DecimalField and 'decimal' module.

2007-07-22 Thread Graham Dumpleton
Rather obscure question here. I noted a comment over on the user list about SVN version of Django supporting a DecimalField database type. What is the relationship between this database field type and any particular database adapters ability to store or return values in some native database decima

Re: include tag security hole

2007-07-22 Thread Gary Wilson
SmileyChris wrote: > PS: I can't patch your diffs because they don't use the format which > TortoiseSVN accepts and the win32 build of patch falls over on it too. > How are you making them? I'm making my diffs with Bazaar, using "bzr diff". My unix patch seems to handle them ok. Sorry about th

Re: include tag security hole

2007-07-22 Thread SmileyChris
On Jul 23, 4:19 pm, Gary Wilson <[EMAIL PROTECTED]> wrote: > You would be fine, but I wasn't sure if you tested on Windows. Yea, my development box runs XP. PS: I can't patch your diffs because they don't use the format which TortoiseSVN accepts and the win32 build of patch falls over on it too. H

Re: include tag security hole

2007-07-22 Thread Gary Wilson
SmileyChris wrote: > On Jul 23, 3:53 pm, Gary Wilson <[EMAIL PROTECTED]> wrote: >> SmileyChris wrote: >> I think the patch looks good. Can someone please confirm that the >> latest patch works ok on Windows. > > I guess you mean apart from me? ;) You would be fine, but I wasn't sure if you test

Re: Django Windows Installers

2007-07-22 Thread Eugene Lazutkin
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Presently I maintain the Windows installer. Because of some reasons (the main one: core devs don't use Windows) it was not included in the official download page, so I "distribute" it manually. Send me an e-mail, and I'll mail it back to you. If you

Re: include tag security hole

2007-07-22 Thread SmileyChris
On Jul 23, 3:53 pm, Gary Wilson <[EMAIL PROTECTED]> wrote: > SmileyChris wrote: > I think the patch looks good. Can someone please confirm that the > latest patch works ok on Windows. I guess you mean apart from me? ;) --~--~-~--~~~---~--~~ You received this mes

Re: include tag security hole

2007-07-22 Thread Gary Wilson
SmileyChris wrote: > On Jul 22, 6:21 pm, Gary Wilson <[EMAIL PROTECTED]> wrote: >> It's a bug and not intended behavior. I've opened a ticket and have >> attached a patch. >> >> http://code.djangoproject.com/ticket/4952 > > I've put up a new patch which is pretty solid and ready for a > committe

Re: include tag security hole

2007-07-22 Thread oggie rob
> > This was my feeling also, however I think it is prudent to prevent > > legitimate users from making mistakes. I don't know about designers, > > but I have worked with some programmers that just don't think things > > through like they should... > > This tells me they have a much deeper problem

Re: include tag security hole

2007-07-22 Thread James Bennett
On 7/22/07, oggie rob <[EMAIL PROTECTED]> wrote: > but everything I can think of is safer & cleaner by restricting > it to TEMPLATE_DIRS locations (e.g. adding the extra directories, sym > linking, or just maintaining another copy in an existing TEMPLATE_DIRS > spot). The advantage is of course th

Re: include tag security hole

2007-07-22 Thread Tom Tobin
On 7/22/07, oggie rob <[EMAIL PROTECTED]> wrote: > > This was my feeling also, however I think it is prudent to prevent > legitimate users from making mistakes. I don't know about designers, > but I have worked with some programmers that just don't think things > through like they should... This

Re: include tag security hole

2007-07-22 Thread oggie rob
> Sort of, but not really. Personally, I don't think there's any secure > way to allow arbitrary users to upload templates, because there are > just too many ways to expose something you wouldn't want to expose; if > you were going to develop a sandboxed version of the template system, > you'd hav

Re: reverse pagination be made default?

2007-07-22 Thread Tom Tobin
On 7/22/07, Amit Upadhyay <[EMAIL PROTECTED]> wrote: > I have just uploaded a patch for what I call "reverse pagination". Please > read about it here: > http://code.djangoproject.com/ticket/4956. You can see it > in action on my blog: http://www.amitu.com/blog/. [...] > To avoid confusion I was wo

reverse pagination be made default?

2007-07-22 Thread Amit Upadhyay
Hi, I have just uploaded a patch for what I call "reverse pagination". Please read about it here: http://code.djangoproject.com/ticket/4956. You can see it in action on my blog: http://www.amitu.com/blog/. The following will make sense after you have read the patch etc. I was trying to write the

Re: include tag security hole

2007-07-22 Thread James Bennett
On 7/22/07, Tai Lee <[EMAIL PROTECTED]> wrote: > Don't you mean *disallow* use of {% include %} and *enforce* use of {% > ssi %} (only)? If he has no control over the template code html > authors are generating, and {% include %} is part of django, those > template authors would be able to access

Re: include tag security hole

2007-07-22 Thread Tai Lee
On Jul 22, 8:29 am, "James Bennett" <[EMAIL PROTECTED]> wrote: > I'm personally ambivalent about where the "include" tag should be able > to search, because I can see cases where it'd be useful to have it > pull in things that aren't in TEMPLATE_DIRS. If you're interested in > confining the place

Re: include tag security hole

2007-07-22 Thread SmileyChris
On Jul 22, 6:21 pm, Gary Wilson <[EMAIL PROTECTED]> wrote: > It's a bug and not intended behavior. I've opened a ticket and have > attached a patch. > > http://code.djangoproject.com/ticket/4952 I've put up a new patch which is pretty solid and ready for a committer's review. --~--~-~-

Re: Django 1.0?

2007-07-22 Thread Mario Gonzalez
On Jul 21, 11:55 pm, Gary Wilson <[EMAIL PROTECTED]> wrote: > > No, not all of the open tickets anyway. There will _always_ be open > tickets no matter how hard we all try to close them :) > Yeah! that's my point of view and we share it. Maybe I didn't explain myself but I wanted to arrive to

Re: Django Windows Installers

2007-07-22 Thread Vsevolod Solovyov
On 7/22/07, Rob Hudson <[EMAIL PROTECTED]> wrote: > In http://code.djangoproject.com/wiki/VersionOneFeatures I see Windows > Installers listed with no leader and no start status. I'm pretty > comfortable building installers using NSIS (nsis.sf.net) as we do that > where I work and could chip in h

Django Windows Installers

2007-07-22 Thread Rob Hudson
Hi Devs, In http://code.djangoproject.com/wiki/VersionOneFeatures I see Windows Installers listed with no leader and no start status. I'm pretty comfortable building installers using NSIS (nsis.sf.net) as we do that where I work and could chip in here. Has it been discussed what the installer s

Re: Ticket #399 (Bigint field object needed) status

2007-07-22 Thread Adrian Holovaty
On 7/11/07, Peter Nixon <[EMAIL PROTECTED]> wrote: > I have added a patch to Ticket #399 at: > http://code.djangoproject.com/attachment/ticket/399/django-bigint-20070711.patch A few days ago, I added a hook to the database Field class -- a db_type() method -- along with some documentation on how

Re: Volunteer(s) needed: Django needs a buildbot

2007-07-22 Thread stava
Due to lack of response, I just went ahead and tried to setup a Trac + Bitten site to get a feel for it. It would seem that the test framework is dependent on the bitten unittest as replacement for the python unittest in order to get the test-results.xml produced and fed to the graphs. Mind you, I