From c0cc76ae93a54dc5d4c6016824ee8de2eb35b4ed Mon Sep 17 00:00:00 2001 From: mdipierro Date: Fri, 6 Jul 2012 11:32:01 -0500 Subject: [PATCH 1/2] removed varquote, too many problems --- VERSION | 2 +- gluon/dal.py | 67 ++++++++++++++++++++++++++-------------------------- 2 files changed, 35 insertions(+), 34 deletions(-) diff --git a/VERSION b/VERSION index c945597e..1fcd094b 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -Version 2.00.0 (2012-07-06 08:54:40) dev +Version 2.00.0 (2012-07-06 11:31:58) dev diff --git a/gluon/dal.py b/gluon/dal.py index 926d3b4a..996ac01b 100644 --- a/gluon/dal.py +++ b/gluon/dal.py @@ -210,6 +210,7 @@ thread = threading.local() regex_type = re.compile('^([\w\_\:]+)') regex_dbname = re.compile('^(\w+)(\:\w+)*') +regex_safe = re.compile('^[\w_]+$') regex_table_field = re.compile('^([\w_]+)\.([\w_]+)$') regex_content = re.compile('(?P[\w\-]+)\.(?P[\w\-]+)\.(?P[\w\-]+)\.(?P\w+)\.\w+$') regex_cleanup_fn = re.compile('[\'"\s;]+') @@ -389,6 +390,9 @@ def AND(a,b): def IDENTITY(x): return x +def varquote_aux(name,quotestr='%s'): + return name if regex_safe.match(name) else quotestr % name + if 'google' in drivers: is_jdbc = False @@ -668,21 +672,19 @@ class BaseAdapter(ConnectionPool): else: ftype = ftype + self.types['reference FK'] % dict( constraint_name = constraint_name, # should be quoted - table_name=self.varquote(tablename), - field_name=self.varquote(field.name), - foreign_key = '%s (%s)' % (self.varquote(rtablename), - self.varquote(rfieldname)), + foreign_key = '%s (%s)' % (rtablename, + rfieldname), on_delete_action=field.ondelete) else: # make a guess here for circular references id_fieldname = referenced in table._db \ and table._db[referenced]._id.name or 'id' ftype = self.types[field.type[:9]] % dict( - index_name = self.varquote(field.name+'__idx'), - field_name = self.varquote(field.name), - constraint_name = self.varquote(constraint_name), - foreign_key = '%s (%s)' % (self.varquote(referenced), - self.varquote(id_fieldname)), + index_name = field.name+'__idx', + field_name = field.name, + constraint_name = constraint_name, + foreign_key = '%s (%s)' % (referenced, + id_fieldname), on_delete_action=field.ondelete) elif field.type.startswith('list:reference'): ftype = self.types[field.type[:14]] @@ -744,13 +746,13 @@ class BaseAdapter(ConnectionPool): # Postgres - PostGIS: # geometry fields are added after the table has been created, not now if not (self.dbengine == 'postgres' and field.type.startswith('geom')): - fields.append('%s %s' % (self.varquote(field.name), ftype)) + fields.append('%s %s' % (field.name, ftype)) other = ';' # backend-specific extensions to fields if self.dbengine == 'mysql': if not hasattr(table, "_primarykey"): - fields.append('PRIMARY KEY(%s)' % self.varquote(table._id.name)) + fields.append('PRIMARY KEY(%s)' % table._id.name) other = ' ENGINE=InnoDB CHARACTER SET utf8;' fields = ',\n '.join(fields) @@ -855,7 +857,7 @@ class BaseAdapter(ConnectionPool): if not key in keys: keys.append(key) if self.dbengine == 'mssql': - new_add = '; ALTER TABLE %s ADD ' % self.varquote(tablename) + new_add = '; ALTER TABLE %s ADD ' % tablename else: new_add = ', ADD ' @@ -871,7 +873,7 @@ class BaseAdapter(ConnectionPool): query = [ sql_fields[key]['sql'] ] else: query = ['ALTER TABLE %s ADD %s %s;' % \ - (self.varquote(tablename), key, + (tablename, key, sql_fields_aux[key]['sql'].replace(', ', new_add))] metadata_change = True elif self.dbengine in ('sqlite', 'spatialite'): @@ -887,9 +889,9 @@ class BaseAdapter(ConnectionPool): query = [ "SELECT DropGeometryColumn ('%(schema)s', '%(table)s', '%(field)s');" % \ dict(schema=schema, table=tablename, field=key,) ] elif not self.dbengine in ('firebird',): - query = ['ALTER TABLE %s DROP COLUMN %s;' % (self.varquote(tablename), self.varquote(key))] + query = ['ALTER TABLE %s DROP COLUMN %s;' % (tablename, key)] else: - query = ['ALTER TABLE %s DROP %s;' % (self.varquote(tablename), self.varquote(key))] + query = ['ALTER TABLE %s DROP %s;' % (tablename, key)] metadata_change = True elif sql_fields[key]['sql'] != sql_fields_old[key]['sql'] \ and not isinstance(table[key].type, SQLCustomType) \ @@ -900,19 +902,19 @@ class BaseAdapter(ConnectionPool): t = tablename tt = sql_fields_aux[key]['sql'].replace(', ', new_add) if not self.dbengine in ('firebird',): - query = ['ALTER TABLE %s ADD %s__tmp %s;' % (self.varquote(t), key, tt), - 'UPDATE %s SET %s__tmp=%s;' % (self.varquote(t), key, key), - 'ALTER TABLE %s DROP COLUMN %s;' % (self.varquote(t), key), - 'ALTER TABLE %s ADD %s %s;' % (self.varquote(t), key, tt), - 'UPDATE %s SET %s=%s__tmp;' % (self.varquote(t), key, key), - 'ALTER TABLE %s DROP COLUMN %s__tmp;' % (self.varquote(t), key)] + query = ['ALTER TABLE %s ADD %s__tmp %s;' % (t, key, tt), + 'UPDATE %s SET %s__tmp=%s;' % (t, key, key), + 'ALTER TABLE %s DROP COLUMN %s;' % (t, key), + 'ALTER TABLE %s ADD %s %s;' % (t, key, tt), + 'UPDATE %s SET %s=%s__tmp;' % (t, key, key), + 'ALTER TABLE %s DROP COLUMN %s__tmp;' % (t, key)] else: - query = ['ALTER TABLE %s ADD %s__tmp %s;' % (self.varquote(t), key, tt), - 'UPDATE %s SET %s__tmp=%s;' % (self.varquote(t), key, key), - 'ALTER TABLE %s DROP %s;' % (self.varquote(t), key), - 'ALTER TABLE %s ADD %s %s;' % (self.varquote(t), key, tt), - 'UPDATE %s SET %s=%s__tmp;' % (self.varquote(t), key, key), - 'ALTER TABLE %s DROP %s__tmp;' % (self.varquote(t), key)] + query = ['ALTER TABLE %s ADD %s__tmp %s;' % (t, key, tt), + 'UPDATE %s SET %s__tmp=%s;' % (t, key, key), + 'ALTER TABLE %s DROP %s;' % (t, key), + 'ALTER TABLE %s ADD %s %s;' % (t, key, tt), + 'UPDATE %s SET %s=%s__tmp;' % (t, key, key), + 'ALTER TABLE %s DROP %s__tmp;' % (t, key)] metadata_change = True elif sql_fields[key]['type'] != sql_fields_old[key]['type']: sql_fields_current[key] = sql_fields[key] @@ -1012,7 +1014,7 @@ class BaseAdapter(ConnectionPool): logfile.write('success!\n') def _insert(self, table, fields): - keys = ','.join(self.varquote(f.name) for f,v in fields) + keys = ','.join(f.name for f,v in fields) values = ','.join(self.expand(v,f.type) for f,v in fields) return 'INSERT INTO %s(%s) VALUES (%s);' % (table, keys, values) @@ -1138,8 +1140,7 @@ class BaseAdapter(ConnectionPool): def expand(self, expression, field_type=None): if isinstance(expression, Field): - return '%s.%s' % (self.varquote(expression.tablename), - self.varquote(expression.name)) + return '%s.%s' % (expression.tablename, expression.name) elif isinstance(expression, (Expression, Query)): if not expression.second is None: return expression.op(expression.first, expression.second) @@ -2049,7 +2050,7 @@ class MySQLAdapter(BaseAdapter): } def varquote(self,name): - return '`%s`' % name + return varquote_aux(name,'`%s`') def RANDOM(self): return 'RAND()' @@ -2161,7 +2162,7 @@ class PostgreSQLAdapter(BaseAdapter): } def varquote(self,name): - return '"%s"' % name + return varquote_aux(name,'"%s"') def adapt(self,obj): return psycopg2_adapt(obj).getquoted() @@ -2645,7 +2646,7 @@ class MSSQLAdapter(BaseAdapter): } def varquote(self,name): - return '[%s]' % name + return varquote_aux(name,'[%s]') def EXTRACT(self,field,what): return "DATEPART(%s,%s)" % (what, self.expand(field)) From 84d4359fd1821872cab1e45a2af723ad47ac4e3a Mon Sep 17 00:00:00 2001 From: mdipierro Date: Fri, 6 Jul 2012 11:47:25 -0500 Subject: [PATCH 2/2] referrer_actions, thanks Anthony --- VERSION | 2 +- gluon/tools.py | 31 ++++++++++++++++++++++--------- 2 files changed, 23 insertions(+), 10 deletions(-) diff --git a/VERSION b/VERSION index 1fcd094b..2ac640e6 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -Version 2.00.0 (2012-07-06 11:31:58) dev +Version 2.00.0 (2012-07-06 11:47:22) dev diff --git a/gluon/tools.py b/gluon/tools.py index 4badf487..a0bfa75b 100644 --- a/gluon/tools.py +++ b/gluon/tools.py @@ -1209,7 +1209,13 @@ class Auth(object): else: raise HTTP(404) - def navbar(self, prefix='Welcome', action=None, separators=(' [ ',' | ',' ] ')): + def navbar(self, prefix='Welcome', action=None, + separators=(' [ ',' | ',' ] '), + referrer_actions=DEFAULT): + if referrer_actions == DEFAULT: + referrer_actions = ['login','logout','profile', + 'register','change_password', + 'retrieve_username','request_reset_password'] request = current.request T = current.T if isinstance(prefix,str): @@ -1224,13 +1230,20 @@ class Auth(object): else: next = '?_next='+urllib.quote(URL(args=request.args,vars=request.get_vars)) - li_next = '?_next='+urllib.quote(self.settings.login_next) - lo_next = '?_next='+urllib.quote(self.settings.logout_next) - + pr_next = next if 'profile' in referrer_actions else '' + pa_next = next if 'change_password' in referrer_actions else '' + re_next = next if 'register' in referrer_actions else '' + ru_next = next if 'retrieve_username' in referrer_actions else '' + rp_next = next if 'request_reset_password' in referrer_actions else '' + li_next = '?_next='+urllib.quote(self.settings.login_next) \ + if 'login' in referrer_actions else '' + lo_next = '?_next='+urllib.quote(self.settings.logout_next) \ + if 'logout' in referrer_actions else '' + if self.user_id: logout=A(T('Logout'),_href=action+'/logout'+lo_next) - profile=A(T('Profile'),_href=action+'/profile'+next) - password=A(T('Password'),_href=action+'/change_password'+next) + profile=A(T('Profile'),_href=action+'/profile'+pr_next) + password=A(T('Password'),_href=action+'/change_password'+pa_next) bar = SPAN(prefix,self.user.first_name,s1, logout,s3,_class='auth_navbar') if not 'profile' in self.settings.actions_disabled: bar.insert(4, s2) @@ -1240,11 +1253,11 @@ class Auth(object): bar.insert(-1, password) else: login=A(T('Login'),_href=action+'/login'+li_next) - register=A(T('Register'),_href=action+'/register'+next) + register=A(T('Register'),_href=action+'/register'+re_next) retrieve_username=A(T('forgot username?'), - _href=action+'/retrieve_username'+next) + _href=action+'/retrieve_username'+ru_next) lost_password=A(T('Lost password?'), - _href=action+'/request_reset_password'+next) + _href=action+'/request_reset_password'+ru_next) bar = SPAN(s1, login, s3, _class='auth_navbar') if not 'register' in self.settings.actions_disabled: