Re: [web2py] Re: Registration passworld field security risk on form failure?

2014-08-27 Thread Mark Li
;s an issue worth discussion. > > > On Wednesday, August 27, 2014 1:11:57 PM UTC-4, Mark Li wrote: >> >> Under the Net tab in Firebug, the Post contains the submitted variables, >> and the response tab is the HTML of the returned page. This response >> contains the pa

Re: [web2py] How to put both login and register forms on one page...

2014-08-28 Thread Mark Li
There seems to be a problem with this implementation For example, if you have def page(): login_form = auth.login() register_form = auth.register() return dict(login_form=login_form, register_form=register_form) If you go to the page with both forms, and submit the register form with

[web2py] Both auth.login() and auth.register() on the same page, prevents password validation

2014-08-28 Thread Mark Li
I currently have both auth.login() and auth.register() forms on the same page. A simplified version of my code below: def page(): login_form = auth.login() register_form = auth.register() return dict(login_form=login_form, register_form=register_form) If you go to the page with both

[web2py] Re: Both auth.login() and auth.register() on the same page, prevents password validation

2014-08-29 Thread Mark Li
gt; In the meantime, you can just define the register form first, or after > defining the login form, do: > > db.auth_user.password.requires[-1].min_length = auth.settings. > password_min_length > > Anthony > > On Thursday, August 28, 2014 4:17:33 PM UTC-4, Mark Li wrote: &

Re: [web2py] How to put both login and register forms on one page...

2014-08-29 Thread Mark Li
The details of this problem are explained more thoroughly here: https://groups.google.com/forum/#!topic/web2py/13gozLyE3Eo On Thursday, August 28, 2014 1:11:47 PM UTC-7, Mark Li wrote: > > There seems to be a problem with this implementation > > For example, if you hav

[web2py] How to return a more specific error message from auth.login(), rather than a generic "invalid login"

2014-09-11 Thread Mark Li
Looking through the source for auth.login(), it seems that the same "invalid login" error is given no matter what the particular error is (either username/email, or the password is wrong). I wanted to know if it is possible to return a more specific error msg after a failed login. If I use user

[web2py] Re: How to return a more specific error message from auth.login(), rather than a generic "invalid login"

2014-09-15 Thread Mark Li
ogin failures. Boneheaded as it may be, it's what > people expect secure software to do. > > On Thursday, September 11, 2014 1:49:36 PM UTC-7, Mark Li wrote: >> >> Looking through the source for auth.login(), it seems that the same >> "invalid login" error is

[web2py] auth.login() does not return input value (username) on error, if auth.define_tables(username=True).

2014-09-15 Thread Mark Li
After submitting a failed login attempt with auth.login(), the failed username input is not returned (it is cleared out). This is not a problem when auth.define_tables(username=False), which would return the failed email input upon login error. But, when username=True, the form no longer return

[web2py] Re: How to return a more specific error message from auth.login(), rather than a generic "invalid login"

2014-09-17 Thread Mark Li
y, September 15, 2014 2:20:06 PM UTC-4, Mark Li wrote: >> >> Ahhh, that is quite frustrating! I see this a quite a big usability >> improvement at virtually no cost to security; would an optional parameter >> like auth.login(return_specific_error=True) still fail secur

[web2py] Re: auth.login() does not return input value (username) on error, if auth.define_tables(username=True).

2014-09-17 Thread Mark Li
needlessly frustrating. On Monday, September 15, 2014 1:42:10 PM UTC-7, Mark Li wrote: > > After submitting a failed login attempt with auth.login(), the failed > username input is not returned (it is cleared out). This is not a problem > when auth.define_tables(username=False), which

[web2py] Re: auth.login() does not return input value (username) on error, if auth.define_tables(username=True).

2014-09-17 Thread Mark Li
Is there a reason for this behavior? Or is it a bug? On Wednesday, September 17, 2014 4:34:44 PM UTC-7, Mark Li wrote: > > My previous post was somewhat off. > > Actually, what happens is that if the form passes validation, but has > incorrect login credentials, auth.login()

[web2py] Re: auth.login() does not return input value (username) on error, if auth.define_tables(username=True).

2014-09-18 Thread Mark Li
, Mark Li wrote: > > Is there a reason for this behavior? Or is it a bug? > > On Wednesday, September 17, 2014 4:34:44 PM UTC-7, Mark Li wrote: >> >> My previous post was somewhat off. >> >> Actually, what happens is that if the form passes validation, but has >&g

Re: [web2py] Re: auth.login() does not return input value (username) on error, if auth.define_tables(username=True).

2014-09-22 Thread Mark Li
Feel like this should be the default behavior, although I'm not sure if there's a particular reason for redirecting as opposed to returning a form. On Thu, Sep 18, 2014 at 12:21 PM, Leonel Câmara wrote: > Humm I had to add keepvalues=True (there could be an > auth.settings.keepvalues) to the for

[web2py] Re: How to alter attributes of multiple elements with the same prefix, in a form

2014-09-25 Thread Mark Li
x27;s starting with "auth_user", and added a "login_" user prefix. This prevents having duplicate ID's on the page (b/c I have the register form on the same page). On Monday, August 18, 2014 9:43:47 AM UTC-7, Mark Li wrote: > > I am currently trying to alter all the

[web2py] Re: Returning a token for Android app authentication

2014-10-14 Thread Mark Li
then of >> course you will get all the normal web2py functionality such as the session. >> >> The web2py session is usually stored in the database which means it can >> store a large amount of data without the size limits of cookie storage. And >> it will persis

[web2py] How to set an email header for the built-in auth() reset password email?

2015-03-08 Thread Mark Li
I currently have my email in web2py setup in a standard way: mail = auth.settings.mailer mail.settings.server = 'smtp.example.com:25' mail.settings.sender = 'y...@example.com' mail.settings.login = 'username:password' If I was to manually use mail.send() for this email, it would be something

Re: [web2py] Re: Remember me with custom or alternate login?

2015-03-20 Thread Mark Li
gt; response.cookies[response.session_id_name]["expires"] = session.auth. >> expiration >> >> That will happen the next time Auth is initialized (which would happen on >> the next request), but it won't happen if you simply close the browser. >&g

Re: [web2py] Re: Remember me with custom or alternate login?

2015-03-20 Thread Mark Li
s" in your login code, so you can see what vars are actually getting passed in from the form. If there is no "remember_me" variable, then that's most likely your main problem. On Fri, Mar 20, 2015 at 12:11 PM, Mark Li wrote: > I'm not quite sure, all the relevant par

Re: [web2py] Re: Plain Text and HTML Email with auth.messages.verify_email

2015-06-24 Thread Mark Li
; >> On Friday, September 14, 2012 2:25:04 PM UTC-7, Massimo Di Pierro wrote: >>> >>> If the email text looks like '' it should be send as >>> html. >>> >>> On Friday, 14 September 2012 12:12:21 UTC-5, Mark Li wrote: >>>&g

Re: [web2py] Re: Prevent multiple submit buttons from showing "Working..." on submit

2015-07-10 Thread Mark Li
I am currently not using the newest version of web2py; I'll probably update in the near future and add a reminder to look into this. On Mon, Jul 6, 2015 at 10:23 AM, Krzysztof Socha wrote: > > > On Wednesday, December 11, 2013 at 10:01:39 PM UTC+1, Mark Li wrote: >> >&

[web2py] Web2py admin page causing internal error (version 2.9.10)

2015-07-29 Thread Mark Li
I just upgraded my web2py version on Pythonanywhere from 2.7.4 to 2.9.10, so my live site can match my test site web2py version This in turn has caused the admin page to start producing errors, so I am unable to look at error tickets (they will just produce more errors). I'm quite lost as to w

[web2py] Re: Web2py admin page causing internal error (version 2.9.10)

2015-07-29 Thread Mark Li
On Wednesday, July 29, 2015 at 10:20:36 AM UTC-7, Mark Li wrote: >> >> I just upgraded my web2py version on Pythonanywhere from 2.7.4 to 2.9.10, >> so my live site can match my test site web2py version >> >> This in turn has caused the admin page to start producing error

[web2py] Re: Web2py admin page causing internal error (version 2.9.10)

2015-07-29 Thread Mark Li
I am looking at the errors for the admin (at the files), and I am getting a " name 'DEMO_MODE' is not defined"" error On Wednesday, July 29, 2015 at 11:24:07 AM UTC-7, Mark Li wrote: > > I've run sessions2trash.py to remove all sessions, as well as remove all

[web2py] Getting a demo_mode not defined error in admin (even though demo_mode defined in 0.py)

2015-07-29 Thread Mark Li
I am getting a very odd error in my admin app (2.9.10) on PythonAnywhere. I am getting the following error: Traceback (most recent call last): File "/home/marladarla7/web2py/gluon/restricted.py", line 224, in restricted exec ccode in environment File "applications/admin/models/0_imports.

Re: [web2py] Re: Web2py admin page causing internal error (version 2.9.10)

2015-07-29 Thread Mark Li
to work great... >> >> Richard >> >> On Wed, Jul 29, 2015 at 3:30 PM, Dave S >> > wrote: >> >>> >>> >>> On Wednesday, July 29, 2015 at 11:44:44 AM UTC-7, Mark Li wrote: >>>> >>>> I am looking at the errors for

Re: [web2py] Re: Web2py admin page causing internal error (version 2.9.10)

2015-07-29 Thread Mark Li
Deleting all the .pyc files from the web2py directory seems to have done the trick. On Wed, Jul 29, 2015 at 8:31 PM, Mark Li wrote: > I've updated to version 2.11.2, and the problem still persists. I've > deleted all errors, cache, and sessions for both admin app and "my

[web2py] Re: Getting a demo_mode not defined error in admin (even though demo_mode defined in 0.py)

2015-07-29 Thread Mark Li
I upgraded to version 2.11.2, but the error was still occurring. I deleted all the .pyc files from the web2py directory and this seems to have solved the problem. On Wednesday, July 29, 2015 at 12:06:46 PM UTC-7, Mark Li wrote: > > I am getting a very odd error in my admin app (2.9.

Re: [web2py] Re: Web2py admin page causing internal error (version 2.9.10)

2015-07-30 Thread Mark Li
chard > > > On Thu, Jul 30, 2015 at 12:48 AM, Mark Li wrote: > >> Deleting all the .pyc files from the web2py directory seems to have done >> the trick. >> >> On Wed, Jul 29, 2015 at 8:31 PM, Mark Li wrote: >> >>> I've updated to version 2.11.2

Re: [web2py] Re: Web2py admin page causing internal error (version 2.9.10)

2015-07-30 Thread Mark Li
app still works? Or you are not there > yet... > > Hope it works for you... > > Richard > > On Thu, Jul 30, 2015 at 2:39 PM, Mark Li wrote: > >> I did miss this, I keep skipping over this part! >> >> On Thu, Jul 30, 2015 at 6:28 AM, Richard Vézina < >

[web2py] Re: import_from_csv_file and id_map={}

2015-08-25 Thread Mark Li
Is id_map still necessary to preserver references when using import_form_csv_file function? I read this in the docs ( http://web2py.com/books/default/chapter/29/06/the-database-abstraction-layer#CSV--all-tables-at-once- ): "When importing, the new records will be appended to the database if it i

<    1   2