login security and some doubts

[hari...@gmail.com]

Hi,

I am intending to use web2py to build some services and tools. I really admire how Massimo DiPierro and the contributors has created an amazing web app development platform from what I have seen so far. It takes away so much pain from web dev. Its been a month since I have started using web2py and I was going by the guide given in web2py.com website and youtube videos by Mdipierro on the same. I am a newbie on both  web2py and python and I am still figuring it out. I test on pythonanywhere. Getting back to topic

1. In the db.py file, I filled email and smtp mail settings and enabled 'require email confirmation for registration', but it says connection refused when trying to register a user account. Is that because I am on pythonanywhere free account OR did I miss some other configuration settings?

2. I read that there was serious security flaw in oauth2 authentication. Should I be worried if I used it for user login and registration for my website. I am not asking about logging in with facebook or google, but the login and registration auth that I get with web2py.

3. Once I register a user, how would I implement user account deletion along with the associated data? I want my users to be able to delete their account and their data if they want to do so. But I couldn't find out how to do so on web2py. Can someone advise on how to do it? Also I'd like to know how to disable or deactivate a user's account.

4. After I define models, I can get {{=form}}. But how do I change button to a different type in the form that I get as a result? Say I want bootstrap 'btn-danger' just in one particular page (I'd like to use  'btn-danger' as the form submit button in a page instead of what I get when using {{=form}} in the view).

5. If I want to use realtime chat in one of my web2py app, is it possible? If so, can you point to some resource on how I can use tornado within web2py?

[Massimo Di Pierro]

1. In the db.py file, I filled email and smtp mail settings and enabled 'require email confirmation for registration', but it says connection refused when trying to register a user account. Is that because I am on pythonanywhere free account OR did I miss some other configuration settings?

yes. python anywhere does not offer a smtp server on localost. You must login to gmail or other smtp server

 

2. I read that there was serious security flaw in oauth2 authentication. Should I be worried if I used it for user login and registration for my website. I am not asking about logging in with facebook or google, but the login and registration auth that I get with web2py.

no. web2py only uses auth2 to delegate authentication to others. If you are not not explicitly using oauth2 you are fine.

 

3. Once I register a user, how would I implement user account deletion along with the associated data? I want my users to be able to delete their account and their data if they want to do so. But I couldn't find out how to do so on web2py. Can someone advise on how to do it? Also I'd like to know how to disable or deactivate a user's account.

@auth.requires_login() 

def delete_my_account():

     del db.auth_user[auth.user.id]

     return 'bye bye!'

 

4. After I define models, I can get {{=form}}. But how do I change button to a different type in the form that I get as a result? Say I want bootstrap 'btn-danger' just in one particular page (I'd like to use  'btn-danger' as the form submit button in a page instead of what I get when using {{=form}} in the view).

form.element('button',_type='submit')['_class'] = 'btn-danger'

or use a custom form in html.

5. If I want to use realtime chat in one of my web2py app, is it possible? If so, can you point to some resource on how I can use tornado within web2py?

yes. integration with tornado for chats and chat groups is already built in:

https://github.com/web2py/web2py/blob/master/gluon/contrib/websocket_messaging.py

 

[hari...@gmail.com]

Thank you so much. Its so reassuring. Pythonanywhere doesn't allow code to connect to outside url in the case of free account. I tested it in a paid account and web2py was able to connect to zoho smtp mail. I have shown web2py to my friends and some couldn't believe it was that easy to build a web application. Overall its amazing. My best regards to everyone working on this and especially Massimo Di Pierro, you are a good teacher. I will definitely acknowledge and give credit to web2py on the finished website and will contribute back to community.