- new installation of 2.14.6 from web2py_src.zip -
After I comment out the auth.wiki in ./default/index I got the following error.
Traceback (most recent call last):
File "/home/LACompetitions/web2py/gluon/restricted.py", line 227, in
restricted
exec ccode in environment
File
"/home/LACompetitions/web2py2-14-6/applications/LAC/controllers/default.py"
<https://lacompetitions.pythonanywhere.com/admin/default/edit/LAC/controllers/default.py>,
line 60, in <module>
File "/home/LACompetitions/web2py/gluon/globals.py", line 417, in <lambda>
self._caller = lambda f: f()
File
"/home/LACompetitions/web2py2-14-6/applications/LAC/controllers/default.py"
<https://lacompetitions.pythonanywhere.com/admin/default/edit/LAC/controllers/default.py>,
line 20, in index
return auth.wiki()
File "/home/LACompetitions/web2py/gluon/tools.py", line 4687, in wiki
groups=groups)
File "/home/LACompetitions/web2py/gluon/tools.py", line 6454, in __init__
auth.add_membership(gid)
UnboundLocalError: local variable 'gid' referenced before assignment
Am Dienstag, 10. Mai 2016 02:31:38 UTC+2 schrieb Massimo Di Pierro:
>
> A few vulnerabilities have been found in admin. One of them was serious
> and it made admin vulnerable to brute force password attacks under some
> conditions.
> They have been been fixed in version 2.14.6. If you expose admin publicly,
> we recommend you upgrade immediately.
>
> Anyway, we remind everybody that it is not recommended to expose admin in
> production environments. Run it locally and connect to it using a ssh
> tunnel instead.
>
> Many takes to Narendra for funding and reporting the vulnerabilities,
> Leonel for fixing them, and Richard and Simone for adding many tests and
> fixing bugs.
>
> Massimo
>
--
Resources:
- http://web2py.com
- http://web2py.com/book (Documentation)
- http://github.com/web2py/web2py (Source code)
- https://code.google.com/p/web2py/issues/list (Report Issues)
---
You received this message because you are subscribed to the Google Groups
"web2py-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to web2py+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
