From amundsen.craig at gene.com  Tue Aug  1 11:13:45 2017
From: amundsen.craig at gene.com (Craig Amundsen)
Date: Tue, 1 Aug 2017 08:13:45 -0700
Subject: [Flask] Datatables question
Message-ID: <CAJKLyXQFxfJ_5=dMU7wVWZ-KGxeAiVM3082WDtxBymUowG4QGA@mail.gmail.com>

Hi -

I've googled around a bit and am having trouble figuring out how to pass a
value from a flask page back to the view method that produces the json for
loading a datatables table.

Currently I'm using datatables to display all the entries in a given table
with great success:

in an html template where I have table with id="test_table":
<script>
        $(document).ready(function() { $('#test_table').DataTable( { "ajax"
: $SCRIPT_ROOT + "/_get-test-rows" } ); } );
    </script>

in views.py:

@main.route('/_get-test-rows')
def get_test_rows():
    trows = Test.query.order_by(Test.name)
    rows = [ [tr.name, tr.x.name, tr.y, tr.z] for tr in trows]
    return josnify(data = rows)


In my above example, I have another table X that tr.x points to. I'd like
to have a page that displays information about individual rows in X that
has a table showing all rows from Test that have that point to that
particular row in X.

@main.route('/show-x/<int:id>')
def show_x(id):
    x = X.query.get_or_404(id)
    return render_template('x.html', x = x)

I know I can just get all the Test rows I need with tr =
Test.query.filter_by(x_id = id).order_by(Test.name) pass them to
render_template and render the table myself, but I'd prefer to have a
jQuery call in the page that gets the rows of Test where x_id = x.id.
Sometimes there are many rows of Test that will be shown and I'd like the
page to start loading so the User sees that the click did get through and
now we're waiting for the values to get loaded.

My problem is that I can't figure out how to write the <script> call to
include x.id and how to read that value in my view function. I tried this:

$(document).ready(function() { $('#test_table').DataTable( { "ajax" : {
"url" : $SCRIPT_ROOT + "/_get-x-test-rows", "data" : { "id" : {{ x.id }} }}
); } );

and

@main.route('/_get-x-test-rows/<int:id>')
def get_x_test_rows(id):
    tr = Test.query.filter_by(x_id = id).order_by(Test.name)
    ...

But the view method never gets called. I think I probably need to do
something along the lines of

@main.route('/_get-x-test-rows')
def get_x_test_rows()
    id = extract the id value from something somehow
    tr = Test.query.filter_by(x_id = id).order_by(Test.name)
    ...

But I haven't been able to figure out how to do that.

Could someone point me in the right direction to figure out how to do this?

Thanks,
- Craig
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/flask/attachments/20170801/830d4ed6/attachment.html>

From sidwoodstock at gmail.com  Mon Aug  7 18:38:37 2017
From: sidwoodstock at gmail.com (sidwoodstock .)
Date: Mon, 7 Aug 2017 15:38:37 -0700
Subject: [Flask] Flask Digest, Vol 26, Issue 1
Message-ID: <CALovGGP4HC_SaOi-7aaZDdTYNSYqLmr5g-+XJRMg5Db+4i+tPg@mail.gmail.com>

Couldn't you just concatenate the ID into the URL of your ajax call?

$(document).ready(function() { $('#test_table').DataTable( { "ajax" : {
"url" : $SCRIPT_ROOT + "/_get-x-test-rows" + *"/{{ x.id <http://x.id> }}/"*,
"data" : { "id" : {{ x.id }} }}
); } );

-Scott

On Tue, Aug 1, 2017 at 9:00 AM, <flask-request at python.org> wrote:

> Send Flask mailing list submissions to
>         flask at python.org
>
> To subscribe or unsubscribe via the World Wide Web, visit
>         https://mail.python.org/mailman/listinfo/flask
> or, via email, send a message with subject or body 'help' to
>         flask-request at python.org
>
> You can reach the person managing the list at
>         flask-owner at python.org
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of Flask digest..."
>
>
> Today's Topics:
>
>    1. Datatables question (Craig Amundsen)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Tue, 1 Aug 2017 08:13:45 -0700
> From: Craig Amundsen <amundsen.craig at gene.com>
> To: flask <flask at python.org>
> Subject: [Flask] Datatables question
> Message-ID:
>         <CAJKLyXQFxfJ_5=dMU7wVWZ-KGxeAiVM3082WDtxBymUowG4QGA@
> mail.gmail.com>
> Content-Type: text/plain; charset="utf-8"
>
> Hi -
>
> I've googled around a bit and am having trouble figuring out how to pass a
> value from a flask page back to the view method that produces the json for
> loading a datatables table.
>
> Currently I'm using datatables to display all the entries in a given table
> with great success:
>
> in an html template where I have table with id="test_table":
> <script>
>         $(document).ready(function() { $('#test_table').DataTable( { "ajax"
> : $SCRIPT_ROOT + "/_get-test-rows" } ); } );
>     </script>
>
> in views.py:
>
> @main.route('/_get-test-rows')
> def get_test_rows():
>     trows = Test.query.order_by(Test.name)
>     rows = [ [tr.name, tr.x.name, tr.y, tr.z] for tr in trows]
>     return josnify(data = rows)
>
>
> In my above example, I have another table X that tr.x points to. I'd like
> to have a page that displays information about individual rows in X that
> has a table showing all rows from Test that have that point to that
> particular row in X.
>
> @main.route('/show-x/<int:id>')
> def show_x(id):
>     x = X.query.get_or_404(id)
>     return render_template('x.html', x = x)
>
> I know I can just get all the Test rows I need with tr =
> Test.query.filter_by(x_id = id).order_by(Test.name) pass them to
> render_template and render the table myself, but I'd prefer to have a
> jQuery call in the page that gets the rows of Test where x_id = x.id.
> Sometimes there are many rows of Test that will be shown and I'd like the
> page to start loading so the User sees that the click did get through and
> now we're waiting for the values to get loaded.
>
> My problem is that I can't figure out how to write the <script> call to
> include x.id and how to read that value in my view function. I tried this:
>
> $(document).ready(function() { $('#test_table').DataTable( { "ajax" : {
> "url" : $SCRIPT_ROOT + "/_get-x-test-rows", "data" : { "id" : {{ x.id }}
> }}
> ); } );
>
> and
>
> @main.route('/_get-x-test-rows/<int:id>')
> def get_x_test_rows(id):
>     tr = Test.query.filter_by(x_id = id).order_by(Test.name)
>     ...
>
> But the view method never gets called. I think I probably need to do
> something along the lines of
>
> @main.route('/_get-x-test-rows')
> def get_x_test_rows()
>     id = extract the id value from something somehow
>     tr = Test.query.filter_by(x_id = id).order_by(Test.name)
>     ...
>
> But I haven't been able to figure out how to do that.
>
> Could someone point me in the right direction to figure out how to do this?
>
> Thanks,
> - Craig
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: <http://mail.python.org/pipermail/flask/attachments/
> 20170801/830d4ed6/attachment-0001.html>
>
> ------------------------------
>
> Subject: Digest Footer
>
> _______________________________________________
> Flask mailing list
> Flask at python.org
> https://mail.python.org/mailman/listinfo/flask
>
>
> ------------------------------
>
> End of Flask Digest, Vol 26, Issue 1
> ************************************
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/flask/attachments/20170807/4759021b/attachment.html>

From amundsen.craig at gene.com  Tue Aug  8 13:34:10 2017
From: amundsen.craig at gene.com (Craig Amundsen)
Date: Tue, 8 Aug 2017 10:34:10 -0700
Subject: [Flask] Flask Digest, Vol 26, Issue 1
In-Reply-To: <CALovGGP4HC_SaOi-7aaZDdTYNSYqLmr5g-+XJRMg5Db+4i+tPg@mail.gmail.com>
References: <CALovGGP4HC_SaOi-7aaZDdTYNSYqLmr5g-+XJRMg5Db+4i+tPg@mail.gmail.com>
Message-ID: <CAJKLyXT2pTk50gm9d8s_FKUyckgCDazsNxYKmxALDN5doAgSYg@mail.gmail.com>

Hi -

Yes. I can do that. It works great. Thanks for pointing the way.

One hidden advantage of my not thinking of the obvious solution is that
I've been reading up on jQuery and honing my very rusty javascript skills

Thanks for the answer!
- Craig
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/flask/attachments/20170808/ba721547/attachment.html>

From riteshn at gmail.com  Wed Aug 16 11:41:32 2017
From: riteshn at gmail.com (Ritesh Nadhani)
Date: Wed, 16 Aug 2017 08:41:32 -0700
Subject: [Flask] Session id reuse and Flask-session question
Message-ID: <CAL0V6M6hmARxmZO3kHQpRBE4995vewRtwdhgVXE4jWRokfyw9Q@mail.gmail.com>

Hello

We are using Flask-Session (with RedisSession) for our session
management. Recently, during a security review it was found that we
can do session reuse in our system.

Basically, the steps is:

a) Log back in, we get a session id and stored in cookie
b) Log back out, we invalidate the data attached to the session id but
the session id is still present in the cookie.
c) Log back in and the session id is reused with the data validated.

Now between, step (a) and (b) if somebody gets access to the token
they will be able to reuse it again once the user logs back in and the
data associated to the session_id is valid again.

Looking at the problem, it seems the best way would be to delete the
cookie when user logs out. I was reviewing the code and it seems this
is the place where the relevant code path happens:

https://github.com/fengsp/flask-session/blob/master/flask_session/sessions.py#L144

But I am not really sure how this code path is valid (not session and
session.modified) for the next two lines of code to executed. How is
this condition met?

This seems to be a generic problem? How do you guys solve it or how
even non-Flask frameworks solve it?

NOTE: we do run everything over HTTPs with SecureOnly; flag set in the cookie.

-- 
Ritesh

From corralejob at gmail.com  Wed Aug 16 11:50:32 2017
From: corralejob at gmail.com (Bryan Corralejo)
Date: Wed, 16 Aug 2017 10:50:32 -0500
Subject: [Flask] Session id reuse and Flask-session question
In-Reply-To: <CAL0V6M6hmARxmZO3kHQpRBE4995vewRtwdhgVXE4jWRokfyw9Q@mail.gmail.com>
References: <CAL0V6M6hmARxmZO3kHQpRBE4995vewRtwdhgVXE4jWRokfyw9Q@mail.gmail.com>
Message-ID: <4D549036-0D96-482D-BFE8-180105185671@gmail.com>

Ritesh,

Do you use session.clear() to clear the session on logout or invalidate using some other method? Also is the session modified before clear it ? Maybe using flash ?

Regards,

Bryan



> On Aug 16, 2017, at 10:41 AM, Ritesh Nadhani <riteshn at gmail.com> wrote:
> 
> Hello
> 
> We are using Flask-Session (with RedisSession) for our session
> management. Recently, during a security review it was found that we
> can do session reuse in our system.
> 
> Basically, the steps is:
> 
> a) Log back in, we get a session id and stored in cookie
> b) Log back out, we invalidate the data attached to the session id but
> the session id is still present in the cookie.
> c) Log back in and the session id is reused with the data validated.
> 
> Now between, step (a) and (b) if somebody gets access to the token
> they will be able to reuse it again once the user logs back in and the
> data associated to the session_id is valid again.
> 
> Looking at the problem, it seems the best way would be to delete the
> cookie when user logs out. I was reviewing the code and it seems this
> is the place where the relevant code path happens:
> 
> https://github.com/fengsp/flask-session/blob/master/flask_session/sessions.py#L144
> 
> But I am not really sure how this code path is valid (not session and
> session.modified) for the next two lines of code to executed. How is
> this condition met?
> 
> This seems to be a generic problem? How do you guys solve it or how
> even non-Flask frameworks solve it?
> 
> NOTE: we do run everything over HTTPs with SecureOnly; flag set in the cookie.
> 
> -- 
> Ritesh
> _______________________________________________
> Flask mailing list
> Flask at python.org
> https://mail.python.org/mailman/listinfo/flask

From riteshn at gmail.com  Wed Aug 16 13:18:20 2017
From: riteshn at gmail.com (Ritesh Nadhani)
Date: Wed, 16 Aug 2017 10:18:20 -0700
Subject: [Flask] Session id reuse and Flask-session question
In-Reply-To: <4D549036-0D96-482D-BFE8-180105185671@gmail.com>
References: <CAL0V6M6hmARxmZO3kHQpRBE4995vewRtwdhgVXE4jWRokfyw9Q@mail.gmail.com>
 <4D549036-0D96-482D-BFE8-180105185671@gmail.com>
Message-ID: <CAL0V6M4MBApZK8x+P5v18=742EsZU_XuvUyb-_6SvfxS1UkgaA@mail.gmail.com>

Thanks.

That is what I needed. This seems to be what I needed and now the
session id is cleared.

On Wed, Aug 16, 2017 at 8:50 AM, Bryan Corralejo <corralejob at gmail.com> wrote:
> Ritesh,
>
> Do you use session.clear() to clear the session on logout or invalidate using some other method? Also is the session modified before clear it ? Maybe using flash ?
>
> Regards,
>
> Bryan
>
>
>
>> On Aug 16, 2017, at 10:41 AM, Ritesh Nadhani <riteshn at gmail.com> wrote:
>>
>> Hello
>>
>> We are using Flask-Session (with RedisSession) for our session
>> management. Recently, during a security review it was found that we
>> can do session reuse in our system.
>>
>> Basically, the steps is:
>>
>> a) Log back in, we get a session id and stored in cookie
>> b) Log back out, we invalidate the data attached to the session id but
>> the session id is still present in the cookie.
>> c) Log back in and the session id is reused with the data validated.
>>
>> Now between, step (a) and (b) if somebody gets access to the token
>> they will be able to reuse it again once the user logs back in and the
>> data associated to the session_id is valid again.
>>
>> Looking at the problem, it seems the best way would be to delete the
>> cookie when user logs out. I was reviewing the code and it seems this
>> is the place where the relevant code path happens:
>>
>> https://github.com/fengsp/flask-session/blob/master/flask_session/sessions.py#L144
>>
>> But I am not really sure how this code path is valid (not session and
>> session.modified) for the next two lines of code to executed. How is
>> this condition met?
>>
>> This seems to be a generic problem? How do you guys solve it or how
>> even non-Flask frameworks solve it?
>>
>> NOTE: we do run everything over HTTPs with SecureOnly; flag set in the cookie.
>>
>> --
>> Ritesh
>> _______________________________________________
>> Flask mailing list
>> Flask at python.org
>> https://mail.python.org/mailman/listinfo/flask



-- 
Ritesh

From scolby33 at gmail.com  Tue Aug 22 17:19:57 2017
From: scolby33 at gmail.com (Scott Colby)
Date: Tue, 22 Aug 2017 14:19:57 -0700
Subject: [Flask] Integrating Flask CLI as a subordinate Click group
Message-ID: <CAGOvbpt_xQi+V8LiWPKXEttau0h4ykE9ZdeHo3C=kvFGR+rbFA@mail.gmail.com>

Hello,

I have a package with a layout like so:

    top_package
    ??? __init__.py
    ??? __main__.py
    ??? cli.py
    ??? web
        ??? __init__.py
        ??? app.py
        ??? blueprints
        ??? cli.py
        ??? templates

The top_package is an application with an optional webui, which is provided
by Flask.

top_package/cli.py looks like this:

    from .web.cli import web as web_group

    @click.group()
    def main():
        """Run the package"""

    main.add_command(web_group)

    @main.command()
    def foo():
        """Foo the package"""
        click.echo('Foo')
    etc.

And top_package/web/cli.py looks like this:

    def create_app_for_cli(info):
        from .app import create_application
        return create_application()

    @click.group(cls=FlaskGroup, create_app=create_app_for_cli)
    def web():
        """Management script for webui"""

    @web.command()
    def baz():
        """Baz the webui"""
        click.echo('Baz')

    if __name__ == '__main__':
        web()

Unfortunately, this doesn't work.

cli_cmd --help shows the `web` command with the proper docstring and
cli_cmd web --help shows `run`, `shell`, and `baz`. But when I run any of
the web commands, I get this error:

    Usage: cli_cmd web baz [OPTIONS]

    Error: Could not locate Flask application. You did not provide the
FLASK_APP environment variable.

    For more information see http://flask.pocoo.org/docs/latest/quickstart/

Running the web cli with python -m top_package.web.cli works as expected,
though.

How do I get the Flask CLI to work this way without introducing any Flask
dependencies outside of the `web` subpackage?

Thank you,
Scott Colby
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/flask/attachments/20170822/119be6c7/attachment.html>

From lists at steveandmimi.com  Thu Aug 24 10:31:14 2017
From: lists at steveandmimi.com (Steve Nicholson)
Date: Thu, 24 Aug 2017 07:31:14 -0700
Subject: [Flask] How can I submit corrections for the tutorial?
Message-ID: <C2F1E13F-CCF5-42F7-8B08-BF4E2E9F19E2@steveandmimi.com>

I?d like to submit corrections for the Flask tutorial. Is it a project on GitHub? I looked at pallets/flask-website and pallets/flask-docs but I don?t see the tutorial content on either of them.

-Steve

From bsdtux at gmail.com  Thu Aug 24 11:19:53 2017
From: bsdtux at gmail.com (Josh Stephens)
Date: Thu, 24 Aug 2017 08:19:53 -0700
Subject: [Flask] How can I submit corrections for the tutorial?
In-Reply-To: <C2F1E13F-CCF5-42F7-8B08-BF4E2E9F19E2@steveandmimi.com>
References: <C2F1E13F-CCF5-42F7-8B08-BF4E2E9F19E2@steveandmimi.com>
Message-ID: <CAKoGbhgJMddt4GgnuyzuE-35D_wMU=1QGO7wn6kQmW-PcZb22w@mail.gmail.com>

Hi Steve,
?I believe to change the documentation you would need to edit the
corresponding rst file in
https://github.com/pallets/flask/tree/master/docs. Which page
where you looking to update?

Best regards
Josh Stephens


On August 24, 2017 at 10:17:34 AM, Steve Nicholson
(lists at steveandmimi.com) wrote:
> I?d like to submit corrections for the Flask tutorial. Is it a project on GitHub? I looked
> at pallets/flask-website and pallets/flask-docs but I don?t see the tutorial content
> on either of them.
>
> -Steve
> _______________________________________________
> Flask mailing list
> Flask at python.org
> https://mail.python.org/mailman/listinfo/flask
>

From lists at steveandmimi.com  Thu Aug 24 11:56:09 2017
From: lists at steveandmimi.com (Lists)
Date: Thu, 24 Aug 2017 08:56:09 -0700
Subject: [Flask] How can I submit corrections for the tutorial?
In-Reply-To: <CAKoGbhgJMddt4GgnuyzuE-35D_wMU=1QGO7wn6kQmW-PcZb22w@mail.gmail.com>
References: <C2F1E13F-CCF5-42F7-8B08-BF4E2E9F19E2@steveandmimi.com>
 <CAKoGbhgJMddt4GgnuyzuE-35D_wMU=1QGO7wn6kQmW-PcZb22w@mail.gmail.com>
Message-ID: <3C850A67-9529-422A-BB07-3990D99D018F@steveandmimi.com>

Thanks for the pointer to the correct location. 

As far as the page I'm looking to update, I ran across two typos in the second paragraph of Step 0 so I figured I would make corrections as I ran through the tutorial.

Looking at the repository it seems like the changes haven't been deployed to the website for a few months. (e.g. a May 24 commit to folders.rst begins with a sentence about virtualenv but the web site doesn't have that sentence.) Do you know what the policy is for when the web site gets updated from the repository?

-Steve

> On Aug 24, 2017, at 8:19 AM, Josh Stephens <bsdtux at gmail.com> wrote:
> 
> Hi Steve,
>  I believe to change the documentation you would need to edit the
> corresponding rst file in
> https://github.com/pallets/flask/tree/master/docs. Which page
> where you looking to update?
> 
> Best regards
> Josh Stephens
> 
> 
> On August 24, 2017 at 10:17:34 AM, Steve Nicholson
> (lists at steveandmimi.com) wrote:
>> I?d like to submit corrections for the Flask tutorial. Is it a project on GitHub? I looked
>> at pallets/flask-website and pallets/flask-docs but I don?t see the tutorial content
>> on either of them.
>> 
>> -Steve
>> _______________________________________________
>> Flask mailing list
>> Flask at python.org
>> https://mail.python.org/mailman/listinfo/flask
>> 


From bsdtux at gmail.com  Thu Aug 24 19:18:17 2017
From: bsdtux at gmail.com (Josh Stephens)
Date: Thu, 24 Aug 2017 16:18:17 -0700
Subject: [Flask] How can I submit corrections for the tutorial?
In-Reply-To: <3C850A67-9529-422A-BB07-3990D99D018F@steveandmimi.com>
References: <C2F1E13F-CCF5-42F7-8B08-BF4E2E9F19E2@steveandmimi.com>
 <CAKoGbhgJMddt4GgnuyzuE-35D_wMU=1QGO7wn6kQmW-PcZb22w@mail.gmail.com>
 <3C850A67-9529-422A-BB07-3990D99D018F@steveandmimi.com>
Message-ID: <CAKoGbhgTfUh1Q9x0DorrkofjxWGCAkm0XLEVLHJAQyJkxYTH0Q@mail.gmail.com>

Hi Steve,

I unfortunately do not. I am very new to this mailing list. Hopefully
someone that is more senior can give you a concrete answer.

Best regards
Josh Stephens


On August 24, 2017 at 11:20:15 AM, Lists (lists at steveandmimi.com) wrote:

Thanks for the pointer to the correct location.

As far as the page I'm looking to update, I ran across two typos in the
second paragraph of Step 0 so I figured I would make corrections as I ran
through the tutorial.

Looking at the repository it seems like the changes haven't been deployed
to the website for a few months. (e.g. a May 24 commit to folders.rst
begins with a sentence about virtualenv but the web site doesn't have that
sentence.) Do you know what the policy is for when the web site gets
updated from the repository?

-Steve

> On Aug 24, 2017, at 8:19 AM, Josh Stephens <bsdtux at gmail.com> wrote:
>
> Hi Steve,
> I believe to change the documentation you would need to edit the
> corresponding rst file in
> https://github.com/pallets/flask/tree/master/docs. Which page
> where you looking to update?
>
> Best regards
> Josh Stephens
>
>
> On August 24, 2017 at 10:17:34 AM, Steve Nicholson
> (lists at steveandmimi.com) wrote:
>> I?d like to submit corrections for the Flask tutorial. Is it a project
on GitHub? I looked
>> at pallets/flask-website and pallets/flask-docs but I don?t see the
tutorial content
>> on either of them.
>>
>> -Steve
>> _______________________________________________
>> Flask mailing list
>> Flask at python.org
>> https://mail.python.org/mailman/listinfo/flask
>>

_______________________________________________
Flask mailing list
Flask at python.org
https://mail.python.org/mailman/listinfo/flask
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/flask/attachments/20170824/4993df8e/attachment.html>