Merge pull request #569 from dpgaspar/release/v1.9.3

Release/v1.9.3

README.rst

@@ -24,7 +24,7 @@ Lots of `examples <https://github.com/dpgaspar/Flask-AppBuilder/tree/master/exam
 Package Version
 ---------------
 
-*New 1.9.2*.
+*New 1.9.3*.
 
 BREAKING CHANGES relative to 1.8.1 when using OAUTH authentication method.
 

docs/versions.rst

@@ -1,6 +1,16 @@
 Versions
 ========
 
+Improvements and Bug fixes on 1.9.3
+-----------------------------------
+
+- Fix, #544 for possible sql injection on order by clauses
+- Fix, #550 check whether `session_form_edit_pk` still exist in db, on CompactCRUDMixin.
+- Fix, #553 for AttributeError when edit_columns on a view in related_views does not include relationship
+- New, #562 Bump flask-babel version to 0.11.1, and pin.
+- Fix, #444 Create LDAP user firstname/lastname may return as bytes instead of str
+- Fix, Fix divergence on versions between setup and requirements, pinned versions
+
 Improvements and Bug fixes on 1.9.2
 -----------------------------------
 

flask_appbuilder/security/manager.py

@@ -593,6 +593,11 @@ def _bind_ldap(self, ldap, con, username, password):
         except ldap.INVALID_CREDENTIALS:
             return False
 
+    @staticmethod
+    def ldap_extract(ldap_dict, field, fallback):
+        if not ldap_dict.get(field):
+            return fallback
+        return ldap_dict[field][0].decode('utf-8') or fallback
 
     def auth_user_ldap(self, username, password):
         """
@@ -644,12 +649,12 @@ def auth_user_ldap(self, username, password):
                     ldap_user_info = new_user[0][1]
                     if self.auth_user_registration and user is None:
                         user = self.add_user(
-                                username=username,
-                                first_name=ldap_user_info.get(self.auth_ldap_firstname_field, [username])[0],
-                                last_name=ldap_user_info.get(self.auth_ldap_lastname_field, [username])[0],
-                                email=ldap_user_info.get(self.auth_ldap_email_field, [username + '@email.notfound'])[0],
-                                role=self.find_role(self.auth_user_registration_role)
-                            )
+                            username=username,
+                            first_name=self.ldap_extract(ldap_user_info, self.auth_ldap_firstname_field, username),
+                            last_name=self.ldap_extract(ldap_user_info, self.auth_ldap_lastname_field, username),
+                            email=self.ldap_extract(ldap_user_info, self.auth_ldap_email_field, username + '@email.notfound'),
+                            role=self.find_role(self.auth_user_registration_role)
+                        )
 
                 self.update_user_auth_stat(user)
                 return user

flask_appbuilder/version.py

@@ -1,6 +1,6 @@
 VERSION_MAJOR = 1
 VERSION_MINOR = 9
-VERSION_BUILD = 2
+VERSION_BUILD = 3
 VERSION_INFO = (VERSION_MAJOR, VERSION_MINOR, VERSION_BUILD)
 VERSION_STRING = "%d.%d.%d" % VERSION_INFO
 

requirements.txt

@@ -1,9 +1,9 @@
-colorama>=0.3.9,<0.3.99
-click>=6.7,<6.99
+colorama==0.3.9
+click==6.7
 Flask>=0.12.1,<0.12.99
 Flask-Login>=0.2.11,<0.2.99
-Flask-SQLAlchemy>=2.0,<2.1.99
-Flask-OpenID>=1.2.5,<1.2.99
-Flask-WTF>=0.14.2,<0.14.99
-Flask-Babel>=0.11.2,<0.11.99
+Flask-SQLAlchemy==2.1
+Flask-OpenID==1.2.5
+Flask-WTF==0.14.2
+Flask-Babel==0.11.1
 

setup.py

@@ -34,14 +34,14 @@ def desc():
     zip_safe=False,
     platforms='any',
     install_requires=[
-        'colorama>=0.3',
-        'click>=3.0',
-        'Flask>=0.10',
+        'colorama==0.3.9',
+        'click==6.7',
+        'Flask>=0.12.1,<0.12.99',
         'Flask-Babel==0.11.1',  # known issues with 0.11.2
         'Flask-Login==0.2.11',
-        'Flask-OpenID>=1.1.0',
-        'Flask-SQLAlchemy>=2.0,<2.1.99',
-        'Flask-WTF>=0.12',
+        'Flask-OpenID==1.2.5',
+        'Flask-SQLAlchemy==2.1',
+        'Flask-WTF==0.14.2',
     ],
     tests_require=[
         'nose>=1.0',