Re: CSRF proposal and patch ready for review

2009-08-29 Thread Luke Plant
here and why everything exists. I am here so everybody can do what I want. Once everybody accepts it, they'll be serene too." (Calvin and Hobbes) Luke Plant || http://lukeplant.me.uk/ --~--~-~--~~~---~--~~ You received this message because you are subsc

Re: CSRF proposal and patch ready for review

2009-08-31 Thread Luke Plant
go, the docs mention nothing about SQL-injection, because the ORM and the API for raw SQL (via cursor.execute) do not open up vulnerabilities. The template docs *do* talk about XSS under the 'Automatic HTML escaping' section, because that is a bit of 'magic' that the developer

Re: CSRF proposal and patch ready for review

2009-08-31 Thread Luke Plant
s anyone screams. Luke -- I never hated a man enough to give him his diamonds back. (Zsa Zsa Gabor) Luke Plant || http://lukeplant.me.uk/ --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups "Django developer

Re: CSRF proposal and patch ready for review

2009-08-31 Thread Luke Plant
ld be a > fantastic subject for a sprint discussion. No, I'm afraid not (though I'd love to go). I have a full time job which is not programming related, and it would be too far for me anyway (I'm in the UK). Luke -- I never hated a man enough to give him his diamonds back

Re: proposal: decouple admin index page from INSTALLED_APPS

2009-09-04 Thread Luke Plant
#x27;projects' don't really exist as far as Django is concerned, only 'apps'. Luke -- I teleported home one night With Ron and Sid and Meg, Ron stole Meggie's heart away And I got Sidney's leg (THHGTTG) Luke Plant || http://lukeplant.me.uk/ --~--~-~--~~--

Re: CSRF proposal and patch ready for review

2009-09-10 Thread Luke Plant
oss a new argument against the CsrfResponseMiddleware: http://code.djangoproject.com/ticket/9163 To me, this confirms my gut instinct (or rather, Jacob's), that post- processing the response is really nasty. Luke -- Life is complex. It has both real and imaginary components. Luke

Re: CSRF proposal and patch ready for review

2009-09-14 Thread Luke Plant
RF mechanism. So keeping it as contrib and not in core might be an advantage if some websites have special requirements, or the bundled CSRF mechanism becomes outdated. Luke -- "Mistakes: It could be that the purpose of your life is only to serve as a warning to others."

Re: CSRF proposal and patch ready for review

2009-09-15 Thread Luke Plant
your CSRF protection mechanism like you can with the template tag and middleware. But I'll wait 'til I see your proposal. Luke -- "My capacity for happiness you could fit into a matchbox without taking out the matches first." (Marvin the paranoid android) Luke Plant || ht

Re: #10436 status

2009-09-16 Thread Luke Plant
gt; It was committed 6 months ago? > > http://code.djangoproject.com/changeset/10030 That would be #10463, not #10436 Luke -- "My middle name is 'Organised'! My first name is 'Poorly'." Luke Plant || http://lukeplant.me.uk/ --~--~-~--~~~---

Re: CSRF proposal and patch ready for review

2009-09-17 Thread Luke Plant
nges to view functions, and zero changes to tests. That's better than some projects, because I obviously must have already been using RequestContext for all POST forms, but I don't think that will be atypical. OK, I'm done! Wondering-if-I-overdid-it-ly :-) Luke -- &quo

Re: CSRF proposal and patch ready for review

2009-09-19 Thread Luke Plant
her than ignore failing tests, so it definitely adds to the upgrade cost. Regards, and thanks for taking my (lengthy) criticisms in good spirit! Luke -- OSBORN'S LAW Variables won't, constants aren't. Luke Plant || http://lukeplant.me.uk/ --~--~-~--~~--

Re: CSRF proposal and patch ready for review

2009-09-19 Thread Luke Plant
On Saturday 19 September 2009 16:56:52 Russell Keith-Magee wrote: > On Fri, Sep 18, 2009 at 6:09 AM, Luke Plant wrote: > > If the target of a is internal: > > * add {% load csrf %} to the template and {% csrf_token %} to the form > > * use RequestContext in t

Re: CSRF proposal and patch ready for review

2009-09-21 Thread Luke Plant
;t use the view function arguments (e.g. the request object), otherwise it would fail). Does anyone have a nice solution to this? Regards, Luke -- "Outside of a dog, a book is a man's best friend... inside of a dog, it's too dark to read." Luke Plant || http://lukep

decorator_from_middleware change

2009-09-21 Thread Luke Plant
-the-same-decorator-with- arguments-with-functions-and-methods/1288936#1288936 -- Parenthetical remarks (however relevant) are unnecessary Luke Plant || http://lukeplant.me.uk/ --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Googl

Re: decorator_from_middleware change

2009-09-21 Thread Luke Plant
On Monday 21 September 2009 20:27:50 Jacob Kaplan-Moss wrote: > On Mon, Sep 21, 2009 at 1:21 PM, Luke Plant wrote: > > However, decorator_from_middleware is a pain, since it doesn't always > > return a an actual decorator, for "historical reasons". I need to chang

Re: CSRF proposal and patch ready for review

2009-09-21 Thread Luke Plant
hich is a refinement we can add later. Regards, Luke [1] http://code.djangoproject.com/attachment/ticket/9977/csrf_template_tag_r11587_1.diff -- Parenthetical remarks (however relevant) are unnecessary Luke Plant || http://lukeplant.me.uk/ --~--~-~--~~~---~--~~ You received this

Re: CSRF proposal and patch ready for review

2009-09-22 Thread Luke Plant
On Tuesday 22 September 2009 13:12:51 Russell Keith-Magee wrote: > On Tue, Sep 22, 2009 at 10:34 AM, Luke Plant wrote: > > I've left most of the code itself under django/contrib/csrf because: > > > > 1) backwards compatibility with people importing the middleware >

Re: CSRF proposal and patch ready for review

2009-09-22 Thread Luke Plant
#x27;my_template.html', ...) -- my_template.html -- {% csrf_token "myform" %} The only question mark in my mind is what happens with multiple forms on a page (e.g. when you have a login box on every page). It might not be an issue - the target of the login box will be

Re: decorator_from_middleware change

2009-09-22 Thread Luke Plant
On Tuesday 22 September 2009 21:31:08 James Bennett wrote: > On Mon, Sep 21, 2009 at 9:04 PM, Luke Plant wrote: > > I've committed my change [1], and also replaced _CheckLogin > > with my method [2] (it was essentially the same method, just > > generalised). > &g

Re: decorator_from_middleware change

2009-09-22 Thread Luke Plant
e(CacheMiddleware) > > Is it correct? Nope, should be decorator_from_middleware_with_args of course, thanks, will fix. Luke [1] http://docs.djangoproject.com/en/dev/topics/cache/#the-per-view- cache -- "Pessimism: Every dark cloud has a silver lining, but lightn

Re: CSRF proposal and patch ready for review

2009-09-23 Thread Luke Plant
On Tuesday 22 September 2009 21:24:48 Luke Plant wrote: > 2) Get the view to be exempted from the normal CSRF checks done > by the middleware. Thankfully, we already have not one but two > ways of doing this - the manual @csrf_exempt decorator on views, > and the internal me

Re: decorator_from_middleware change

2009-09-23 Thread Luke Plant
ome asserts to get a better error message for now unsupported ways of calling it. Do you think this is enough? Luke -- "Pretension: The downside of being better than everyone else is that people tend to assume you're pretentious." (despair.com) Luke Plant || http://lukeplant.me

Re: decorator_from_middleware change

2009-09-23 Thread Luke Plant
ods". So, in light of those things, should it be backported to 1.1.X or not? Luke -- "Pretension: The downside of being better than everyone else is that people tend to assume you're pretentious." (despair.com) Luke Plant || http://lukeplant.me.uk/ --~--~-~--~---

Re: Adding signing (and signed cookies) to Django core

2009-09-25 Thread Luke Plant
compatibility with existing signed messages, especially persistent ones like those stored in password files etc. Luke -- "Smoking cures weight problems...eventually..." (Steven Wright) Luke Plant || http://lukeplant.me.uk/ --~--~-~--~~~---~--~-

Re: Adding signing (and signed cookies) to Django core

2009-09-25 Thread Luke Plant
t of the application was essentially allowing the user to retrieve MD5(secret_key + user_supplied_data) (might have been HMAC or SHA1), which allowed them to get past another bit of security. Luke -- "Smoking cures weight problems...eventually..." (Steven Wright) Luke Plant || http

CSRF - next step?

2009-09-26 Thread Luke Plant
ep etc. Where should it go? It's currently in 'extras/' which seems to be the right place. Luke -- "Smoking cures weight problems...eventually..." (Steven Wright) Luke Plant || http://lukeplant.me.uk/ --~--~-~--~~~---~--~~ You re

Re: CSRF - next step?

2009-09-26 Thread Luke Plant
t something to make using RequestContext easier and simpler. Luke -- "Smoking cures weight problems...eventually..." (Steven Wright) Luke Plant || http://lukeplant.me.uk/ --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups

Re: decorator_from_middleware change

2009-09-26 Thread Luke Plant
emove. Putting specific support for it in cache_page would make it harder to remove. Does anyone else know if we want to expose all the arguments of CacheMiddleware in cache_page? I can easily add them if so. Regards, Luke -- "Smoking cures wei

Re: Proposal for 1.2: built-in logging with django.core.log

2009-10-09 Thread Luke Plant
espect their good judgement." -- Libbie Fudim Luke Plant || http://lukeplant.me.uk/ --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups "Django developers" group. To post to this group, send email to django-devel

Re: Proposal for 1.2: built-in logging with django.core.log

2009-10-10 Thread Luke Plant
e hit for me anyway. Luke -- "Where a person wishes to attract, they should always be ignorant." (Jane Austen) Luke Plant || http://lukeplant.me.uk/ --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups &qu

lazy auth context processor

2009-10-14 Thread Luke Plant
"You'll be glad to know, I'm going to donate all the snot I sneeze to hospitals for mucus transfusions." (Calvin and Hobbes) Luke Plant || http://lukeplant.me.uk/ --~--~-~--~~~---~--~~ You received this message because you are subscribed to t

Re: lazy auth context processor

2009-10-14 Thread Luke Plant
On Wednesday 14 October 2009 15:32:11 Jacob Kaplan-Moss wrote: > On Wed, Oct 14, 2009 at 7:24 AM, Luke Plant wrote: > > I want to fix #6552 (also #12031), and I've attached a patch that > > makes the auth context processor lazy. > > The patch looks good to me. The

Re: lazy auth context processor

2009-10-14 Thread Luke Plant
se in this case. If people find other uses for it, almost all the functionality is in LazyObject anyway, which is as generic as it sounds. Luke -- "You'll be glad to know, I'm going to donate all the snot I sneeze to hospitals for mucus transfusions." (Calvin and Hobbes) L

Re: lazy auth context processor

2009-10-15 Thread Luke Plant
On Wednesday 14 October 2009 16:39:31 Luke Plant wrote: > On Wednesday 14 October 2009 15:54:25 Russell Keith-Magee wrote: > > > * the output of {{ user }} in a template will be different. I > > > think this is acceptable, because only things like {{ > > > user.u

LazyObject fix - tiny backwards incompatible change

2009-10-15 Thread Luke Plant
.__dir__()) Any objections to this? I can only imagine that it will affect interactive usage at the Python prompt in a few obscure cases, if anything. But I could have missed something. Luke -- You meet a lot of smart guys with stupid wives, but you almost never meet a smart woman with

shortcut proposal

2009-10-15 Thread Luke Plant
without losing that. Given where we are right now, I think it's the best option so far. Comments? Luke -- You meet a lot of smart guys with stupid wives, but you almost never meet a smart woman with a stupid husband. (Erica Jong) Luke Plant || http://lukeplant.me.uk/ --~--~-~

Re: Session/cookie based messages (#4604)

2009-10-16 Thread Luke Plant
messaging systems in Django, and if user messages are not deprecated, then we do have two systems. Luke -- You meet a lot of smart guys with stupid wives, but you almost never meet a smart woman with a stupid husband. (Erica Jong) Luke Plant || http://lukeplant.me.uk/ --~--~-~--~~

Re: shortcut proposal

2009-10-16 Thread Luke Plant
e -- The probability of someone watching you is proportional to the stupidity of your action. Luke Plant || http://lukeplant.me.uk/ --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups "Django developers" gro

Re: shortcut proposal

2009-10-16 Thread Luke Plant
rry about import lines :-) Not that I don't have a complete test suite on all my projects that would catch any missing imports, of course... ;-) Hmm, for me this boils down to whether I'm feeling lazy or feeling like a perfectionist, opt

Re: LazyObject fix - tiny backwards incompatible change

2009-10-16 Thread Luke Plant
be bit as described above, than bit by me changing it, especially if I document it in release notes. Luke -- The probability of someone watching you is proportional to the stupidity of your action. Luke Plant || http://lukeplant.me.uk/ --~--~-~--~~~---~--~~ Yo

Re: shortcut proposal

2009-10-16 Thread Luke Plant
more recent one: You wrote: > Luke Plant wrote: > > The Django devs don't think that everything to do with view > > functions is perfect, but I for one would be against changing the > > whole way they work. The basic definition of a view function: > > &

Re: Session/cookie based messages (#4604)

2009-10-22 Thread Luke Plant
changes and complete tests for the auth context processor, including the different configurations that are allowed (with and without the messages app, for instance). I think the auth context processor should call the messages one, so that you get the same result whether you use one or the o

Re: default Model.all()?

2009-10-22 Thread Luke Plant
es. Luke -- "Some people says that if you play a Windows XP install CD backwards you will hear demon voices commanding you to worship Satan. But that's nothing. If you play it forwards it will install Windows XP." Luke Plant || http://lukeplant.me.uk/ --~--~-~--~~

Re: default Model.all()?

2009-10-22 Thread Luke Plant
It also wouldn't be thread safe. Luke -- "Some people says that if you play a Windows XP install CD backwards you will hear demon voices commanding you to worship Satan. But that's nothing. If you play it forwards it will install Windows XP." Luke Plant || http://lukepla

Re: default Model.all()?

2009-10-23 Thread Luke Plant
e man. Naked people have little or no influence on society. -- Mark Twain Luke Plant || http://lukeplant.me.uk/ --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups "Django developers" group. To p

Re: Django 1.2 feature voting

2009-10-24 Thread Luke Plant
unfortunate oversight. Nonetheless, I don't think that oversight will change the plan. Python 2.4 was released nearly 5 years ago, so it's hardly unreasonable for us to drop support for 2.3. Luke -- Noise proves nothing. Often a hen who has merely laid an egg cackles as if she

Buildbot failure

2009-10-26 Thread Luke Plant
ow what to do about this, does anyone else? Luke -- "If we could just get everyone to close their eyes and visualise world peace for an hour, imagine how serene and quiet it would be until the looting started" -- Anon Luke Plant || http://lukeplant.me.uk/ --~--~-~--~~---

CSRF changes - backwards incompatible

2009-10-27 Thread Luke Plant
re -- lots of planets are much worse off than earth is. Luke Plant || http://lukeplant.me.uk/ --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups "Django developers" group. To post to this group, send email to

Re: CSRF changes - backwards incompatible

2009-10-27 Thread Luke Plant
are much too concerned with planet earth. Their geocentric attitude prevents them from seeing the greater picture -- lots of planets are much worse off than earth is. Luke Plant || http://lukeplant.me.uk/ --~--~-~--~~~---~--~~ You received this message because you

Re: CSRF changes - backwards incompatible

2009-10-27 Thread Luke Plant
templates which don't have the CSRF token. Beyond that, I'll need more details! Luke -- Environmentalists are much too concerned with planet earth. Their geocentric attitude prevents them from seeing the greater picture -- lots of planets are much worse off than earth is. Luke

Re: CSRF changes - backwards incompatible

2009-10-27 Thread Luke Plant
On Tuesday 27 October 2009 13:03:14 Luke Plant wrote: > If you have supplied custom templates to contrib views that accept > POST requests (e.g. auth login etc.), the template may need > updating. The steps needed are fully described in the docs, but in > short: > > In

Re: Advocacy for Email-01 (email backends)

2009-10-30 Thread Luke Plant
ritical anyway), so this doesn't really add any maintenance burden to Django. Regards, Luke -- A common mistake that people make when trying to design something completely foolproof is to underestimate the ingenuity of complete fools. -- Douglas Adams Luke Plant || http://lukeplant.me

Re: ImproperlyConfigured: Error importing middleware django.middleware.csrf: "No module named csrf"

2009-10-31 Thread Luke Plant
On Saturday 31 October 2009 01:04:09 vl4dt wrote: > I get this output from a newly created project with the latest > trunk: > > > Any suggestions? I suspect the python path is missing something, > also the server stops responding, just sits there and no further > requests are served. I star

Re: CSRF changes - backwards incompatible

2009-10-31 Thread Luke Plant
y of complete fools. -- Douglas Adams Luke Plant || http://lukeplant.me.uk/ --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups "Django developers" group. To post to this group, send email to django-develop

Documentation of backwards incompatible changes

2009-11-13 Thread Luke Plant
project.com/wiki/FutureBackwardsIncompatibleChanges [6] http://docs.djangoproject.com/en/dev/internals/deprecation/ -- As Ralph Waldo Emerson once said, "I hate quotations." Luke Plant || http://lukeplant.me.uk/ -- You received this message because you are subscribed to the Google Groups "Dj

Re: Documentation of backwards incompatible changes

2009-11-14 Thread Luke Plant
d some. Perhaps we could have two sections on that page — all release notes, and upgrading notes. Or, next to 'final' releases there could be an additional link to the 'backwards incompatible changes' section, along with some notes at the top explaining the page. Luke -

Re: Doc building piece missing?

2009-11-21 Thread Luke Plant
you put "versionchanged:: 1.2", our docs are set up to parse that as referring to the next version of Django, so it says "Development version". The same isn't true of 1.1.2. I don't know how this should be handled. Perhaps the easiest way is to start the tentative 1

smart if tag

2009-11-28 Thread Luke Plant
don't know of any other language where keywords can be treated as variables if the keyword doesn't make sense in that position... Regards, Luke -- "He knows the way I take: when he has tried me, I shall come forth as gold" (Job 23:10). Luke Plant || http://lukeplant.me

Re: Composite Primary/Foreign Keys

2009-11-28 Thread Luke Plant
knows the way I take: when he has tried me, I shall come forth as gold" (Job 23:10). Luke Plant || http://lukeplant.me.uk/ -- You received this message because you are subscribed to the Google Groups "Django developers" group. To post to this group, send email to django-develop

Re: smart if tag

2009-11-30 Thread Luke Plant
ull' behaviour changes, I changed your implementation slightly — I added explicit classes for Less, LessOrEqual, NotEqual and Not, pulling out the 'negate' behaviour from the individual classes (it made implementing the Null logic simpler). Other than that, very little of the p

Re: smart if tag

2009-11-30 Thread Luke Plant
On Monday 30 November 2009 20:27:32 SmileyChris wrote: > On Dec 1, 6:08 am, Luke Plant wrote: > > Given that the 'Null' stuff has now been removed, we could > > move back to your way to reduce the code a bit, but I'm not sure > > it is worth it. > > I&

Re: Session/cookie based messages (#4604)

2009-12-01 Thread Luke Plant
e used by re-usable apps. Regards, Luke -- "Humiliation: The harder you try, the dumber you look." (despair.com) Luke Plant || http://lukeplant.me.uk/ -- You received this message because you are subscribed to the Google Groups "Django developers" group. To post to

Re: Single lines between top level classes & functions

2009-12-01 Thread Luke Plant
Should new code use two lines between top level classes & > functions, like PEP 8 suggests, or should the contributing guide > be updated? I had no idea it said that! I had got so used to Django's style that anything else just grated... Luke -- "Humiliation: The harder you

SMTPConnection DeprecationWarning

2009-12-03 Thread Luke Plant
deprecated in 1.2" section of docs/releases/1.2.txt Regards, Luke -- "I am going to let you move around more, just to break up the mahogany." (True Quotes From Induhviduals, Scott Adams) Luke Plant || http://lukeplant.me.uk/ -- You received this message because you are subscr

Re: SMTPConnection DeprecationWarning

2009-12-03 Thread Luke Plant
am going to let you move around more, just to break up the mahogany." (True Quotes From Induhviduals, Scott Adams) Luke Plant || http://lukeplant.me.uk/ -- You received this message because you are subscribed to the Google Groups "Django developers" group. To post to this group,

Re: Session/cookie based messages (#4604)

2009-12-03 Thread Luke Plant
ete_messages, {}, 0), list)() >>> Luke -- "I am going to let you move around more, just to break up the mahogany." (True Quotes From Induhviduals, Scott Adams) Luke Plant || http://lukeplant.me.uk/ -- You received this message because you are subscribed to the Google Gro

Re: #7052 - Fixing serialization for contrib.contenttypes and contrib.auth

2009-12-03 Thread Luke Plant
h the alternative method on that ticket as well, right? Regards, Luke -- "I am going to let you move around more, just to break up the mahogany." (True Quotes From Induhviduals, Scott Adams) Luke Plant || http://lukeplant.me.uk/ -- You received this message because you are subsc

Re: Session/cookie based messages (#4604)

2009-12-05 Thread Luke Plant
#x27;t exist for the e-mail backends, because they don't use each other like the messages ones do. Regards, Luke -- "Idiocy: Never underestimate the power of stupid people in large groups." (despair.com) Luke Plant || http://lukeplant.me.uk/ -- You received this message because

Re: smart if tag

2009-12-05 Thread Luke Plant
{% ifequal %} tag. Irrespective of which one is right, it seems unreasonable that {% if x == y %} behaves so differently from {% ifequal x y %} in this regard. (Actually, I didn't test that. Perhaps the behaviour of 'if' has changed with the smart if code). Regards, Luke -- &

Re: smart if tag

2009-12-05 Thread Luke Plant
On Saturday 05 December 2009 20:09:21 Luke Plant wrote: > I'm not likely to able to look at this before Tuesday. If anyone > wants to look at it, I think the right approach is something like > the following: > http://effbot.org/zone/simple-top-down-parsing.htm > (without th

Re: Session/cookie based messages (#4604)

2009-12-05 Thread Luke Plant
ng the other way is also possible, with a similar level of fragility. Regards, Luke -- "Idiocy: Never underestimate the power of stupid people in large groups." (despair.com) Luke Plant || http://lukeplant.me.uk/ -- You received this message because you are subscribed to the Googl

Re: Conventions around plugable backends

2009-12-08 Thread Luke Plant
g, but with the class based you will at least find a line in settings.py, which gives you something to google. Cheers, Luke -- "If something is hard, it's not worth doing." (Homer Simpson) Luke Plant || http://lukeplant.me.uk/ -- You received this message because you are s

Re: smart if tag

2009-12-08 Thread Luke Plant
e, a container with a __contains__() method is replaced by one without, or by one with a buggy __contains__() method that throws exceptions, it's more useful and arguably more correct to get an exception than for the 'if' tag expression to return False. Regards, Luke -- "If some

QuerySet __contains__

2009-12-08 Thread Luke Plant
authors will be able to do. An explicit __contains__ method also protects us against changes in Python which could produce quite different performance. Regards, Luke -- "If something is hard, it's not worth doing." (Homer Simpson) Luke Plant || http://lukeplant.me.uk/ -- You

Re: QuerySet __contains__

2009-12-08 Thread Luke Plant
On Wednesday 09 December 2009 01:52:48 Jeremy Dunck wrote: > On Tue, Dec 8, 2009 at 7:22 PM, Luke Plant > wrote: ... > > > However, it could be slightly more efficient in some cases, > > because the entire QuerySet._result_cache does not necessarily > > need to be

Re: smart if tag

2009-12-09 Thread Luke Plant
nt in > honoring it in the first place. Very good point. You convinced me easily, contrary to tradition this time :-) Thanks for the review again. Luke -- If you can't answer a man's arguments, all is not lost; you can still call him vile names. (Elbert Hubbard) Luke Plant || http

Python version roadmap

2009-12-15 Thread Luke Plant
ple to upgrade and giving us the freedom to drop it if that seems like a good idea. Luke -- "I imagine bugs and girls have a dim suspicion that nature played a cruel trick on them, but they lack the intelligence to really comprehend the magnitude of it." (Calvin and Hobbes) Luke P

Re: why last_login in django.contrib.auth.models.User cannot be null?

2009-12-15 Thread Luke Plant
on't want the situation of bugs which are impossible to reproduce because they depend on installation and upgrade order. Luke -- "I imagine bugs and girls have a dim suspicion that nature played a cruel trick on them, but they lack the intelligence to really comprehend the magni

Re: preventing brute forcing passwords

2009-12-17 Thread Luke Plant
an external project. But as other people have mentioned, check out the existing projects. Regards, Luke -- "I'm at peace with the world. I'm completely serene. I know why I was put here and why everything exists. I am here so everybody can do what I want. Once everybody acc

Re: preventing brute forcing passwords

2009-12-18 Thread Luke Plant
On Friday 18 December 2009 01:44:05 Jeremy Dunck wrote: > On Thu, Dec 17, 2009 at 6:47 PM, Luke Plant > wrote: ... > > > The problem with signals is that they don't return values, and so > > the mechanism can't interact with the actual login process. It > &

Re: Feedback: Syndication feed views

2009-12-21 Thread Luke Plant
need to be specified in painstaking detail. Other than that, I think the PendingDeprecationWarnings are OK. Regards, Luke -- I never hated a man enough to give him his diamonds back. (Zsa Zsa Gabor) Luke Plant || http://lukeplant.me.uk/ -- You received this message because you are subscri

Re: Call for feedback: django.utils.signed and signed cookies

2009-12-21 Thread Luke Plant
rs should be very careful not to expose functionality that would allow users to retrieve signatures for arbitrary strings. If they do, it will allow any other system which uses the same key for signing to be subverted. And an entry in the 1.2 release notes is needed. Luke -- I never hate

Re: Feedback: Syndication feed views

2009-12-21 Thread Luke Plant
or not, but we do need those docs at some point so we can see the implications of deprecating feeds.Feed. So for now, maybe just update the release notes so they don't say that the new LatestEntries class is identical to before, or a caveat like "if you are only using the high level feed

r11964 and PendingDeprecationWarning

2009-12-28 Thread Luke Plant
he review stage. Russell mentioned adding the warnings, but said it might be hard to do (presumably because of the above problem). The alternative to my patch is to just remove the warnings. Regards, Luke -- I teleported home one night With Ron and Sid and Meg, Ron stole Meggie's hea

Re: safe characters used in iri_to_uri (#12445)

2009-12-28 Thread Luke Plant
ng the same thing. Hence this bug. However, I can't actually come up with a nicer solution, and one that is equally fast is probably even harder. So, +1 to changing this, as well as some fixes to the comments in the code. Luke -- I teleported home one night With Ron and Sid and Meg, Ron sto

Re: An idea to eliminate {% csrf token %}

2009-12-30 Thread Luke Plant
e as an interim measure to stop your code from breaking, so the change to require csrf_token isn't quite so bad. Thanks, Luke -- "It is a truth universally acknowledged, that a single man in possession of a good fortune, must be in want of a wife." (Jane Austen) Luke P

Re: An idea to eliminate {% csrf token %}

2010-01-01 Thread Luke Plant
le, unless you pass the request object to the Form instance, which requires changing the API for Form to something like SafeForm. That's the problem. Luke -- "I washed a sock. Then I put it in the dryer. When I took it out, it was gone." (Steven Wright) Luke Plant || http://lukepl

Re: Design and code review requested for Django string signing / signed cookies

2010-01-04 Thread Luke Plant
is like an hourglass, with the heart filling up as the brain empties." Luke Plant || http://lukeplant.me.uk/ -- You received this message because you are subscribed to the Google Groups "Django developers" group. To post to this group, send email to django-develop...@googlegro

Re: r11964 and PendingDeprecationWarning

2010-01-04 Thread Luke Plant
pinging Jannis - did you see this? Can you have a look at my suggestion? Cheers, Luke -- "Love is like an hourglass, with the heart filling up as the brain empties." Luke Plant || http://lukeplant.me.uk/ -- You received this message because you are subscribed to the Goo

Re: r11964 and PendingDeprecationWarning

2010-01-04 Thread Luke Plant
list)() > DEFAULT_DATETIME_INPUT_FORMATS = lazy(lambda: > en_format('DATETIME_INPUT_FORMATS'), tuple, list)() Personally I wouldn't worry about people who are monkey patching - they ought to expect things to break. But I don't think this addition will harm either. Luke -- &q

Re: Design and code review requested for Django string signing / signed cookies

2010-01-05 Thread Luke Plant
hing up? Life's bad enough as it is without wanting to invent any more of it." (Marvin the paranoid android) Luke Plant || http://lukeplant.me.uk/ -- You received this message because you are subscribed to the Google Groups "Django developers" group. To post to this group, se

Re: Possible contrib.humanize addition

2010-01-06 Thread Luke Plant
ts at all, etc. etc.) To summarise: if I were you, I would give up now. Luke -- "Mediocrity: It takes a lot less time, and most people don't realise until it's too late." (despair.com) Luke Plant || http://lukeplant.me.uk/ -- You received this message because you are subsc

Re: Design and code review requested for Django string signing / signed cookies

2010-01-06 Thread Luke Plant
er just a case of "use this API" - what you feed into the API is always critical. > Any thoughts on Django's auth using HMAC besides md5 and sha1 > hashing alone? It sounds like a good idea, I'm not aware of any particular problems with our current implementation that

Re: Design and code review requested for Django string signing / signed cookies

2010-01-06 Thread Luke Plant
cookies, in which case just signing "name=value" should be enough (provided the developer doesn't do something silly like make "=" part of the name of the cookie). Luke -- "Mediocrity: It takes a lot less time, and most people don't realise until it's too

Re: user_passes_test decorator changes in 1.2

2010-01-06 Thread Luke Plant
a lot less time, and most people don't realise until it's too late." (despair.com) Luke Plant || http://lukeplant.me.uk/ -- You received this message because you are subscribed to the Google Groups "Django developers" group. To post to this group, send email to django-d

Re: Call for comment: #5390 Many To Many signals

2010-01-08 Thread Luke Plant
#x27;. But I think this call: p1.fans.add(p2) needs to send a different signal than p1.favorites.add(p2) and with your patch it wouldn't. But my brain doesn't seem to be functioning properly today, I may have made a mistake. Luke -- "My capacity for happiness you could fit in

DB optimization docs

2010-01-08 Thread Luke Plant
first." (Marvin the paranoid android) Luke Plant || http://lukeplant.me.uk/ -- You received this message because you are subscribed to the Google Groups "Django developers" group. To post to this group, send email to django-develop...@googlegroups.com. To unsubscribe fro

Re: DB optimization docs

2010-01-08 Thread Luke Plant
t, it would be gratefully received :-) I'm not planning on doing any more on this for at least a few days. Luke -- "My capacity for happiness you could fit into a matchbox without taking out the matches first." (Marvin the paranoid android) Luke Plant || http://lukeplant.me.uk/

Re: DB optimization docs

2010-01-15 Thread Luke Plant
... inside of a dog, it's too dark to read." Luke Plant || http://lukeplant.me.uk/ -- You received this message because you are subscribed to the Google Groups "Django developers" group. To post to this group, send email to django-develop...@googlegroups.com. To unsubsc

Re: AnonymousUser has_perm/has_module_perms function check authentication backends

2010-01-18 Thread Luke Plant
ill help: - 'set()' is nicer than 'set([])' - in topics/auth.html, it would be nice to document that the backend should be able to cope with anonymous users being passed to has_perm(). Luke -- "Pessimism: Every dark cloud has a silver lining, but lightning kills h

  1   2   3   4   5   6   7   8   >