From 55016cbd4d7a297413df4aad46753be1d95c136d Mon Sep 17 00:00:00 2001 From: mdipierro Date: Wed, 2 Jul 2014 08:27:02 -0500 Subject: [PATCH] =?UTF-8?q?fixed=20guessable=20CSRF=20token=20when=20detec?= =?UTF-8?q?t=5Frecord=5Fchange,=20thanks=20Stephen=20R=C3=B6ttger?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- VERSION | 2 +- gluon/contrib/hypermedia.py | 2 +- gluon/contrib/populate.py | 4 ++-- gluon/html.py | 4 ++-- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/VERSION b/VERSION index 368f4ca0..e6407938 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -Version 2.9.5-trunk+timestamp.2014.07.02.07.25.19 +Version 2.9.5-trunk+timestamp.2014.07.02.08.25.23 diff --git a/gluon/contrib/hypermedia.py b/gluon/contrib/hypermedia.py index 817f1794..a2b5908d 100644 --- a/gluon/contrib/hypermedia.py +++ b/gluon/contrib/hypermedia.py @@ -222,7 +222,7 @@ class Collection(object): 'href':URL(args=request.args,vars=vars,scheme=True)} if self.extensions and limitby[0]>0: vars = dict(request.get_vars) - vars['_offset'] = max(0,limitby[0]-1-delta) + vars['_offset'] = max(0,limitby[0]-delta) vars['_limit'] = limitby[0] r['previous'] = {'rel':'previous', 'href':URL(args=request.args,vars=vars,scheme=True)} diff --git a/gluon/contrib/populate.py b/gluon/contrib/populate.py index 2930d119..cc7dd216 100644 --- a/gluon/contrib/populate.py +++ b/gluon/contrib/populate.py @@ -133,6 +133,8 @@ def populate_generator(table, default=True, compute=False, contents={}): continue elif field.type == 'id': continue + elif field.type == 'upload': + continue elif default and not field.default in (None, ''): record[fieldname] = field.default elif compute and field.compute: @@ -153,8 +155,6 @@ def populate_generator(table, default=True, compute=False, contents={}): record[fieldname] = datetime.time(h, m, 0) elif field.type == 'password': record[fieldname] = '' - elif field.type == 'upload': - record[fieldname] = None elif field.type == 'integer' and \ hasattr(field.requires, 'options'): options = field.requires.options(zero=False) diff --git a/gluon/html.py b/gluon/html.py index f3354f8a..db880c47 100644 --- a/gluon/html.py +++ b/gluon/html.py @@ -2101,7 +2101,7 @@ class FORM(DIV): status = False if status and session: # check if editing a record that has been modified by the server - if hasattr(self, 'record_hash') and self.record_hash != formkey: + if hasattr(self, 'record_hash') and self.record_hash != formkey.split(':')[0]: status = False self.record_changed = changed = True status = self._traverse(status, hideerror) @@ -2129,7 +2129,7 @@ class FORM(DIV): status = False if not session is None: if hasattr(self, 'record_hash'): - formkey = self.record_hash + formkey = self.record_hash+':'+web2py_uuid() else: formkey = web2py_uuid() self.formkey = formkey