From Stephen.Mazzei at asrcfederal.com  Mon Aug  1 15:54:01 2016
From: Stephen.Mazzei at asrcfederal.com (Mazzei, Stephen Andrew)
Date: Mon, 1 Aug 2016 19:54:01 +0000
Subject: [Flask] Java script dynamic dropdown
Message-ID: <FA1CCD1F7381504ABB7081B0462B9DDC01E33B4D@AFSY-MXDBP2.asrcfh.local>

Good afternoon,

You all have been incredibly helpful so I am looking for a little more help :) . I am trying to create a dynamic drop down menu based on another dropdown menu. Similar to the <State> <City> type thing.

I have the following

    <script type=text/javascript>
        $('#application').on('change', function() {
            $("#result").empty();
            application_name = $("#application option:selected").text();
            application_id = $("#application option:selected").val();
            $.getJSON('/_parse_models', {
                a: application_name,
                b: application_id
            }, function(data) {
                var options = $("#result");
                $.each(data, function() {
                    options.append($("<option />").val(this).text(this));
                });
            });
            return false;
        });
    </script>

    <div class="container">
        <hr/>
        <div>
        <p>
        <td><select id='application'>
            <option value='1'>1</option>
            <option value='2'>2</option>
            <option value='3'>3</option>
        </select></td>
        <td><select name='result'>
            <option value='{{result}}'>{{result}}</option>
        </select></td>
        </form>
        </div>
    </div>

@mod_validations.route('/_parse_models')
def list_models():
    id = request.args.get('b', 0)
    print id
    return jsonify(result=id)


If I can just receive a little help on getting this part to work, I can figure out how to apply real data. Thank you

________________________________

The preceding message (including attachments) is covered by the Electronic Communication Privacy Act, 18 U.S.C. sections 2510-2512, is intended only for the person or entity to which it is addressed, and may contain information that is confidential, protected by attorney-client or other privilege, or otherwise protected from disclosure by law. If you are not the intended recipient, you are hereby notified that any retention, dissemination, distribution, or copying of this communication is strictly prohibited. Please reply to the sender that you have received the message in error and destroy the original message and all copies.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/flask/attachments/20160801/ca2c2d1e/attachment.html>

From guymatz at gmail.com  Thu Aug  4 12:29:08 2016
From: guymatz at gmail.com (Guy Matz)
Date: Thu, 4 Aug 2016 12:29:08 -0400
Subject: [Flask] SDLC configuration
Message-ID: <CABnTgtWP3Tu1v386G1p7WaC4mOTD3eDU3Rn4aNrgE7vS4SQZMQ@mail.gmail.com>

Hi!  I've tried to follow the suggestions here
<http://flask.pocoo.org/docs/0.11/config/#development-production> for
maintaining separate configs for my dev/qa/prod environments but am bumping
into problems . . .

My config can be found here <http://pastebin.com/6gDdT0YT>

I "call" the config like so:
app = Flask(__name__)
env = os.environ['FLOWBOT_ENV']
print("ENV : %s" % env)
app.config.from_object('config.%sConfig' % env.title())

so when env is set to "dev" it should pick up the DevConfig config . . .
 but it seems to want to pick up ALL of the classes in the config and I
can't see why!

when after running the "from_object" above I get output that says
Loading from config/qa/projects.yml
then
Loading from config/production/projects.yml
etc . . .

Any ideas what I'm doing wrong here?

thanks so much,
Guy
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/flask/attachments/20160804/903280de/attachment.html>

From badrihippo at gmail.com  Fri Aug  5 08:24:54 2016
From: badrihippo at gmail.com (Badri Sunderarajan)
Date: Fri, 5 Aug 2016 17:54:54 +0530
Subject: [Flask] SDLC configuration
In-Reply-To: <CABnTgtWP3Tu1v386G1p7WaC4mOTD3eDU3Rn4aNrgE7vS4SQZMQ@mail.gmail.com>
References: <CABnTgtWP3Tu1v386G1p7WaC4mOTD3eDU3Rn4aNrgE7vS4SQZMQ@mail.gmail.com>
Message-ID: <57A48596.6080200@gmail.com>

Looking at your pastebin code, it seems like you're calling the 
load_active_projects() function while /defining/ the classes, rather 
than when you're actually using them. So the Python interpreter will be 
executing load_active_projects for each of (ProductionConfig, DevConfig, 
QaConfig) /before/ it actually uses the DevConfig class.

You can confirm this by checking the value of app.config['FLOWBOT_ENV'] 
from your main app.

I don't know how exactly Flask's config.from_object works, but I think 
what you want to do would be more like:

class DevConfig(Config):
     FLOWBOT_ENV = 'dev'
     # ... other config goes here ...
     def __init__(self):
         self.PROJECTS = load_active_projects(self.FLOWBOT_ENV)
         self.SCHEDULED_JOBS = load_active_scheduled_jobs(FLOWBOT_ENV)

...so that your load functions are only called when the class is 
actually instantiated (used).

Sorry I can't into it properly at the moment?tell me how it goes and 
I'll check back tomorrow when I have more time ;)

?Badri/Hippo
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/flask/attachments/20160805/770288bb/attachment.html>

From badrihippo at gmail.com  Sun Aug  7 03:05:33 2016
From: badrihippo at gmail.com (Badri Sunderarajan)
Date: Sun, 7 Aug 2016 12:35:33 +0530
Subject: [Flask] SDLC configuration
In-Reply-To: <CABnTgtWRRkj976yVAOUfmQkOPRb2W6utj3F0=-YwrTNkQ8i+UA@mail.gmail.com>
References: <CABnTgtWP3Tu1v386G1p7WaC4mOTD3eDU3Rn4aNrgE7vS4SQZMQ@mail.gmail.com>
 <57A48596.6080200@gmail.com>
 <CABnTgtWRRkj976yVAOUfmQkOPRb2W6utj3F0=-YwrTNkQ8i+UA@mail.gmail.com>
Message-ID: <57A6DDBD.4080801@gmail.com>

You're welcome!

Yeah, I just tried it and realised: the __init__ and __new__ functions 
don't work config files. I think you'll have to fall back to doing 
something like

class DevConfig(Config):
     FLOWBOT_ENV = 'dev'

     # ... other config ...#

     # Only do the loading if FLOWBOT_ENV actually matches
     if os.environ.get('FLOWBOT_ENV', None) == FLOWBOT_ENV:
         self.PROJECTS = load_activee_projects(self.FLOWBOT_ENV)
         self.SCHEDULED_JOBS = load_active_scheduled_jobs(FLOWBOT_ENV)

...which checks the actual FLOWBOT_ENV environment variable to decide 
whether to load it or not. If-statements do work there, even though the 
init functions don't. While not a very pretty solution, it'll prevent 
against unnecessary loading of files. Do let me know if you think of 
anything better, though!

?Badri/Hippo

On 08/06/2016 12:45 AM, Guy Matz wrote:
> You're totally right!  Thanks!  Unfortunately, it doesn't look like 
> the Config as outlined in the flask docs 
> <http://flask.pocoo.org/docs/0.11/config/#configuring-from-files> allow for 
> an __init__, but I could totally be wrong since I don't understand 
> what those classes are in that documentation that don't contain a 
> "self".  Any ideas?
>
> Much appreciated!!
> regards,
> Guy
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/flask/attachments/20160807/fcc80d31/attachment.html>

From guymatz at gmail.com  Mon Aug  8 11:31:19 2016
From: guymatz at gmail.com (Guy Matz)
Date: Mon, 8 Aug 2016 11:31:19 -0400
Subject: [Flask] SDLC configuration
In-Reply-To: <57A6DDBD.4080801@gmail.com>
References: <CABnTgtWP3Tu1v386G1p7WaC4mOTD3eDU3Rn4aNrgE7vS4SQZMQ@mail.gmail.com>
 <57A48596.6080200@gmail.com>
 <CABnTgtWRRkj976yVAOUfmQkOPRb2W6utj3F0=-YwrTNkQ8i+UA@mail.gmail.com>
 <57A6DDBD.4080801@gmail.com>
Message-ID: <CABnTgtXtpBqM5KCRH5Y9GtUe+t7nJXmJ0Hae2iR0OiFgYBtBFQ@mail.gmail.com>

Thanks!   Yeah, that works when I remove the references to self, but I
don't like the idea of having to repeat that code in the definition for
each environment . . .  would be nice to have that in the super-class
(Config), but that doesn't seem to work . . .

I still don't really understand what kind of class Config is, that doesn't
use self or have the usual dunder-score methods . . .

On Sun, Aug 7, 2016 at 3:05 AM, Badri Sunderarajan <badrihippo at gmail.com>
wrote:

> You're welcome!
>
> Yeah, I just tried it and realised: the __init__ and __new__ functions
> don't work config files. I think you'll have to fall back to doing
> something like
>
> class DevConfig(Config):
>     FLOWBOT_ENV = 'dev'
>
>     # ... other config ... #
>
>     # Only do the loading if FLOWBOT_ENV actually matches
>     if os.environ.get('FLOWBOT_ENV', None) == FLOWBOT_ENV:
>         self.PROJECTS = load_activee_projects(self.FLOWBOT_ENV)
>         self.SCHEDULED_JOBS = load_active_scheduled_jobs(FLOWBOT_ENV)
>
> ...which checks the actual FLOWBOT_ENV environment variable to decide
> whether to load it or not. If-statements do work there, even though the
> init functions don't. While not a very pretty solution, it'll prevent
> against unnecessary loading of files. Do let me know if you think of
> anything better, though!
>
> ?Badri/Hippo
>
> On 08/06/2016 12:45 AM, Guy Matz wrote:
>
> You're totally right!  Thanks!  Unfortunately, it doesn't look like the
> Config as outlined in the flask docs
> <http://flask.pocoo.org/docs/0.11/config/#configuring-from-files> allow
> for an __init__, but I could totally be wrong since I don't understand what
> those classes are in that documentation that don't contain a "self".  Any
> ideas?
>
> Much appreciated!!
> regards,
> Guy
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/flask/attachments/20160808/27f4d469/attachment.html>

From badrihippo at gmail.com  Tue Aug  9 04:36:24 2016
From: badrihippo at gmail.com (Badri Sunderarajan)
Date: Tue, 9 Aug 2016 14:06:24 +0530
Subject: [Flask] SDLC configuration
In-Reply-To: <CABnTgtXtpBqM5KCRH5Y9GtUe+t7nJXmJ0Hae2iR0OiFgYBtBFQ@mail.gmail.com>
References: <CABnTgtWP3Tu1v386G1p7WaC4mOTD3eDU3Rn4aNrgE7vS4SQZMQ@mail.gmail.com>
 <57A48596.6080200@gmail.com>
 <CABnTgtWRRkj976yVAOUfmQkOPRb2W6utj3F0=-YwrTNkQ8i+UA@mail.gmail.com>
 <57A6DDBD.4080801@gmail.com>
 <CABnTgtXtpBqM5KCRH5Y9GtUe+t7nJXmJ0Hae2iR0OiFgYBtBFQ@mail.gmail.com>
Message-ID: <57A99608.6080202@gmail.com>

I think having Config as a class is just a convenient way to have 
multiple configs without repeating code (so you can just inherit the 
repeating bits). From what I can make out, Flask doesn't actually use it 
as a normal class (eg. call __new__ and stuff).

Maybe it'll be better in this case to forget about trying to make it 
object-oriented (come on, it's just a config file!) and run it as a 
normal script. So you can have

FLOWBOT_ENV = os.environ.get('FLOWBOT_ENV', None)
if FLOWBOT_ENV is not None:
     self.PROJECTS = load_active_projects(FLOWBOT_ENV)
     self.SCHEDULED_JOBS = load_active_scheduled_jobs(FLOWBOT_ENV)

This is usually not recommended because it'll do the loading according 
to the environment variable and give the same values for all the configs 
(eg. if FLOWBOT_ENV == 'foo' then it'll load 'foo' files for /all/ of 
Config, DevConfig, ProductionConfig, ...). But in this case it doesn't 
matter because you know you're choosing the /config/ itself based on the 
environment variable as well. So basically, the other configs will 
sometimes be wrong, but only when you're not using them.

This can get confusing for later developers, though, so make sure you 
explain it in the comments! Or it might be better to drop the whole idea 
of inheriting classes and do the whole config as a script:

FLOWBOT_ENV = os.environ.get('FLOWBOT_ENV', None)

# generic config options here

if FLOWBOT_ENV == 'dev':
     # dev-specific options here
elif FLOWBOT_ENV == 'production':
     # production-specific options here
elif FLOWBOT_ENV == 'qa':
     # qa-specific options here
# ...

(This will need app.config.from_pyfile instead of from_object). 
Inheritance would be useful if you're going to be doing multi-level 
inheritance (eg. having a TestingConfig and BackupServerDevConfig 
subclassing DevConfig), but in your case I think you'll be equally fine 
with the script style.

Basically it's just a config script so I guess you could just use 
whichever style seems to work better for you. Also, remember it's 
interpreted line-by-line. So something you set later will override what 
you set earlier anyways.

DEBUG = False
# (some other code)
if something:
     DEBUG = True

# if something was True then DEBUG will end up as turned on,
# even if it was off to start with

Sorry if that was a bit long coz I was thinking as I typed! Hope it helps.

?Badri/Hippo
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/flask/attachments/20160809/723de508/attachment.html>

From arsh840 at gmail.com  Thu Aug 11 08:29:05 2016
From: arsh840 at gmail.com (Arshpreet Singh)
Date: Thu, 11 Aug 2016 17:59:05 +0530
Subject: [Flask] Trading bot in Flask
Message-ID: <CAAstK2HLBbWUZqz4mdPfqRRmY7stKf3nDH80PhpqguwWDUyC1Q@mail.gmail.com>

I am making a bitcoin trrading bot using Flask. I am using this API:
https://github.com/absortium/poloniex-api

I have basic understand of creating a Python Web-apps but in my this
Flask APP I need to update ticker's data in webpage after every
second(Do I need Ajax for that?)

and on the other hand when my strategy returns a required results I
have to execute Buy and sell function as well. Can flask be helpful in
such situation?

-- 

Thanks
Arshpreet Singh
Mobile: (91)987 6458 387
https://www.linkedin.com/in/arsh840

From david at davidbaumgold.com  Thu Aug 11 09:21:22 2016
From: david at davidbaumgold.com (David Baumgold)
Date: Thu, 11 Aug 2016 09:21:22 -0400
Subject: [Flask] Trading bot in Flask
In-Reply-To: <CAAstK2HLBbWUZqz4mdPfqRRmY7stKf3nDH80PhpqguwWDUyC1Q@mail.gmail.com>
References: <CAAstK2HLBbWUZqz4mdPfqRRmY7stKf3nDH80PhpqguwWDUyC1Q@mail.gmail.com>
Message-ID: <etPan.57ac7bd7.10dcd59d.156d@davidbaumgold.com>

Why are you using Flask for this? It sounds like you want a bot that runs on a server, checks the API every so often, and executes buy and sell orders automatically. None of that requires a web interface. Flask is a great tool, but it?s quite minimal: it?s designed to respond to HTTP requests, and that?s all.

I?ll also point out that the poloniex-api project you linked to is built on top of aiohttp, not Flask. The documentation for aiohttp is here:?http://aiohttp.readthedocs.io/en/stable/?Aiohttp is also designed to respond to HTTP requests ? you don?t need both aiohttp and Flask.

David Baumgold

On August 11, 2016 at 8:29:30 AM, Arshpreet Singh (arsh840 at gmail.com) wrote:

I am making a bitcoin trrading bot using Flask. I am using this API:  
https://github.com/absortium/poloniex-api  

I have basic understand of creating a Python Web-apps but in my this  
Flask APP I need to update ticker's data in webpage after every  
second(Do I need Ajax for that?)  

and on the other hand when my strategy returns a required results I  
have to execute Buy and sell function as well. Can flask be helpful in  
such situation?  

--  

Thanks  
Arshpreet Singh  
Mobile: (91)987 6458 387  
https://www.linkedin.com/in/arsh840  
_______________________________________________  
Flask mailing list  
Flask at python.org  
https://mail.python.org/mailman/listinfo/flask  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/flask/attachments/20160811/7715da10/attachment.html>

From John.Robson at usp.br  Sun Aug 14 00:46:32 2016
From: John.Robson at usp.br (John Robson)
Date: Sun, 14 Aug 2016 00:46:32 -0400
Subject: [Flask] Flask won't set cookies for IP based domains
Message-ID: <noot38$nqt$1@blaine.gmane.org>

Hi everyone,

I have a weird problem with CSRF validation.

Running my app with "http://0.0.0.0:5001/" the Form CSRF validation 
Works Fine.

But when I changed to "http://192.168.0.106:5001/" the CSRF become 
invalid. (this is my Wi-Fi IP, I use it to access my laptop site with my 
smartphone)

I believe that the problem is because Flask won't set cookies for IP 
based domains.

I add to /etc/hosts : "192.168.0.106 myapp.dev" and I add to Config 
file: SERVER_NAME = 'myapp.dev:5001'

But the cookies still not working and therefore CSRF still invalid.

I'll appreciate if someone run my code in a different domain or IP to 
figure out what is wrong.

Code: https://github.com/USP/Flask

Running:  http://2gm8ql-flask-staging-usp.runnableapp.com:5001/

(refresh 2 times to get cookies)


Screenshots: https://github.com/USP/Flask/tree/master/static/img

Thank you very much,
John


From mehdiesteghamat at gmail.com  Tue Aug 16 15:57:28 2016
From: mehdiesteghamat at gmail.com (Mehdi Esteghamatian)
Date: Wed, 17 Aug 2016 00:27:28 +0430
Subject: [Flask] Deploy Flask-Python on Separate Folder in Windows Server
 2012
Message-ID: <CAByWZpqg1HGguX+z+cWU=4isZkQ7AvxB2zuyK-PTDJYxdiFKjg@mail.gmail.com>

Hi All,

I am new to flask and recently I have been working on a web application in
Flask/Python. I use VS-2015 and Python Tools for VS for this matter.

I would like to have Flask and Python installed on a shared server. Since
it is a shared server, I would like to know if it is possible to install
everything the server needs including the python interpreter under a
separate folder on a Window Server 2012 machine. In such a way that It can
be assured nothing else outside the sub-folder is required to be installed.


I know the general idea exists thanks to python virtual environments.
However, that is more about development time where you can have everything
your project needs under a separate folder. But, what about release time in
a shred Windows server?

Would it be possible to just copy the virtual environment folder into a
production server and expect that every things works in the same way
without having to go through all trouble for installing pip and virtual
environments from scratch?

Please let me know.

Thank you,
Mike
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/flask/attachments/20160817/253c1e37/attachment.html>

From unai at sysbible.org  Tue Aug 16 23:13:32 2016
From: unai at sysbible.org (Unai Rodriguez)
Date: Wed, 17 Aug 2016 11:13:32 +0800
Subject: [Flask] Deploy Flask-Python on Separate Folder in Windows
 Server 2012
In-Reply-To: <CAByWZpqg1HGguX+z+cWU=4isZkQ7AvxB2zuyK-PTDJYxdiFKjg@mail.gmail.com>
References: <CAByWZpqg1HGguX+z+cWU=4isZkQ7AvxB2zuyK-PTDJYxdiFKjg@mail.gmail.com>
Message-ID: <1471403612.1065740.697564513.77A24BF3@webmail.messagingengine.com>

Hi Mike,

Is Linux an option here? Because it would be extremely easy to do -- it
just works in the way you describe. I am not so sure about the Windows
version though...

-- unai


On Wed, Aug 17, 2016, at 03:57 AM, Mehdi Esteghamatian wrote:
> Hi All,
>
> I am new to flask and recently I have been working on a web
> application in Flask/Python. I use VS-2015 and Python Tools for VS for
> this matter.
>
> I would like to have Flask and Python installed on a shared server.
> Since it is a shared server, I would like to know if it is possible to
> install everything the server needs including the python interpreter
> under a separate folder on a Window Server 2012 machine. In such a way
> that It can be assured nothing else outside the sub-folder is required
> to be installed.
>
>
> I know the general idea exists thanks to python virtual environments.
> However, that is more about development time where you can have
> everything your project needs under a separate folder. But, what about
> release time in a shred Windows server?
>
> Would it be possible to just copy the virtual environment folder into
> a production server and expect that every things works in the same way
> without having to go through all trouble for installing pip and
> virtual environments from scratch?
>
> Please let me know.
>
> Thank you,
> Mike
> _________________________________________________
> Flask mailing list
> Flask at python.org
> https://mail.python.org/mailman/listinfo/flask
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/flask/attachments/20160817/934688ba/attachment.html>

From alex-alex-90 at wp.pl  Sun Aug 21 13:24:32 2016
From: alex-alex-90 at wp.pl (Alex Alex)
Date: Sun, 21 Aug 2016 19:24:32 +0200
Subject: [Flask] Executing user input python code inside flask app context
Message-ID: <57b9e3d0d89936.76974707@wp.pl>

Hi,



I'm working on flask based webapp that requires users to be able to eneter and execute python code (+ presenting exeuction output) within flask app context. As I'm new to flask (and I love it) I'd be greatful for any tips regarding implementing such functionality. As a side note: the security is not a concern so please don't responde with code snippets containg os.system('rm -rf /') as example of dangerus user input. I'm also not interested in running code inside pypy sandbox (at least not on 
this stage).
 
Thank you in advance
BR
Alex 
 




From aresowj at gmail.com  Sun Aug 21 16:32:15 2016
From: aresowj at gmail.com (Ares Ou)
Date: Sun, 21 Aug 2016 13:32:15 -0700
Subject: [Flask] Executing user input python code inside flask app
 context
In-Reply-To: <57b9e3d0d89936.76974707@wp.pl>
References: <57b9e3d0d89936.76974707@wp.pl>
Message-ID: <CAFCGC=ZmueVKU81=Dv2MGKtBigeh9vdmg_RrX2+jCd9Wm9wEYw@mail.gmail.com>

I guess u should at least run you app with a limited user to avoid those
dangerous actions. Then try to filter out all undesired patterns.

On Aug 21, 2016 12:11, "Alex Alex" <alex-alex-90 at wp.pl> wrote:

> Hi,
>
>
>
> I'm working on flask based webapp that requires users to be able to eneter
> and execute python code (+ presenting exeuction output) within flask app
> context. As I'm new to flask (and I love it) I'd be greatful for any tips
> regarding implementing such functionality. As a side note: the security is
> not a concern so please don't responde with code snippets containg
> os.system('rm -rf /') as example of dangerus user input. I'm also not
> interested in running code inside pypy sandbox (at least not on
> this stage).
>
> Thank you in advance
> BR
> Alex
>
>
>
>
> _______________________________________________
> Flask mailing list
> Flask at python.org
> https://mail.python.org/mailman/listinfo/flask
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/flask/attachments/20160821/5fe2e396/attachment.html>

From alex-alex-90 at wp.pl  Mon Aug 22 02:42:23 2016
From: alex-alex-90 at wp.pl (Alex Alex)
Date: Mon, 22 Aug 2016 08:42:23 +0200
Subject: [Flask] Odp: Re: Executing user input python code inside flask app
 context
Message-ID: <57ba9ecf0df6b4.09418539@wp.pl>

Thanks, but as far as filtering user input and limiting python interpreter goes all those approaches failed just look how bastion module failed. As I've said the security is not a concern here. Furthermore the app will be running inside a docker container so the worst thing can happen is particular container instance getting destroyed. I'm really interested only in any tips regarding executing python code within flask web app.
All the best
Alex  

Dnia Niedziela, 21 Sierpnia 2016 22:32 Ares Ou <aresowj at gmail.com> napisa?(a)
> I guess u should at least run you app with a limited user to avoid those dangerous actions. Then try to filter out all undesired patterns.
> On Aug 21, 2016 12:11, "Alex Alex" <alex-alex-90 at wp.pl> wrote:
> > Hi,
> >  
> >  
> >  
> >  I'm working on flask based webapp that requires users to be able to eneter and execute python code (+ presenting exeuction output) within flask app context. As I'm new to flask (and I love it) I'd be greatful for any tips regarding implementing such functionality. As a side note: the security is not a concern so please don't responde with code snippets containg os.system('rm -rf /') as example of dangerus user input. I'm also not interested in running code inside pypy sandbox (at least 
not on
> >  this stage).
> >  
> >  Thank you in advance
> >  BR
> >  Alex
> >  
> >  
> >  
> >  
> >  _______________________________________________
> >  Flask mailing list
> >  Flask at python.org
> >  https://mail.python.org/mailman/listinfo/flask
> 


 




From coreybrett at gmail.com  Mon Aug 22 08:00:55 2016
From: coreybrett at gmail.com (Corey Boyle)
Date: Mon, 22 Aug 2016 08:00:55 -0400
Subject: [Flask] Odp: Re: Executing user input python code inside flask
 app context
In-Reply-To: <57ba9ecf0df6b4.09418539@wp.pl>
References: <57ba9ecf0df6b4.09418539@wp.pl>
Message-ID: <CAD=ssw0pjJZh2d07gO3uxmVpc6Dys-Emxz=QD_pqmaxyAYA=GA@mail.gmail.com>

Why not use a form to collect the code, then pipe it into a Python process
using the subprocess
<https://docs.python.org/2/library/subprocess.html#module-subprocess> module.
You may have to store the code in a temp file, not sure.

What are your end goals?

On Aug 22, 2016 2:42 AM, "Alex Alex" <alex-alex-90 at wp.pl> wrote:

> Thanks, but as far as filtering user input and limiting python interpreter
> goes all those approaches failed just look how bastion module failed. As
> I've said the security is not a concern here. Furthermore the app will be
> running inside a docker container so the worst thing can happen is
> particular container instance getting destroyed. I'm really interested only
> in any tips regarding executing python code within flask web app.
> All the best
> Alex
>
> Dnia Niedziela, 21 Sierpnia 2016 22:32 Ares Ou <aresowj at gmail.com>
> napisa?(a)
> > I guess u should at least run you app with a limited user to avoid those
> dangerous actions. Then try to filter out all undesired patterns.
> > On Aug 21, 2016 12:11, "Alex Alex" <alex-alex-90 at wp.pl> wrote:
> > > Hi,
> > >
> > >
> > >
> > >  I'm working on flask based webapp that requires users to be able to
> eneter and execute python code (+ presenting exeuction output) within flask
> app context. As I'm new to flask (and I love it) I'd be greatful for any
> tips regarding implementing such functionality. As a side note: the
> security is not a concern so please don't responde with code snippets
> containg os.system('rm -rf /') as example of dangerus user input. I'm also
> not interested in running code inside pypy sandbox (at least
> not on
> > >  this stage).
> > >
> > >  Thank you in advance
> > >  BR
> > >  Alex
> > >
> > >
> > >
> > >
> > >  _______________________________________________
> > >  Flask mailing list
> > >  Flask at python.org
> > >  https://mail.python.org/mailman/listinfo/flask
> >
>
>
>
>
>
>
> _______________________________________________
> Flask mailing list
> Flask at python.org
> https://mail.python.org/mailman/listinfo/flask
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/flask/attachments/20160822/7a9b87ed/attachment.html>

From alex-alex-90 at wp.pl  Mon Aug 22 09:02:31 2016
From: alex-alex-90 at wp.pl (Alex Alex)
Date: Mon, 22 Aug 2016 15:02:31 +0200
Subject: [Flask] Odp: Re: Odp: Re: Executing user input python code inside
 flask app context
Message-ID: <57baf7e7810fb2.29661149@wp.pl>

An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/flask/attachments/20160822/de56b944/attachment-0001.html>

From alexeibendebury at gmail.com  Mon Aug 22 21:53:57 2016
From: alexeibendebury at gmail.com (Alexei Bendebury)
Date: Mon, 22 Aug 2016 18:53:57 -0700
Subject: [Flask] Help with converters that require an application context
Message-ID: <CAJT4QUw35WKZPzPxMVeJS2LVXLiGbbGw-zB5hHp9A9Xgcpg0sg@mail.gmail.com>

Hello all,

I'm working on a project in which I have a lot of views that take in
an ID number of some model via url variables and then check if the
model exists before continuing.

I thought that it would be useful to move this functionality into a
url converter to clean up my code.

However, it seems that I need an application context to do a database
lookup in a url converter, and I can't quite figure out how to do it.

This SO question isn't mine, but it perfectly describes my issue,
along with code examples:

https://stackoverflow.com/questions/33856007/passing-application-context-to-custom-converter-using-the-application-factory-pa

I'd appreciate any suggestions on what to do.

From davidnieder at gmx.de  Tue Aug 23 06:41:13 2016
From: davidnieder at gmx.de (David Nieder)
Date: Tue, 23 Aug 2016 12:41:13 +0200
Subject: [Flask] Executing user input python code inside flask app
 context
In-Reply-To: <57b9e3d0d89936.76974707@wp.pl>
References: <57b9e3d0d89936.76974707@wp.pl>
Message-ID: <80773946-c0ae-380c-f200-686d9fedc959@gmx.de>

On 21.08.2016 19:24, Alex Alex wrote:
> Hi,
>
>
>
> I'm working on flask based webapp that requires users to be able to eneter and execute python code (+ presenting exeuction output) within flask app context. As I'm new to flask (and I love it) I'd be greatful for any tips regarding implementing such functionality. As a side note: the security is not a concern so please don't responde with code snippets containg os.system('rm -rf /') as example of dangerus user input. I'm also not interested in running code inside pypy sandbox (at least not on
> this stage).
>
> Thank you in advance
> BR
> Alex
>
>

Hi Alex.

You could use the code module:
https://docs.python.org/2.7/library/code.html
Here is a very minimal but working example of how you could go about it:


import sys
from StringIO import StringIO
from code import InteractiveInterpreter
from flask import Flask, request, Response


app = Flask(__name__)

@app.route('/', methods=['GET', 'POST'])
def index():
     if request.method == 'GET':
         return '''
             <form action="/" method="post">
                 <input type="text" name="user-input">
                 <input type="submit">
             </form>
         '''

     remember_stdout = sys.stdout
     stdout = StringIO()
     sys.stdout = stdout

     interpreter = InteractiveInterpreter({
         '__name__': 'console',
         '__doc__': None,
         # add objects you want to make available here, e.g.
         'app': app,
         'request': request
         })
     interpreter.runsource(request.form.get('user-input'))

     sys.stdout = remember_stdout
     return Response(stdout.getvalue(), mimetype='text/plain')

if __name__ == '__main__':
     app.run(debug=True)


You probably want to extend this quite a bit (support multi-line 
statements, input history, ...).
Take a look at the werkzeug debug console which does a similar thing. 
And since you have werkzeug installed you could directly use a lot of 
it's code.
https://github.com/pallets/werkzeug/tree/master/werkzeug/debug

You stressed security is not a concern but I have to note anyway that 
this is highly insecure and people got hacked before having sth like 
this exposed on the web.

Hope this was helpful
David

From alex-alex-90 at wp.pl  Tue Aug 23 14:48:55 2016
From: alex-alex-90 at wp.pl (Alex Alex)
Date: Tue, 23 Aug 2016 20:48:55 +0200
Subject: [Flask] Executing user input python code inside flask app
 context
Message-ID: <57bc9a97319071.10346385@wp.pl>

An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/flask/attachments/20160823/e91f56c2/attachment.html>

From Stephen.Mazzei at asrcfederal.com  Tue Aug 23 15:52:04 2016
From: Stephen.Mazzei at asrcfederal.com (Mazzei, Stephen Andrew)
Date: Tue, 23 Aug 2016 19:52:04 +0000
Subject: [Flask] Adding hyperlink to Pandas Data Frame
Message-ID: <FA1CCD1F7381504ABB7081B0462B9DDC01FACF13@AFSY-MXDBP1.asrcfh.local>

Good afternoon,

I am currently working on a page that present a pandas data frame. The table displays the over arching information. What I am wanting to do is make one of the columns either click-able or a hyper link. When a user clicks this item, it brings them to a new page showing more details for that line. How can I design this "drill down" feature? Can I use the df for this?

My html code is the following:
{{validation_df | safe}}

I do not know if I can change the way the df is presented on the html code and allow almost a table to be built?
{% for items in validation_df %}
Table
Header
Rows?

Looking for some advice on this. Thank you,


---
Stephen A. Mazzei
Systems Administrator | AFDS, ASRC Federal Data Solutions - P&G HPC Account | 513-634-9965


________________________________

The preceding message (including attachments) is covered by the Electronic Communication Privacy Act, 18 U.S.C. sections 2510-2512, is intended only for the person or entity to which it is addressed, and may contain information that is confidential, protected by attorney-client or other privilege, or otherwise protected from disclosure by law. If you are not the intended recipient, you are hereby notified that any retention, dissemination, distribution, or copying of this communication is strictly prohibited. Please reply to the sender that you have received the message in error and destroy the original message and all copies.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/flask/attachments/20160823/782a8b38/attachment.html>

From projetmbc at gmail.com  Tue Aug 23 16:20:51 2016
From: projetmbc at gmail.com (Christophe Bal)
Date: Tue, 23 Aug 2016 22:20:51 +0200
Subject: [Flask] Executing user input python code inside flask app
 context
In-Reply-To: <57b9e3d0d89936.76974707@wp.pl>
References: <57b9e3d0d89936.76974707@wp.pl>
Message-ID: <CAAb4jGnA4ux5P9Q-D_epZiEqK+z=pA3owMB=BBBmS+HtNPkS_Q@mail.gmail.com>

Hello.

What kind of programs your user will code ? Do they code simple program ?
Have you consider solutions like brython which is safe to use on a server.


*Christophe BAL*
*Enseignant de math?matiques en Lyc?e **et d?veloppeur Python amateur*
*---*
*French teacher of **math** in a high school **and **amateur **Python *
*developer*

2016-08-21 19:24 GMT+02:00 Alex Alex <alex-alex-90 at wp.pl>:

> Hi,
>
>
>
> I'm working on flask based webapp that requires users to be able to eneter
> and execute python code (+ presenting exeuction output) within flask app
> context. As I'm new to flask (and I love it) I'd be greatful for any tips
> regarding implementing such functionality. As a side note: the security is
> not a concern so please don't responde with code snippets containg
> os.system('rm -rf /') as example of dangerus user input. I'm also not
> interested in running code inside pypy sandbox (at least not on
> this stage).
>
> Thank you in advance
> BR
> Alex
>
>
>
>
> _______________________________________________
> Flask mailing list
> Flask at python.org
> https://mail.python.org/mailman/listinfo/flask
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/flask/attachments/20160823/4e044fda/attachment.html>

From projetmbc at gmail.com  Tue Aug 23 16:44:10 2016
From: projetmbc at gmail.com (Christophe Bal)
Date: Tue, 23 Aug 2016 22:44:10 +0200
Subject: [Flask] Executing user input python code inside flask app
 context
In-Reply-To: <57bc9a97319071.10346385@wp.pl>
References: <57bc9a97319071.10346385@wp.pl>
Message-ID: <CAAb4jG=g37+oia68exMdRKMeCLN1jmuRjGFxxOvUZMwpNstiRQ@mail.gmail.com>

Hello (bis).

What kind of container do you use ?


*Christophe BAL*
*Enseignant de math?matiques en Lyc?e **et d?veloppeur Python amateur*
*---*
*French teacher of **math** in a high school **and **amateur **Python *
*developer*

2016-08-23 20:48 GMT+02:00 Alex Alex <alex-alex-90 at wp.pl>:

> Dear David,
>
> Thank you for all the input. The werkzeug looks very promising and
> interesting. This is a great idea. Thanks for a example code snippet -
> using code module is a good idea as well. Below is a code I came up so far
> but I'm not happy with it. It's just a quick hack and I'm not proud of it:
>
>
>
> @app.route('/', methods=['GET', 'POST'])
>
> def hello_world():
>
>     form = ExecForm()
>
>     if form.validate_on_submit():
>
>         flash('Python statement to execute: %s from %s' %
> (form.python_cmd.data, form.python_cmd))
>
>
>
>         output = StringIO.StringIO()
>
>         err = StringIO.StringIO()
>
>
>
>         sys.stderr = err
>
>         sys.stdout = output
>
>
>
>         try:
>
>             exec(form.python_cmd.data)
>
>             outp = output.getvalue()
>
>             e = err.getvalue()
>
>         except SyntaxError as exc:
>
>             e = str(exc)
>
>             outp = ''
>
>         except NameError as exc:
>
>             e = str(exc)
>
>             outp = ''
>
>         except:
>
>             e = 'Failed to execute code: %s' % form.python_cmd.data
>
>             outp = ''
>
>
>
>         sys.stdout = sys.__stdout__
>
>         sys.stderr = sys.__stderr__
>
>
>
>         output.close()
>
>         err.close()
>
>         if outp:
>
>             flash(Markup('<img src="static/python-16x16.png" alt="python">
> %s' % outp), 'success')
>
>         if e:
>
>             flash('Error: %s' % e, 'danger')
>
>         return redirect('/')
>
>     return render_template('index.html', title='Exec', form=form)
>
>
>
> As far as security concerns you are right and I fully agree with you. But
> if the project gets acceptance this will not be an issue in this case. As
> I've said running this inside a container in worst case scenario wipes out
> only container which can be easly recrated in seconds. Ability to access
> complete flask app context allso allows you to bypass authentication and
> authorization models of an webapp since by accessing SQLAlchemy instance
> you can query database, but in my casa this is the whole point: being able
> to access data through web without any constrains of webapp itself, and
> being able to do it using keyboard instead of clicking through doze of web
> forms.
>
>
>
> BR
>
> Alex
>
>
>
>
> _______________________________________________
> Flask mailing list
> Flask at python.org
> https://mail.python.org/mailman/listinfo/flask
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/flask/attachments/20160823/f561f78f/attachment-0001.html>

From alex-alex-90 at wp.pl  Tue Aug 23 17:36:58 2016
From: alex-alex-90 at wp.pl (Alex Alex)
Date: Tue, 23 Aug 2016 23:36:58 +0200
Subject: [Flask] Odp: Re: Executing user input python code inside flask app
 context
Message-ID: <57bcc1fa87dfa4.08050416@wp.pl>

An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/flask/attachments/20160823/9760d026/attachment.html>

From alex-alex-90 at wp.pl  Tue Aug 23 17:42:12 2016
From: alex-alex-90 at wp.pl (Alex Alex)
Date: Tue, 23 Aug 2016 23:42:12 +0200
Subject: [Flask] Odp: Re: Executing user input python code inside flask app
 context
Message-ID: <57bcc33407d037.56511994@wp.pl>

An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/flask/attachments/20160823/94db2a9d/attachment.html>

From alex-alex-90 at wp.pl  Thu Aug 25 17:34:27 2016
From: alex-alex-90 at wp.pl (Alex Alex)
Date: Thu, 25 Aug 2016 23:34:27 +0200
Subject: [Flask] Reusing flask database model in client app
Message-ID: <57bf64637a7223.22964960@wp.pl>

An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/flask/attachments/20160825/7cd54410/attachment.html>

From alex-alex-90 at wp.pl  Thu Aug 25 17:43:20 2016
From: alex-alex-90 at wp.pl (Alex Alex)
Date: Thu, 25 Aug 2016 23:43:20 +0200
Subject: [Flask] Deploy Flask-Python on Separate Folder in Windows Server
 2012
Message-ID: <57bf66784eaaa8.25191157@wp.pl>

An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/flask/attachments/20160825/a5c42238/attachment.html>

From John.Robson at usp.br  Fri Aug 26 14:16:14 2016
From: John.Robson at usp.br (John Robson)
Date: Fri, 26 Aug 2016 14:16:14 -0400
Subject: [Flask] Qt: Session management error: Authentication Rejected
Message-ID: <npq11d$qdu$1@blaine.gmane.org>

Hi everyone,

When I run "pandas my_dataframe.plot()", Flask freezes for +1 minute and 
I got this ERROR:

"Qt: Session management error: Authentication Rejected, reason : None of 
the authentication protocols specified are supported and host-based 
authentication failed"

But when I run directly on the terminal (Linux) (without the flask 
server), works fast without error!!!

I believe that Flask / Werkzeug / WSGI are the problem. Maybe I need to 
give them some permission (export DISPLAY=":0.0" ? .Xauthority ?) like I 
have with my regular user, but I have no idea what I need to do 
(creating a new user? setting some config?).

Someone knows how to solve this error?

Thank you in advance.
John