Re: XSS and Secure HTML Filtering

2006-11-07 Thread SmileyChris
On Nov 8, 12:25 pm, "Oliver Lavery" <[EMAIL PROTECTED]> wrote: > That's a pretty nice solution. > > Implicitness in this case is a desirable attribute, imho. For output > filtering it would be nice to have HTML escaping be a sitewide default. This > is just good security practice, deny by default,

Re: Re: Re: XSS and Secure HTML Filtering

2006-11-07 Thread James Bennett
On 11/7/06, Oliver Lavery <[EMAIL PROTECTED]> wrote: > Jing though? Eeep, all them Java VMs firing up could get costly. Perhaps > I'll try to hack it to use xmllint. Well, Jing itself is not so bad, especially when you've compiled it. That system grew largely out of our usage here at World Online

Debugging with Winpdb

2006-11-07 Thread Mike
Hello, I've been trying to debug a Django sample application with Winpdb, but haven't been successful thus far. Can anyone who's able to do this please share your secret? ;) I'm using the GUI and have tried the "Attach" option but see no processes available, and the "Launch" option which hangs a

Re: how are you handling i18n and m10l content?

2006-11-07 Thread Gonzalo Saavedra
On 11/7/06, Bill de hOra <[EMAIL PROTECTED]> wrote: > Hey, > > I know Django has solid i18n support for templates/strings and content > negotiation in the request. But I was wondering how people are going > about managing translations of content or having a multilingual website > - eg supporting f

Re: how are you handling i18n and m10l content?

2006-11-07 Thread Bill de hOra
Jacob Kaplan-Moss wrote: > Hey Bill -- > > *Great* question. We've talked a few times to newspapers who cross-publish > (usually in English and Spanish), and at least in the news industry there's > pretty much nothing that makes that process easy. I would absolutely love to > have a standard

Re: how are you handling i18n and m10l content?

2006-11-07 Thread Kenneth Gonsalves
On 08-Nov-06, at 6:27 AM, [EMAIL PROTECTED] wrote: > Where i work we have a concept of "channels". Different instances of > the sites (probably they could fit well in Django's site framework) > are > localized for different countries/languages. News on these websites > are > channelized too

Re: Store uploaded image by id

2006-11-07 Thread Enrico
Hi Dirk, I'm the author of that Wiki page, I've put that code on '/util/'. You could put somewhere else in your python path if you plan to use it in more projects. But Django doesn't look for custom fields anywhere, you'll have to import in your code. Best regards. Enrico --~--~-~--~-

Re: Re: XSS and Secure HTML Filtering

2006-11-07 Thread Oliver Lavery
James,That's perfect thanks! If I have to role my own at least using a validator like relax ng makes it somewhat less painful.Jing though? Eeep, all them Java VMs firing up could get costly. Perhaps I'll try to hack it to use xmllint. Cheers,~olOn 11/7/06, James Bennett <[EMAIL PROTECTED]> wrote: O

Re: Issues with FastCGI

2006-11-07 Thread Jaroslaw Zabiello
[EMAIL PROTECTED] napisał(a): > Did you read this: > http://www.python.rk.edu.pl/w/p/django-pod-serwerem-nginx/ ? :) I found it in Google cache. I solve your problem with static files in Django & Nginx. See http://blog.zabiello.com/articles/2006/11/08/nginx-apache-killer (sorry, only Polish vers

Re: how are you handling i18n and m10l content?

2006-11-07 Thread [EMAIL PROTECTED]
On Nov 7, 11:01 pm, "James Bennett" <[EMAIL PROTECTED]> wrote: > I don't have any real experience in that area, though; what are some > general best practices for the backend design of a multilingual site? Where i work we have a concept of "channels". Different instances of the sites (probably t

Re: how are you handling i18n and m10l content?

2006-11-07 Thread Patrick
On Tue, 07 Nov 2006 21:28:21 +, Bill de hOra wrote: > Hey, > > I know Django has solid i18n support for templates/strings and content > negotiation in the request. But I was wondering how people are going > about managing translations of content or having a multilingual website > - eg sup

Re: UnicodeEncodeError with templatetags

2006-11-07 Thread David Abrahams
Ivan Sagalaev <[EMAIL PROTECTED]> writes: > David Abrahams wrote: >> I've been running into a problem that seems very similar to >> http://code.djangoproject.com/ticket/170, although I see that that >> issue was fixed so I am betting the bug is on my end somewhere. >> Unfortunately, I'm a little

Apache 2.0.58 will not OBEY on OS X 10.4.8

2006-11-07 Thread kmr
Running Apache 2.0.58 (Unix), mod_python 3.1.4, and Python 2.4.1 on Mac OS X 10.4.8 I've been able to run Django using the Development Server, and I've run the tests to prove mod_python and Python work. However, when I try to configure Apache using the entries shown below, I get a 500 Internal Se

Re: Re: XSS and Secure HTML Filtering

2006-11-07 Thread James Bennett
On 11/7/06, Oliver Lavery <[EMAIL PROTECTED]> wrote: > Thanks. Output filtering is definitely a good thing, but I'm more worried > about input filtering. If users are allowed to submit HTML that will be > displayed to other users, I want to pass the HTML through a strict validator > to keep them f

Automatic Manipulators and spanning relationships

2006-11-07 Thread Oliver Lavery
Hi,I'm full of questions tonight.My team is working a project to automatically generate a webservice API from django models. It makes extensive use of manipulators for providing input validation.I hit a bump today with the tight coupling between automatic manipulators and the admin interface. I tur

Re: Creating one call for most recent entry, and another call for the restI have just set up a blog using the helpful tutorial over at

2006-11-07 Thread Andy
Hazaa, that seemed to have done the trick. When I have a second, I'll try to debug the sucker too, that way we can have some closure on your method, Rajesh. Thank you both for your help! --~--~-~--~~~---~--~~ You received this message because you are subscribed t

Re: XSS and Secure HTML Filtering

2006-11-07 Thread Oliver Lavery
That's a pretty nice solution.Implicitness in this case is a desirable attribute, imho. For output filtering it would be nice to have HTML escaping be a sitewide default. This is just good security practice, deny by default, and allow by exception. If I must have a < or a > in a output variable I w

Django/Javascript string problem

2006-11-07 Thread Dagur
I have a form with a drop down box and a few other fields but I want to put it in a javascript field and printed out when a link is clicked. So it looks something like this: function bla(){ var test = 'Type{{ form.embeddedvideo.0.type }}'; return test; } the problem is that the formfield

Re: XSS and Secure HTML Filtering

2006-11-07 Thread Oliver Lavery
James,Thanks. Output filtering is definitely a good thing, but I'm more worried about input filtering. If users are allowed to submit HTML that will be displayed to other users, I want to pass the HTML through a strict validator to keep them from posting scripts. Imagine we have a hypothetical webs

Re: Re: XSS and Secure HTML Filtering

2006-11-07 Thread James Bennett
On 11/7/06, SmileyChris <[EMAIL PROTECTED]> wrote: > When I brought it up on the group a while ago, I hit resounding > silence. It doesn't seem to be the hot topic it was a while back. So bring it up again :) I honestly don't remember seeing it, so it may have come across at a time when everyone

Re: XSS and Secure HTML Filtering

2006-11-07 Thread SmileyChris
> ... There's been > extensive discussion of this on the developer list and thus far > no-one's stepped up with a clean implementation that doesn't get in > the way of some use cases (keep in mind that Django's template system > is expected to be able to produce more than just HTML ... I dunno, I

Re: how are you handling i18n and m10l content?

2006-11-07 Thread Jacob Kaplan-Moss
Hey Bill -- *Great* question. We've talked a few times to newspapers who cross-publish (usually in English and Spanish), and at least in the news industry there's pretty much nothing that makes that process easy. I would absolutely love to have a standard way of doing translatable content in

Re: Logging in an application

2006-11-07 Thread David Blewett
Chris Moffitt wrote: > I could try putting the code into each view but this seems like it's > something easy to forget and not very DRY. > > I looked at signals but it looks like there's no signal associated with > viewing or displaying objects. > Ian Holmsman has an example here: http://feh.hol

Re: XSS and Secure HTML Filtering

2006-11-07 Thread James Bennett
On 11/7/06, Oliver Lavery <[EMAIL PROTECTED]> wrote: > I was a little disappointed to see that Django doesn't include a safe HTML > checker / sanitizer. RoR has something along these lines afaik (which is > very little in this case). We include the 'escape' and 'striptags' filters, but there is n

XSS and Secure HTML Filtering

2006-11-07 Thread Oliver Lavery
Hi Djangoers,I was a little disappointed to see that Django doesn't include a safe HTML checker / sanitizer. RoR has something along these lines afaik (which is very little in this case).It's an understandable omission, but a good community maintained HTML security checker could go a *long way* to

Re: how are you handling i18n and m10l content?

2006-11-07 Thread James Bennett
On 11/7/06, Bill de hOra <[EMAIL PROTECTED]> wrote: > There's no direct support for this kind of thing in the core (that's > afaik, I haven't been following the trunk in the last couple of months). > And, if there's no standard patterns or models for this, is this worth > thinking about at as an e

how are you handling i18n and m10l content?

2006-11-07 Thread Bill de hOra
Hey, I know Django has solid i18n support for templates/strings and content negotiation in the request. But I was wondering how people are going about managing translations of content or having a multilingual website - eg supporting features like "read this in newspeak", or "browse this site

Re: Logging in an application

2006-11-07 Thread Joseph Heck
I've instantiated a logger in settings.py and just pull it up by name thereafter to do the logging - import logging# Grabs or creates a new logging object with the string name "edmonds". Since# we are in the model init component, it will probably be creating the logger. ll=logging.getLogger("foo")#

Logging in an application

2006-11-07 Thread Chris Moffitt
I've done some searching on this but haven't found the definitive answer on this (or at least one that answers all my questions ;). How is everyone implementing routine logging for their applications? I know that the standard python logger works but if I'd like to log each object a user views or

Re: a few questions about django

2006-11-07 Thread Florian Apolloner
James Bennett schrieb: > On 11/7/06, Florian Apolloner <[EMAIL PROTECTED]> wrote: > > Yes I see this box, but I (for example) don't won't to see all users > > and have to klick on is_staff->yes, I want this to be preselected > > (which means I don't want to see all by default) to show only > > i

Re: Re: a few questions about django

2006-11-07 Thread James Bennett
On 11/7/06, Florian Apolloner <[EMAIL PROTECTED]> wrote: > Yes I see this box, but I (for example) don't won't to see all users > and have to klick on is_staff->yes, I want this to be preselected > (which means I don't want to see all by default) to show only > is_staff->yes, unless I klick no, or

Re: a few questions about django

2006-11-07 Thread Florian Apolloner
> On 11/7/06, Florian Apolloner <[EMAIL PROTECTED]> wrote: > > 1.) In the admin-area you can use filters ( list_filter = ('is_staff', > > 'is_superuser') ), which show by default all entries. Now I want to > > have the entries prefilterd (let's say i have a boolean field, and want > > all entries

Re: Encoding fields (md5) when inserted in DB

2006-11-07 Thread James Bennett
On 11/7/06, Fredp <[EMAIL PROTECTED]> wrote: > I should log IP, user-agent and date/time (perhaps this as a string) > but for privacy reasons I would like to store this crypted, as I don't > need to read them). If you look in the auth application, passwords are stored as salted SHA1 hashes; we've

Re: Mysql 3.23.xx

2006-11-07 Thread sansmojo
For those of us who have no choice but to use Django with older versions of MySQL, is there any possible workaround for this? --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups "Django users" group. To post to this gr

Encoding fields (md5) when inserted in DB

2006-11-07 Thread Fredp
Is there a simple way to make Django encode the data contained in some fields when a new record is added to the database? If it takes too much effort, I guess I'd better directly feed to Django's object-model already-encoded information. I should log IP, user-agent and date/time (perhaps this as

Re: Generic Views

2006-11-07 Thread [EMAIL PROTECTED]
Ok, it works now like a charm --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups "Django users" group. To post to this group, send email to django-users@googlegroups.com To unsubscribe from this group, send email to [

Re: Session problems

2006-11-07 Thread Jakub Labath
Hi All, The best I understand it, this is a mod_python problem. I put in some debugging code into session middleware to see what it is sending to who. This is my debug statement. LOGGER.debug("Process %d Request 0x%x and response 0x%x IP: %s The session key send is %s and mod python request is 0x

Re: Bugtracker sucks?

2006-11-07 Thread graham_king
Jaroslaw, It nearly drove me crazy too ! You need to enter your name and email on the "settings" page (http://code.djangoproject.com/settings) before you post anything. Regards, Graham. --~--~-~--~~~---~--~~ You received this message because you are subsc

Re: a few questions about django

2006-11-07 Thread Frankie Robertson
On 07/11/06, Florian Apolloner <[EMAIL PROTECTED]> wrote: > > I have a few questions about django, where I didn't found the answer in > the docu. > > Here they are: > > 1.) In the admin-area you can use filters ( list_filter = ('is_staff', > 'is_superuser') ), which show by default all entries. No

Re: a few questions about django

2006-11-07 Thread James Bennett
On 11/7/06, Florian Apolloner <[EMAIL PROTECTED]> wrote: > 1.) In the admin-area you can use filters ( list_filter = ('is_staff', > 'is_superuser') ), which show by default all entries. Now I want to > have the entries prefilterd (let's say i have a boolean field, and want > all entries with true

a few questions about django

2006-11-07 Thread Florian Apolloner
I have a few questions about django, where I didn't found the answer in the docu. Here they are: 1.) In the admin-area you can use filters ( list_filter = ('is_staff', 'is_superuser') ), which show by default all entries. Now I want to have the entries prefilterd (let's say i have a boolean fiel

Django screen cast

2006-11-07 Thread Eric Lake
This site has what looks to be the first of a series of screen casts for django. It is nicely done and easy to understand. Here is a direct link to the video. http://www2.lamptraining.com/screencast/1-- ThanksEric Lake --~--~-~--~~~---~--~~  You received this messag

Re: Model structure help requested

2006-11-07 Thread James Bennett
On 11/7/06, Vortexmind <[EMAIL PROTECTED]> wrote: > Or should I create Comments app, then import in each object the > Comments object and make it a Foreign key? The built-in comments application in Django (django.contrib.comments) provides comment models which can "attach" to any other installed

Model structure help requested

2006-11-07 Thread Vortexmind
Hi all It's always me :) I have a "conceptual" problem about application development, and I don't know what's the best way to sort this out with Django. I have a collection of items that should provide the classic functions: browsing, item view, search query (simple & complex), listing and s

Re: UnicodeEncodeError with templatetags

2006-11-07 Thread Ivan Sagalaev
David Abrahams wrote: > I've been running into a problem that seems very similar to > http://code.djangoproject.com/ticket/170, although I see that that > issue was fixed so I am betting the bug is on my end somewhere. > Unfortunately, I'm a little green w.r.t. unicode issues so I'm hoping > someo

Re: Newbie DB question

2006-11-07 Thread Martin Bačovský
Russell Keith-Magee wrote: > I just created a test model and set the db_table to 'poll.polls', and > tables were created without difficulty. What problem did you > experience? > Problem is that django quotes db_table so table is called "poll.polls" and postgres stores it in default schema "pub

Re: PySchool - Online Python Web Framework Workshop.

2006-11-07 Thread elake
This could be very nice if done right. I am looking forward to see what you have in mind. On Nov 7, 6:10 am, "Spider" <[EMAIL PROTECTED]> wrote: > Question 2 says "select all that apply", but you have radio buttons not > check boxes, so only one option can be selected. --~--~-~--~~-

Re: PySchool - Online Python Web Framework Workshop.

2006-11-07 Thread igor Guerrero
Ok, tell me one thing were is Debian?, you must there must be an option to select "other" Linux distribution.On 11/7/06, Spider < [EMAIL PROTECTED]> wrote:Question 2 says "select all that apply", but you have radio buttons not check boxes, so only one option can be selected.-- :::lxuser 391715:::

Re: How would you do this on Django?

2006-11-07 Thread Ivan Sagalaev
Carlos Yoder wrote: > As to URLs, I'd need to support at least the following three schemes: > > * Language codes mapped to directories (http://maindomain.com/en/ and > http://maindomain.com/sl/ and http://maindomain.com/es/) > * Language codes mapped to subdomains (http://en.maindomain.com/ an

Re: Creating a table if it doesn't exist

2006-11-07 Thread Russell Keith-Magee
On 11/7/06, Oliver Lavery <[EMAIL PROTECTED]> wrote: > I'm a little fuzzy on django's execution order, though. What would be the > safest place to do this? Initialization code in the model module seems like > the most obvious choice, but I'm a bit uncomfortable being in the dark as to > how django

UnicodeEncodeError with templatetags

2006-11-07 Thread David Abrahams
I've been running into a problem that seems very similar to http://code.djangoproject.com/ticket/170, although I see that that issue was fixed so I am betting the bug is on my end somewhere. Unfortunately, I'm a little green w.r.t. unicode issues so I'm hoping someone else can correct my misconcep

Re: Admin class cannot extend object

2006-11-07 Thread Russell Keith-Magee
On 11/7/06, paulh <[EMAIL PROTECTED]> wrote: > > Running through the django tutorials I noticed that you cannot create > the inner Admin class as a subclass of object. i.e. > class Admin(object): > -->pass > does not work. Is this deliberate or an historical quirk? No particular reason that I can

Re: Newbie DB question

2006-11-07 Thread Russell Keith-Magee
On 11/7/06, Martin Bačovský <[EMAIL PROTECTED]> wrote: > E.g. polls.poll instead of polls_poll. At first it doesn't look like a big > deal, but it is more natural. > When you have big db model and need to access db from other sources then > Django it can do things easier. I just created a test

Re: Re: Django SOAP server

2006-11-07 Thread Tom Haddon
Cool, works a treat!On 11/2/06, Jure Čuhalev <[EMAIL PROTECTED]> wrote: On 11/2/06, tomass <[EMAIL PROTECTED]> wrote:>> Hi Jure,>> Thanks for the response. I've made the changes you suggest, but just> have a few questions: >> - The urls.py file: the soapview.soap - does this refer to a file> called

Re: PySchool - Online Python Web Framework Workshop.

2006-11-07 Thread Spider
Question 2 says "select all that apply", but you have radio buttons not check boxes, so only one option can be selected. --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups "Django users" group. To post to this group,

Re: Accessing request and session objects from templates

2006-11-07 Thread pength
i think i am facing the same problem with [EMAIL PROTECTED] well, i have done as Jorge suggested, but just don't know how to retriving the my_data in my_template.html. I tried with {{my_data.key}}, though no error occurred, but there's no value appeared --~--~-~--~~~

Admin class cannot extend object

2006-11-07 Thread paulh
Running through the django tutorials I noticed that you cannot create the inner Admin class as a subclass of object. i.e. class Admin(object): -->pass does not work. Is this deliberate or an historical quirk? --~--~-~--~~~---~--~~ You received this message becaus

Re: Creating a table if it doesn't exist

2006-11-07 Thread [EMAIL PROTECTED]
On Nov 7, 2:53 am, "Oliver Lavery" <[EMAIL PROTECTED]> wrote: > I'm a little fuzzy on django's execution order, though. What would be the > safest place to do this? Initialization code in the model module seems like > the most obvious choice, but I'm a bit uncomfortable being in the dark as to >

Re: Issues with FastCGI

2006-11-07 Thread Jaroslaw Zabiello
Page not found --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups "Django users" group. To post to this group, send email to django-users@googlegroups.com To unsubscribe from this group, send email to [EMAIL PROTECTED

Re: Newbie DB question

2006-11-07 Thread Martin Bačovský
Thank you for quick response. Russell Keith-Magee wrote: > On 11/6/06, Martin Bačovský <[EMAIL PROTECTED]> wrote: > >> I have two questions I was unable to google: >> - Is Django going to support database views? >> > > We don't have any immediate plans to support views; however, if > som