#hypothes.is

<nick> Morning tous le monde!

<chdorner> morning everybody :wave:

<nick> yo!

<chdorner> will be spending the first part of the day catching up with things

<chdorner> yo nick!

<nick> I'm in the office today. Sadly no Django.

<chdorner> getting some packages delivered this week, so sadly might not make it to the office very often

<nick> no worries -- just letting you know in case you were thinking of coming in

<nick> (I know that the real reason is the lack of dog.)

<chdorner> haha, of course not

<chdorner> but I heard Django had a good time with Aron and the family

<nick> Sure did :slightly_smiling_face: https://www.flickr.com/photos/nickstenning/albu...

<chdorner> nice pictures!

<nick> that was a hit rate of about 5%

<nick> the dog moves tooooooo fast

<nick> (and it's a seriously fast camera)

<nick> (for a compact)

<chdorner> I like this one: https://www.flickr.com/photos/nickstenning/2913...

<nick> hehehe, me too

<robertknight> Morning :)

<nick> I also took a few of the dog a little later on, some of which came out pretty well: https://www.flickr.com/photos/nickstenning/albu...

<nick> morning @robertknight

<robertknight> Is that the Aron you mentioned when we met in London @chdorner ?

<chdorner> yep

<robertknight> I'm going to reply to the last comments on the inline editing PR later today when there is a break

<robertknight> Don't worry - I'm not ignoring them (!)

<chdorner> deploying to staging again, I just added deployment hooks for newrelic

<nick> :+1:

<chdorner> ok, seems to work. next prod deploy should get it as well

<seanh> robertknight Don't suppose you've any idea what this issue could be? https://github.com/hypothesis/h/issues/3828

<nick> Oh, nice. Grafana image sharing now works, so I can do things like this to show people how our memory leak affects response times:

<nick> https://mon.hypothes.is/grafana/render/dashboar...

<nick> hmmm, except you have to be logged in, so that's not super useful

<nick> does this work?

<nick> https://mon.hypothes.is/grafana/dashboard/snaps...

<nick> no image preview, but it works for logged out users

<nick> i guess I can just copy images and paste them into Slack

<nick> that works...

<seanh> I'm not seeing any way to customize the error messages like "Shorter than minimum length 3" that Deform/Colander returns. It looks like doing a regex against the error message and transforming it might be the only way..

<nick> @seanh: really? that seems unlikely...

<nick> I mean, I presume deform/colander have some kind of I18N support, so I doubt the error messages are hard-coded as English and not overrideable.

<seanh> Oh no just found it

<seanh> You can pass custom ones in

<seanh> Oh you can l10n the errors, colander marks them in a gettext compatible way, but I don't think that would be quite right for what I'm trying to do

<nick> no, I wasn't suggesting that

<nick> I was just pointing out that if the error messages were hardcoded, that would make localisation really difficult

<seanh> Anyway, you can pass in args to the colander nodes to change the error message templates

<nick> :+1:

<nick> I'm just looking into how we handle CSRF tokens in the client, with a view to removing the `assertion` parameter from the token endpoint (this blocks us moving to Pyramid 1.7, which blocks a couple of other things)

<nick> unsurprisingly, it's a bit of a mess

<nick> in theory, Angular has some magic which manages this all for us

<nick> you set a `XSRF-TOKEN` cookie, readable from JavaScript, and then on unsafe requests (POST/PUT/etc.) angular will put the value of that cookie back into the `X-XSRF-TOKEN` header

<nick> (or, in our case, an `X-CSRF-Token` header, as specified here: https://github.com/hypothesis/client/blob/9105e...)

<nick> this is a nice solution overall, as only JavaScript running on our domain can read the `XSRF-TOKEN` cookie (by the same-origin policy)

<nick> we send the CSRF token to the `/token` endpoint in order to prevent session hijacking

<nick> but at the moment it seems like we send it in an `assertion` GET parameter explicitly

<nick> and I'm not really sure why that it

<nick> because it's sent in the request headers as well

<nick> anyway, Pyramid 1.7 doesn't allow retrieval of a CSRF token from GET parameters

<nick> so I guess we can just remove the `assertion` parameter entirely?

<nick> @robertknight: does this tally with your understanding at the moment? ^

<robertknight> @nick: Your guess as to why that parameter was sent explicitly is as good as mine.

<robertknight> So we should just remove it

<nick> sooooo

<nick> I think I found our memory leak culprit

<nick> and oh looky https://github.com/getsentry/raven-python/commi...

<nick> hmm, except that the latest sentry doesn't fix the leak

<lenazun> @robertknight @nick any progress on this one from last week? https://github.com/hypothesis/client/issues/83

<nick> @lenazun I think we have a PR open for that

<nick> @sheetaluk was working on the other half of it, though

<nick> and I don't know where that got to

<seanh> Something odd going on with Deform/Colander. I added a `min_err="Must be longer than ${min} characters."` arg to the `colander.Length` validator. Now the error message gets rendered as `(u'Must be longer than 3 characters.',)` in the HTML (i.e. someone as done `str()` on a tuple). Simply removing the `min_err` arg fixes this though - it's adding a `min_err` that seems to cause the error. Debugging, `h.form.Jinja2

`kwargs['field'].error.asdict()` returning `{'username': u"(u'Must be longer than 3 characters.',)"}`. So, it seems to be a bug in Colander or Deform? It doesn't appear to be _us_ that stringifies a tuple

<robertknight> We have a PR open that fixes one part. @sheetaluk is indeed working on the other part

<robertknight> We should be able to sort it in the next couple of days

<seanh> All we do is call `self.form.render()` quite innocently in our view function. The call stack then passes through deform which calls our Jinja2Renderer passing it the bad value. So either deform has a bug at that point, or something else already went wrong before then. Gonna have to debug deform