[Freedombox-discuss] Plinth deb packages

[Tzafrir Cohen]

On Tue, Sep 03, 2013 at 10:44:52AM +0200, Tzafrir Cohen wrote:

> At the moment it is semi-working. I didn't really get past the
> first_boot module. Not sure why I'm stuck there. But I ran out of time
> to check it.

And when I skip it by force, I get the following error on a login
attempt (after submitting the login form):

Traceback (most recent call last):
  File "/usr/lib/python2.7/dist-packages/cherrypy/_cprequest.py", line
656, in respond
    response.body = self.handler()
  File "/usr/lib/python2.7/dist-packages/cherrypy/lib/encoding.py", line
188, in __call__
    self.body = self.oldhandler(*args, **kwargs)
  File "/usr/lib/python2.7/dist-packages/cherrypy/_cpdispatch.py", line
34, in __call__
    return self.callable(*self.args, **self.kwargs)
  File "/usr/share/plinth/python/plinth/modules/auth_page.py", line 33,
in login
    error_msg = check_credentials(username, passphrase)
  File "/usr/share/plinth/python/plinth/modules/auth.py", line 30, in
check_credentials
    u = cfg.users[username]
  File "/usr/lib/python2.7/dist-packages/withsqlite/withsqlite.py", line
174, in __getitem__
    self.crsr.execute('select val from %s where key=?' % self.table,
[key])
ProgrammingError: SQLite objects created in a thread can only be used in
that same thread.The object was created in thread id 139879518795520 and
this is thread id 139879381292800

It's also nice to see the URL:

http://127.0.0.1:8000/auth/login?from_page=%2Frouter%2Fsetup&username=admin&passphrase=secret

which means that the password is sent via GET and thus displayed to
anybody viewing the screen or that has read access to plinth's
access.log .

-- 
Tzafrir Cohen         | tzafrir at jabber.org | VIM is
http://tzafrir.org.il |                    | a Mutt's
tzafrir at cohens.org.il |                    |  best
tzafrir at debian.org    |                    | friend