fixed guessable CSRF token when detect_record_change, thanks Stephen Röttger

gluon/contrib/hypermedia.py

@@ -222,7 +222,7 @@ class Collection(object):
                              'href':URL(args=request.args,vars=vars,scheme=True)}
             if self.extensions and limitby[0]>0:
                 vars = dict(request.get_vars)
-                vars['_offset'] = max(0,limitby[0]-1-delta)
+                vars['_offset'] = max(0,limitby[0]-delta)
                 vars['_limit'] = limitby[0]
                 r['previous'] = {'rel':'previous',
                                  'href':URL(args=request.args,vars=vars,scheme=True)}

gluon/contrib/populate.py

@@ -133,6 +133,8 @@ def populate_generator(table, default=True, compute=False, contents={}):
                 continue
             elif field.type == 'id':
                 continue
+            elif field.type == 'upload':
+                continue
             elif default and not field.default in (None, ''):
                 record[fieldname] = field.default
             elif compute and field.compute:
@@ -153,8 +155,6 @@ def populate_generator(table, default=True, compute=False, contents={}):
                 record[fieldname] = datetime.time(h, m, 0)
             elif field.type == 'password':
                 record[fieldname] = ''
-            elif field.type == 'upload':
-                record[fieldname] = None
             elif field.type == 'integer' and \
                     hasattr(field.requires, 'options'):
                 options = field.requires.options(zero=False)