Re: [Feature Request] Having an middleware to be able to force authentication on views by default

2020-03-13 Thread Abhijeet Viswa
Hello, If I'm not mistaken, middlewares are not aware of decorators, mixins applied on the request handlers. Therefore, if the middleware is turned on, there wouldn't be a way to selectively not enforce it. At least not with decorators/mixins. The rest framework uses a global setting that applies

[Feature Request] Having an middleware to be able to force authentication on views by default

2020-03-13 Thread Mehmet Ince
Hi everyone, I've been working as a security researcher for a long time. Common mistake that I've seen is forgotten decorator and/or Mixin usage on controllers, which leads to OWASP A5 Broken_Access_Control[1]. I believe one of the most important, as well as most used, decorator and/or Mixing i

Re: New Merger nomination.

2020-03-13 Thread Tom Forbes
Thanks for that James! Out of interest what is the exact implementation of the public vote? Is that performed at a meeting, via the mailing list or via the same/similar software used to elect the DSF board? Tom On Friday, 13 March 2020 20:25:58 UTC, James Bennett wrote: > > So I guess it's wort

Re: [Probably BUG] set_password and check_password accept values other than string as parameters

2020-03-13 Thread Tom Forbes
There is an argument to be made for not using force_bytes, but there is also a semantic difference between “force” and “to”. I wouldn’t think it would be possible to change force_bytes to throw an exception without serious compatibility issues - str() is how lazy objects are resolved IIRC, and

Re: New Merger nomination.

2020-03-13 Thread James Bennett
So I guess it's worth walking through how to do this. The first step would be a member of the Technical Board deciding Mariusz' suggestion is a good one, and nominating Claude to be a Merger, putting the question to the full Technical Board for voting: "Shall Claude be appointed a Merger?" The Te

Re: New Merger nomination.

2020-03-13 Thread James Bennett
A quick refresher on this since DEP 10 governance is still quite new: Mergers have no special decision-making privileges -- being a Merger, while important for the project, is not equivalent to the former "committer"/"core" status, and is not used as an honor or as a reward for past service or con

Re: New Merger nomination.

2020-03-13 Thread Tom Forbes
+1 from me! Seems like a no-brainer to make Claude a merger, his past and present contributions have been fantastic. On Friday, 13 March 2020 19:30:19 UTC, Mariusz Felisiak wrote: > > I nominate Claude Paroz to a new MERGER for 8 years of contributions to > Django, including triaging tickets, re

Re: New Merger nomination.

2020-03-13 Thread Adam Johnson
Big +1 from me, Claudes contributions are solid. On Fri, 13 Mar 2020 at 19:33, charettes wrote: > I second this nomination. > > Le vendredi 13 mars 2020 15:30:19 UTC-4, Mariusz Felisiak a écrit : >> >> I nominate Claude Paroz to a new MERGER for 8 years of contributions to >> Django, including t

Re: New Merger nomination.

2020-03-13 Thread Carlton Gibson
Seconded. Claude is one of the few existing committers who still uses and needs his commit access. He handles the translation updates for each release, and we’d be (not lost but) lost without that help. Kind Regards, Carlton On Fri, 13 Mar 2020 at 20:30, Mariusz Felisiak wrote: > I nomi

Re: New Merger nomination.

2020-03-13 Thread charettes
I second this nomination. Le vendredi 13 mars 2020 15:30:19 UTC-4, Mariusz Felisiak a écrit : > > I nominate Claude Paroz to a new MERGER for 8 years of contributions to > Django, including triaging tickets, reviewing PRs, and serving as the > Django translations manager. Claude is one of the mo

New Merger nomination.

2020-03-13 Thread Mariusz Felisiak
I nominate Claude Paroz to a new MERGER for 8 years of contributions to Django, including triaging tickets, reviewing PRs, and serving as the Django translations manager. Claude is one of the most active contributor with outstanding impact on Django. He was also awarded the 2017 Malcolm Tredin