Re: User data being exposed with mod_wsgi/apache

2011-11-01 Thread Karen Tracey
On Tue, Nov 1, 2011 at 4:40 PM, Jennifer Bell wrote: >def > __init__(self,data=None,files=None,initial={},first_update=False,user=None, > report=None): > if user and user.is_authenticated() and > UserProfile.objects.filter(user=user).exists(): > initial[ 'author' ] = user.f

Re: User data being exposed with mod_wsgi/apache

2011-11-01 Thread Jennifer Bell
Well... you were right. The problem was with my code. As a public service, the code below will expose the data of a logged in user for anyone viewing the site: BAD code > view.py: def show( request, report_id ): report = get_object_or_404(Report, id=report_i

Re: User data being exposed with mod_wsgi/apache

2011-10-25 Thread Daniel Roseman
On Monday, 24 October 2011 23:14:40 UTC+1, Jennifer Bell wrote: > > On my site, some user data is automatically filled in to a form if a > user is logged in by accessing request.user in the view code. > > On deployment, it seems that if *any* user is logged in, forms > requested via another brow

User data being exposed with mod_wsgi/apache

2011-10-24 Thread Jennifer Bell
On my site, some user data is automatically filled in to a form if a user is logged in by accessing request.user in the view code. On deployment, it seems that if *any* user is logged in, forms requested via another browser will be filled in with their data. The data is not filled in if no user i