-
-
Notifications
You must be signed in to change notification settings - Fork 308
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
error when changing from version0.13.1 to 0.14 #275
Comments
I can't reproduce your issue. The session token is generated as a string, not bytes, on Python 3, and the serializer handles it correctly. The only thing I can think of is that there might be invalid data in the session due to the change in how the token is generated, but I couldn't reproduce that either. Try clearing the browser's cookies for your app (probably localhost or 127.0.0.1). If that doesn't work, you'll need to provide a self-contained example that reproduces the issue. |
This has happened to me when upgrading my code from Python 2 to Python 3. The browser had cookies set by Python 2 code. Python 3 interpreted the cookie content as byte strings. Deleting the cookie solved the issue. |
@guillaumep OMG it really was cookies. I was so confused while everything was working fine locally but was broken inside docker container and it was just cookies. |
@ojosdegris Yes, same to me. It took me hours to fix it. |
@guillaumep really thanks |
as a workaround, you could try running
before instantiating the form. This should remove the leftover (Python 2) CSRF token and trigger recreating it. |
Work around pallets-eco/flask-wtf#275 -- after upgrading from Python 2 to Python 3, any existing session's csrf_token value will be retrieved as bytes, causing a TypeError. This simple fix, deleting the existing token, was suggested in the issue comments. This code will be safe to remove after Python 2 reaches EOL in 2020, and no supported SecureDrop installations can still have this problem.
Work around pallets-eco/flask-wtf#275 -- after upgrading from Python 2 to Python 3, any existing session's csrf_token value will be retrieved as bytes, causing a TypeError. This simple fix, deleting the existing token, was suggested in the issue comments. This code will be safe to remove after Python 2 reaches EOL in 2020, and no supported SecureDrop installations can still have this problem.
Work around pallets-eco/flask-wtf#275 -- after upgrading from Python 2 to Python 3, any existing session's csrf_token value will be retrieved as bytes, causing a TypeError. This simple fix, deleting the existing token, was suggested in the issue comments. This code will be safe to remove after Python 2 reaches EOL in 2020, and no supported SecureDrop installations can still have this problem.
Building on freedomofpress#4555, change the Debian packaging of securedrop-app-code to use dh-virtualenv, allowing us to embed mod_wsgi in the package. This means we don't have to include wheels and pip install them during postinst. Not requiring python3-pip, which isn't available in the apt repositories in /etc/apt/security.list, means upgrading to Python 3 is going to be smoother. The securedrop-app-code Debian package now Conflicts/Replaces libapache2-mod-wsgi. It will be removed when this new package is installed. This requires updates to the builder Docker image, so I've made changes under molecule/builder-xenial to support building the Debian packages with a local image. Noting for future removal: this includes a workaround for pallets-eco/flask-wtf#275 -- after upgrading from Python 2 to Python 3, any existing session's csrf_token value will be retrieved as bytes, causing a TypeError. This simple fix, deleting the existing token, was suggested in the issue comments. This code will be safe to remove after Python 2 reaches EOL in 2020, and no supported SecureDrop installations can still have this problem.
Building on freedomofpress#4555, change the Debian packaging of securedrop-app-code to use dh-virtualenv, allowing us to embed mod_wsgi in the package. This means we don't have to include wheels and pip install them during postinst. Not requiring python3-pip, which isn't available in the apt repositories in /etc/apt/security.list, means upgrading to Python 3 is going to be smoother. The securedrop-app-code Debian package now Conflicts/Replaces libapache2-mod-wsgi. It will be removed when this new package is installed. This requires updates to the builder Docker image, so I've made changes under molecule/builder-xenial to support building the Debian packages with a local image. Noting for future removal: this includes a workaround for pallets-eco/flask-wtf#275 -- after upgrading from Python 2 to Python 3, any existing session's csrf_token value will be retrieved as bytes, causing a TypeError. This simple fix, deleting the existing token, was suggested in the issue comments. This code will be safe to remove after Python 2 reaches EOL in 2020, and no supported SecureDrop installations can still have this problem.
Building on freedomofpress#4555, change the Debian packaging of securedrop-app-code to use dh-virtualenv, allowing us to embed mod_wsgi in the package. This means we don't have to include wheels and pip install them during postinst. Not requiring python3-pip, which isn't available in the apt repositories in /etc/apt/security.list, means upgrading to Python 3 is going to be smoother. The securedrop-app-code Debian package now Conflicts/Replaces libapache2-mod-wsgi. It will be removed when this new package is installed. This requires updates to the builder Docker image, so I've made changes under molecule/builder-xenial to support building the Debian packages with a local image. Noting for future removal: this includes a workaround for pallets-eco/flask-wtf#275 -- after upgrading from Python 2 to Python 3, any existing session's csrf_token value will be retrieved as bytes, causing a TypeError. This simple fix, deleting the existing token, was suggested in the issue comments. This code will be safe to remove after Python 2 reaches EOL in 2020, and no supported SecureDrop installations can still have this problem.
Building on freedomofpress#4555, change the Debian packaging of securedrop-app-code to use dh-virtualenv, allowing us to embed mod_wsgi in the package. This means we don't have to include wheels and pip install them during postinst. Not requiring python3-pip, which isn't available in the apt repositories in /etc/apt/security.list, means upgrading to Python 3 is going to be smoother. The securedrop-app-code Debian package now Conflicts/Replaces libapache2-mod-wsgi. It will be removed when this new package is installed. This requires updates to the builder Docker image, so I've made changes under molecule/builder-xenial to support building the Debian packages with a local image. Noting for future removal: this includes a workaround for pallets-eco/flask-wtf#275 -- after upgrading from Python 2 to Python 3, any existing session's csrf_token value will be retrieved as bytes, causing a TypeError. This simple fix, deleting the existing token, was suggested in the issue comments. This code will be safe to remove after Python 2 reaches EOL in 2020, and no supported SecureDrop installations can still have this problem.
Building on #4555, change the Debian packaging of securedrop-app-code to use dh-virtualenv, allowing us to embed mod_wsgi in the package. This means we don't have to include wheels and pip install them during postinst. Not requiring python3-pip, which isn't available in the apt repositories in /etc/apt/security.list, means upgrading to Python 3 is going to be smoother. The securedrop-app-code Debian package now Conflicts/Replaces libapache2-mod-wsgi. It will be removed when this new package is installed. This requires updates to the builder Docker image, so I've made changes under molecule/builder-xenial to support building the Debian packages with a local image. Noting for future removal: this includes a workaround for pallets-eco/flask-wtf#275 -- after upgrading from Python 2 to Python 3, any existing session's csrf_token value will be retrieved as bytes, causing a TypeError. This simple fix, deleting the existing token, was suggested in the issue comments. This code will be safe to remove after Python 2 reaches EOL in 2020, and no supported SecureDrop installations can still have this problem.
When updating I Hate Money from python2 to python3, any leftover cookie set from python2 causes the python3 version to crash when reading the cookie back. This is a bug/omission in Flask-WTF: pallets-eco/flask-wtf#275 It was fixed in 0.14.3 with: pallets-eco/flask-wtf@eff54ec
When updating I Hate Money from python2 to python3, any leftover cookie set from python2 causes the python3 version to crash when reading the cookie back. This is a bug/omission in Flask-WTF: pallets-eco/flask-wtf#275 It was fixed in 0.14.3 with: pallets-eco/flask-wtf@eff54ec
When updating I Hate Money from python2 to python3, any leftover cookie set from python2 causes the python3 version to crash when reading the cookie back. This is a bug/omission in Flask-WTF: pallets-eco/flask-wtf#275 It was fixed in 0.14.3 with: pallets-eco/flask-wtf@eff54ec
I am using Python 3.
The text was updated successfully, but these errors were encountered: