« first day (3542 days earlier)      last day (1630 days later) » 
06:00 - 23:0023:00 - 00:00

06:35
im trying to find a solution for this problem.. is there a way to do it? thanks in advance
07:19
i am trying to print pdf with win32api and win32print but i am not able to change print page size but i can change other options like copies . and also no matter what pdf size is it always covers whole page like if i am using A4 size and pdf size is 1*2 inches on printing it will be scaled to cover whole page any idea how to resolve it
@keinagae In order for someone to determine what you're doing wrong, you'd need to post code that reproduces the problem. The best place and way to do that would be by asking a proper question on Stack Overflow. If you haven't seen it already, please read our advice on creating a minimal, reproducible example.
You can find some sample code demonstrating the usage of win32print here. For things like scaling the document to a particular page size, you'll probably need to follow the advice in the section "Single image: use PIL and win32ui".
The win32print.DocumentProperties function is how you specify the printer configuration. Specifically, as the DevModeOutput parameter, you pass a PyDEVMODE structure that includes fields for all sorts of configuration, including the paper length and width (in 1/10 millimeters).
07:58
Fancy seeing you here @CodyGray!
Have you taken up python? Or are you just fulfilling your moderator duties, or both?
Or perhaps you'd always taken up python and I just don't know
@cs95 I don't do any snake wrangling. I have, at various times, felt pressured to learn Python, given its incredible popularity, but every time I learn things about the language, it becomes less likely that I will ever want to learn it.
Being here is mostly a mod thing, I guess. At least, that's how I ended up here the first time. Kind of hanging around because that company is interesting. Andras says I'm welcome even if my opinions are wrong.
I understand, parseltongue is not for the faint of heart
It's just... nothing can hold a candle to C++, you see.
In terms of... finger ache from too much verbosity? :p
Nah, not even.
Modern C++ is nearly Pythonic in all the good ways.
08:05
I see a lot of older languages moving to more functional approaches with modern iterations
java streams and iterators, as another example
Two things C++ has had since the beginning. :-)
If it's supposed to be so good, why isn't it ++C?
sorry, it's an old one
Andras and I were talking about idioms to reverse an array a while back in here. Apparently Python has some kind of arr[::-1] idiom, but I still maintain that's nowhere near as clear as std::reverse(std::begin(arr), std::end(arr))
I guess I'm not overly obsessed with verbosity, considering I can type at upwards of 150 WPM...
The bottleneck is never my typing speed. It's my thinking speed.
Well imagine having to type less at 150 Wpm, don't you get more done?
Okay, that's fair. That's the same with me
I specifically improved my typing speed years ago so that it would never be the bottleneck.
Granted, it wasn't for writing code. It was for writing English prose. But it's the same thing in either case. The bottleneck should be how fast I can think, not how fast I can type.
08:10
Interesting, it's only been a few years since I've been able to touch type with confidence, I can avg around 90 wpm now, 100 on good days. But even at that rate my thought process is still the bottleneck there
and of course the wpm depends on recall.
What did you do before? Just hunt and peck? It always blows my mind when people who use a computer all day long don't know how to type.
thankfully IDEs make that a lot easier with type hints and code completion, so I'm not complaining
haha I used to play games, hardly ever any typing required
Heh. I almost never use IDEs. 90% of my code is written in Programmer's Notepad. The other 10% is written in Visual Studio, but only because I'm using the debugger and have to fix bugs. :-)
I assume you mean one of vim or emacs, but you couldn't reasonably be productive without, tons of plugins
and the keybindings are like a rubiks cube to a millenial
Nah, I don't use either of those. Sometimes I fear that makes me not a Real Programmer, but then I realize I don't have anything to prove.
Tools should work for me, not vice versa.
08:48
@CodyGray old habits die hard, I guess. Presumably you must have had to unlearn some things during your training?
@roganjosh During typing training, or do you mean more generally? I didn't have any bad typing habits.
Specifically typing training
Unless you count that I only ever use my left thumb to hit the spacebar. Apparently, you're supposed to use both left and right thumbs.
I'm on my phone currently but my gut tells me I only use my right thumb. Hmm, I'll have to check :)
The big drawback of learning how to type efficiently is that it makes using a mobile device all that much more frustrating.
08:54
@LinkBere I have a scrolled canvas which contains a table (also created with tk.Canvas).
In some cells of the table i want to put some buttons.
That's the reason i want Frame window inside canvas.

The problem is that if i use the create_window function the when i scroll the outer frame, the frames inside the table still vissible out of canvas scroll region.
One thing that would be interesting is whether you could rebuild a keyboard (at least the letters) from memory. I seem to recall that the percentage of people who can tough type (whether through formal training or just acquired skill) is surprisingly low. I know I've got QWERTY down, then I'm on my own :)
Absolutely. I can name all of the letter keys in order on a QWERTY keyboard from memory with no problem.
Probably just as well as I can tell you the order of the letters in the English alphabet.
09:08
Huh, it's the middle finger of my right hand for the spacebar it seems. That's an awful lot of unlearning for me if I want to correct my style
Whuh?!
How do you do that without moving your whole hand?
If I bring down the middle finger on my right hand, I maybe hit the Alt key, not the spacebar. And even that is not comfortable.
I don't. My whole hands are always moving. I'm just realising how borked my typing is :P
Haha, yeah, that's terrible. :-)
You're only supposed to move the fingers
I've always known that my approach is far from correct but I'm quite surprised by my own finding here. How did I even develop that habit? Ugh
I guess I'll never fulfill my dream of operating a keyboard for four hands :(
09:26
I can't get past someone who is supposedly an IT professional using one of those awful mushy membrane keyboards.
That's probably on par with my annoyance with TV forensic labs only having balances that go up to 2 d.p. I can look past all the fancy touchscreen glass panels but, really guys? I bet they didn't even set the spirit level bubble; that'd really trigger me
I have had to learn how to suspend disbelief.
When you know both how computers work and how laboratory science works as I do, TV shows would otherwise be almost impossible to watch.
09:58
hey roganjosh
Not sure if you saw i sent messages in the other chat
10:22
i seem to have gotten through the actual login and check, however now when going in it takes me to this
dpaste.com/1VJCJ0K
i have tried this with both the redirect and render_template and receiving the same error
and not quite sure what a pickle thread is
Sorry, had something to sort out. It's not a pickle thread, it's complaining that you're trying to serialize something that can't be serialized. Which makes me assume that you're trying to store something in the user session that isn't necessary
@phoenix please don't ask for help here with fresh questions on the main site as per our rules
@roganjosh You were fixing your touch-typing? :-p
Yup, all done. 180 WPM. Yey :P
10:34
\o/
The typo shows there are still some rough edges :P
@roganjosh dpaste.com/0EQVN6E thats the session storage
@CodyGray I could type crazy fast with my old nokia dumbphones. Still waiting for touchscreens with generic tactile feedback
Ok, this is simpler than I first thought. I think I let my mind get tangled up yesterday. Your user object needs to be serializable if you want to store it in the session. What you actually have is a query result object that you're calling user_ but, realistically, it's not, is it? It's just a name
@roganjosh I just realized
10:41
You'll want something like flask-login to manage this for you
this is the same problem as with the password_hash
Yep. I just got confused about the error messages with several issues being compounded. Apologies
using the list() allowed me to index the values and allow it to work without error
thank you so much for all the help you are legend
You're welcome. I wish I could have resolved it faster but I filled in too many gaps with my own assumptions. My mental creation was at least exotic, if not entirely helpful
@roganjosh lol well atleast I have learnt a few methods of debugging from you man.. so thank you it feels amazing to finally have the solution lol
11:00
Just a heads up, @Kwsswart. You're using file-based storage of sessions. I managed to break it and get some really weird behaviour here. I never managed to understand the issue properly, but I know that it came from repeated AJAX requests from one of my pages. That is probably not relevant to your current stage, but I'd really suggest switching to SQLA-backed sessions here, even if you don't want to use an ORM for the rest
11:32
@roganjosh how would i make that switch
You need to change the SESSION_TYPE. I would say "like how they show in the docs" but actually, that site doesn't appear to exist from google searches. You can find it here. Be wary of this library; it broke fully when werkzeug went to version 1, and the maintainer has only recently started dealing with PRs
Only last week, I decided to rip out my dependency on the library and take over session management myself (though, granted, it was totally based on that library's approach). I don't want a dependency on something like that, though
@CodyGray technically, python has reversed(arr) for iterator reversal. For some reason, most people prefer to show off their 1337 slicing skills and prefer arr[::-1].
11:49
TIL you can use else in a for loop.
Yes, which makes no sense whatsoever.
It's not actually executed as an else, as far as I can tell. It's more like a finally.
@roganjosh hmmm may look into it does it effect the way i develop the rest of the app or could i focus on getting the app working and going over the session data once i have a functioning app?
@Kwsswart focus on getting the app working :) These are technicalities at this point, it just happens that this was the worst library in my toolset and I had to pin versions of libraries around it. But; no more! Huzzah!
@roganjosh Ok great thanks again for all the help
@CodyGray Not even a finally really either :)
12:00
Yeah. It's literally just like code that appears after the loop, which...doesn't require special syntax.
(only gets executed if the for-loop didn't break - so it's not that simple either :p)
Oh
The tutorial site I read didn't mention that :-)
for n in range(3):
    print(n)
else:
    print('cabbage')

for n in range(3):
    print(n)
    break
else:
    print('cabbage')
That's probably the simplest example to run to show it
1
2
3
cabbage
1
Is what I'd assume it would print.
12:04
Based on the Python interpreter that is not built into my brain
except range is zero based so it's be 0, 1, 2 and 0 but yes... that's what happens
That...is extremely confusing syntax, all to accomplish nothing useful.
I don't recall ever actually having used it for anything - just one of those things I'm aware of
I would be somewhat curious to know if anyone has ever come up with any useful application for it
Someone at geeksforgeeks.org/… has tried but that's just a convoluted way of writing: any(el % 2 == 0 for el in some_sequence)...
12:10
Yeah, it seems like a feature introduced for the sole purpose of FizzBuzz-type applications
Like a friendly-looking goto
@JonClements Interesting what you find being tethered to a phone. Opening that link shut down YouTube and just continuously loads - it took all my bandwidth. I wonder what geeksforgeeks is loading
ouch :(
@CodyGray I think I've used it at least once
Meh, all fixed. I'm just curious/suspicious of what they're doing :)
12:15
@roganjosh malware, probably
@CodyGray I use it every now and then in a pattern of "find something in this container, do something if it isn't there."
if (std::find(std::begin(data), std::end(data), x) == std::end(data)) is so much more obvious.
@AndrasDeak Be difficult to use it less than once I guess :)
Oh, there are plenty of things I've used less than once...
<-- never used it
12:17
wait... are we counting never having used something as having used it or am I still not yet awake :)
I've got a while-else here
Huh. Manually implementing a BFS seems like it would be an anti-pattern. Isn't there a library function to do that for you?
That's cheating
@Cody for not really having been a chat guy a while back - seems I'm seeing you everywhere these days :)
Most of my basic CS practice is for AoC
12:22
@JonClements Well, someone had to pay attention to these crazy folks while you were on hiatus
Glad there was a benefit from my hiatus :)
Not sure if you're using that word "benefit" correctly there, @Jon
Ahh... would you feel more comfortable if I made a few uncomplimentary remarks instead? :p
Whatever seems right. You're the ones stuck with me.
That's it. He nested. I called it :P
12:29
@roganjosh hahaha... only too late do they realise that Room 6 is actually inside Hotel California :p muhahahha muhahahah
Shhh, we're still at the "livin' it up" stage
You mean like the well stocked mega-bar and lazy boy chairs?
I was wondering when you folks were going to show me the way to the bar
Wut? Nobody showed this fine person to the bar?! That's a breach of protocol <shoos away the cutlery-wielders in the background>
Yeah... you might ruin the "well stocked" part of it :p
Look on the bright side though... you get to use the nice lazy boy chairs... I get told off if I try and use the furniture :(
12:41
Yeah, well, I get tired of going round with an overpriced roll of sellotape to get rid of the fur
Hey, it's not my fault I'm stuck with paws and you've got opposable thumbs... live with it hooman :p
13:34
Umm... now where's that website that puts crontab syntax into nice easy to read English... 1-23/2 is every odd hour, right?
Yup... appears so: crontab.guru/#35_1-23/2___*
Well, the URL auto-linking doesn't work because of the strange characters
But that site works on mobile, which is super useful, and I like the English readout a bit better
13:49
ahh okies
14:12
@CodyGray I agree that the syntax is somewhat confusing. It's fairly rare for a for or while loop to have an else clause, and IME it confuses most people when they first encounter it. I've used it a few times on SO, here's a typical use case: stackoverflow.com/a/50291458/4014959
sometimes searching for errors typos in long lines of code is not good. Done it in the beginning and ended up doing the work of the compiler.
14:30
I learned of the for...else syntax in a prime number generator I saw on SO
user12867493
14:45
I was given a problem wondering if anyone can help me. I have a array of 1's and 0's. What is the longest subarray of 1's after deleting one element?
user12867493
Not sure where to start
user12867493
e.g. [1,1,0,1] = 3 (remove the 0)
List or array?
user12867493
Doesn't matter, list is fine as well
the only difference it makes is whether numpy solutions are applicable
user12867493
14:49
The input is actually a list
You can probably do it O(N) with a naive loop, checking contiguous ones and looking at whether there's only one zero between two blocks.
user12867493
Maybe go through the list in a loop (runs as many times as there are zeros), removing a zero and checking the number of continuous 1's. Not sure how efficient that is though
@Daniil not very
You have to find the contiguous ones, and then for each of these you merely have to inspect the (at most) two edges to see if there's a solitary 0 separating it from the previous/next block of ones.
user12867493
How do I do that?
each block of ones gives you either 1. its own size, or 2. its own size plus its predecessor's size if there's only one zero between them, or 3. its own size plus its sucessor's size if there's only one zero between them
@Daniil as I said: start with a naive loop. Keep track of ones, do logistics when a block of ones ends.
user12867493
14:54
What's a naive loop?
If a block of ones ends (there's a zero) you know you've just ended a block of ones, remember its size. Add its size as a candidate. If before that block there was a single zero, add the length of the previous block as a candidate. Go on to the next block of ones, if any
user12867493
How many times do I repeat that though?
@Daniil it's just like a regular loop ;) By naive loop I meant a naive (looping) solution that just checks every item as you woud on paper. Is it a one? Is it a zero? Have we ended a block of ones?
@Daniil you only have one loop over every element in the list.
you just need a few counters and flags, such as "length of the block of ones so far" and "length of the previous block of ones assuming there was only a single zero after it"
user12867493
But how do I check I'm only removing 1 zero?
and you need a "longest sublist so far" which starts from 0
@Daniil you're not removing it. If you see [... 1, 1, 1, 0, 1, 1, ...] you know you could remove that 0, so you'd end up with a sublist that has a size that's the sum of the length of the blocks before and after that one 0. If you see [..., 1, 1, 0, 0, 1, 1, ...] you know that the two blocks are decoupled, so you can only consider the size of the blocks you found before the double zeros
On paper how would you do this? Count the size of every block of ones, then see which are separated by a single 0, and see what is the largest "neighbour sum" for these neighbouring blocks separated by a single 0.
that's basically what you can implement with a single loop over your list and some logistics
Perhaps what you're missing is that "removing at most one zero" implies that you only have to consider adjacent pairs of blocks of ones.
(adjacent as in "separated by only a single zero")
Is this some kind of homework or interview question?
user12867493
15:01
Just some interview practice I'm stuck on
user12867493
Not sure why my code isn't working
me neither
user12867493
class Solution:
    def longestSubarray(self, nums: List[int]) -> int:
        count=0
        countBefore=0
        zeroRemoved=0
        for i in range (len(nums)):
            if nums[i]==1:
                count+=1
            elif nums[i]==0:
                if zeroRemoved==0:
                    zeroRemoved=1
                else:
                    if count>countBefore:
                        countBefore=count
                        count=0
                        zeroRemoved=0
        return countBefore
Is it necessary to have a Solution class?
user12867493
No
user12867493
15:03
Does it make a difference?
Then don't, that makes your code look like java
@Daniil nah, just an anti-pattern
(although it's probably how online thingies expect things to be submitted... sighs)
I'll have to go for a while, be back later
user12867493
@JonClements Yeah, don't know why
So is it one of those online challenges that gives you no indication why something didn't work?
user12867493
15:05
Yep, debugging time
user12867493
Thought I got it but wrong answer :(
care to share the link? What about if no zeros are present etc...?
Where do you account for two consecutive 0s?
user12867493
@JonClements No zeros are present means you return 0
user12867493
@roganjosh zeroRemoved
15:08
@Daniil but that's never used in any kind of check other than being 1
@Daniil so [1, 1, 1] is 0 rather than 3 ?
user12867493
@JonClements [1, 1, 1] is 3, [0, 0, 0] is 0
that's kinda of what I'd expect, but your answer wasn't to the question I asked a few message ago :)
user12867493
@JonClements What question?
user12867493
@roganjosh What do you mean?
15:12
@Daniil just want to check... did you have that code in place before asking and didn't provide it and @Andras had to spend quite a bit of time of discussing logic and stuff with you?
user12867493
@JonClements Oh sorry, [1, 1, 1] is 2 (you need to remove one element)
oh... so you can remove any element
user12867493
@JonClements I didn't have an idea where to start
@Daniil right... so did you write the code above in the space of 2/3 minutes after looking at what Andras had mentioned, or did you already have it there, and just didn't provide it - that's what I'm trying to get at?
user12867493
I wrote the code after the logic was provided
15:15
and did so remarkably quickly it seems
user12867493
You don't believe me?
and you still haven't linked or provided the full text of the interview question?
We've gone from removing a zero, to removing a 1 if a zero isn't present now...
user12867493
I don't know the link, someone sent it to me
user12867493
@JonClements It was an example testcase, my mistake for not seeing it
ahh... so you have a testcase, able to see it's not working, but still can't provide further info... I'm confused?
15:18
I have a flask server that stores video, now I need to show the video to the user in the browser, so after a lot of stackoverflowing and trying various answers I am able to display a video frame and get status as 200 which means OK, but for some reason the video doesn't show up on the browser , it's always an empty video fram even after 200 status from flask, here is the python and associated HTML for quick reference : pastebin.com/7QbNxt3N
Note : I also tried changing browsers for compatibility, yet the issue persisits.
user12867493
@JonClements I do have a testcase (sent in the question), the person who sent it to me said my code won't work
@Daniil This sounds like "find the longest contiguous subarray" if I am correct, maybe?
user12867493
@AshwinPhadke Kind of (except removing one element)
@Daniil is whatever you remove always fixed? like the value to remove.
user12867493
@AshwinPhadke You can remove a 0 or 1 (you would usually remove a 0)
15:26
@Daniil err... that's nice of 'em?
@AshwinPhadke 200 code for what route, exactly?
user12867493
@JonClements What?
you read my mind
user12867493
?
idk if I am oversimplifying this or simply did not understand , but if you are removing an element from an array which both you probably know is always staying the same values here 0,1 , you can just count the number of 1s regardless, right?as the problem doesn't deal with coniguous it means that you count all 1s as what you said you need to count all 1s, I hope this makes sense :p
@roganjosh /downloadfiles/ part, let me recheck, also if I give a download button with the same url I can download the video but strange enough I cannot view it in the vid player.
user12867493
15:29
Not sure why my code doesn't work still
@AshwinPhadke That would be the wrong route, because it's not the one that returns the file
user12867493
@JonClements Why?
I'm not sure <source src="/return-files/{{value}}" type="video/mp4"> issues a request at all. I don't think I've ever seen a source tag?
@roganjosh let me recheck.
@roganjosh there is that tag.
15:35
@Daniil if you can post the problem fully in a gist, and as you're asking people here for help, get the full problem descriptions and test cases you're doing for a friend, and then we can go from there...
user12867493
@JonClements I gave an adequate description
it's approaching adequate but still ambiguous - good luck with it, but right now, it's too much noise in the room, thanks
user12867493
I don't agree, so what's this room for if it''s not for helping people?
@AshwinPhadke In that case, you would see /return-files/ in the logs. I suspect you don't?
Disclaimer: I don't have streaming content in Flask, so I'm winging this and learning with you
You had a huge of amount of advice from Andras - you don't appear to have tried to implement that - and then you change the logic of what will actually pass/fail shortly after... we'll try and help, especially if you help yourself, but right now, I think people are out of patience now... try and figure it out with the hints given, really play with that for a bit, and then if you're still confused, and can produce more code of attempts - ask again, okay?
user12867493
15:44
Sure, sorry about that
user12867493
Yay, it just got accepted :)
@Daniil \o/
user12867493
Sorry for another question but how can I remove dupe elements in a 2D list? e.g. [[2,1],[3,1],[4,1],[1,5]] = [2,3,4,[1,5]]
user12867493
(because the last 1's are the same in the first 3 elements)
user12867493
Or even separate that list into [[2,1],[3,1],[4,1]] and [[1,5]]?
15:55
@Daniil let's not start doing that, please
if you have a debugging question you can ask with an MCVE
user12867493
Why?
because we already have a user who uses this room as a code challenge site solving resource, and I'm getting tired of doing this again
user12867493
Who? Are you talking about me?
Hi there
@Daniil No, he's talking about another user that we already have.
user12867493
16:00
Ok
how nice to find a python room chat
what are we allowed to ask as questions ?
ofc questions about code and pythons
@Azertux0 you can review the room rules
thanks
Actually, there are a few of them, but 1 in particular is rather persistent in having protracted discussions that aren't very useful, either for the person themself, or the rest of the room inhabitants.
according to you what kind of methods should we use to create a python program, classes or functions ?
i saw a comment about java and classes, then there is another way to do the work ?
16:04
@Daniil Consider using a set of elements you've already seen. And don't turn a list of lists into a list that contains a random mix of ints & lists. That makes the list messy to process.
@roganjosh yeah now I checked it I dont, I only see the video file name returning as 200.
user12867493
@PM2Ring Thanks for the suggestion :)
@roganjosh and the page where I upload the video returns 302 which I means it was successfully caried ahead I guess
@AshwinPhadke Ok, well that's a starting point - no request is sent for the resource. I'm not sure I'm ready for another big discussion around Flask, but that's a decent starting point
@roganjosh okay , thanks.
16:10
@Azertux0 Python isn't Java. We don't have to wrap everything in classes like Java does. And quite often you can use Python's built-in classes to do things, rather than creating custom classes. OTOH, Python is an object-oriented language: (almost) everything in Python is an object, there are no primitive datatypes that aren't proper objects.
thank you
17:11
@AshwinPhadke Since it's gone quiet and I have a bit of spare time, I'll have a look at this. The code seems broken from the get-go in terms of name collisions. How are you sorting the filename at the point that the user saves the file?
Not sorting in the sense of lexicographic sorting. I mean, ensuring it's unique
The first thing that strikes me in this is that there are no database hits in the code you gave. I'd rather back this up with a database that has the filename and the user id, with a row id to populate the request, instead of <filename>. The foundations seem shakey
17:55
mm, thinking about that a bit more, I've just found a loophole to explode my own app. Thankfully it's only internal, but Monday will be fun. I need to fix this now, rbrb
18:27
@AshwinPhadke Why dont you go ahead and post it as an SO question? (with MCVE, and anything else to make it not sound like debugging help)
@smci debugging help is on topic
18:44
Time I've invested in writing a widget that lets the user switch between various website and syntax themes: 10+ hours and counting.
Time I've invested in writing a light theme: 0 minutes.
Task failed successfully.
20:00
I'm missing something on the web front. I have a complicated system that gives me control over whether a user can actually access my route on my server (well above @login_required) and the front end will disable the button. All good. However, a user that can pass my access decorator could just edit a database entry id in the template and get around it all. What am I supposed to be doing?
For example:
<button onclick="deleteUser({{ userId) }}">Delete this person</button>

<script>
function deleteUser(userId) {
    var csrf_token = "{{ csrf_token() }}";

    $.ajax({
        type: 'POST',
        data: JSON.stringify({
            'delete_id': userId,
        }),
        contentType: 'application/json; charset=utf-8',
        url: "{{ url_for(stuff) }}",
        success: function(data) {
            window.location.href = "something";
        }
    });

}
</script>
I could edit that prior to submission to just pick "1" for the userID. It'd be a decent guess that it'd be a mod account
As long as I had permission to access to route that allows for deleting users, even if I wasn't a master user, I could just do it. It wouldn't matter what was inserted for {{ userId }}
Errr... reject it in the backend?
does the backend know who the user is making the request?
Yes, but it doesn't know who the user is that they want to delete. To do that, i'd need to attach a user privilege to every entry in my db?
wait... so you've got @login_required and that's it?
we talking flask/django here?
20:11
No, I have user groups. It's flask. But it occurs to me that, once someone clears that hurdle, they could actually do more than they were meant to
The user group decorator will boot them to login if they don't have the right priviledges. Once they do, they could edit my template and circumvent, well, any restriction
so retrieve the user from the delete_id and check its group, and then go from there?
@AndrasDeak It's borderline, and as you're well aware some users are likely to downvote it and call it offtopic for beibg debugging help. So I was preemptively helping the OP avoid that possibility.
This isn't something that's happened, it's just a horrifying realisation
@roganjosh which is generally why you write stuff with the effect of "deny all" and keep loosening up until you get to a point where "allow all" is what you want to show public, and "allow if" is correct for what's necessary :p
So err, if the user couldn't access that link, don't show that part of the interface, and if they try and wangle with the url paths, return a 404. If they do have access but what they're requesting you don't want 'em to do, then return a 403.
@JonClements yeah, but that's the point I'm missing. As soon as they get base-level access, they could edit the template to pick IDs at random.
20:19
what do you mean template?
if they're not a registered user or don't have "admin" access/more finer grained control, then you just deny them access if they try the delete route
Exactly what I posted. Imagine that was rendered to someone with mid-level access, but they can delete mid-level users. Instead, they just edit the HTML to change the user ID
Why does the HTML matter...? I could just take the url from it and shove a for i in range(1, 10000000): requests.post('someurl', json={'deleted_id': n}) in and let it go
1) make sure you've got a user, 2) check their privs so they can delete, 3) lookup what they're trying to delete exists, 4) check they're able to delete it via some logic, 5) do/don't delete that id
ultimately yes, you do need permission info for users associated with 'em
Yeah, but unfortunately there's some hand-waving going on in point 4 :P
I have a non-trivial system for access permissions
@roganjosh isn't there always... sometimes though it's as simple as... "level 1) superuser, 2) admin, 3) moderator, 4) whatever..." and if the level of the user requesting the operation isn't greater than the target id, you deny it
And now I find I could just walk all over it, provided I have some level of access
20:29
well... your check_user_group is errr... interesting
at a quick glance the logic doesn't look right and that whole looping over stuff and keep executing .first() on stuff... errr - not sure what's going on there :p
Mmm, indeed. I'm looking at it and I'm not sure that's my current version. But it's beside the point :P
@roganjosh sounds like you have client-side validation, so that wouldn't be too surprising
@roganjosh where do you actually check in your route permissions?
@AndrasDeak nope nope. I have both. But once you have any level of access, you can play with what you submit. How can my server determine whether deleting user_id = 1 is within your remit? You've had to earn a privilege that I attach to the route (the action) but not the person
so you definitely need to attach permission bits/similar to the person
and the target user
20:39
^ that sounds reasonable to me
Or if you mean "the action" has privilege, you have to check whether the person making the action matches that. But I'm pretty sure this is exactly what you've been discussing.
@AndrasDeak there action is "delete a user" (for example). I've already assigned a privilege to the person trying to delete a user. What I haven't done, is verify whether the user they want to delete is within their remit. And, considering this is a pattern across my whole site, we're talking ridiculous amounts of cross-checks
@Andras Yeah... I'm getting a little confused... I'm kinda reading it as something a little more complicated like: "Who could kick someone from R6... - only someone that's an RO/mod - so you'd need to check they have either of those permissions, but then you further need to check who's to be kicked and if it's a mod, the system denies it, but otherwise proceeds" kind of thing
@roganjosh then that's what you're going to have to do :)
At the end of the day, the backend needs to implement a "is user X allowed to delete user Y" check. What the best way to do that is, is probably not something we can answer
you're just going to have to pull the other user from the id, and do whatever makes sense in terms of a yes/no based on whatever
Fun. That's 500 or so routes that need extra checks on top of user groups and department checks.
20:52
I wouldn't recommend it, but you can intercept calls to routes and then decorate them before actually calling 'em, but yuck
anyway... snooze time for me... if you're still stuck in the morning @roganjosh gimme a bell... might be more awake then :p
Tis my bed, and I've made it extra spikey. Just how I like it :P
Ugh, that doesn't fit well with your last reply. I'll add bad timing to my list of woes :P
you'll work it out... but generally, a good approach is design stuff security minded with nothing has access, and then just tweak as needed
Let me know if you need a penetration tester ;)
back-porting this kind of logic is err... awkward :)
rbrb for now
@Aran-Fey lol
21:03
People forget to implement backend security checks surprisingly often... one time in an online game I played, I found out I could read any guild's MotD just by sending a membership application to the guild. One guild had a link to google doc that contained their strategy for their upcoming fight against my guild... so that was nice
Thing is, I implemented a lot of backend checks. The issue only occurred to me when I was talking about entry ids earlier. I've enjoyed working alone for ~5 years but I'm feeling pretty "meh" right now. I should have picked up on this and I guess it'd be nice if there was someone around who also potentially would have
To be honest, I'm not convinced that having a lot of people helps with security. How often do you really look at someone else's code closely enough to spot a security issue? I think you need to put yourself in the shoes of an attacker every now and then and try to break your own stuff
21:20
Now I've spotted it, though, it's scary. The problem is that I can't put myself in the shoes of an attacker here; they would have spotted it before me, if by nothing more than brute-force
If it makes you feel better, not all attackers wear black hats :)
Anyway, I'm over feeling sorry for myself :) "Guilds" reminds me of EverQuest. What game was this?
Oh, it was a pretty obscure browser game called "Tyrant". I'd be surprised if you'd heard of it
I haven't heard of it, sorry. But I do recall that guild documents are most precious; keep them secret, keep them safe.
It was really the developers' fault. For a player, it was reasonable to think that only real guild members (i.e. not applicants) could read it
But yeah, it was a browser game so... it wasn't much of a surprise that the security was half-baked
21:44
Hello
is there a particular reason why have I been, excuse my french, kicked out?
@roganjosh
Yes. You asked a question that had nothing to do with Python and stated you were intoxicated
it happens to be python that I'm using for web scraping, many apologies for not explicitly stating that fact
It doesn't matter.
It doesn't change anything
22:09
Hi everyone. I am trying to run my flask application in DigitalOcean VPS using this guide digitalocean.com/community/tutorials/…. The flask application works fine when I run directly from command line with command flask run, but when trying to serve with gunicorn get this error: if sa_url.drivername.startswith('mysql'): AttributeError: 'NoneType' object has no attribute 'drivername'
@CodyGray Oh oops, just discovered this is its own thing. What made you choose this over other options?
@AmacOS sa_url is None
I provided absoltute url address
it works fine when you run from command line
but gunicorn fails to run
clearly some of your assumptions are wrong
One assumption might be "sa_url will never ever be None" which seems not to reflect reality
Is it just me or is Flask the new flavour of the season? I feel I'm doing some heavy lifting :P
22:12
there's always the option to ignore questions, you know
Lord knows we need some of that
Some flask?
Nah, not even. Not much of a coffee drinker
oh, you meant some ignoring questions
hmm, oh yeah. Sorry didn't realise that was a serious question :p
22:15
I meant more on the wetware level
I'm not gonna ignore them, I just feel the frequency is increasing (and I know it's always my choice whether I respond, that's not an issue :) )
TIL what "wetware" is :D
@roganjosh Maybe. I've been seeing a surge in "how do I write this MATLAB code in python?" questions on main...
Sigh. If there's an applause button on posts there should also be a heckle one. But that wouldn't be as welcoming now would it.
Instead of closing questions, maybe we could vote to put the user in stocks and then throw tomatoes at them. While we're at it, we could probably charge a cent per extra tomato once you've exhausted your initial basket of 5.
22:21
what a waste of perfectly good tomatos
You see waste, I see progress
How can we throw tomatoes at bad questions in a more welcoming way?
"it's not you, it's the tomatoes"
tomatos/tomatoes
Suffice to say I'm not a fan of the feature :)
I don't want to sleep
But it's not time to write code.
@AmacOS That isn't an MCVE. I have a rough idea what might fix this but I don't have enough info
Actually, scrap my initial thoughts. They don't include .startswith('mysql'). I don't know why you'd be looking for your connection string that way
06:00 - 23:0023:00 - 00:00

« first day (3542 days earlier)      last day (1630 days later) »