R-2.6.3

Makefile

@@ -30,7 +30,7 @@ update:
 	echo "remember that pymysql was tweaked"
 src:
 	### Use semantic versioning
-	echo 'Version 2.6.2-stable+timestamp.'`date +%Y.%m.%d.%H.%M.%S` > VERSION
+	echo 'Version 2.6.3-stable+timestamp.'`date +%Y.%m.%d.%H.%M.%S` > VERSION
 	### rm -f all junk files
 	make clean
 	### clean up baisc apps

VERSION

@@ -1 +1 @@
-Version 2.6.2-stable+timestamp.2013.09.13.17.43.10
+Version 2.6.3-stable+timestamp.2013.09.15.11.59.21

applications/admin/controllers/default.py

@@ -108,7 +108,7 @@ def index():
     if session.authorized:
         redirect(send)
     elif request.vars.password:
-        if verify_password(request.vars.password):
+        if verify_password(request.vars.password[:1024]):
             session.authorized = True
             login_record(True)
 

applications/admin/models/access.py

@@ -49,7 +49,7 @@ def verify_password(password):
     session.pam_user = None
     if DEMO_MODE:
         return True
-    elif not 'password' in _config:
+    elif not _config.get('password'):
         return False
     elif _config['password'].startswith('pam_user:'):
         session.pam_user = _config['password'][9:].strip()

gluon/validators.py

@@ -2890,7 +2890,8 @@ class CRYPT(object):
                  key=None,
                  digest_alg='pbkdf2(1000,20,sha512)',
                  min_length=0,
-                 error_message='too short', salt=True):
+                 error_message='too short', salt=True,
+                 max_length=1024):
         """
         important, digest_alg='md5' is not the default hashing algorithm for
         web2py. This is only an example of usage of this function.
@@ -2901,10 +2902,12 @@ class CRYPT(object):
         self.key = key
         self.digest_alg = digest_alg
         self.min_length = min_length
+        self.max_length = max_length
         self.error_message = error_message
         self.salt = salt
 
     def __call__(self, value):
+        value = value and value[:self.max_length]
         if len(value) < self.min_length:
             return ('', translate(self.error_message))
         return (LazyCrypt(self, value), None)