Monday, August 18, 2008

This Week in Django 34

with hosts Brian Rosner and Michael Trier

Bookmark and Share

This Week in Django is a weekly podcast about all things Django.

This week we discuss Django 1.0 Beta 1, a bunch of source commits, some cool projects from the community, and a tip of the week.

Please see the Show Notes below for all the pertinent information and links

Downloads

AAC Enhanced Podcast (40.1 MB, 48:34, AAC)

MP3 Edition (33.4 MB, 48:34, MP3)

OGG Edition (26.2 MB, 48:34, Vorbis)

The Enhanced Podcast version contains screenshots and easy access links to all of the items we discuss throughout the podcast.

Give Us Feedback

Want to give us some feedback on the show? We’re always looking for ideas or suggestions that will help improve each episode. Please contact us at feedback <i>at</i> thisweekindjango.com.

Show Notes

Big News (0:36)

  • Django 1.0 Beta 1 – Just released. Great point of stability and the ongoing press towards 1.0.
  • Upcoming Events
    • August 21, 2008 – Django 1.0 release candidate 1
    • August 22, 2008: Sprint based in Portland, Oregon, USA, and online in #django-sprint on freenode.

Tracking Trunk (4:29)

Community Catchup (21:50)

  • Cyberstar – Adrian Holovaty is as red-hot as a techie can get. His EveryBlock.com tells you all about your neighborhood-including who’s taking bribes
  • RequestFactory Snippet – This snippet by Simon Willison Makes it easy to create mock request objects in Django, which you can then use for testing view functions directly (bypassing the current test client mechanism which requires views to be assigned to a URLconf before they can be tested).

Tip of the Week (38:04)

This Tip of the Week comes from Eric Holscher in his blog post titled, Using mock objects in django and python testing.


import unittest
class LoadDateutil(TemplateTestCase):
    def test_load(self):
        olddatetime = datetime.datetime
        datetime.datetime = make_datetime(5)
        self.assertEqual(self.render(u'{% load dateutil %}{% ifnight %}Hi{% endifnight %}'), u'')
        datetime.datetime = olddatetime

It’s implementation looks like:


import datetime
def make_datetime(hour):
    class MockDatetime(datetime.datetime):
        @classmethod
        def now(cls):
            return datetime.datetime(2007, 1, 1, hour)
    return MockDatetime
  • GitPython – Python interface to Git. Uses Mock by Michael Foord to mock out a Git repository.

Thank You! (43:02)

  • Running Time: 48:34

Comments - 5 people have already said something. Join the discussion.

  • Darren said

    I can here all the twid viewers shouting from the roof tops - Yeah at last 'a django site'.

    congrats guy's

  • Felix Ingram said

    RE: Session attacks

    Hi guys,

    You mentioned a change which allowed moving from anonymous to authenticated sessions and asked for some feedback around the security issues associated with this, so I thought I'd oblige. The issue with this is based around the actual session ID itself. The attack is normally seen in a public terminal scenario. The malicious party uses the terminal and captures the current (anonymous) session ID. When the victim comes at a later time and authenticates to the application then the attacker will be able to spoof their session ID on another terminal and act as the authenticated user with all of their privileges.

    This is only an issue if the session ID remains the same in the anonymous and authenticated sessions, so it'd be good if you could let us all know whether a new ID is generated upon authentication (keeping all the other data intact) or whether it stays the same (in which case we should file a ticket).

    Hope this makes sense.

  • Malcolm Tredinnick said

    I haven't listened to the episode, so I'm not sure of the originaly question, but in response to Felix Ingram's comment: the code to recycle the session key when moving to authenticated isn't in trunk yet, but it is written. I wanted to let the first round of changes settle a bit first to work any bugs there before introducing this last place where the session key will be changed. It's just a matter of only having to debug one problem at a time. So, yes, that attack vector is something we're aware of and will be guarded against in 1.0 -- code will be in the tree in the next couple of days.

  • mike said

    "Post version 1.0 will have a kick ass-validation implementation."


    Wow, that´s awesome!! How does it work? Can I upload pictures of naked butts and Django then scores them for me, like: "Oh yeah, that´s hot! Definately 10 out of 10."


    I guess you guys know this one ;)
    http://xkcd.com/37/ />

  • haha said

    It would be good if we could just play it directly withoutt downloading

Leave a comment

Please leave your comments below.