The rule is that whenever possible, a password should never be stored in plain text, and whenever possible, we should only store non invertible hashes. But what matters in your use case is precisely whenever possible. A hash only allows to validate a password while you need to send it, so a hash is a no go. And the DJANGO application has to be able to access the plain text password in order to read/send emails. Of course you could encrypt the password, but you have just put the same problem on step further: what to do with the decrypting key? For that reason, the password has to exist somewhere in plain text, and environment variables are a nice place because the problem of reading the plain text password is left to the launching procedure which can use a privileged (system) account, while the DJANGO application should run under a non privileged one.

Python is, in general, pretty secure against arbitrary code execution vulnerabilities in file parsers. The most likely problem you'd face would be if you were invoking an external program to parse or process the files, in which case there'd both be risk of command injection vulns (which may be mitigated by the temporary file names) and/or parser errors causing memory corruption. With pure python code, the most likely risk is that you'll mis-parse the file (think it claims one resolution or length, when a different codec might "see" a very different value). One very simple test you can do, before even parsing the file data, is just checking its size. That isn't a perfect protection against some attacks (such as "decompression bombs") but it's impossible to spoof the compressed size, at least, as being smaller than it is. If you wanted to be really paranoid, you'd create a sandbox environment (using a VM, or using the sandboxing features of the Linux kernel) and try loading the file within it using a conventional media player app. Then you could see what its length, resolution, etc. are in an environment where malicious code couldn't do anything (ideally, you'd want to extract the data from outside the sandbox, rather than trust anything within it to report accurately). That's almost certainly not needed, though, unless the consequences of uploading maliciously over-size media are really bad.

I don't remember how to work with the arguments called, but try this:def get_category_article(request, slug): In theory, the name of the argument of the same name in the url given in regular terms should be present in the vein.

As an option that first came to the head, to give the list to the template, that is, img_list = [[img1,img2, img3], [img4,img5,img6]...] and then,{% for obj in img_list %} <div class='item'> {% for el in obj %} <div class='col-xs-4'> <img src='{{ el.image.url|safe }}' class="img-responsive" /> </div> {% endfor %} </div> {% endfor %}

First, your own function is called login and system function is called the same. There will be a conflict. Either rename your function or import the system under another name. Second, function https://docs.djangoproject.com/en/1.10/topics/auth/default/#django.contrib.auth.login Accepts two parameters, the first of which is request♪from django.contrib.auth import authenticate, login as auth_login def login(request): username = request.POST['email'] password = request.POST['password'] user = authenticate(username=username, password=password) if user is not None: if user.is_active(): auth_login(request, user) ...

You forgot to add delta in context. Try this:return render_to_response('graf2.html', {'dcster': dcster, 'dcster2': dcster2, 'delta': delta}) Details of render_to_response(s) here. https://docs.djangoproject.com/el/1.10/topics/http/shortcuts/

Decided!I don't know, but after a lot of manipulation, it's working. It may have helped:import sys reload(sys) sys.setdefaultencoding('utf8')

You've correctly written that file_storage is a class field, and as a class field, it's initiated once in the class setting (when the module is imported).In order to initialize this field, each facility has to move initialization to the designer, i.e., to make it a field not an attribute of the class, but an attribute of the object.def __init__(self): self.file_storage = FileSystemStorage( ^^^^ location = os.path.join(settings.MEDIA_ROOT, 'photos', self.date_now_to_path())) ^^^^

What's the veget into the template? You can transfer the list of days of the week to the template and then irradiate it:{% for item in weekdays_list %} <tr {% if w == '1' %}class="{% if h <= '9' and h >= '15' %}red accent-3{% else %}teal{% endif %} white-text"{% endif %}> <td class="pE">{{ item }}</td> <td class="qE">9:00–15:00</td> </tr> {% endfor %}

We'll be out. verbose_name Model field or properties label The field itself, if it is (as a mark to the field, the mould itself will have its meaning). The change request is made by Ajax.

It's gonna be a little easier.def startPage(request): print(request.META['HTTP_ACCEPT']) return render(request, 'polls/startpage.html', {}) I don't know what to do with GET? This time.Try:return redirect('start') These are minor adjustments. But the main problem in the logs is not clear.Only if you send a script (Ajax POST) and expect the server to change the browser page. Then the server has to send an authentication response to your crypt, and the js will be on the right page.

The solution to this issue is described in the open-Edx panel.Reference https://groups.google.com/d/msg/edx-code/Aj4HlsO1SvU/0LM0rUhXAwAJ The problem was that there was no access to the approval of the OpenEdx certification platform.DecisionIssue the temporary zone in lms.env.json and cms.env.jsonTIME_ZONE: Europe/KievWe' time in the ub. dpkg-reconfigure tzdataAdd the clock belt in here. /etc/my.cnfdefault-time-zone = 'Europe/Kiev'Actuate bases mysql_tzinfo_to_sql /usr/share/zoneinfo - sed -e "s/Local time zone must be set--see zic manual page/local/" - mysql -u root mysqlmysql_tzinfo_to_sql /usr/share/zoneinfo/Europe/Kiev 'Europe/Kiev'mysql -u root -p -e "flush tables;" mysql Set up a certificate folder. Published file /etc/init/mounted-tmp.confmkdir /tmp/certificates chown -R www-data: www-data /tmp/certificates{cms/lms}.env.json and add to FEATURES: row ♪ CERTIFICATES_HTML_VIEW: trueSynchronize OBD sudo su edxapp -s /bin/bash cd ~ source edxapp_env python /edx/app/edxapp/edx-platform/manage.py cms syncdb --settings=aws python /edx/app/edxapp/edx-platform/manage.py lms syncdb --settings=awsReset all services by team. sudo /edx/bin/supervisorctl restart all

Without an idea, you're not going to work the form. Make a separate presentation for the form and send an axe or read it after treatment.And the form can be added in the base template through its own strategy:@register.assigment_tag() def get_form(): return FormFoo() HTML{% get_form as form %} <form action={% url 'form_view' %}> {{ form }} <input type="submit"> </form>

Record the g assigment_tag.@register.assigment_tag def count_callbacks(): data = CallBacks.objects.filter(read=False).count() return {'data': data }

They're not supposed to. In order for other users to be placed in the adminica, they should be indicated is_staf = Trueuser_object.is_staf = True user_object.save()

How was the User model created? Is AbstractBaseUser inherited? If you don't, you have to do it.from django.contrib.auth.models import BaseUserManager, AbstractBaseUser class UserManager(BaseUserManager): use_in_migrations = True def _create_user(self, email, password, **extra_fields): ... def create_user(self, email=None, password=None, **extra_fields): ... def create_superuser(self, email, password, **extra_fields): ... class User(AbstractBaseUser, PermissionsMixin): email = models.EmailField(('email address'), unique=True, db_index=True) first_name = models.CharField((u'Имя'), max_length=30, blank=True) last_name = models.CharField((u'Фамилия'), max_length=30, blank=True) is_staff = models.BooleanField(('staff status'), default=False) is_active = models.BooleanField(('active'), default=False) date_joined = models.DateTimeField(('date joined'), default=timezone.now) username = models.CharField(_('username'), max_length=200, null=True, blank=True, db_index=True) objects = UserManager() USERNAME_FIELD = 'email' class Meta: verbose_name = u'пользователя' verbose_name_plural = u'пользователей' def __unicode__(self): return u'%s' % self.get_full_name() and in settings.py specify this model AUTH_USER_MODEL = 'app_name.User

Maybe you need to use a factory for related facilities.>>> from django.forms import inlineformset_factory >>> FormSet = inlineformset_factory(Person, BioInformation) Doc. http://djbook.ru/rel1.9/topics/forms/modelforms.html#inline-formsets

A method could also be used for this purpose. https://docs.python.org/3/library/stdtypes.html?highlight=get%20method#dict.get ♪ it's different that you won't get ♪ KeyErrorif you forget to indicate any value. The result will be None or what you're pointing out as a second argument.json_local.get('sc.site_name', 'default_field_name') Lines can also be stored in a separate module in the form of variables where necessary.

class CasinoForm(forms.ModelForm): country = forms.MultipleChoiceField(queryset=CasinoCountries.objects.all().values_list('id', 'name_ru').order_by('name_ru')) class Meta(): model = Casino fields = ['meta_title','meta_description','meta_keywords','title','logo','mini_logo','background','e_wallet','credit_cards','bank_send','e_partomone','pending_period','raiting_total','raiting_admin','external_href','description','support','description_bonus','payment','valuta','games','langs','license','country','sport','rtp']

You can create a model form. Use standard class Django https://docs.djangoproject.com/en/1.10/topics/forms/modelforms/ Example of documentation>>> from django.forms import ModelForm >>> from myapp.models import Article Create the form class. >>> class ArticleForm(ModelForm): ... class Meta: ... model = Article ... fields = ['pub_date', 'headline', 'content', 'reporter'] Creating a form to add an article. >>> form = ArticleForm() Creating a form to change an existing article. >>> article = Article.objects.get(pk=1) >>> form = ArticleForm(instance=article) In the ModelForm render with a transmitted copy of the model, you will receive a complete data form. Documentation: https://docs.djangoproject.com/en/1.10/topics/forms/modelforms/ http://djbook.ru/rel1.6/topics/forms/modelforms.html