[web2py] Re: smartgrid tampering with url in browser

2017-06-20 Thread Anthony
Have you tried user_signature=True? On Tuesday, June 20, 2017 at 6:42:11 AM UTC-4, T.R.Rajkumar wrote: > > I have this page from the edit button of the child. > > http://127.0.0.1:8000/web_ocms/amc/new_contract/amc_master/amc_details.amc_id/17/edit/amc_details/10 > Here 17 is the id of the master

[web2py] Re: smartgrid tampering with url in browser

2017-06-21 Thread T.R.Rajkumar
Yes, Anthony now with user_signature = True prevents tampering of urls generated by smartgrid. This is when I use auth and signup and then call the grid. But in my app I am using custom login form with user credentials from a legacy table. Can I achieve the same result with custom login form? As

[web2py] Re: smartgrid tampering with url in browser

2017-06-21 Thread Anthony
The user_signature functionality expects auth.hmac_key in the session, so, you could add something like the following in a model file: from gluon.storage import Storage from gluon.utils import web2py_uuid if not 'auth' in session: session.auth = Storage(hmac_key=web2py_uuid()) Anthony On We

[web2py] Re: smartgrid tampering with url in browser

2017-06-21 Thread T.R.Rajkumar
I put the below code in my model file amc.py from gluon.storage import Storage from gluon.utils import web2py_uuid if not 'auth' in session: session.auth = Storage(hmac_key=web2py_uuid()) But now when in run http://127.0.0.1:8000/web_ocms/amc/new_contract I get this error. Error ticket for

[web2py] Re: smartgrid tampering with url in browser

2017-06-21 Thread Dave S
On Wednesday, June 21, 2017 at 10:06:05 PM UTC-7, T.R.Rajkumar wrote: > > I put the below code in my model file amc.py > > from gluon.storage import Storage > from gluon.utils import web2py_uuid > if not 'auth' in session: > session.auth = Storage(hmac_key=web2py_uuid()) > > But now when in

[web2py] Re: smartgrid tampering with url in browser

2017-06-22 Thread T.R.Rajkumar
If I am not defining auth the error does not appear, but the grid user_signature is not working. I am setting the hmac_key as mentioned in model amc.py. from gluon.storage import Storage from gluon.utils import web2py_uuid if not 'auth' in session: session.auth = Storage(hmac_key=web2py_uuid(

[web2py] Re: smartgrid tampering with url in browser

2017-06-22 Thread Anthony
As far as I understand, you are not using Auth, so why are you defining auth = Auth(...) at all? Just get rid of that line. On Thursday, June 22, 2017 at 1:06:05 AM UTC-4, T.R.Rajkumar wrote: > > I put the below code in my model file amc.py > > from gluon.storage import Storage > from gluon.util

[web2py] Re: smartgrid tampering with url in browser

2017-06-22 Thread T.R.Rajkumar
Anthony, When I comment out auth and in model amc/amc.py I add this from gluon.storage import Storage from gluon.utils import web2py_uuid if not 'auth' in session: session.auth = Storage(hmac_key=web2py_uuid()) Now the smartgrid lists the rows but when add or edit button is clicked I get not

[web2py] Re: smartgrid tampering with url in browser

2017-06-23 Thread Anthony
On Friday, June 23, 2017 at 1:35:23 AM UTC-4, T.R.Rajkumar wrote: > > Anthony, When I comment out auth and in model amc/amc.py I add this > from gluon.storage import Storage > from gluon.utils import web2py_uuid > if not 'auth' in session: > session.auth = Storage(hmac_key=web2py_uuid()) > Try

[web2py] Re: smartgrid tampering with url in browser

2017-06-23 Thread T.R.Rajkumar
Yes, perfect Anthony. Thanks a lot for forbearing with me. Anyway it is my pleasure to learn from the group. I put the above code in my login action as below. It is working perfectly. from gluon.storage import Storage from gluon.utils import web2py_uuid def login(): form = FORM(TABLE(

[web2py] Re: smartgrid tampering with url in browser

2017-06-24 Thread T.R.Rajkumar
Now I have ant\other small hitch. When I logout the action logout is called and redirect to login page. If I or another user logins in with the same browser window digital signature is not available in grid. If I close the browser window and open the browser and login _signature is available.

[web2py] Re: smartgrid tampering with url in browser

2017-06-24 Thread Anthony
To remove items from the session, don't simply set their values to None. In that case, the key will remain in the session, simply with None stored as its value. Instead, to get rid of a given item completely, delete it: del session.auth Alternatively, you could change the condition: if not 'au

[web2py] Re: smartgrid tampering with url in browser

2017-06-26 Thread T.R.Rajkumar
Yes, Anthony I did del session.auth in logout action and it working fine. Thanks for all the input. I thought I cannot use the grid without auth. But now because of your help the dependency has been removed and I am on my own authentication. Thanks again. -- Resources: - http://web2py.com - ht