Commit Graph

15 Commits

Author SHA1 Message Date
Honza Král 70b3ac1f07 Few improvements to FormPreview, thanks Andy!
This commit adds several new hooks in backwards-compatible way:
 * get_initial to specify initial data based on request
 * get_auto_id to enable different AUTO_ID values
 * get_context for overriding and extending default context contents

git-svn-id: http://code.djangoproject.com/svn/django/trunk@14659 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-11-21 13:47:38 +00:00
Luke Plant 45c7f427ce Fixed #14445 - Use HMAC and constant-time comparison functions where needed.
All adhoc MAC applications have been updated to use HMAC, using SHA1 to
generate unique keys for each application based on the SECRET_KEY, which is
common practice for this situation. In all cases, backwards compatibility
with existing hashes has been maintained, aiming to phase this out as per
the normal deprecation process. In this way, under most normal
circumstances the old hashes will have expired (e.g. by session expiration
etc.) before they become invalid.

In the case of the messages framework and the cookie backend, which was
already using HMAC, there is the possibility of a backwards incompatibility
if the SECRET_KEY is shorter than the default 50 bytes, but the low
likelihood and low impact meant compatibility code was not worth it.

All known instances where tokens/hashes were compared using simple string
equality, which could potentially open timing based attacks, have also been
fixed using a constant-time comparison function.

There are no known practical attacks against the existing implementations,
so these security improvements will not be backported.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@14218 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-10-14 20:54:30 +00:00
Russell Keith-Magee 41c30f2fb8 Fixed #12981 -- Removed some stray tabs. Thanks to loewis for the report.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@12614 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-02-27 05:38:17 +00:00
Justin Bronn a9b2ac25d1 Fixed #9147 -- Added `FormPreview.process_preview` customization hook. Thanks, bthomas and thalin.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@12486 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-02-22 05:00:36 +00:00
Jacob Kaplan-Moss 6056ab1bee Fixed #6209: handle `BooleanField`s in `FormPreview` and `FormWizard`. In the process, broke the the security hash calculation out to a helper function. Thanks to mcroydon and rajeshdhawan.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@8597 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2008-08-26 20:19:12 +00:00
Gary Wilson Jr c85c8f8891 Fixed #7919 -- md5 and sha modules are deprecated since Python 2.5, use hashlib module when available. Patch from Karen Tracey.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@8193 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2008-08-02 05:56:57 +00:00
Adrian Holovaty 17155d3845 Fixed corner-case bug in formtools wizard.py and preview.py, in case of a None value -- thanks, Honza
git-svn-id: http://code.djangoproject.com/svn/django/trunk@7277 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2008-03-18 00:17:59 +00:00
Malcolm Tredinnick f1a24be01c Fixed #6481 -- Fixed a bunch of import problems (and some whitespace cleanups).
Found by Bastian Kleineidam with help from pyflakes. Thanks.


git-svn-id: http://code.djangoproject.com/svn/django/trunk@7131 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2008-02-19 00:08:08 +00:00
Malcolm Tredinnick e0bff49063 Fixed a Python 2.3 incompatibility.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@6754 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2007-11-29 21:10:11 +00:00
Adrian Holovaty 92e55fe8b1 Fixed #5432 -- Added docs/form_preview.txt. Thanks, ryankanno
git-svn-id: http://code.djangoproject.com/svn/django/trunk@6247 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2007-09-14 23:15:40 +00:00
Malcolm Tredinnick d8db013eea Fixed #4330 -- Fixed typo when retrieving field names. Patch from Marc Fargas.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@5293 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2007-05-19 18:54:35 +00:00
Malcolm Tredinnick b996e214c0 Changed the fix from [5231] so that the backwards-incompatibility is made more
obvious and everything still has nice names.


git-svn-id: http://code.djangoproject.com/svn/django/trunk@5237 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2007-05-14 16:24:51 +00:00
Adrian Holovaty 0919920bc0 Added missing import to django.contrib.formtools.preview from [4259]. Thanks, Vadim Macagon
git-svn-id: http://code.djangoproject.com/svn/django/trunk@4260 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2006-12-30 00:06:28 +00:00
Adrian Holovaty 3dbaf60b86 Fixed #3204 -- Changed FormPreview to use RequestContext
git-svn-id: http://code.djangoproject.com/svn/django/trunk@4259 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2006-12-29 19:42:56 +00:00
Adrian Holovaty 311fadeee0 Added django.contrib.formtools, including the forced-preview application
git-svn-id: http://code.djangoproject.com/svn/django/trunk@4164 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2006-12-05 20:51:25 +00:00