| Age | Commit message (Collapse) | Author |
|---|
|
|
|
|
|
|
|
|
|
of self for normalization with exception getting
|
|
|
|
like sessionauthenticationpolicy which does its own header-setting when its remember/forget methods are called)
|
|
_forget_userid (these should always return a sequence even if there is no authentication policy), defactorize tests
|
|
policies/processes
|
|
mgrbyte-security-apis-on-request
|
|
The pyramid.security Authorization API function has_permission is made available on the request.
The pyramid.security Authentication API functions are now available as
properties (unauthenticated_userid, authenticated_userid, effective_principals)
and methods (remember_userid, forget_userid) on pyramid.request.Request.
Backwards compatibility:
For each of the APIs moved to request method or property,
the original API in the pyramid.security module proxies to the request.
Reworked tests to check module level b/c wrappers call through to mixins for each API.
Tests that check no reg on request now do the right thing.
Use a response callback to set the request headers for forget_userid and remember_userid.
Update docs.
Attempt to improve a documentation section referencing the pyramid.security.has_permission
function in docs/narr/resources.rst
Ensures backwards compatiblity for `pyramid.security.forget`
and `pyramid.security.remember`.
|
|
|
|
Due to line 69 in hmac.py in the Python standard library (2.7) it
expects to be able to call the digestmod function with the current key
if the key passed in exceeds the block size in length.
This fixes the code so that digestmod can accept string as an extra
parameter, which is passed through to hashlib.new()
[1]: http://hg.python.org/cpython/file/2.7/Lib/hmac.py#l69
|
|
This could be fixed in other ways but the basic problem is that because
config.add_notfound_view and config.add_forbidden_view have actual
signatures instead of *args, **kwargs, the arguments are squashing the
view_defaults which are applied later on the call to config.add_view.
Basically, by the time the args get to config.add_view, they look
explicit when they are not.
fix #1173
|
|
import ITemplateRenderer)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
UnencryptedCookieSessionFactoryConfig deprecation (it will happen at import time, rather than usage time, which is good for tests); add a few sphinx directives for deprecated and versionadded
|
|
|
|
|
|
fixes #898
fixes #904
|
|
fix.basic-authentication-encodings
|
|
|
|
|
|
|
|
feature.bad-csrf-token-exception
|
|
|
|
|
|
|
|
|
|
for example::
env/bin/python -3 -m pyramid.scripts.pserve development.ini
|
|
request.session.check_csrf_token use the new exception.
This supports a more fine-grained exception trapping.
|
|
|
|
|
|
- Break apart UnencryptedCookieSessionFactoryConfig into a
BaseCookieSessionFactory.
- Add support for reissue_time in the base. Set the unencrypted class to
use reissue_time=0 for bw-compat.
- Add SignedCookieSessionFactory which wraps the base in a serializer
that uses signing via a sha512+hmac with a secret derived using an
8-byte random salt.
|
|
improved the signing to use a derived key based on a random salt, and
upgraded the hash from sha1 to sha512. Finally the entire result is b64
instead of just the payload.
|
|
|
|
the key plus the equal sign
|
|
|
|
``ACLAuthorizationPolicy`` so it anticipates a callable ``__acl__``
on resources. Previously it did not try to call the ``__acl__``
if it was callable.
|
|
slash it does not produce a non-working project directory structure.
Previously saying ``pcreate -s starter /foo/bar/`` produced different output
than saying ``pcreate -s starter /foo/bar``. The former did not work
properly.
|
|
|
|
had to fix DummyBootstrap a bit because it fails pretty hard at handling
part of bootstrap contract in which the request passed in should be
enhanced with the registry, and returned. In some cases the wrong
request or the wrong registry were being returned if the test case
actually specified a registry or request.
|
|
|
|
|
