, but setting that header manually doesn't have any impact.

The errors I see:

[Error] Cross-origin redirection to http://cdnjs.cloudflare.com/ajax/libs/moment.js/2.24.0/moment-with-locales.min.js denied by Cross-Origin Resource Sharing policy: Origin http://localhost:5000 is not allowed by Access-Control-Allow-Origin.
[Error] Failed to load resource: Cross-origin redirection to http://cdnjs.cloudflare.com/ajax/libs/moment.js/2.24.0/moment-with-locales.min.js denied by Cross-Origin Resource Sharing policy: Origin http://localhost:5000 is not allowed by Access-Control-Allow-Origin. (moment-with-locales.min.js, line 0)
[Error] Cross-origin script load denied by Cross-Origin Resource Sharing policy.
[Error] ReferenceError: Can't find variable: moment
Global Code (localhost:15)
[Error] Cross-origin script load denied by Cross-Origin Resource Sharing policy.
[Error] ReferenceError: Can't find variable: moment
Global Code (localhost:49)

The code I used:

main.py:

from flask_bootstrap import Bootstrap
from flask_moment import Moment
from flask import Flask, render_template, make_response
from datetime import datetime

app = Flask(__name__)
bootstrap = Bootstrap(app)
moment = Moment(app)

@app.route("/")
def index():
    return render_template('index.html', current_time=datetime.utcnow())

if __name__ == '__main__':
    app.run()

base.html:

{% extends "bootstrap/base.html" %}
{% block head %}
{{ super() }}
  {% block scripts %}
  {{ super() }}
  {{ moment.include_moment() }}
  {% endblock %}
{% endblock %}

{% block content %}
  {% block page_content %}
  {% endblock %}
{% endblock %}

index.html:

{% extends 'base.html' %}

{% block page_content %}
Current time: {{ moment(current_time).format('LLL') }}.
{% endblock %}

• Changes in this commit allow for the use of a 'live' timestamp. See the example file for a live demo.
• Prevents starting multiple timers for a single object
• Refresh now allows for other values (like every second).
• Adds a toNow function
• All changes are backwards compatible.

Pull request of the change proposed here, allowing to remove the use of the eval() JavaScript function. Would also fix #43 and allow to work with a Content-Security-Policy (CSP) that doesn't require unsafe-eval for any JavaScript page on the entire webpage (since that doesn't apply just to the bits from Flask-Moment)

Had trouble with adding .format() to the end of subtract, and add because of render statements being parsed in-between. For this reason these methods expect a format parameter which will be added to the aforementioned moment.js render call.

Issue #35

I found in using this in my app I use the same string format in all my web pages. When adding new dates in new pages I would have a hard time remembering what exactly that format was. This solves that problem by setting a config variable to the format needed without needing to register a new jinja variable.

So for this conversion (regarding eval) I discovered that it was mostly a lot easier than I expected (after initially believing it would be a lot harder than I expected).

The primary problem presented in this case is regarding the parameters called to the moment. This is why the fromNow exists.

I thought just a minute ago about how it would be possible to, instead of rendering each parameter as a dataset attribute, simply render a csv string of the parameters and then split on the commas. This becomes more complicated as we start dealing with datatypes (string vs bool vs int, etc.) but I think I could manage it.

The one point at which I don't think I could manage it anymore is with regard to from as we need to create a new moment.

It would theoretically be possible to write a getArgs() function that took a type-annotated csv string, e.g. moment:<timestamp>,int:<int> which would then parse those into the correct datatypes. Heck, I could just use JSON I would think, but at that point we're really writing a parser.

Wow I just noticed I still have a console logger there and a random return. Sorry will clean immediately.

As regards elimination of JQuery, I think this did it.

Opinions?

I am displaying time data was received using flask Moment.fromNow. Typically it outputs 'a few seconds ago' but sometimes the sender's clock is a little off and it displays ' in a few seconds' - which makes no sense to the user. To fix this I want to change ' in a few seconds' to 'current' but this does not seem easy using Moment customization so I thought I could simply change the output in jinja2 but cannot see how to capture the output string to change it: Code: {% set moment_text = moment(value.lastupdated).fromNow(no_suffix = False) %}

    {% if moment_text == "in a few seconds"  %}
        {% set moment_text = "current" %}
    {% endif %}

This never fires because moment_text is still a date and not a string. How can I get the output string of Flask Moment so I can test it and change it? Thanks Bill

I'd like to format a number of seconds e.g. 150 seconds -> 00:02:30 using Flask-Moment

I think this should work:

{{ moment().startOf('day').seconds(s).format('H:mm:ss'); }}

but I get an error jinja2.exceptions.UndefinedError: 'flask_moment._moment object' has no attribute 'startOf'