" "\n" % entry) forbiddenError=notFoundError # If a resource is forbidden, # why reveal that it exists? def badRequestError(self,name): if regex.match('^[A-Z_0-9]+$',name) >= 0: raise 'InternalError', self.html( "Internal Error", "Sorry, an internal error occurred in this resource.") raise 'BadRequest',self.html( "Invalid request", "The parameter, %s, was omitted from the request." "" % (name,self.request)) def unauthorized(self, realm): if not (self.request.has_key('REMOTE_USER') and self.request['REMOTE_USER']): self.response['WWW-authenticate']='basic realm="%s"' % realm m="You are not authorized to access this resource." if not self.HTTP_AUTHORIZATION: m=m+'\n' raise 'Unauthorized', m def forbiddenError(self,object=None): raise 'NotFound',self.html( "Resource not found", "Sorry, the requested document does not exist.
"
"" % object)
def get_request_data(self,request_params):
try: request_params=request_params()
except: pass
for key in request_params.keys():
self.request[key]=request_params[key]
def publish(self, module_name, after_list, published='web_objects',
imported_modules={}, module_dicts={},debug=0):
request=self.request
request_get=request.get
response=self.response
# First check for "cancel" redirect:
cancel=''
if request_get('SUBMIT','')=='cancel':
cancel=request_get('CANCEL_ACTION','')
if cancel: raise 'Redirect', cancel
(bobo_before, bobo_after, request_params,
inherited_groups, groups, roles,
object, doc, published, realm, module_name
) = get_module_info(module_name)
after_list[0]=bobo_after
if bobo_before is not None: bobo_before();
if request_params: self.get_request_data(request_params)
# Get a nice clean path list:
path=strip(request_get('PATH_INFO'))
if path[:1]=='/': path=path[1:]
if path[-1:]=='/': path=path[:-1]
path=split(path,'/')
while path and not path[0]: path = path[1:]
method=upper(request_get('REQUEST_METHOD'))
if method=='GET' or method=='POST': method='index_html'
URL=self.script
# Get default object if no path was specified:
if not path:
entry_name=method
try:
if hasattr(object,entry_name):
response.setBase(URL)
path=[entry_name]
else:
try:
if object.has_key(entry_name):
path=[entry_name]
except: pass
except: pass
if not path: path = ['help']
# Traverse the URL to find the object:
request['PARENTS']=parents=[]
# if the top object has a __bobo_traverse__ method, then use it
# to possibly traverse to an alternate top-level object.
if hasattr(object,'__bobo_traverse__'):
request['URL']=URL
try: object=object.__bobo_traverse__(request)
except: pass
if hasattr(object, '__of__'):
# Try to bind the top-level object to the request
object=object.__of__(RequestContainer(REQUEST=request))
steps=[]
while path:
entry_name,path=path[0], path[1:]
URL="%s/%s" % (URL,quote(entry_name))
got=0
if entry_name:
if entry_name[:1]=='_': self.forbiddenError(entry_name)
if hasattr(object,'__bobo_traverse__'):
request['URL']=URL
subobject=object.__bobo_traverse__(request,entry_name)
else:
try:
subobject=getattr(object,entry_name)
except AttributeError:
got=1
try: subobject=object[entry_name]
except (KeyError, IndexError,
TypeError, AttributeError):
if entry_name=='.': subobject=object
elif entry_name=='..' and parents:
subobject=parents[-1]
else: self.notFoundError(URL)
try:
try: doc=subobject.__doc__
except: doc=getattr(object, entry_name+'__doc__')
if not doc: raise AttributeError, entry_name
except: self.notFoundError("%s" % (URL))
if hasattr(subobject,'__roles__'): roles=subobject.__roles__
else:
if not got:
roleshack=entry_name+'__roles__'
if hasattr(object, roleshack):
roles=getattr(object, roleshack)
# Promote subobject to object
parents.append(object)
object=subobject
steps.append(entry_name)
# Check for method:
if not path:
if hasattr(object,method) and entry_name != method:
response.setBase(URL)
path=[method]
else:
if (hasattr(object, '__call__') and
hasattr(object.__call__,'__roles__')):
roles=object.__call__.__roles__
if self._hacked_path:
i=string.rfind(URL,'/')
if i > 0: response.setBase(URL[:i])
if entry_name != method and method != 'index_html':
self.notFoundError(method)
request.steps=steps
parents.reverse()
# Do authorization checks
user=None
i=0
if roles is not None:
last_parent_index=len(parents)
if hasattr(object, '__allow_groups__'):
groups=object.__allow_groups__
inext=0
else:
inext=None
for i in range(last_parent_index):
if hasattr(parents[i],'__allow_groups__'):
groups=parents[i].__allow_groups__
inext=i+1
break
if inext is not None:
i=inext
if hasattr(groups, 'validate'): v=groups.validate
else: v=old_validation
auth=self.HTTP_AUTHORIZATION
if v is old_validation and roles is UNSPECIFIED_ROLES:
# No roles, so if we have a named group, get roles from
# group keys
if hasattr(groups,'keys'): roles=groups.keys()
else:
try: groups=groups()
except: pass
try: roles=groups.keys()
except: pass
if groups is None:
# Public group, hack structures to get it to validate
roles=None
auth=''
if v is old_validation:
user=old_validation(groups, request, auth, roles)
elif roles is UNSPECIFIED_ROLES: user=v(request, auth)
else: user=v(request, auth, roles)
while user is None and i < last_parent_index:
parent=parents[i]
i=i+1
if hasattr(parent, '__allow_groups__'):
groups=parent.__allow_groups__
else: continue
if hasattr(groups,'validate'): v=groups.validate
else: v=old_validation
if v is old_validation:
user=old_validation(groups, request, auth, roles)
elif roles is UNSPECIFIED_ROLES: user=v(request, auth)
else: user=v(request, auth, roles)
if user is None and roles != UNSPECIFIED_ROLES:
self.unauthorized(realm)
steps=join(steps[:-i],'/')
if user is not None:
request['AUTHENTICATED_USER']=user
request['AUTHENTICATION_PATH']=steps
# Attempt to start a transaction:
try: transaction=get_transaction()
except: transaction=None
if transaction is not None:
info="\t" + request_get('PATH_INFO')
auth_user=request_get('AUTHENTICATED_USER',None)
if auth_user is not None:
info=("%s %s" % (steps,auth_user))+info
transaction.begin(info)
# Now get object meta-data to decide if and how it should be
# called:
object_as_function=object
# First, assume we have a method:
if hasattr(object_as_function,'im_func'):
f=object_as_function.im_func
c=f.func_code
defaults=f.func_defaults
argument_names=c.co_varnames[1:c.co_argcount]
else:
# Rather than sniff for FunctionType, assume its a
# function and fall back to returning the object itself:
if hasattr(object_as_function,'func_defaults'):
defaults=object_as_function.func_defaults
c=object_as_function.func_code
argument_names=c.co_varnames[:c.co_argcount]
# Make sure we don't have a class that smells like a func
if hasattr(object_as_function, '__bases__'):
self.forbiddenError(entry_name)
else: return response.setBody(object)
request['URL']=URL
request['PARENT_URL']=URL[:rfind(URL,'/')]
args=[]
nrequired=len(argument_names) - (len(defaults or []))
for name_index in range(len(argument_names)):
argument_name=argument_names[name_index]
v=request_get(argument_name, args)
if v is args:
if argument_name=='self': args.append(parents[0])
elif name_index < nrequired:
self.badRequestError(argument_name)
else: args.append(defaults[name_index-nrequired])
else: args.append(v)
args=tuple(args)
if debug: result=self.call_object(object,args)
else: result=apply(object,args)
if result and result is not response: response.setBody(result)
if transaction: transaction.commit()
return response
def call_object(self,object,args):
result=apply(object,args) # Type s '
def field2int(v):
if hasattr(v,'read'): v=v.read()
else: v=str(v)
# we can remove the check for an empty string when we go to python 1.4
if v: return atoi(v)
raise ValueError, 'Empty entry when integer expected'
def field2float(v):
if hasattr(v,'read'): v=v.read()
else: v=str(v)
# we can remove the check for an empty string when we go to python 1.4
if v: return atof(v)
raise ValueError, (
'Empty entry when floating-point number expected')
def field2long(v):
if hasattr(v,'read'): v=v.read()
else: v=str(v)
# we can remove the check for an empty string when we go to python 1.4
if v: return atol(v)
raise ValueError, 'Empty entry when integer expected'
def field2tokens(v):
if hasattr(v,'read'): v=v.read()
else: v=str(v)
return split(v)
def field2lines(v):
return split(field2text(v),'\n')
def field2date(v):
from DateTime import DateTime
if hasattr(v,'read'): v=v.read()
else: v=str(v)
return DateTime(v)
def field2list(v):
if type(v) is not ListType: v=[v]
return v
def field2tuple(v):
if type(v) is not ListType: v=(v,)
return tuple(v)
type_converters = {
'float': field2float,
'int': field2int,
'long': field2long,
'string': field2string,
'date': field2date,
'list': field2list,
'tuple': field2tuple,
'required': field2required,
'tokens': field2tokens,
'lines': field2lines,
'text': field2text,
}
class Request:
"""\
Model HTTP request data.
This object provides access to request data. This includes, the
input headers, form data, server data, and cookies.
Request objects are created by the object publisher and will be
passed to published objects through the argument name, REQUEST.
The request object is a mapping object that represents a
collection of variable to value mappings. In addition, variables
are divided into four categories:
- Environment variables
These variables include input headers, server data, and other
request-related data. The variable names are as specified
in the CGI
specification
- Form data
These are data extracted from either a URL-encoded query
string or body, if present.
- Cookies
These are the cookie data, if present.
- Other
Data that may be set by an application object.
The form attribute of a request is actually a Field Storage
object. When file uploads are used, this provides a richer and
more complex interface than is provided by accessing form data as
items of the request. See the FieldStorage class documentation
for more details.
The request object may be used as a mapping object, in which case
values will be looked up in the order: environment variables,
other variables, form data, and then cookies.
"""
def __init__(self,environ,form,stdin):
self.environ=environ
self.other=form
self.stdin=stdin
have_env=environ.has_key
b=script=strip(environ['SCRIPT_NAME'])
while b and b[-1]=='/': b=b[:-1]
p = rfind(b,'/')
if p >= 0: b=b[:p+1]
else: b=''
while b and b[0]=='/': b=b[1:]
if have_env('SERVER_URL'):
server_url=strip(environ['SERVER_URL'])
else:
if have_env('HTTPS') and (
environ['HTTPS'] == "on" or environ['HTTPS'] == "ON"):
server_url='https://'
elif (have_env('SERVER_PORT_SECURE') and
environ['SERVER_PORT_SECURE'] == "1"):
server_url='https://'
else: server_url='http://'
if have_env('HTTP_HOST'):
server_url=server_url+strip(environ['HTTP_HOST'])
else:
server_url=server_url+strip(environ['SERVER_NAME'])
server_port=environ['SERVER_PORT']
if server_port!='80': server_url=server_url+':'+server_port
if server_url[-1:]=='/': server_url=server_url[:-1]
self.base="%s/%s" % (server_url,b)
while script[:1]=='/': script=script[1:]
if script: self.script="%s/%s" % (server_url,script)
else: self.script=server_url
def __setitem__(self,key,value):
"""Set application variables
This method is used to set a variable in the requests "other"
category.
"""
self.other[key]=value
set=__setitem__
def __str__(self):
def str(self,name):
dict=getattr(self,name)
return "%s:\n\t%s\n\n" % (
name,
join(
map(lambda k, d=dict: "%s: %s" % (k, `d[k]`), dict.keys()),
"\n\t"
)
)
return "%s\n%s\n" % (
str(self,'form'),str(self,'environ'))
__repr__=__str__
def __getitem__(self,key,
default=field2list, # Any special internal marker will do
URLmatch=regex.compile('URL[0-9]$').match,
BASEmatch=regex.compile('BASE[0-9]$').match,
):
"""Get a variable value
Return a value for the required variable name.
The value will be looked up from one of the request data
categories. The search order is environment variables,
other variables, form data, and then cookies.
""" #"
other=self.other
if other.has_key(key):
if key=='REQUEST': return self
return other[key]
if key[:1]=='U' and URLmatch(key) >= 0 and other.has_key('URL'):
n=ord(key[3])-ord('0')
URL=other['URL']
for i in range(0,n):
l=rfind(URL,'/')
if l >= 0: URL=URL[:l]
else: raise KeyError, key
other[key]=URL
return URL
if isCGI_NAME(key) or key[:5] == 'HTTP_':
environ=self.environ
if environ.has_key(key): return environ[key]
return ''
if key=='REQUEST': return self
if key[:1]=='B' and BASEmatch(key) >= 0 and other.has_key('URL'):
n=ord(key[4])-ord('0')
if n:
v=self.script
while v[-1:]=='/': v=v[:-1]
v=join([v]+self.steps[:n-1],'/')
else:
v=self.base
while v[-1:]=='/': v=v[:-1]
other[key]=v
return v
if default is not field2list: return default
raise KeyError, key
__getattr__=get=__getitem__
def has_key(self,key):
return self.get(key, field2tuple) is not field2tuple
isCGI_NAME = {
'SERVER_SOFTWARE' : 1,
'SERVER_NAME' : 1,
'GATEWAY_INTERFACE' : 1,
'SERVER_PROTOCOL' : 1,
'SERVER_PORT' : 1,
'REQUEST_METHOD' : 1,
'PATH_INFO' : 1,
'PATH_TRANSLATED' : 1,
'SCRIPT_NAME' : 1,
'QUERY_STRING' : 1,
'REMOTE_HOST' : 1,
'REMOTE_ADDR' : 1,
'AUTH_TYPE' : 1,
'REMOTE_USER' : 1,
'REMOTE_IDENT' : 1,
'CONTENT_TYPE' : 1,
'CONTENT_LENGTH' : 1,
}.has_key
parse_cookie_lock=allocate_lock()
def parse_cookie(text,
result=None,
qparmre=regex.compile(
'\([\0- ]*'
'\([^\0- ;,=\"]+\)="\([^"]*\)\"'
'\([\0- ]*[;,]\)?[\0- ]*\)'
),
parmre=regex.compile(
'\([\0- ]*'
'\([^\0- ;,=\"]+\)=\([^\0;-=\"]*\)'
'\([\0- ]*[;,]\)?[\0- ]*\)'
),
acquire=parse_cookie_lock.acquire,
release=parse_cookie_lock.release,
):
if result is None: result={}
already_have=result.has_key
acquire()
try:
if qparmre.match(text) >= 0:
# Match quoted correct cookies
name=qparmre.group(2)
value=qparmre.group(3)
l=len(qparmre.group(1))
elif parmre.match(text) >= 0:
# Match evil MSIE cookies ;)
name=parmre.group(2)
value=parmre.group(3)
l=len(parmre.group(1))
else:
if not text or not strip(text): return result
raise "InvalidParameter", text
finally: release()
if not already_have(name): result[name]=value
return apply(parse_cookie,(text[l:],result))
base64=None
def old_validation(groups, request, HTTP_AUTHORIZATION,
roles=UNSPECIFIED_ROLES):
global base64
if base64 is None: import base64
if HTTP_AUTHORIZATION:
if lower(HTTP_AUTHORIZATION[:6]) != 'basic ':
if roles is None: return ''
return None
[name,password] = string.splitfields(
base64.decodestring(
split(HTTP_AUTHORIZATION)[-1]), ':')
elif request.environ.has_key('REMOTE_USER'):
name=request.environ['REMOTE_USER']
password=None
else:
if roles is None: return ''
return None
if roles is None: return name
keys=None
try:
keys=groups.keys
except:
try:
groups=groups() # Maybe it was a method defining a group
keys=groups.keys
except: pass
if keys is not None:
# OK, we have a named group, so apply the roles to the named
# group.
if roles is UNSPECIFIED_ROLES: roles=keys()
g=[]
for role in roles:
if groups.has_key(role): g.append(groups[role])
groups=g
for d in groups:
if d.has_key(name) and (d[name]==password or password is None):
return name
if keys is None:
# Not a named group, so don't go further
raise 'Forbidden', (
"""You are not authorized to access this resource""")
return None
def publish_module(module_name,
stdin=sys.stdin, stdout=sys.stdout, stderr=sys.stderr,
environ=os.environ, debug=0):
must_die=0
status=200
after_list=[None]
request=None
try:
try:
try:
response=Response(stdout=stdout, stderr=stderr)
publisher = ModulePublisher(
stdin=stdin, stdout=stdout, stderr=stderr,
environ=environ)
response = publisher.response
request=publisher.request
finally:
pass
response = publisher.publish(module_name,after_list,
debug=debug)
except SystemExit, v:
if hasattr(sys, 'exc_info'): must_die=sys.exc_info()
else: must_die = SystemExit, v, sys.exc_traceback
response.exception(must_die)
except ImportError, v:
if type(v) is type(()) and len(v)==3: must_die=v
elif hasattr(sys, 'exc_info'): must_die=sys.exc_info()
else: must_die = SystemExit, v, sys.exc_traceback
response.exception(1, v)
except:
response.exception()
status=response.getStatus()
if response:
response=str(response)
if response: stdout.write(response)
# The module defined a post-access function, call it
if after_list[0] is not None: after_list[0]()
finally:
if request is not None: request.other={}
if must_die: raise must_die[0], must_die[1], must_die[2]
sys.exc_type, sys.exc_value, sys.exc_traceback = None, None, None
return status
', '
'
if hasattr(module,'__bobo_before__'): bobo_before=module.__bobo_before__
else: bobo_before=None
if hasattr(module,'__bobo_after__'): bobo_after=module.__bobo_after__
else: bobo_after=None
# Get request data from outermost environment:
if hasattr(module,'__request_data__'):
request_params=module.__request_data__
else: request_params=None
# Get initial group data:
inherited_groups=[]
if hasattr(module,'__allow_groups__'):
groups=module.__allow_groups__
inherited_groups.append(groups)
else: groups=None
web_objects=None
roles=UNSPECIFIED_ROLES
if hasattr(module,'bobo_application'):
object=module.bobo_application
if hasattr(object,'__allow_groups__'):
groups=object.__allow_groups__
inherited_groups.append(groups)
else: groups=None
if hasattr(object,'__roles__'): roles=object.__roles__
else:
if hasattr(module,'web_objects'):
web_objects=module.web_objects
object=web_objects
else: object=module
published=web_objects
try: doc=module.__doc__
except:
if web_objects is not None: doc=' '
else: doc=None
info= (bobo_before, bobo_after, request_params,
inherited_groups, groups, roles,
object, doc, published, realm, module_name)
modules[module_name]=modules[module_name+'.cgi']=info
return info
except:
if hasattr(sys, 'exc_info'): t,v,tb=sys.exc_info()
else: t, v, tb = sys.exc_type, sys.exc_value, sys.exc_traceback
v=str(v)
raise ImportError, (t, v), tb
finally:
tb=None
release()
def str_field(v):
if type(v) is ListType:
return map(str_field,v)
if hasattr(v,'__class__') and v.__class__ is FieldStorage:
v=v.value
elif type(v) is not StringType:
if hasattr(v,'file') and v.file: v=v.file
elif hasattr(v,'value'): v=v.value
return v
class FileUpload:
'''\
File upload objects
File upload objects are used to represent file-uploaded data.
File upload objects can be used just like files.
In addition, they have a 'headers' attribute that is a dictionary
containing the file-upload headers, and a 'filename' attribute
containing the name of the uploaded file.
'''
def __init__(self, aFieldStorage):
file=aFieldStorage.file
if hasattr(file, '__methods__'): methods=file.__methods__
else: methods= ['close', 'fileno', 'flush', 'isatty',
'read', 'readline', 'readlines', 'seek',
'tell', 'truncate', 'write', 'writelines']
d=self.__dict__
for m in methods:
if hasattr(file,m): d[m]=getattr(file,m)
self.headers=aFieldStorage.headers
self.filename=aFieldStorage.filename
def field2string(v):
if hasattr(v,'read'): v=v.read()
else: v=str(v)
return v
def field2text(v, nl=regex.compile('\r\n\|\n\r').search):
if hasattr(v,'read'): v=v.read()
else: v=str(v)
l=nl(v)
if l < 0: return v
r=[]
s=0
while l >= s:
r.append(v[s:l])
s=l+2
l=nl(v,s)
r.append(v[s:])
return join(r,'\n')
def field2required(v):
if hasattr(v,'read'): v=v.read()
else: v=str(v)
if strip(v): return v
raise ValueError, 'No input for required field