Add customizable ordering and new request type for timeslot queryset

Hello!

In this MR I added a way to customize the ordering of the TimeSlot queryset with a new order GET parameter. It defaults to sorting by reverse start date. (aka -start).

I also added a new query parameter surrounding which returns the 10 timeslots closest to the current date.

Since it's been a while since I've written Python, I'm not sure if this is the most safe/optimal way to do it, but I hope I did alright :D

If I should change anything, please let me know!

program/views.py

@@ -509,6 +509,7 @@ class APITimeSlotViewSet(viewsets.ModelViewSet):
     /timeslots/{pk} eturns the given timeslot (GET)
     /timeslots/?start={start_date}&end={end_date} returns timeslots within the time range (GET)
     /shows/{show_pk}/timeslots returns timeslots of the show (GET, POST)
+    /shows/{show_pk}/timeslots?surrounding returns the 10 nearest timeslots for the current date (GET)
     /shows/{show_pk}/timeslots/{pk} returns a timeslots by its ID (GET, PUT, DELETE)
     /shows/{show_pk}/timeslots/?start={start_date}&end={end_date} returns timeslots of the show within the time range
     /shows/{show_pk}/schedules/{schedule_pk}/timeslots returns all timeslots of the schedule (GET, POST)
@@ -534,10 +535,17 @@ class APITimeSlotViewSet(viewsets.ModelViewSet):
             start = datetime.combine(datetime.strptime(self.request.query_params.get('start'), '%Y-%m-%d').date(), time(0, 0))
             end = datetime.combine(datetime.strptime(self.request.query_params.get('end'), '%Y-%m-%d').date(), time(23, 59))
 
-        # Is this safe?
-        order = self.request.query_params.get('order', '-start')
+        default_order = '-start'
+        order = self.request.query_params.get('order', default_order)
 
-        if ('surrounding' in self.request.query_params):
+        # If someone tries to sort by a field that isn't available on the model
+        # we silently ignore that and use the default sort order.
+        model_fields = [field.name for field in TimeSlot._meta.get_fields()]
+        if order.lstrip('-') not in model_fields:
+            order = default_order
+
+
+        if 'surrounding' in self.request.query_params:
             today = datetime.today()
 
             nearest_timeslots_in_future = TimeSlot.objects.filter(start__gte=today).order_by('start').values_list('id', flat=True)[:5]