get vs. post in production vs. dev server

2011-02-21 Thread Josh Cartmell
I have a simple login form on every page like this: {% csrf_token %} It was working great on the dev server. Then I went into production. Now every form submission is being interpreted as a GET rather than a POST unless I am actually on the page /shop/account/ (the forms action). Has anyone

Re: get vs. post in production vs. dev server

2011-02-21 Thread Josh Cartmell
I forgot to mention my development server is fastcgi/apache. Thnaks On Feb 21, 11:15 am, Josh Cartmell wrote: > I have a simple login form on every page like this: > > {% csrf_token %} > > type="password"> > > > > It was working great on the dev ser

Re: ANN: Mezzanine 1.0 released

2012-03-05 Thread Josh Cartmell
Congrats on the release Steve. As a developer that has been using Mezzanine for a bit under a year and a half I have to say that I have been really pleased with the project. A lot has changed in the time since I began using Mezzanine but even in it's infancy Mezzanine provided a very usable base

Re: Auth app in separate database

2012-03-29 Thread Josh Cartmell
Couldn't he also just add the router before syncdb and then they would be created in the correct database? Chris take a look at this documentation if you haven't already, it explains routers which tell Django which database to use for a particular query: https://docs.djangoproject.com/en/dev/topic

Re: comparing custom template tag within if tag

2012-03-29 Thread Josh Cartmell
I think something like this would work: {% with price_for_pax service pax '' as pfp %} {% if service.price == pfp %} do something {% endif %} {% endwith %} Alternatively if price_for_pax is only used for comparing to service.price you could have it return true or false based on whether whatever

Admin user privilege elevation (how to prevent it)

2012-05-11 Thread Josh Cartmell
I work a lot with Mezzanine which is a CMS that uses Django. A security issue was recently revealed where an admin user, lets call him A, (they can post rich content) could put a cleverly constructed javascript on a page such that if a superuser, let's call her B, then visited the page it would el

Re: Admin user privilege elevation (how to prevent it)

2012-05-14 Thread Josh Cartmell
osting via ajax to the admin, rendering obsolete this sort of injection, and still allowing admin users to post javascripts? I'm not sure if it's always possible to reliably differentiate between an ajax vs non-ajax request. On May 12, 7:31 pm, jim wrote: > On Fri, May 11, 2012 at

Re: Admin user privilege elevation (how to prevent it)

2012-05-14 Thread Josh Cartmell
That is as I feared, thanks for the help Russ. On May 14, 4:58 pm, Russell Keith-Magee wrote: > On Tue, May 15, 2012 at 5:09 AM, Josh Cartmell wrote: > > Thanks for the responses and insight everyone (special thanks to > > Russel to clarifying what type of attack this is).  I

Re: Is GeoDjango Too Much For This?

2012-03-02 Thread Josh Cartmell
I have two quick comments, check out geopy: http://code.google.com/p/geopy/ and this website http://www.movable-type.co.uk/scripts/latlong-db.html Geopy can give you lat/lng for a given address and that other website has formulas for using lat/lng to calculate a bounding box/circle. It may be a

Re: django synchronize database over REST

2012-12-06 Thread Josh Cartmell
Why not use the same database? i.e. is there any reason that they have to have separate databases? On Dec 6, 5:10 am, psychok7 wrote: > Thanks for the answer.. but what I. Could have synchronous replication? What > do you advise over a rest interface? -- You received this message because you a

Re: Manually added foreign key not working.

2013-02-21 Thread Josh Cartmell
Can you look at the database in some way and see if FK_Formats_id actually exists in the table? If you added that to the model after you had already synced it then running another syncdb will not create the new field. I would suggest looking into South which will handle database migrations for yo

Re: Daemonize django server

2013-02-28 Thread Josh Cartmell
This (http://software.clapper.org/daemonize/) may do what you want and can be installed with homebrew on a mac, but if this is in any way a production setting, I wouldn't do it. The dev server hasn't gone through any security audits and could and probably does have unknown weaknesses in that regar

possible ModelMultipleChoiceField bug

2013-03-21 Thread Josh Cartmell
Today I noticed that while this breaks things complaining about an unexpected kwarg empty_label: some_field = forms.ModelMultipleChoiceField( widget=forms.CheckboxSelectMultiple(), queryset=SomeM2mField.objects.all(), empty_label='empty') doing the following in a form's init works (as

Re: my project is not working in virtualenv in ubuntu?

2013-04-02 Thread Josh Cartmell
It looks to me like your wsgi script is name index.py (which is fine) but you are referencing index.wsgi in your apache conf which probably doesn't exist. Have a look through your error logs and you might see the same. On Mar 31, 12:20 am, Avnesh Shakya wrote: > hi, >    please tell me,what is i

Re: How to manage django settings.py for Github, local, production

2013-04-02 Thread Josh Cartmell
You could set up a fabric file that handles the pushing. In our local repo create a file called live_settings.py (which is ignored by git). When fabric pushes to the production server tell it to copy live_settings.py to local_settings.py on the production server. On Mar 29, 1:11 am, surya wrote:

Re: Django hosting. Need to run executable for my app

2013-04-09 Thread Josh Cartmell
+1 for webfaction, it shouldn't be a problem to compile and use your own binary with them. On Monday, April 8, 2013 11:52:41 PM UTC-7, larsvegas wrote: > > Can somebody advice me on a provider where I can run my own executable? > The program I need to run is written is c++ and can be installed o

Announcing Django Announce Twitter bot

2013-04-09 Thread Josh Cartmell
I created a Twitter bot that tweets the title and provides links to messages posted in the Django Announce Google Group (Django release announcements for example). If anyone is interested you can see it here: http://twitter.com/djangoannounce Feel free to give me feedback, or point out bugs. --