Re: If there was massive security hole found in Django, are there plans in place to deal with it?

2006-08-10 Thread Adrian Holovaty
On 8/10/06, e <[EMAIL PROTECTED]> wrote: > Hopefully this is not out-of-line in this thread. I am a Rails person, > not a Django person, although I have written a lot of Python in the > past. I can give you some more information about the fallout in the > rails community which might help you

Re: Admin lockout

2006-08-10 Thread Jeremy Dunck
On 8/10/06, Adrian Holovaty <[EMAIL PROTECTED]> wrote: > I'm not so sure about this... It seems like protecting people from > themselves. Presumably the "real" superuser has access to Python code > and the database, so that person can make the change in the database, > or via the Python API, if

Re: Admin lockout

2006-08-10 Thread Adrian Holovaty
On 8/10/06, Jeremy Dunck <[EMAIL PROTECTED]> wrote: > In the admin, it's possible to disable all superuser accounts. It'd > be good to not allow the last one, or to warn against it. I'm not so sure about this... It seems like protecting people from themselves. Presumably the "real" superuser

Admin lockout

2006-08-10 Thread Jeremy Dunck
In the admin, it's possible to disable all superuser accounts. It'd be good to not allow the last one, or to warn against it. --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups "Django developers" group. To post to

Re: If there was massive security hole found in Django, are there plans in place to deal with it?

2006-08-10 Thread e
Hi, Hopefully this is not out-of-line in this thread. I am a Rails person, not a Django person, although I have written a lot of Python in the past. I can give you some more information about the fallout in the rails community which might help you formulate your policy. I agree with Simon,

Re: Dependency problem in flatpages...

2006-08-10 Thread John Szakmeister
- Malcolm Tredinnick <[EMAIL PROTECTED]> wrote: [snip] > Have a poke around in django/core/management.py in the > _get_sql_model_create() function and see if you can work out why we're > getting this wrong. > > The fact that the generated SQL has a "...REFERENCES ..." clause on the >

Re: Proposal: make templatetag loading magic a little more invisible

2006-08-10 Thread Alan Green
On 8/11/06, James Bennett <[EMAIL PROTECTED]> wrote: > The reason for this is that django/templatetags/__init__.py, when it > loops over INSTALLED_APPS to find templatetag libraries, > indiscriminately quashes ImportError -- apparently on the assumption > that any ImportError being raised is a

Re: django and LDAP support

2006-08-10 Thread Scott Paul Robertson
On Thu, Aug 10, 2006 at 12:41:21PM -0600, Scott Paul Robertson wrote: > 2. An option that is a function that will be called to generate a bind > string for the user. This gives a lot of flexibility in allowing for a > large variety of pre-bind methods to occur, and gives a lot of > flexibility.

Proposal: make templatetag loading magic a little more invisible

2006-08-10 Thread James Bennett
This is a bit long for a ticket writeup, but I wanted to get some comments on it, so here goes: The "magic" that still goes on in the templatetag system has been discussed before on the list[1], and the consensus was that, since it's relatively invisible and harmless, it's OK for it to stay.

Thoughts on extensibility of the admin app

2006-08-10 Thread Steven Armstrong
Hi all I'm just thinking out loud here. Don't know if something like this is even wanted in django land. I've been playing around with trac lately and am rather fond of their light weight component architecture [1]. I was wondering if an approach like this may be a good idea for the django

Re: django and LDAP support

2006-08-10 Thread Scott Paul Robertson
On Wed, Aug 09, 2006 at 10:22:24PM -0600, Scott Paul Robertson wrote: > > Also, in the ldap setup I deal with, you must bind to the server using > > a service account before attempting a bind with the user-supplied > > credentials. The process goes something like > > > > 1. Retrieve the username

Re: If there was massive security hole found in Django, are there plans in place to deal with it?

2006-08-10 Thread Jason Huggins
Adrian Holovaty wrote: > On 8/10/06, Jason Huggins <[EMAIL PROTECTED]> wrote: > > At this point, I'll leave it to the project admins to decide how to > > procede. But a new "django-announce" Google group sounds like the > > logicial next step. > > I've created the django-announce mailing list:

Re: If there was massive security hole found in Django, are there plans in place to deal with it?

2006-08-10 Thread Simon Willison
James Bennett wrote: > On 8/9/06, Jason Huggins <[EMAIL PROTECTED]> wrote: > > I can see how a policy like that is "tricky"... What's to keep an evil > > blackhat from subscribing to the very same list so he he knows when to > > get busy cracking sites using the same information? > > I've been

Re: If there was massive security hole found in Django, are there plans in place to deal with it?

2006-08-10 Thread Adrian Holovaty
On 8/10/06, Jason Huggins <[EMAIL PROTECTED]> wrote: > At this point, I'll leave it to the project admins to decide how to > procede. But a new "django-announce" Google group sounds like the > logicial next step. I've created the django-announce mailing list:

Re: If there was massive security hole found in Django, are there plans in place to deal with it?

2006-08-10 Thread Jason Huggins
Jyrki Pulliainen wrote: > On 8/10/06, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote: > > > > For notification what about a low-volume django-announce group / > > mailing list specifically for disclosures and point version upgrades? > > This gives something for vendors etc to subscribe to and

Re: If there was massive security hole found in Django, are there plans in place to deal with it?

2006-08-10 Thread Jyrki Pulliainen
On 8/10/06, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote: > > For notification what about a low-volume django-announce group / > mailing list specifically for disclosures and point version upgrades? > This gives something for vendors etc to subscribe to and follow, and > patches etc can be

Re: JavaScript and Changeset 3541

2006-08-10 Thread Chris Long
The main reason why I switched was more timing then anything else. I wanted to try a few different toolkits to practice with them and find out the differences. I have never touched AJAX before this summer. I tried Dojo first and did like it, and wrote some working code, which I should be able to

Re: Dependency problem in flatpages...

2006-08-10 Thread Malcolm Tredinnick
On Thu, 2006-08-10 at 05:55 -0400, John Szakmeister wrote: > Now that the magic has been removed, and Django released 0.95, I decided to > start porting my applications over. I knew the merge of magic-removal was > coming, so I never deployed the apps. So, I decided to dump the tables that >

Re: If there was massive security hole found in Django, are there plans in place to deal with it?

2006-08-10 Thread [EMAIL PROTECTED]
For notification what about a low-volume django-announce group / mailing list specifically for disclosures and point version upgrades? This gives something for vendors etc to subscribe to and follow, and patches etc can be announced in here before djangoproject.com or, say, reddit. --Simon

Re: django unicode-conversion, beginning

2006-08-10 Thread limodou
On 8/10/06, Ivan Sagalaev <[EMAIL PROTECTED]> wrote: > > Malcolm Tredinnick wrote: > > I completely agree this is painful and normally I would punt. But my > > crystal ball tells me that you will then get bug reports from Mr > > Sagalaev, who is generally both very diligent in his debugging and

Re: django unicode-conversion, beginning

2006-08-10 Thread Ivan Sagalaev
gabor wrote: > hmmm.. are you sure that the situation with unicode-aware editors is so bad? > > could you name some non-unicode-aware editors? > for me it seems that from notepad through vim to eclipse everything does > unicode fine... Ok, I should rephrase it. Even if most editors do support

Re: django unicode-conversion, beginning

2006-08-10 Thread Ivan Sagalaev
Malcolm Tredinnick wrote: > I completely agree this is painful and normally I would punt. But my > crystal ball tells me that you will then get bug reports from Mr > Sagalaev, who is generally both very diligent in his debugging and likes > to use some language with a funny alphabet. If whatever

Re: If there was massive security hole found in Django, are there plans in place to deal with it?

2006-08-10 Thread Ivan Sagalaev
James Bennett wrote: > One would hope that anyone who's using Django is subscribed to > django-users and/or watches the Django blog This would be less and less true as time goes because Django will spread beyond early adopters to a new forming local communities. For example there is russian

"relative" limit_choices_to

2006-08-10 Thread zeuxis
Hi all, I saw many posts on this list on the dynamic limit_choices_to but I think my question is a little bit different, but very common as well. Here is a very simple example. I'd like to filter the streets in the DrugStore edit page so that only the streets in the selected

Re: JavaScript and Changeset 3541

2006-08-10 Thread Eugene Lazutkin
James Bennett wrote: > On 8/9/06, Linicks <[EMAIL PROTECTED]> wrote: >> 1. Chris, would it be reasonable to move your work to Dojo? > > From the looks of things, that's how he'd implemented it at first; he > then switched to YUI. Do you know the reason? I am curious to know what was wrong.