Home Original page

[python-committers] [Infrastructure] [Pydotorg] XSS security issue

R. David Murray rdmurray at bitdance.com
Mon Jul 15 18:45:18 CEST 2013 
On Mon, 15 Jul 2013 18:02:35 +0200, Antoine Pitrou <solipsis at pitrou.net> wrote:
> On 2013-07-15 17:16, R. David Murray wrote:
> > 
> >> I will make the password available to whoever is in charge, (Or they
> >> can just change the password themselves I don't care).
> > 
> > I think the user should just be retired.  My guess is that it dates 
> > from
> > a time when we were less worried about bad actors coming in and 
> > trashing
> > things just for the fun of it.  What I don't know is if there is some
> > script somewhere depending on it being a valid user.  For now, I've
> > removed its access roles, and we'll see if anything breaks.
> 
> Isn't it the user for automatic Roundup updates from hg pushes?

No, that one is python-dev.  Push updates are still working.

--David
More information about the python-committers mailing list