Commit Graph

5 Commits

Author SHA1 Message Date
Alex Gaynor 5bc0ec4ec4 Removed all usages of deprecated TestCase methods (self.fail*). This removed most of the Warnings emitted (with -Wall) during the test suite.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14803 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-12-04 07:28:12 +00:00
Honza Král 70b3ac1f07 Few improvements to FormPreview, thanks Andy!
This commit adds several new hooks in backwards-compatible way:
 * get_initial to specify initial data based on request
 * get_auto_id to enable different AUTO_ID values
 * get_context for overriding and extending default context contents

git-svn-id: http://code.djangoproject.com/svn/django/trunk@14659 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-11-21 13:47:38 +00:00
Luke Plant b84838aef4 Fixed #14576 - FormWizard.done() method doesn't get passed the last form in the list
Thanks to cyberdelia for report and test, and steph for the initial patch.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@14574 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-11-16 14:37:00 +00:00
Luke Plant 46c17654ed Fixed #14498 - Forms passed to FormWizard.process_step are not guaranteed to have cleaned_data
Thanks to stas for the report.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@14290 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-10-19 20:45:40 +00:00
Luke Plant 45c7f427ce Fixed #14445 - Use HMAC and constant-time comparison functions where needed.
All adhoc MAC applications have been updated to use HMAC, using SHA1 to
generate unique keys for each application based on the SECRET_KEY, which is
common practice for this situation. In all cases, backwards compatibility
with existing hashes has been maintained, aiming to phase this out as per
the normal deprecation process. In this way, under most normal
circumstances the old hashes will have expired (e.g. by session expiration
etc.) before they become invalid.

In the case of the messages framework and the cookie backend, which was
already using HMAC, there is the possibility of a backwards incompatibility
if the SECRET_KEY is shorter than the default 50 bytes, but the low
likelihood and low impact meant compatibility code was not worth it.

All known instances where tokens/hashes were compared using simple string
equality, which could potentially open timing based attacks, have also been
fixed using a constant-time comparison function.

There are no known practical attacks against the existing implementations,
so these security improvements will not be backported.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@14218 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-10-14 20:54:30 +00:00