dinislage/web2py
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7,273 Commits 18 Branches 72 Tags
4e704ca6f7f6e349a8e66ea883fef98c7d94e342
Commit Graph
573 Commits
Author SHA1 Message Date
mdipierroandGitHub 453123a8ed Merge pull request #1652 from BuhtigithuB/improve/pep8-tools-py 
Enhance tools.py PEP8 compliancy
 2017-07-10 14:11:11 -05:00
mdipierro f657b42f65 fixed undefined variable 2017-07-02 01:34:05 -05:00
mdipierro 1c0b498880 fixed undefined variable 2017-07-02 01:32:25 -05:00
Richard Vézina 583d106104 Fix docstring py3 compatibility issues print -> print() 2017-06-21 11:33:00 -04:00
Richard Vézina 7ada2cf89a Enhance tools.py PEP8 compliancy 2017-06-21 11:27:54 -04:00
mdipierro 0674111129 fixes #1579, thanks Nico 2017-06-20 14:29:47 -05:00
mdipierro 18b755b8da fixed #1583, thanks matclab 2017-06-20 14:24:35 -05:00
Leonel Câmara 376c12a225 Fixes #1628 2017-06-05 23:35:41 +01:00
mdipierroandGitHub baa129f871 Merge pull request #1527 from leonelcamara/authapi2 
Auth refactor
 2017-05-01 09:13:18 -05:00
BrenBarn 86a2c529b9 Change to modify Service instead of adding FlexibleService 2017-01-31 14:13:43 -08:00
BrenBarn 55592e7c6e Add FlexibleService, which allows @service-style methods that accept varargs 2017-01-31 11:48:28 -08:00
Martin Doucha e7cab3b975 Add Auth and Crud messages when updating language files 2016-12-20 18:54:20 +01:00
Leonel Câmara bf5ec0d7cf Fixed a long standing bug in login_user which was using 'password' instead of settings.password_field 
Fixes #636
 2016-11-20 19:38:21 +00:00
Giuseppe Chiesa 2c70a858f1 implemented base support for CASv3 2016-11-17 13:30:11 +01:00
mdipierroandGitHub 091d9c74b0 Merge pull request #1525 from michele-comitini/confirm_registration_redirect_fix 
keep the _next while doing the redirect
 2016-11-14 08:27:39 -06:00
Leonel Câmara 02f0bdb8d3 Auth refactor, extracted many methods into a base class for more generic auth mechanisms. 
Partially addresses #1526
Includes a solution for IS_LOWER and IS_UPPER validator problems I mentioned in #1353
 2016-11-05 16:37:22 +00:00
Michele Comitini 6b1225da02 keep the _next while doing the redirect 2016-11-04 09:59:49 +01:00
Mathieu Clabaut 2d4817841f Allow for firstname and lastname in verify_email message 2016-11-01 11:31:01 +01:00
niphlod 40d6a72b90 fixes #1455 2016-09-21 22:35:04 +02:00
kelson fe058bf817 fixed auth.add_membership succeeding with invalid group_id/user_id 2016-08-17 17:17:34 -04:00
Giovanni Barillari 0528a347b3 Updated pyDAL to 16.08 2016-08-13 15:38:55 +02:00
mdipierro 35eaba1096 removed duplicated code, using pydal's _compat.py 2016-08-01 03:39:22 -05:00
niphlod cae10a68c0 fixed most of py3 warnings, output is much cleaner this way 2016-07-18 23:45:28 +02:00
Jason BohrerandGitHub 0c4d254a9c Changed tuple to list 
The comparison between parts[1:3] and ('', host) would return false because a list and a tuple were being compared.
 2016-07-01 13:26:23 -04:00
mdipierro d9c2f778ee fixed auth next open redirect 2016-07-01 02:22:15 -05:00
Th3R3p0 d95acb6897 Fixed open redirect security vulnerability. The previous filter searched for two forward slashes "//" in the "_next” parameter and if the two forward slashes were found it would check the URI and determine if the hostname matched the hostname of the web server. If not, it would change the next variable to the None. However, browsers don't require two forward slashes. As a feature, browsers accept typos such as http:google.com or http:/google.com and redirect to http://google.com. This can be used to leverage an open redirect attack even with the current filter. This commit fixes the open redirect vulnerability in the _next get parameter. Thanks to jnbrex for helping debug/write the patch for this vulnerability. 2016-06-30 17:24:47 -04:00
Alex Artigues f87c3e260c Fix next redirect if only one / exists 2016-06-29 20:54:13 -04:00
ilvalle 48209f5bdf fix compileapp 2016-06-13 20:20:49 +02:00
ilvalle 7259516627 fix tools 2016-06-13 20:20:44 +02:00
mdipierro a18e0e489f why is session.forget not callable in tests? 2016-06-12 21:08:33 -05:00
mdipierro dfb0129f09 do not forget a missing session 2016-06-12 20:55:16 -05:00
mdipierro f4a353960b merged conflicts 2016-06-12 19:59:58 -05:00
Chen Rotem Levy 9877ad5155 fix in_base for base='/' 
If the base directory already ends with '/' the test failed.

It failed because we added an extra '/' to make sure that '/foobar' is
not under '/foo', so ask '/foobar/'.startswith('/foo/').

Whoever when we have the base already start with '/' we might test:
'/foo/bar/'.startwith('/foo//'), and give a false negative.  We
shouldn't have this case, because we normalized the path, but in the
case of the root directory ('/') even a normalized path ends with '/',
and thus when base='/' this function failed.

Some re-factoring was needed to make this base testable.
 2016-06-11 12:19:16 +03:00
Chen Rotem Levy e020395bdc apply pull request #1313 
This should have resolved security issue#1261 -- gluon.tools.Expose
symlinks, however it does not deal well with the case where the base
exposed directory is '/'
 2016-06-11 11:20:23 +03:00
zvolsky 225a286162 revert wiki to earlier (properly working) state 2016-06-07 15:10:03 +02:00
ilvalle db8306b5c4 fix iteritems, enabled test_cache & test_dal for 3.5 2016-06-02 17:21:36 +02:00
ilvalle a1fd92b7f8 updated imports in tests 2016-06-02 14:28:21 +02:00
Michele Comitini 67f85fd631 allow token renewal with http authorization header. 2016-05-31 23:55:58 +02:00
ilvalle 9b9ed0ad0f running lib2to3.fixes.fix_funcattrs 2016-05-29 08:31:20 +02:00
ilvalle 35900da19b running lib2to3.fixes.fix_except 2016-05-29 08:31:19 +02:00
ilvalle d22222ebea running lib2to3.fixes.fix_reduce 2016-05-29 08:31:19 +02:00
Michele Comitini 95c1a734d1 fix wrong reference to request out of current namespace 2016-05-27 00:23:25 +02:00
mdipierro be1845ad83 Merge pull request #1327 from leonelcamara/ditch26 
Ditch python2.6
 2016-05-11 01:35:52 -05:00
Leonel Câmara a9ee9a6b58 remove simplejson 2016-05-11 00:47:23 +01:00
Michele Comitini 7d48d6ba03 removed logging leftover 2016-05-10 01:35:22 +02:00
Michele Comitini 2c26a8c33a make allows_jwt a real decorator. Tests included! 2016-05-10 00:50:33 +02:00
mdipierro 85819a5f83 Merge pull request #1299 from BuhtigithuB/improve/auth-tests 
New Auth tests
 2016-04-17 21:27:35 -05:00
Hardirc 2f0de8d8a0 New Auth tests & del_membership('role') api harmonization 2016-04-17 11:35:17 -04:00
Hardirc 92b3c8f777 New Auth tests 2016-04-16 19:35:06 -04:00
Hardirc d622a8aa66 New test suite for prettydate() + fix wrong number of days for month 2016-04-16 14:54:34 -04:00