[issue16248] Security bug in tkinter allows for untrusted, arbitrary code execution.

2013-09-15 Thread Roundup Robot
Roundup Robot added the comment: New changeset c39f42f46a05 by Georg Brandl in branch '3.1': Fix tkinter regression introduced by the security fix in #16248. http://hg.python.org/cpython/rev/c39f42f46a05 -- ___ Python tracker rep...@bugs.python.org

[issue16248] Security bug in tkinter allows for untrusted, arbitrary code execution.

2013-09-15 Thread Antoine Pitrou
Antoine Pitrou added the comment: Fix backported to 3.1, closing. -- resolution: - fixed status: open - closed ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16248 ___

[issue16038] ftplib: unlimited readline() from connection

2013-09-15 Thread Barry A. Warsaw
Barry A. Warsaw added the comment: == FAIL: test_retrlines_too_long (__main__.TestFTPClass) -- Traceback (most recent call last): File

[issue14984] netrc module allows read of non-secured .netrc file

2013-09-15 Thread R. David Murray
R. David Murray added the comment: Here is an updated patch, with docs and test. Turns out it actually wasn't necessary to move the check to the password, but I'm leaving it that way anyway. The reason it wasn't necessary is that we don't actually parse the .netrc file correctly: we require

[issue14984] netrc module allows read of non-secured .netrc file

2013-09-15 Thread Barry A. Warsaw
Barry A. Warsaw added the comment: @RDM: In netrc.rst, s/posix/POSIX/ It also looks like you're keeping the ownership test. Did I misunderstand msg197815? I thought you were only going to keep the permission test? -- ___ Python tracker

[issue14984] netrc module allows read of non-secured .netrc file

2013-09-15 Thread R. David Murray
Changes by R. David Murray rdmur...@bitdance.com: Removed file: http://bugs.python.org/file31779/netrc-2.6.patch ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue14984 ___

[issue14984] netrc module allows read of non-secured .netrc file

2013-09-15 Thread R. David Murray
Changes by R. David Murray rdmur...@bitdance.com: Added file: http://bugs.python.org/file31780/netrc-2.6.patch ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue14984 ___

[issue18307] Relative path in co_filename for zipped modules

2013-09-15 Thread Vitaly Murashev
Vitaly Murashev added the comment: patch suggested (over 3.3.0 code base). Without patch test fails, with patch - passed -- components: -Library (Lib) keywords: +patch Added file: http://bugs.python.org/file31781/zipimport.diff ___ Python tracker

[issue18857] urlencode of a None value uses the string 'None'

2013-09-15 Thread Claudiu.Popa
Claudiu.Popa added the comment: Hello. I attached a simple patch for the urlencode case. I'll try to make one for parse_qs(l) as well. -- keywords: +patch nosy: +Claudiu.Popa Added file: http://bugs.python.org/file31782/urllib.patch ___ Python

[issue14984] netrc module allows read of non-secured .netrc file

2013-09-15 Thread R. David Murray
R. David Murray added the comment: Yes, you did :) I was using permissions check to cover both tests, since as you say, if the file is owned by someone other than the user running the processes, a user other than the one running the process has permission to modify it. posix-POSIX fixed in

[issue19028] tkinter.tkapp.merge() fails on non-strings

2013-09-15 Thread Serhiy Storchaka
New submission from Serhiy Storchaka: tkinter.tkapp.merge() recursively merge Python data into Tcl string. When a subitem neither tuple, string or byte string, it calls str() on it. But then it use PyBytes_AsString() which always fails because accepts bytes instead of str. The proposed patch

[issue19029] tix.py uses StringType

2013-09-15 Thread Serhiy Storchaka
New submission from Serhiy Storchaka: Lib/tkinter/tix.py uses the StringType name which is not defined. This is a remnant from 2.x where the StringType type was imported from the types module. In 3.x it gone and was replaced by str in Lib/tkinter/__init__.py. The proposed patch fixes it also

[issue18857] urlencode of a None value uses the string 'None'

2013-09-15 Thread Claudiu.Popa
Claudiu.Popa added the comment: Added patch for parse_qsl as well. -- Added file: http://bugs.python.org/file31785/urllib_null_value.patch ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue18857

[issue18515] zipfile._ZipDecryptor generates wasteful crc32 table on import

2013-09-15 Thread Serhiy Storchaka
Serhiy Storchaka added the comment: I meant my pure Python patch in issue10030. Binding crctable to local variable is one of microoptimizations. Not the largest one however. So in general I not objects. Your patch LGTM. Only one nitpick -- instead not _ZipDecrypter.crctable use

[issue18771] Reduce the cost of hash collisions for set objects

2013-09-15 Thread Roundup Robot
Roundup Robot added the comment: New changeset 9353c611f897 by Raymond Hettinger in branch 'default': Issue 18771: Make it possible to set the number linear probes at compile-time. http://hg.python.org/cpython/rev/9353c611f897 -- ___ Python tracker

[issue1565525] tracebacks eat up memory by holding references to locals and globals when they are not wanted

2013-09-15 Thread Roundup Robot
Roundup Robot added the comment: New changeset 100606ef02cf by Andrew Kuchling in branch 'default': #1565525: Add traceback.clear_frames() helper function to clear locals ref'd by a traceback http://hg.python.org/cpython/rev/100606ef02cf -- nosy: +python-dev

[issue18857] urlencode of a None value uses the string 'None'

2013-09-15 Thread Senthil Kumaran
Senthil Kumaran added the comment: The patch looks good, but I have doubt in the claim that, this new behavior is actually a right thing to do. RDM wrote: Now, that said, it seems to me that while it is not (apparently) RFC compliant, query strings do have a natural way to support null

[issue12558] Locale-dependent exception for float width argument to Tkinter widget constructor

2013-09-15 Thread Terry J. Reedy
Terry J. Reedy added the comment: Perhaps we can fix it on the Python side. When self.tk is called with a configuration cnf, cnf is often (always?) first passed to Misc._options, as in BaseWidget.__init__: self.tk.call( (widgetName, self._w) + extra + self._options(cnf))

[issue19029] tix.py uses StringType

2013-09-15 Thread Terry J. Reedy
Terry J. Reedy added the comment: I am slightly surprised no one has complained about a NameError. I guess tix is untested and not used too much, or at least not the two methods, tixCommand.tix_configure and TixWidget.config_all. Anyway, do it. --

[issue18307] Relative path in co_filename for zipped modules

2013-09-15 Thread Nick Coghlan
Changes by Nick Coghlan ncogh...@gmail.com: -- nosy: +ncoghlan ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue18307 ___ ___ Python-bugs-list

[issue18693] help() not helpful with enum

2013-09-15 Thread Ethan Furman
Ethan Furman added the comment: Two issues still remain: - custom behavior, as well as value and name, don't show in help - value and name, if defined as enum members, show up as data descriptors in help

[issue18693] help() not helpful with enum

2013-09-15 Thread Roundup Robot
Roundup Robot added the comment: New changeset 353ced6ae182 by Ethan Furman in branch 'default': Close #18693: Enum is now more help() friendly. http://hg.python.org/cpython/rev/353ced6ae182 -- resolution: - fixed stage: patch review - committed/rejected status: open - closed

[issue19030] Make inspect.getmembers and inspect.classify_class_attrs Enum aware

2013-09-15 Thread Ethan Furman
New submission from Ethan Furman: Due to the odd nature of Enum classes and instances, the normal methods used by inspect.getmembers and inspect.classify_class_attrs are insufficient. By special casing Enum inside those two functions the correct information can be returned. Here is an

[issue19031] Make help() enum aware

2013-09-15 Thread Ethan Furman
New submission from Ethan Furman: Currently, if help() is called on an Enum member, it displays help for the class. While this is usually what one wants, it is not for Enums. -- messages: 197845 nosy: barry, eli.bendersky, ethan.furman priority: normal severity: normal status: open

[issue18693] help() not helpful with enum

2013-09-15 Thread Ethan Furman
Ethan Furman added the comment: Tracking inspect in issue19030. Tracking help in issue19031. -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue18693 ___

[issue14927] add Do not supply 'int' argument to random.shuffle docstring

2013-09-15 Thread Senthil Kumaran
Senthil Kumaran added the comment: Georg Brandl added the comment: I would propose a leading underscore for these methods; they should make it clear to the user that the parameter is meant to be private. +1 to this proposal. This style is present with randrange, randbelow and shuffle.

[issue14927] add Do not supply 'int' argument to random.shuffle docstring

2013-09-15 Thread Tim Peters
Tim Peters added the comment: [Senthil Kumaran] I am unaware of the optimization technique you refer to as well, it will helpful if you could point to any resource. It's an old trick since the very first Pythons: global lookups are much slower than local lookups (the difference between the

[issue14927] add Do not supply 'int' argument to random.shuffle docstring

2013-09-15 Thread Senthil Kumaran
Senthil Kumaran added the comment: Tim Peters added the comment: ..., _fast=slow, ... in an argument list means we endure the slow lookup (of `slow`) only once, when the function is first defined. When the function is _called_, that binding is available via the local (much faster

[issue19032] __reduce_ex__ on lock object

2013-09-15 Thread Ram Rachum
New submission from Ram Rachum: import threading l = threading.Lock() l.__reduce_ex__(3) (function __newobj__ at 0x026CD8C8, (class '_thread.lock',), None, None, None) Isn't it a bug that `__reduce_ex__` works on the non-pickleable lock object?

[issue18857] urlencode of a None value uses the string 'None'

2013-09-15 Thread R. David Murray
R. David Murray added the comment: Thank you for working on the patches, Claudiu, but... The backward compatibility concern is valid. Furthermore, I did a bunch of googling looking for examples. I did not turn up any examples of APIs that were documented to use parameters without '='...all

[issue18975] timeit: Use thousands separators and print number of loops per second

2013-09-15 Thread Jakub Stasiak
Jakub Stasiak added the comment: Antoine: I agree that it does look weird to have thousands separators at one place and not at the other but IMO it's still slightly better - the number formatted with separators is simply more readable that separator-less one. R. David Murray: what's the

[issue19030] Make inspect.getmembers and inspect.classify_class_attrs Enum aware

2013-09-15 Thread R. David Murray
R. David Murray added the comment: Special casing Enum in inspect has a code smell to it. There may not be a better option, but it sure feels ugly. -- nosy: +r.david.murray ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue19030

[issue19030] Make inspect.getmembers and inspect.classify_class_attrs Enum aware

2013-09-15 Thread Ethan Furman
Ethan Furman added the comment: Attached patch yields these results: === Help on class Test in module __main__: class Test(enum.Enum) | Method resolution order: | Test | enum.Enum |

[issue19030] Make inspect.getmembers and inspect.classify_class_attrs Enum aware

2013-09-15 Thread Ethan Furman
Ethan Furman added the comment: R David Murray said: Special casing Enum in inspect has a code smell to it. I agree, and I'm certainly open to other options. The flow at this point is: help() -- inspect.classify_class_attrs -- dir() -- Enum.__dir__ Because inspect relies on dir and Enum's

[issue14927] add Do not supply 'int' argument to random.shuffle docstring

2013-09-15 Thread Senthil Kumaran
Senthil Kumaran added the comment: Attaching a patch after changing int=int to _int = int and improving the docstring. Please review the changes to the docstring and see if it will be helpful. -- status: closed - pending Added file: http://bugs.python.org/file31788/14927.diff

[issue19030] Make inspect.getmembers and inspect.classify_class_attrs Enum aware

2013-09-15 Thread R. David Murray
R. David Murray added the comment: So the real problem is that inspect depends on dir? Isn't there already a bug open for that issue? -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue19030

[issue18975] timeit: Use thousands separators and print number of loops per second

2013-09-15 Thread R. David Murray
R. David Murray added the comment: My vote is no separators. But I'm just one vote :) -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue18975 ___

[issue14927] add Do not supply 'int' argument to random.shuffle docstring

2013-09-15 Thread Georg Brandl
Georg Brandl added the comment: I wouldn't add info about the optimization in the docstring. In _randbelow() I think you missed a call to int(). For _randbelow(), all arguments after int are non-public ones. (_randbelow as a private function wouldn't necessarily need the change, but it's good

[issue14927] add Do not supply 'int' argument to random.shuffle docstring

2013-09-15 Thread Senthil Kumaran
Senthil Kumaran added the comment: Thanks for catching the mistake at _randbelow. Updated patch to fix that and removed the explanation in the docstring. Not sure if _randbelow should changed (fully) or not at all. Leaving the change only with _int. Will wait for Raymond's review. --

[issue19030] Make inspect.getmembers and inspect.classify_class_attrs Enum aware

2013-09-15 Thread Ethan Furman
Ethan Furman added the comment: I do not see one. I did post to PyDev asking about dir -- perhaps I should have given it a different title. -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue19030

[issue19024] Document asterisk (*), splat or star operator

2013-09-15 Thread Georg Brandl
Changes by Georg Brandl ge...@python.org: -- Removed message: http://bugs.python.org/msg197774 ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue19024 ___

[issue18844] allow weights in random.choice

2013-09-15 Thread Madison May
Madison May added the comment: Serhiy, from a technical standpoint, your latest patch looks like a solid solution. From an module design standpoint we still have a few options to think through, though. What if random.weighted_choice_generator was moved to random.choice_generator and

[issue19024] Document asterisk (*), splat or star operator

2013-09-15 Thread Madison May
Madison May added the comment: http://docs.python.org/3/tutorial/controlflow.html#arbitrary-argument-lists http://docs.python.org/3/tutorial/controlflow.html#unpacking-argument-lists The above links do a so-so of explaining the splat operator, although I agree that the docs for '*' could be

[issue19033] Python 3 won't go on PC-BSD 9.1

2013-09-15 Thread Robert M. Koretsky
New submission from Robert M. Koretsky: I use the instructions in the README file that gets unzipped with Python-3.0.tgz to install on PC-BSD 9.1 ./configure, make, make test, sudo make install and it does not work! Error messages too verbose to include here. My path includes the directory that

[issue18844] allow weights in random.choice

2013-09-15 Thread Westley Martínez
Westley Martínez added the comment: I think Storchaka's solution is more transparent and I agree with him on the point that the choice generator should be exposed. -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue18844

[issue18844] allow weights in random.choice

2013-09-15 Thread Madison May
Madison May added the comment: I think Storchaka's solution is more transparent and I agree with him on the point that the choice generator should be exposed. Valid point -- transparency should be priority #1 -- ___ Python tracker

[issue19030] Make inspect.getmembers and inspect.classify_class_attrs Enum aware

2013-09-15 Thread Ethan Furman
Ethan Furman added the comment: Here's a crazy idea. :) The only reason the patch is tied to Enum is because of Enum's use of the _RouteClassAttributeToGetattr descriptor. If we had a module similar to functools, say classtools, we could flesh out _RouteClassAttributeToGetattr, rename it to

[issue19025] Deleting attribute of Enum gives misleading error message

2013-09-15 Thread Vajrasky Kok
Vajrasky Kok added the comment: Here is the patch containing unit test only to confirm existing behaviour. So people can learn what to expect when they delete Enum attributes. Even if we *decide* to change the behaviour of del MyPet.CUTE_CAT (assuming CUTE_CAT is an Enum member), I sense that

[issue18975] timeit: Use thousands separators and print number of loops per second

2013-09-15 Thread Serhiy Storchaka
Serhiy Storchaka added the comment: My vote is no separators. But I'm just one vote :) Seconded. -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue18975 ___

[issue19029] tix.py uses StringType

2013-09-15 Thread Serhiy Storchaka
Serhiy Storchaka added the comment: I guess this code executed only when wantobjects is false. -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue19029 ___

<    1   2