Display password from PostgreSQL database using web.py form

Question

I am playing around with PostgreSQL and web.py and I have noticed that if I have a username and password in a database and given that the password may contain special characters that are members of string.printable, then when I want to print the queried password to the browser through a web.py template, something goes wrong with the character escaping and the password doesn't want to display. Instead the browser offers to download a text file (with no file extension) containing the password.

In my Python file:

class login:
    ...
    def POST(self):
        ...
        cursor.execute("SELECT password FROM tbl WHERE username = %s", (f['username'].value, ))
        realpassword = cursor.fetchone()
        realpassword = realpassword[0]
        ...
        return realpassword

The password appears correctly in the text file that downloads, but how do I display the password as text on the webpage?

I hope that you are not really going to store passwords as plain text in your database. — pferate
– pferate, Commented Oct 3, 2016 at 16:53
Yes I am, just for the purposes of illustrating this problem! — Adriaan Joubert
– Adriaan Joubert, Commented Oct 3, 2016 at 19:38

pbuck · Accepted Answer · 2016-11-20 20:01:06Z

1

Python string.printable includes both vertical-tab \x0b and form-feed \x0c, neither of which are friends to browsers. Browsers assume they're receiving a file and offer to download it.

(string.printable isn't the same as ASCII.)

Instead of returning the raw realpassword, return repr(realpassword). Built-in repr() returns a "string containing a printable representation...", escaping control characters.

>>> import string
>>> print string.printable[-20:]
=>?@[\]^_`{|}~  



>>> print repr(string.printable[-20:])
'=>?@[\\]^_`{|}~ \t\n\r\x0b\x0c'

answered Nov 20, 2016 at 20:01

pbuck

4,5902 gold badges28 silver badges37 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Display password from PostgreSQL database using web.py form

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related