diff --git a/VERSION b/VERSION index 7cce570c..70b92f72 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -Version 2.00.0 (2012-07-28 20:19:12) dev +Version 2.00.0 (2012-07-28 20:51:14) dev diff --git a/applications/admin/controllers/default.py b/applications/admin/controllers/default.py index 6c03cc87..a680efe2 100644 --- a/applications/admin/controllers/default.py +++ b/applications/admin/controllers/default.py @@ -11,6 +11,7 @@ if EXPERIMENTAL_STUFF: import re from gluon.admin import * from gluon.fileutils import abspath, read_file, write_file +from gluon.utils import web2py_uuid from glob import glob import shutil import platform @@ -40,6 +41,9 @@ if FILTER_APPS and request.args(0) and not request.args(0) in FILTER_APPS: session.flash = T('disabled in demo mode') redirect(URL('site')) + +if not session.token: session.token = web2py_uuid() + def count_lines(data): return len([line for line in data.split('\n') if line.strip() and not line.startswith('#')]) @@ -862,6 +866,9 @@ def design(): msg = T('ATTENTION: you cannot edit the running application!') response.flash = msg + if request.vars and not request.vars.token==session.token: + redirect(URL('logout')) + if request.vars.pluginfile!=None and not isinstance(request.vars.pluginfile,str): filename=os.path.basename(request.vars.pluginfile.filename) if plugin_install(app, request.vars.pluginfile.file, @@ -1113,6 +1120,8 @@ def plugin(): def create_file(): """ Create files handler """ + if request.vars and not request.vars.token==session.token: + redirect(URL('logout')) try: anchor='#'+request.vars.id if request.vars.id else '' if request.vars.app: @@ -1260,6 +1269,8 @@ def create_file(): def upload_file(): """ File uploading handler """ + if request.vars and not request.vars.token==session.token: + redirect(URL('logout')) try: filename = None app = get_app(name=request.vars.location.split('/')[0]) @@ -1639,7 +1650,9 @@ def git_pull(): if not have_git: session.flash = GIT_MISSING redirect(URL('site')) - if 'pull' in request.vars: + dialog = FORM.confim(T('Pull'), + {T('Cancel'):URL('site')}) + if dialog.accepted: try: repo = Repo(os.path.join(apath(r=request),app)) origin = repo.remotes.origin @@ -1667,7 +1680,7 @@ def git_pull(): redirect(URL('site')) elif 'cancel' in request.vars: redirect(URL('site')) - return dict(app=app) + return dict(app=app,dialog=dialog) def git_push(): diff --git a/applications/admin/views/default/design.html b/applications/admin/views/default/design.html index e5b92ab8..9ef577e8 100644 --- a/applications/admin/views/default/design.html +++ b/applications/admin/views/default/design.html @@ -19,6 +19,7 @@ def file_upload_form(location, anchor=None): INPUT(_type="file",_name="file")," ",T("and rename it:")," ", INPUT(_type="text",_name="filename",requires=IS_NOT_EMPTY), INPUT(_type="hidden",_name="location",_value=location), + INPUT(_type="hidden",_name="token",_value=session.token), INPUT(_type="hidden",_name="sender",_value=URL('design',args=app, anchor=anchor)), INPUT(_type="submit",_value=T("upload")),_action=URL('upload_file')) return form @@ -27,6 +28,7 @@ def file_create_form(location, anchor=None): INPUT(_type="text",_name="filename",requires=IS_NOT_EMPTY), INPUT(_type="hidden",_name="location",_value=location), INPUT(_type="hidden",_name="sender",_value=URL('design',args=app)), + INPUT(_type="hidden",_name="token",_value=session.token), INPUT(_type="hidden",_name="id",_value=anchor), INPUT(_type="submit",_value=T("Create")),_action=URL('create_file')) return form @@ -34,6 +36,7 @@ def upload_plugin_form(app, anchor=None): form=FORM(T("upload plugin file:")," ", INPUT(_type="file",_name="pluginfile"), INPUT(_type="hidden",_name="id",_value=anchor), + INPUT(_type="hidden",_name="token",_value=session.token), INPUT(_type="submit",_value=T("upload"))) return form def deletefile(arglist, vars={}): diff --git a/applications/admin/views/default/git_pull.html b/applications/admin/views/default/git_pull.html index 68623136..3afbf783 100644 --- a/applications/admin/views/default/git_pull.html +++ b/applications/admin/views/default/git_pull.html @@ -1,9 +1,5 @@ {{extend 'layout.html'}} -
+

{{=T('This will pull changes from the remote repo for application "%s"?', app)}}

- - - -
{{=FORM(INPUT(_type='submit',_name='cancel',_value=T('Cancel')))}}{{=FORM(INPUT(_type='submit',_name='pull',_value=T('Pull')))}}
-
+{{=dialog}} diff --git a/applications/admin/views/default/plugin.html b/applications/admin/views/default/plugin.html index aded9d40..49d328e7 100644 --- a/applications/admin/views/default/plugin.html +++ b/applications/admin/views/default/plugin.html @@ -16,6 +16,7 @@ def file_upload_form(location): INPUT(_type="file",_name="file")," ",T("and rename it:")," ", INPUT(_type="text",_name="filename",requires=IS_NOT_EMPTY), INPUT(_type="hidden",_name="location",_value=location), + INPUT(_type="hidden",_name="token",_value=session.token), INPUT(_type="hidden",_name="sender",_value=URL('design/'+app)), INPUT(_type="submit",_value=T("submit")),_action=URL('upload_file')) return form @@ -23,14 +24,10 @@ def file_create_form(location): form=FORM(T("create file with filename:")," ", INPUT(_type="text",_name="filename",requires=IS_NOT_EMPTY), INPUT(_type="hidden",_name="location",_value=location), + INPUT(_type="hidden",_name="token",_value=session.token), INPUT(_type="hidden",_name="sender",_value=URL('design/'+app)), INPUT(_type="submit",_value=T("submit")),_action=URL('create_file')) return form -def upload_plugin_form(app): - form=FORM(T("upload plugin file:")," ", - INPUT(_type="file",_name="pluginfile"), - INPUT(_type="submit",_value=T("submit"))) - return form def deletefile(arglist): return A(TAG[''](IMG(_src=URL('static', 'images/delete_icon.png')), SPAN(T('Delete this file (you will be asked to confirm deletion)'))), _class='icon delete tooltip', _href=URL('delete',args=arglist,vars=dict(sender=request.function+'/'+app))) }}