mdipierro
f657b42f65
fixed undefined variable
2017-07-02 01:34:05 -05:00
mdipierro
1c0b498880
fixed undefined variable
2017-07-02 01:32:25 -05:00
mdipierro
0674111129
fixes #1579 , thanks Nico
2017-06-20 14:29:47 -05:00
mdipierro
18b755b8da
fixed #1583 , thanks matclab
2017-06-20 14:24:35 -05:00
Leonel Câmara
376c12a225
Fixes #1628
2017-06-05 23:35:41 +01:00
mdipierro and GitHub
baa129f871
Merge pull request #1527 from leonelcamara/authapi2
...
Auth refactor
2017-05-01 09:13:18 -05:00
BrenBarn
86a2c529b9
Change to modify Service instead of adding FlexibleService
2017-01-31 14:13:43 -08:00
BrenBarn
55592e7c6e
Add FlexibleService, which allows @service-style methods that accept varargs
2017-01-31 11:48:28 -08:00
Martin Doucha
e7cab3b975
Add Auth and Crud messages when updating language files
2016-12-20 18:54:20 +01:00
Leonel Câmara
bf5ec0d7cf
Fixed a long standing bug in login_user which was using 'password' instead of settings.password_field
...
Fixes #636
2016-11-20 19:38:21 +00:00
Giuseppe Chiesa
2c70a858f1
implemented base support for CASv3
2016-11-17 13:30:11 +01:00
mdipierro and GitHub
091d9c74b0
Merge pull request #1525 from michele-comitini/confirm_registration_redirect_fix
...
keep the _next while doing the redirect
2016-11-14 08:27:39 -06:00
Leonel Câmara
02f0bdb8d3
Auth refactor, extracted many methods into a base class for more generic auth mechanisms.
...
Partially addresses #1526
Includes a solution for IS_LOWER and IS_UPPER validator problems I mentioned in #1353
2016-11-05 16:37:22 +00:00
Michele Comitini
6b1225da02
keep the _next while doing the redirect
2016-11-04 09:59:49 +01:00
Mathieu Clabaut
2d4817841f
Allow for firstname and lastname in verify_email message
2016-11-01 11:31:01 +01:00
niphlod
40d6a72b90
fixes #1455
2016-09-21 22:35:04 +02:00
kelson
fe058bf817
fixed auth.add_membership succeeding with invalid group_id/user_id
2016-08-17 17:17:34 -04:00
Giovanni Barillari
0528a347b3
Updated pyDAL to 16.08
2016-08-13 15:38:55 +02:00
mdipierro
35eaba1096
removed duplicated code, using pydal's _compat.py
2016-08-01 03:39:22 -05:00
niphlod
cae10a68c0
fixed most of py3 warnings, output is much cleaner this way
2016-07-18 23:45:28 +02:00
Jason Bohrer and GitHub
0c4d254a9c
Changed tuple to list
...
The comparison between parts[1:3] and ('', host) would return false because a list and a tuple were being compared.
2016-07-01 13:26:23 -04:00
mdipierro
d9c2f778ee
fixed auth next open redirect
2016-07-01 02:22:15 -05:00
Th3R3p0
d95acb6897
Fixed open redirect security vulnerability. The previous filter searched for two forward slashes "//" in the "_next” parameter and if the two forward slashes were found it would check the URI and determine if the hostname matched the hostname of the web server. If not, it would change the next variable to the None. However, browsers don't require two forward slashes. As a feature, browsers accept typos such as http:google.com or http:/google.com and redirect to http://google.com . This can be used to leverage an open redirect attack even with the current filter. This commit fixes the open redirect vulnerability in the _next get parameter. Thanks to jnbrex for helping debug/write the patch for this vulnerability.
2016-06-30 17:24:47 -04:00
Alex Artigues
f87c3e260c
Fix next redirect if only one / exists
2016-06-29 20:54:13 -04:00
ilvalle
48209f5bdf
fix compileapp
2016-06-13 20:20:49 +02:00
ilvalle
7259516627
fix tools
2016-06-13 20:20:44 +02:00
mdipierro
a18e0e489f
why is session.forget not callable in tests?
2016-06-12 21:08:33 -05:00
mdipierro
dfb0129f09
do not forget a missing session
2016-06-12 20:55:16 -05:00
mdipierro
f4a353960b
merged conflicts
2016-06-12 19:59:58 -05:00
Chen Rotem Levy
9877ad5155
fix in_base for base='/'
...
If the base directory already ends with '/' the test failed.
It failed because we added an extra '/' to make sure that '/foobar' is
not under '/foo', so ask '/foobar/'.startswith('/foo/').
Whoever when we have the base already start with '/' we might test:
'/foo/bar/'.startwith('/foo//'), and give a false negative. We
shouldn't have this case, because we normalized the path, but in the
case of the root directory ('/') even a normalized path ends with '/',
and thus when base='/' this function failed.
Some re-factoring was needed to make this base testable.
2016-06-11 12:19:16 +03:00
Chen Rotem Levy
e020395bdc
apply pull request #1313
...
This should have resolved security issue#1261 -- gluon.tools.Expose
symlinks, however it does not deal well with the case where the base
exposed directory is '/'
2016-06-11 11:20:23 +03:00
zvolsky
225a286162
revert wiki to earlier (properly working) state
2016-06-07 15:10:03 +02:00
ilvalle
db8306b5c4
fix iteritems, enabled test_cache & test_dal for 3.5
2016-06-02 17:21:36 +02:00
ilvalle
a1fd92b7f8
updated imports in tests
2016-06-02 14:28:21 +02:00
Michele Comitini
67f85fd631
allow token renewal with http authorization header.
2016-05-31 23:55:58 +02:00
ilvalle
9b9ed0ad0f
running lib2to3.fixes.fix_funcattrs
2016-05-29 08:31:20 +02:00
ilvalle
35900da19b
running lib2to3.fixes.fix_except
2016-05-29 08:31:19 +02:00
ilvalle
d22222ebea
running lib2to3.fixes.fix_reduce
2016-05-29 08:31:19 +02:00
Michele Comitini
95c1a734d1
fix wrong reference to request out of current namespace
2016-05-27 00:23:25 +02:00
mdipierro
be1845ad83
Merge pull request #1327 from leonelcamara/ditch26
...
Ditch python2.6
2016-05-11 01:35:52 -05:00
Leonel Câmara
a9ee9a6b58
remove simplejson
2016-05-11 00:47:23 +01:00
Michele Comitini
7d48d6ba03
removed logging leftover
2016-05-10 01:35:22 +02:00
Michele Comitini
2c26a8c33a
make allows_jwt a real decorator. Tests included!
2016-05-10 00:50:33 +02:00
mdipierro
85819a5f83
Merge pull request #1299 from BuhtigithuB/improve/auth-tests
...
New Auth tests
2016-04-17 21:27:35 -05:00
Hardirc
2f0de8d8a0
New Auth tests & del_membership('role') api harmonization
2016-04-17 11:35:17 -04:00
Hardirc
92b3c8f777
New Auth tests
2016-04-16 19:35:06 -04:00
Hardirc
d622a8aa66
New test suite for prettydate() + fix wrong number of days for month
2016-04-16 14:54:34 -04:00
Richard Vézina
f109be363d
Enhancement tools.py PEP8
2016-04-14 11:17:27 -04:00
Leonel Câmara
b5c8b3ad25
closes #1286
2016-04-12 15:10:14 +01:00
mdipierro
83cf098c07
fixed stupid.css and impersonate
2016-04-09 10:30:31 -05:00
mdipierro