[web2py] Re: Template security

2012-07-25 Thread Babak
I've had clients request that some independent design firm come in and beautify there website. They request access to the views sometimes to re-arrange things. On Wednesday, July 25, 2012 3:45:06 PM UTC-7, Anthony wrote: > > Of course *I* like Python code. But what about giving access to the

[web2py] Template security

2012-07-25 Thread Babak
Of course *I* like Python code. But what about giving access to the templates/views where we do not want to grant access to the internals of the server via system calls. ie, {{ import os os.popen('...') }} Can this be safer? --

[web2py] Re: DAL syntax, Unix Sockets, & Regular Expression Suggestion

2012-05-28 Thread Babak
to the Regular Expression enforced syntax of the connection string. On Monday, May 28, 2012 9:43:06 AM UTC-7, Babak wrote: > > Web2Py community, > > I am rewriting this note, please disregard/delete the prior post (I'm not > getting updated on it) > > Working with

[web2py] DAL syntax, Unix Sockets, & Regular Expression Suggestion

2012-05-28 Thread Babak
a UNIX user may prefer sockets over localhost connections. The easiest work around I can think of is to change [1] to the following: [2] re.compile('^(?P[^:@]+)(\:(?P[^@]*))?@(?P[^\:@]+)(\:(?P[0-9]+))?/(?P[^\?]+)(\?sslmode=(?P.+))?$') Where the "/" character exclusion is removed from the character class definition for the group "host" Best regards, Babak

[web2py] DAL syntax does not support UNIX sockets & Regex modification suggestion

2012-05-28 Thread Babak
Hello web2py community, I have noted that the DAL does not suppor the follow kind of underlying connection in python: import psycopg2 conn_string = "host='/tmp' dbname='foobar_db' user='foo' password='bar'" conn = psycopg2.connect(conn_string) cursor = conn.cursor() cursor.execute("SELECT * FROM