Webware for Python

Author: chrisz
Date: Sun Apr 22 15:10:59 2007
New Revision: 6503

Modified:
   Webware/trunk/WebKit/Examples/jsonrpc.js
   Webware/trunk/WebKit/JSONRPCServlet.py

Log:
Further improved security of JSONRPCServlet by preventing direct execution of the response.

Modified: Webware/trunk/WebKit/Examples/jsonrpc.js
==============================================================================
--- Webware/trunk/WebKit/Examples/jsonrpc.js	(original)
+++ Webware/trunk/WebKit/Examples/jsonrpc.js	Sun Apr 22 15:10:59 2007
@@ -22,119 +22,114 @@
  *
  */
 
-
 /* escape a character */
 
 escapeJSONChar =
 function escapeJSONChar(c)
 {
-    if(c == "\"" || c == "\\") return "\\" + c;
-    else if (c == "\b") return "\\b";
-    else if (c == "\f") return "\\f";
-    else if (c == "\n") return "\\n";
-    else if (c == "\r") return "\\r";
-    else if (c == "\t") return "\\t";
-    var hex = c.charCodeAt(0).toString(16);
-    if(hex.length == 1) return "\\u000" + hex;
-    else if(hex.length == 2) return "\\u00" + hex;
-    else if(hex.length == 3) return "\\u0" + hex;
-    else return "\\u" + hex;
+	if(c == "\"" || c == "\\") return "\\" + c;
+	else if(c == "\b") return "\\b";
+	else if(c == "\f") return "\\f";
+	else if(c == "\n") return "\\n";
+	else if(c == "\r") return "\\r";
+	else if(c == "\t") return "\\t";
+	var hex = c.charCodeAt(0).toString(16);
+	if(hex.length == 1) return "\\u000" + hex;
+	else if(hex.length == 2) return "\\u00" + hex;
+	else if(hex.length == 3) return "\\u0" + hex;
+	else return "\\u" + hex;
 };
 
-
 /* encode a string into JSON format */
 
 escapeJSONString =
 function escapeJSONString(s)
 {
-    /* The following should suffice but Safari's regex is b0rken
-       (doesn't support callback substitutions)
-       return "\"" + s.replace(/([^\u0020-\u007f]|[\\\"])/g,
-       escapeJSONChar) + "\"";
-    */
-
-    /* Rather inefficient way to do it */
-    var parts = s.split("");
-    for(var i=0; i < parts.length; i++) {
+	/* The following should suffice but Safari's regex is b0rken
+	   (doesn't support callback substitutions)
+	   return "\"" + s.replace(/([^\u0020-\u007f]|[\\\"])/g,
+	   escapeJSONChar) + "\"";
+	*/
+
+	/* Rather inefficient way to do it */
+	var parts = s.split("");
+	for(var i=0; i < parts.length; i++) {
 	var c =parts[i];
 	if(c == '"' ||
-	   c == '\\' ||
-	   c.charCodeAt(0) < 32 ||
-	   c.charCodeAt(0) >= 128)
-	    parts[i] = escapeJSONChar(parts[i]);
-    }
-    return "\"" + parts.join("") + "\"";
+		c == '\\' ||
+		c.charCodeAt(0) < 32 ||
+		c.charCodeAt(0) >= 128)
+		parts[i] = escapeJSONChar(parts[i]);
+	}
+	return "\"" + parts.join("") + "\"";
 };
 
-
 /* Marshall objects to JSON format */
 
 toJSON = function toJSON(o)
 {
-    if(o == null) {
+	if(o == null) {
 	return "null";
-    } else if(o.constructor == String) {
+	} else if(o.constructor == String) {
 	return escapeJSONString(o);
-    } else if(o.constructor == Number) {
+	} else if(o.constructor == Number) {
 	return o.toString();
-    } else if(o.constructor == Boolean) {
+	} else if(o.constructor == Boolean) {
 	return o.toString();
-    } else if(o.constructor == Date) {
+	} else if(o.constructor == Date) {
 	return '{javaClass: "java.util.Date", time: ' + o.valueOf() +'}';
-    } else if(o.constructor == Array) {
+	} else if(o.constructor == Array) {
 	var v = [];
-	for(var i = 0; i < o.length; i++) v.push(toJSON(o[i]));
+	for(var i=0; i<o.length; i++) v.push(toJSON(o[i]));
 	return "[" + v.join(", ") + "]";
-    } else {
+	} else {
 	var v = [];
 	for(attr in o) {
-	    if(o[attr] == null) v.push("\"" + attr + "\": null");
-	    else if(typeof o[attr] == "function"); /* skip */
-	    else v.push(escapeJSONString(attr) + ": " + toJSON(o[attr]));
+		if(o[attr] == null) v.push("\"" + attr + "\": null");
+		else if(typeof o[attr] == "function"); /* skip */
+		else v.push(escapeJSONString(attr) + ": " + toJSON(o[attr]));
 	}
 	return "{" + v.join(", ") + "}";
-    }
+	}
 };
 
-
 /* JSONRpcClient constructor */
 
 JSONRpcClient =
 function JSONRpcClient_ctor(serverURL, user, pass, objectID)
 {
-    this.serverURL = serverURL;
-    this.user = user;
-    this.pass = pass;
-    this.objectID = objectID;
+	this.serverURL = serverURL;
+	this.user = user;
+	this.pass = pass;
+	this.objectID = objectID;
 
-    /* Add standard methods */
-    if(this.objectID) {
+	/* Add standard methods */
+	if(this.objectID) {
 	this._addMethods(["listMethods"]);
 	var req = this._makeRequest("listMethods", []);
-    } else {
+	} else {
 	this._addMethods(["system.listMethods"]);
 	var req = this._makeRequest("system.listMethods", []);
-    }
-    var m = this._sendRequest(req);
-    this._addMethods(m);
+	}
+	var m = this._sendRequest(req);
+	this._addMethods(m);
 };
 
-
 /* JSONRpcCLient.Exception */
 
 JSONRpcClient.Exception =
 function JSONRpcClient_Exception_ctor(code, message, javaStack)
 {
-    this.code = code;
-    var name;
-    if(javaStack) {
+	this.code = code;
+	var name;
+	if(javaStack) {
 	this.javaStack = javaStack;
 	var m = javaStack.match(/^([^:]*)/);
 	if(m) name = m[0];
-    }
-    if(name) this.name = name;
-    else this.name = "JSONRpcClientException";
-    this.message = message;
+	}
+	if(name) this.name = name;
+	else this.name = "JSONRpcClientException";
+	this.message = message;
 };
 
 JSONRpcClient.Exception.CODE_REMOTE_EXCEPTION = 490;
@@ -149,16 +144,14 @@
 JSONRpcClient.Exception.prototype.toString =
 function JSONRpcClient_Exception_toString(code, msg)
 {
-    return this.name + ": " + this.message;
+	return this.name + ": " + this.message;
 };
 
-
 /* Default top level exception handler */
 
 JSONRpcClient.default_ex_handler =
 function JSONRpcClient_default_ex_handler(e) { alert(e); };
 
-
 /* Client settable variables */
 
 JSONRpcClient.toplevel_ex_handler = JSONRpcClient.default_ex_handler;
@@ -166,68 +159,67 @@
 JSONRpcClient.max_req_active = 1;
 JSONRpcClient.requestId = 1;
 
-
 /* JSONRpcClient implementation */
 
 JSONRpcClient.prototype._createMethod =
 function JSONRpcClient_createMethod(methodName)
 {
-    var fn=function()
-    {
+	var fn=function()
+	{
 	var args = [];
 	var callback = null;
-	for(var i=0;i<arguments.length;i++) args.push(arguments[i]);
+	for(var i=0; i<arguments.length; i++) args.push(arguments[i]);
 	if(typeof args[0] == "function") callback = args.shift();
 	var req = fn.client._makeRequest.call(fn.client, fn.methodName,
-					      args, callback);
+						  args, callback);
 	if(callback == null) {
-	    return fn.client._sendRequest.call(fn.client, req);
+		return fn.client._sendRequest.call(fn.client, req);
 	} else {
-	    JSONRpcClient.async_requests.push(req);
-	    JSONRpcClient.kick_async();
-	    return req.requestId;
-	}
-    };
-    fn.client = this;
-    fn.methodName = methodName;
-    return fn;
+		JSONRpcClient.async_requests.push(req);
+		JSONRpcClient.kick_async();
+		return req.requestId;
+	}
+	};
+	fn.client = this;
+	fn.methodName = methodName;
+	return fn;
 };
 
 JSONRpcClient.prototype._addMethods =
 function JSONRpcClient_addMethods(methodNames)
 {
-    for(var i=0; i<methodNames.length; i++) {
+	for(var i=0; i<methodNames.length; i++) {
 	var obj = this;
 	var names = methodNames[i].split(".");
 	for(var n=0; n<names.length-1; n++) {
-	    var name = names[n];
-	    if(obj[name]) {
+		var name = names[n];
+		if(obj[name]) {
 		obj = obj[name];
-	    } else {
-		obj[name]  = new Object();
+		} else {
+		obj[name] = new Object();
 		obj = obj[name];
-	    }
+		}
 	}
 	var name = names[names.length-1];
 	if(!obj[name]) {
-	    var method = this._createMethod(methodNames[i]);
-	    obj[name] = method;
+		var method = this._createMethod(methodNames[i]);
+		obj[name] = method;
+	}
 	}
-    }
 };
 
 JSONRpcClient._getCharsetFromHeaders =
 function JSONRpcClient_getCharsetFromHeaders(http)
 {
-    try {
+	try {
 	var contentType = http.getResponseHeader("Content-type");
 	var parts = contentType.split(/\s*;\s*/);
-	for(var i =0; i < parts.length; i++) {
-	    if(parts[i].substring(0, 8) == "charset=")
-		return parts[i].substring(8, parts[i].length);
+	for(var i=0; i<parts.length; i++) {
+		if(parts[i].substring(0,8) == "charset=")
+		return parts[i].substring(8,parts[i].length);
 	}
-    } catch (e) {}
-    return "UTF-8"; /* default */
+	} catch (e) {}
+	return "UTF-8"; /* default */
 };
 
 /* Async queue globals */
@@ -240,196 +232,202 @@
 JSONRpcClient._async_handler =
 function JSONRpcClient_async_handler()
 {
-    JSONRpcClient.async_timeout = null;
+	JSONRpcClient.async_timeout = null;
 
-    while(JSONRpcClient.async_responses.length > 0) {
+	while(JSONRpcClient.async_responses.length > 0) {
 	var res = JSONRpcClient.async_responses.shift();
 	if(res.canceled) continue;
 	if(res.profile) res.profile.dispatch = new Date();
 	try {
-	    res.cb(res.result, res.ex, res.profile);
+		res.cb(res.result, res.ex, res.profile);
 	} catch(e) {
-	    JSONRpcClient.toplevel_ex_handler(e);
+		JSONRpcClient.toplevel_ex_handler(e);
+	}
 	}
-    }
 
-    while(JSONRpcClient.async_requests.length > 0 &&
-	  JSONRpcClient.num_req_active < JSONRpcClient.max_req_active) {
+	while(JSONRpcClient.async_requests.length > 0 &&
+		JSONRpcClient.num_req_active < JSONRpcClient.max_req_active) {
 	var req = JSONRpcClient.async_requests.shift();
 	if(req.canceled) continue;
 	req.client._sendRequest.call(req.client, req);
-    }
+	}
 };
 
 JSONRpcClient.kick_async =
 function JSONRpcClient_kick_async()
 {
-    if(JSONRpcClient.async_timeout == null)
+	if(JSONRpcClient.async_timeout == null)
 	JSONRpcClient.async_timeout =
-	    setTimeout(JSONRpcClient._async_handler, 0);
+		setTimeout(JSONRpcClient._async_handler, 0);
 };
 
 JSONRpcClient.cancelRequest =
 function JSONRpcClient_cancelRequest(requestId)
 {
-    /* If it is in flight then mark it as canceled in the inflight map
-       and the XMLHttpRequest callback will discard the reply. */
-    if(JSONRpcClient.async_inflight[requestId]) {
+	/* If it is in flight then mark it as canceled in the inflight map
+	   and the XMLHttpRequest callback will discard the reply. */
+	if(JSONRpcClient.async_inflight[requestId]) {
 	JSONRpcClient.async_inflight[requestId].canceled = true;
 	return true;
-    }
+	}
 
-    /* If its not in flight yet then we can just mark it as canceled in
-       the the request queue and it will get discarded before being sent. */
-    for(var i in JSONRpcClient.async_requests) {
+	/* If its not in flight yet then we can just mark it as canceled in
+	   the the request queue and it will get discarded before being sent. */
+	for(var i in JSONRpcClient.async_requests) {
 	if(JSONRpcClient.async_requests[i].requestId == requestId) {
-	    JSONRpcClient.async_requests[i].canceled = true;
-	    return true;
+		JSONRpcClient.async_requests[i].canceled = true;
+		return true;
+	}
 	}
-    }
 
-    /* It may have returned from the network and be waiting for its callback
-       to be dispatched, so mark it as canceled in the response queue
-       and the response will get discarded before calling the callback. */
-    for(var i in JSONRpcClient.async_responses) {
+	/* It may have returned from the network and be waiting for its callback
+	   to be dispatched, so mark it as canceled in the response queue
+	   and the response will get discarded before calling the callback. */
+	for(var i in JSONRpcClient.async_responses) {
 	if(JSONRpcClient.async_responses[i].requestId == requestId) {
-	    JSONRpcClient.async_responses[i].canceled = true;
-	    return true;
+		JSONRpcClient.async_responses[i].canceled = true;
+		return true;
+	}
 	}
-    }
 
-    return false;
+	return false;
 };
 
 JSONRpcClient.prototype._makeRequest =
 function JSONRpcClient_makeRequest(methodName, args, cb)
 {
-    var req = {};
-    req.client = this;
-    req.requestId = JSONRpcClient.requestId++;
-
-    var obj = {};
-    obj.id = req.requestId;
-    if (this.objectID)
+	var req = {};
+	req.client = this;
+	req.requestId = JSONRpcClient.requestId++;
+
+	var obj = {};
+	obj.id = req.requestId;
+	if(this.objectID)
 	obj.method = ".obj#" + this.objectID + "." + methodName;
-    else
+	else
 	obj.method = methodName;
-    obj.params = args;
+	obj.params = args;
 
-    if (cb) req.cb = cb;
-    if (JSONRpcClient.profile_async)
+	if(cb) req.cb = cb;
+	if(JSONRpcClient.profile_async)
 	req.profile = { "submit": new Date() };
-    req.data = toJSON(obj);
+	req.data = toJSON(obj);
 
-    return req;
+	return req;
 };
 
 JSONRpcClient.prototype._sendRequest =
 function JSONRpcClient_sendRequest(req)
 {
-    if(req.profile) req.profile.start = new Date();
+	if(req.profile) req.profile.start = new Date();
 
-    /* Get free http object from the pool */
-    var http = JSONRpcClient.poolGetHTTPRequest();
-    JSONRpcClient.num_req_active++;
+	/* Get free http object from the pool */
+	var http = JSONRpcClient.poolGetHTTPRequest();
+	JSONRpcClient.num_req_active++;
 
-    /* Send the request */
-    if (typeof(this.user) == "undefined") {
+	/* Send the request */
+	if(typeof(this.user) == "undefined") {
 	http.open("POST", this.serverURL, (req.cb != null));
-    } else {
+	} else {
 	http.open("POST", this.serverURL, (req.cb != null), this.user, this.pass);
-    }
+	}
 
-    /* setRequestHeader is missing in Opera 8 Beta */
-    try { http.setRequestHeader("Content-type", "text/plain"); } catch(e) {}
+	/* setRequestHeader is missing in Opera 8 Beta */
+	try { http.setRequestHeader("Content-type", "text/plain"); } catch(e) {}
 
-    /* Construct call back if we have one */
-    if(req.cb) {
+	/* Construct call back if we have one */
+	if(req.cb) {
 	var self = this;
 	http.onreadystatechange = function() {
-	    if(http.readyState == 4) {
+		if(http.readyState == 4) {
 		http.onreadystatechange = function () {};
 		var res = { "cb": req.cb, "result": null, "ex": null};
-		if (req.profile) {
-		    res.profile = req.profile;
-		    res.profile.end = new Date();
+		if(req.profile) {
+			res.profile = req.profile;
+			res.profile.end = new Date();
 		}
 		try { res.result = self._handleResponse(http); }
 		catch(e) { res.ex = e; }
 		if(!JSONRpcClient.async_inflight[req.requestId].canceled)
-		    JSONRpcClient.async_responses.push(res);
+			JSONRpcClient.async_responses.push(res);
 		delete JSONRpcClient.async_inflight[req.requestId];
 		JSONRpcClient.kick_async();
-	    }
+		}
 	};
-    } else {
+	} else {
 	http.onreadystatechange = function() {};
-    }
+	}
+
+	JSONRpcClient.async_inflight[req.requestId] = req;
 
-    JSONRpcClient.async_inflight[req.requestId] = req;
-	
-    try {
+	try {
 	http.send(req.data);
-    } catch(e) {
+	} catch(e) {
 	JSONRpcClient.poolReturnHTTPRequest(http);
 	JSONRpcClient.num_req_active--;
 	throw new JSONRpcClient.Exception
-	    (JSONRpcClient.Exception.CODE_ERR_CLIENT, "Connection failed");
-    }
+		(JSONRpcClient.Exception.CODE_ERR_CLIENT, "Connection failed");
+	}
 
-    if(!req.cb) return this._handleResponse(http);
+	if(!req.cb) return this._handleResponse(http);
 };
 
 JSONRpcClient.prototype._handleResponse =
 function JSONRpcClient_handleResponse(http)
 {
-    /* Get the charset */
-    if(!this.charset) {
+	/* Get the charset */
+	if(!this.charset) {
 	this.charset = JSONRpcClient._getCharsetFromHeaders(http);
-    }
+	}
 
-    /* Get request results */
-    var status, statusText, data;
-    try {
+	/* Get request results */
+	var status, statusText, data;
+	try {
 	status = http.status;
 	statusText = http.statusText;
 	data = http.responseText;
-    } catch(e) {
+	} catch(e) {
 	JSONRpcClient.poolReturnHTTPRequest(http);
 	JSONRpcClient.num_req_active--;
 	JSONRpcClient.kick_async();
 	throw new JSONRpcClient.Exception
-	    (JSONRpcClient.Exception.CODE_ERR_CLIENT, "Connection failed");
-    }
+		(JSONRpcClient.Exception.CODE_ERR_CLIENT, "Connection failed");
+	}
 
-    /* Return http object to the pool; */
-    JSONRpcClient.poolReturnHTTPRequest(http);
-    JSONRpcClient.num_req_active--;
+	/* Return http object to the pool; */
+	JSONRpcClient.poolReturnHTTPRequest(http);
+	JSONRpcClient.num_req_active--;
 
-    /* Unmarshall the response */
-    if(status != 200) {
+	/* Unmarshall the response */
+	if(status != 200) {
 	throw new JSONRpcClient.Exception(status, statusText);
-    }
-    var obj;
-    try {
+	}
+	var obj;
+	try {
+	/* remove protection against direct evaluation */
+	if(data.substring(0,6) == "throw ") {
+		data = data.substring(data.indexOf('\n')+1);
+	}
+	if (data.substring(0,2) == "/*") {
+		data = data.substring(2, data.length-2)
+	}
 	eval("obj = " + data);
-    } catch(e) {
+	} catch(e) {
 	throw new JSONRpcClient.Exception(550, "error parsing result");
-    }
-    if(obj.error)
-	throw new JSONRpcClient.Exception(obj.error.code, obj.error.msg,
-					  obj.error.trace);
-    var res = obj.result;
+	}
+	if(obj.error)
+	throw new JSONRpcClient.Exception(obj.error.code,
+		obj.error.msg, obj.error.trace);
+	var res = obj.result;
 
-    /* Handle CallableProxy */
-    if(res && res.objectID && res.JSONRPCType == "CallableReference")
+	/* Handle CallableProxy */
+	if(res && res.objectID && res.JSONRPCType == "CallableReference")
 	return new JSONRpcClient(this.serverURL, this.user,
-				 this.pass, res.objectID);
+		this.pass, res.objectID);
 
-    return res;
+	return res;
 };
 
-
 /* XMLHttpRequest wrapper code */
 
 /* XMLHttpRequest pool globals */
@@ -439,46 +437,46 @@
 JSONRpcClient.poolGetHTTPRequest =
 function JSONRpcClient_pool_getHTTPRequest()
 {
-    if(JSONRpcClient.http_spare.length > 0) {
+	if(JSONRpcClient.http_spare.length > 0) {
 	return JSONRpcClient.http_spare.pop();
-    }
-    return JSONRpcClient.getHTTPRequest();
+	}
+	return JSONRpcClient.getHTTPRequest();
 };
 
 JSONRpcClient.poolReturnHTTPRequest =
 function JSONRpcClient_poolReturnHTTPRequest(http)
 {
-    if(JSONRpcClient.http_spare.length >= JSONRpcClient.http_max_spare)
+	if(JSONRpcClient.http_spare.length >= JSONRpcClient.http_max_spare)
 	delete http;
-    else
+	else
 	JSONRpcClient.http_spare.push(http);
 };
 
-JSONRpcClient.msxmlNames = [ "MSXML2.XMLHTTP.5.0",
-			     "MSXML2.XMLHTTP.4.0",
-			     "MSXML2.XMLHTTP.3.0",
-			     "MSXML2.XMLHTTP",
-			     "Microsoft.XMLHTTP" ];
+JSONRpcClient.msxmlNames = [
+	"MSXML2.XMLHTTP.5.0",
+	"MSXML2.XMLHTTP.4.0",
+	"MSXML2.XMLHTTP.3.0",
+	"MSXML2.XMLHTTP",
+	"Microsoft.XMLHTTP" ];
 
 JSONRpcClient.getHTTPRequest =
 function JSONRpcClient_getHTTPRequest()
 {
-    /* Mozilla XMLHttpRequest */
-    try {
+	/* Mozilla XMLHttpRequest */
+	try {
 	JSONRpcClient.httpObjectName = "XMLHttpRequest";
 	return new XMLHttpRequest();
-    } catch(e) {}
+	} catch(e) {}
 
-    /* Microsoft MSXML ActiveX */
-    for (var i=0;i < JSONRpcClient.msxmlNames.length; i++) {
+	/* Microsoft MSXML ActiveX */
+	for(var i=0; i<JSONRpcClient.msxmlNames.length; i++) {
 	try {
-	    JSONRpcClient.httpObjectName = JSONRpcClient.msxmlNames[i];
-	    return new ActiveXObject(JSONRpcClient.msxmlNames[i]);
+		JSONRpcClient.httpObjectName = JSONRpcClient.msxmlNames[i];
+		return new ActiveXObject(JSONRpcClient.msxmlNames[i]);
 	} catch (e) {}
-    }
+	}
 
-    /* None found */
-    JSONRpcClient.httpObjectName = null;
-    throw new JSONRpcClient.Exception(0, "Can't create XMLHttpRequest object");
+	/* None found */
+	JSONRpcClient.httpObjectName = null;
+	throw new JSONRpcClient.Exception(0, "Can't create XMLHttpRequest object");
 };
-

Modified: Webware/trunk/WebKit/JSONRPCServlet.py
==============================================================================
--- Webware/trunk/WebKit/JSONRPCServlet.py	(original)
+++ Webware/trunk/WebKit/JSONRPCServlet.py	Sun Apr 22 15:10:59 2007
@@ -23,23 +23,26 @@
 	are able to be called by an JSON-RPC-enabled web page. This is very similar
 	in functionality to Webware's actions.
 
+	Some basic security measures against JavaScript hijacking are taken	by
+	default which can be deactivated if you're not dealing with sensitive data.
+	You can further increase security by adding shared secret mechanisms.
+
 	"""
 
 	# Class level variables that can be overridden by servlet instances:
 	_debug = 0 # set to True if you want to see debugging output
+	# The following variables control security precautions concerning
+	# a vulnerability known as "JavaScript hijacking". See also:
+	# http://www.fortifysoftware.com/servlet/downloads/public/JavaScript_Hijacking.pdf
+	# http://ajaxian.com/archives/protecting-a-javascript-service
 	_allowGet = 0 # set to True if you want to allow GET requests
+	_allowEval = 0 # set to True to allow direct evaluation of the response
 
 	def __init__(self):
 		HTTPContent.__init__(self)
 
 	def respondToGet(self, transaction):
-		"""Deny GET requests with JSON by returning an error.
-
-		This forces clients to use POST requests only, since GET requests
-		with JSON are vulnerable to "JavaScript hijacking".
-
-		"""
-		if not self._allowGet:
+		if self._allowGet:
 			self.error("GET method not allowed")
 		HTTPContent.respondToGet(self, transaction)
 
@@ -54,6 +57,16 @@
 	def json_methods(self):
 		return []
 
+	def json_error(self, msg):
+		self.write(simplejson.dumps({'id': self._id, 'code': -1, 'error': msg}))
+
+	def json_result(self, data):
+		data = simplejson.dumps({'id': self._id, 'result': data})
+		if not self._allowEval:
+			data = 'throw new Error' \
+				'("Direct evaluation not allowed");\n/*%s*/' % (data,)
+		self.write(data)
+
 	def json_call(self):
 		"""Execute method with arguments on the server side.
 
@@ -62,32 +75,26 @@
 		"""
 		request = self.request()
 		data = simplejson.loads(request.rawInput().read())
-		id, call, params = data["id"], data["method"], data["params"]
-		self._id = id
+		self._id, call, params = data["id"], data["method"], data["params"]
 		if call == 'system.listMethods':
-			result = self.json_methods()
-			self.write(simplejson.dumps({'id': id, 'result': result}))
+			self.json_result(self.json_methods())
 		elif call in self.json_methods():
 			try:
 				method = getattr(self, call)
 			except AttributeError:
-				self.error('%s, although an approved method, '
+				self.json_error('%s, although an approved method, '
 					'was not found' % call)
 			else:
 				try:
 					if self._debug:
 						self.log("json call %s(%s)" % (call, params))
-					result = method(*params)
-					self.write(simplejson.dumps({'id': id, 'result': result}))
+					self.json_result(method(*params))
 				except Exception:
 					err = StringIO()
 					traceback.print_exc(file=err)
 					e = err.getvalue()
-					self.error('%s was called, '
+					self.json_error('%s was called, '
 						'but encountered an error: %s' % (call, e))
 					err.close()
 		else:
-			self.error('%s is not an approved method' % call)
-
-	def error(self, msg):
-		self.write(simplejson.dumps({'id': self._id, 'code': -1, 'error': msg}))
+			self.json_error('%s is not an approved method' % call)

Author: chrisz
Date: Sun Apr 22 12:41:42 2007
New Revision: 6502

Modified:
   Webware/trunk/WebKit/JSONRPCServlet.py

Log:
Make JSONRPCServlet.py less vulnerable to JavaScript hijacking by forcing POST requests (patch #1697059 by Jean-Francois Pieronne).

Modified: Webware/trunk/WebKit/JSONRPCServlet.py
==============================================================================
--- Webware/trunk/WebKit/JSONRPCServlet.py	(original)
+++ Webware/trunk/WebKit/JSONRPCServlet.py	Sun Apr 22 12:41:42 2007
@@ -12,8 +12,6 @@
 
 from HTTPContent import HTTPContent
 
-debug = 0
-
 
 class JSONRPCServlet(HTTPContent):
 	"""A superclass for Webware servlets using JSON-RPC techniques.
@@ -27,9 +25,24 @@
 
 	"""
 
+	# Class level variables that can be overridden by servlet instances:
+	_debug = 0 # set to True if you want to see debugging output
+	_allowGet = 0 # set to True if you want to allow GET requests
+
 	def __init__(self):
 		HTTPContent.__init__(self)
 
+	def respondToGet(self, transaction):
+		"""Deny GET requests with JSON by returning an error.
+
+		This forces clients to use POST requests only, since GET requests
+		with JSON are vulnerable to "JavaScript hijacking".
+
+		"""
+		if not self._allowGet:
+			self.error("GET method not allowed")
+		HTTPContent.respondToGet(self, transaction)
+
 	def defaultAction(self):
 		self.json_call()
 
@@ -62,7 +75,7 @@
 					'was not found' % call)
 			else:
 				try:
-					if debug:
+					if self._debug:
 						self.log("json call %s(%s)" % (call, params))
 					result = method(*params)
 					self.write(simplejson.dumps({'id': id, 'result': result}))

Author: chrisz
Date: Sun Apr 22 10:33:30 2007
New Revision: 6501

Modified:
   Webware/trunk/WebKit/Adapters/CGIPlus/CgiPlusMakeAppWorkDir.py
   Webware/trunk/bin/MakeAppWorkDir.py

Log:
Made MakeAppWorkDir run with older Python versions, too.

Modified: Webware/trunk/WebKit/Adapters/CGIPlus/CgiPlusMakeAppWorkDir.py
==============================================================================
--- Webware/trunk/WebKit/Adapters/CGIPlus/CgiPlusMakeAppWorkDir.py	(original)
+++ Webware/trunk/WebKit/Adapters/CGIPlus/CgiPlusMakeAppWorkDir.py	Sun Apr 22 10:33:30 2007
@@ -182,7 +182,9 @@
 			import grp
 			group = grp.getgrgid(gid)[0]
 		executable = sys.executable
-		for name in launcherScripts:
+		scriptNames = launcherScripts.keys()
+		scriptNames.sort()
+		for name in scriptNames:
 			if name.endswith('Service.py') and self._osType != 'nt':
 				continue
 			newname = os.path.join(workDir, name)
@@ -205,14 +207,15 @@
 			self._contextDir or self._contextName)
 		if contextDir.startswith(self._workDir):
 			configDir = contextDir[len(self._workDir):]
-			configDir = configDir.lstrip(os.sep)
-			if os.altsep:
-				configDir =  configDir.lstrip(os.altsep)
+			while configDir[:1] in (os.sep, os.altsep):
+				configDir = configDir[1:]
 		else:
 			configDir = contextDir
 		if not os.path.exists(contextDir):
 			os.makedirs(contextDir)
-		for name in exampleContext:
+		contextNames = exampleContext.keys()
+		contextNames.sort()
+		for name in contextNames:
 			filename = os.path.join(contextDir, name)
 			if not os.path.exists(filename):
 				self.msg("\t%s" % filename)
@@ -431,7 +434,7 @@
 				print 'Error: Group %r does not exist.' % gid
 				sys.exit(2)
 			except ImportError:
-				print 'Error: Group names are not supported.'
+				print 'Error: Group names are supported under Unix only.'
 				sys.exit(2)
 			gid = entry[2]
 	# Figure out the user id:
@@ -447,7 +450,7 @@
 				print 'Error: User %r does not exist.' % uid
 				sys.exit(2)
 			except ImportError:
-				print 'Error: User names are not supported.'
+				print 'Error: User names are supported under Unix only.'
 				sys.exit(2)
 			if not gid:
 				gid = entry[3]

Modified: Webware/trunk/bin/MakeAppWorkDir.py
==============================================================================
--- Webware/trunk/bin/MakeAppWorkDir.py	(original)
+++ Webware/trunk/bin/MakeAppWorkDir.py	Sun Apr 22 10:33:30 2007
@@ -203,7 +203,9 @@
 			import grp
 			group = grp.getgrgid(gid)[0]
 		executable = sys.executable
-		for name in launcherScripts:
+		scriptNames = launcherScripts.keys()
+		scriptNames.sort()
+		for name in scriptNames:
 			if name.endswith('Service.py') and self._osType != 'nt':
 				continue
 			newname = os.path.join(workDir, name)
@@ -252,9 +254,8 @@
 			self._contextDir or self._contextName)
 		if contextDir.startswith(self._workDir):
 			configDir = contextDir[len(self._workDir):]
-			configDir = configDir.lstrip(os.sep)
-			if os.altsep:
-				configDir =  configDir.lstrip(os.altsep)
+			while configDir[:1] in (os.sep, os.altsep):
+				configDir = configDir[1:]
 		else:
 			configDir = contextDir
 		if os.path.exists(contextDir):
@@ -262,7 +263,9 @@
 		else:
 			self.msg("\t%s" % contextDir)
 			os.makedirs(contextDir)
-		for name in exampleContext:
+		contextNames = exampleContext.keys()
+		contextNames.sort()
+		for name in contextNames:
 			filename = os.path.join(contextDir, name)
 			if os.path.exists(filename):
 				self.msg("\t%s already exists." % filename)
@@ -552,7 +555,7 @@
 				print 'Error: Group %r does not exist.' % gid
 				sys.exit(2)
 			except ImportError:
-				print 'Error: Group names are not supported.'
+				print 'Error: Group names are supported under Unix only.'
 				sys.exit(2)
 			gid = entry[2]
 	# Figure out the user id:
@@ -568,7 +571,7 @@
 				print 'Error: User %r does not exist.' % uid
 				sys.exit(2)
 			except ImportError:
-				print 'Error: User names are not supported.'
+				print 'Error: User names are supported under Unix only.'
 				sys.exit(2)
 			if not gid:
 				gid = entry[3]

Author: chrisz
Date: Sun Apr 22 09:48:12 2007
New Revision: 6500

Modified:
   Webware/trunk/KidKit/Docs/UsersGuide.phtml
   Webware/trunk/KidKit/Examples/KidExamplePage.py
   Webware/trunk/PSP/Examples/PSPExamplePage.py
   Webware/trunk/WebKit/AppServer.py
   Webware/trunk/WebKit/Configs/Application.config
   Webware/trunk/WebKit/Examples/ExamplePage.py
   Webware/trunk/WebKit/Examples/Welcome.py
   Webware/trunk/WebKit/PlugIn.py
   Webware/trunk/WebKit/Testing/TestIMS.py
   Webware/trunk/WebKit/Tests/Basic/Configs/Application.config
   Webware/trunk/install.py

Log:
Two different mechanisms had been used to create the Examples and Docs contexts for all the plugins: For the Docs contexts, hierarchical context names were used (nice), but the Application.config file was modified (ugly), while the Examples contexts were created on the fly when the plugins were loaded (nice), but they constructed their own context names which were not hierarchical (ugly). This has now been unified. The Application.config file is not touched any more (except for the admin password), all contexts are created on the fly, and both use the hierarchical notation, e.g. 'PSP/Examples' instead of 'PSPExamples'. These things are much simpler and clearer now.

Modified: Webware/trunk/KidKit/Docs/UsersGuide.phtml
==============================================================================
--- Webware/trunk/KidKit/Docs/UsersGuide.phtml	(original)
+++ Webware/trunk/KidKit/Docs/UsersGuide.phtml	Sun Apr 22 09:48:12 2007
@@ -98,7 +98,7 @@
 <p>In the simplest case, you can just take a Kid template file with the
 extension <tt>.kid</tt> and place it into a directory that is a valid Webware
 context. For instance, you will find the following file with the name
-<tt>Time2.kid</tt> in the <i>KidKitExamples</i> context:</p>
+<tt>Time2.kid</tt> in the <i>KidKit/Examples</i> context:</p>
 
 <pre class="py">
 &lt;?xml version='1.0' encoding='utf-8'?&gt;
@@ -243,7 +243,7 @@
 
 <h2>More examples</h2>
 
-<p>You will find some more examples in the <i>KidKitExamples</i> context.</p>
+<p>You will find some more examples in the <i>KidKit/Examples</i> context.</p>
 
 <h2>Credits</h2>
 

Modified: Webware/trunk/KidKit/Examples/KidExamplePage.py
==============================================================================
--- Webware/trunk/KidKit/Examples/KidExamplePage.py	(original)
+++ Webware/trunk/KidKit/Examples/KidExamplePage.py	Sun Apr 22 09:48:12 2007
@@ -30,10 +30,10 @@
 
 	def writeOtherMenu(self):
 		self.menuHeading('Other')
-		viewPath = self.request().uriWebKitRoot() + "KidKitExamples/View"
+		viewPath = self.request().uriWebKitRoot() + "KidKit/Examples/View"
 		self.menuItem('View source of<br/>%s' % self.title(),
 			self.request().uriWebKitRoot() +
-				'KidKitExamples/View?filename=%s'
+				'KidKit/Examples/View?filename=%s'
 				% os.path.basename(self.request().serverSidePath()))
 		if self.application().hasContext('Documentation'):
 			filename = 'Documentation/WebKit.html'

Modified: Webware/trunk/PSP/Examples/PSPExamplePage.py
==============================================================================
--- Webware/trunk/PSP/Examples/PSPExamplePage.py	(original)
+++ Webware/trunk/PSP/Examples/PSPExamplePage.py	Sun Apr 22 09:48:12 2007
@@ -22,10 +22,10 @@
 
 	def writeOtherMenu(self):
 		self.menuHeading('Other')
-		viewPath = self.request().uriWebKitRoot() + "PSPExamples/View"
+		viewPath = self.request().uriWebKitRoot() + "PSP/Examples/View"
 		self.menuItem(
 			'View source of<br/>%s' % self.title(),
-			self.request().uriWebKitRoot() + 'PSPExamples/View?filename=%s' \
+			self.request().uriWebKitRoot() + 'PSP/Examples/View?filename=%s' \
 				% os.path.basename(self.request().serverSidePath()))
 		if self.application().hasContext('Documentation'):
 			filename = 'Documentation/WebKit.html'

Modified: Webware/trunk/WebKit/AppServer.py
==============================================================================
--- Webware/trunk/WebKit/AppServer.py	(original)
+++ Webware/trunk/WebKit/AppServer.py	Sun Apr 22 09:48:12 2007
@@ -311,7 +311,9 @@
 		# a "dontload" file) then add them to the plugs in list.
 		for plugInDir in self.setting('PlugInDirs'):
 			plugInDir = self.serverSidePath(plugInDir)
-			for filename in os.listdir(plugInDir):
+			fileNames = os.listdir(plugInDir)
+			fileNames.sort()
+			for filename in fileNames:
 				filename = os.path.normpath(os.path.join(plugInDir, filename))
 				if (os.path.isdir(filename)
 					and os.path.exists(os.path.join(filename, '__init__.py'))

Modified: Webware/trunk/WebKit/Configs/Application.config
==============================================================================
--- Webware/trunk/WebKit/Configs/Application.config	(original)
+++ Webware/trunk/WebKit/Configs/Application.config	Sun Apr 22 09:48:12 2007
@@ -1,7 +1,7 @@
 # Application.config file for Webware for Python
 
 # The password for the Admin context:
-AdminPassword = '' # you cannot log in with an empty password
+AdminPassword = '2RPTm2Tw' # you cannot log in with an empty password
 
 PrintConfigAtStartUp = True
 
@@ -36,9 +36,10 @@
 
 Contexts = {}
 Contexts['Admin'] = WebKitPath + '/Admin'
+Contexts['Docs'] = WebwarePath + '/Docs'
+Contexts['WebKit/Docs'] = WebKitPath + '/Docs'
 Contexts['Examples'] = WebKitPath + '/Examples'
 Contexts['Testing'] = WebKitPath + '/Testing'
-# Installer will insert Contexts['Docs'] here.
 Contexts['default'] = WebKitPath + '/Examples'
 
 SessionStore = 'Dynamic' # can be File or Dynamic or Memory

Modified: Webware/trunk/WebKit/Examples/ExamplePage.py
==============================================================================
--- Webware/trunk/WebKit/Examples/ExamplePage.py	(original)
+++ Webware/trunk/WebKit/Examples/ExamplePage.py	Sun Apr 22 09:48:12 2007
@@ -42,7 +42,7 @@
 	def isDebugging(self):
 		return 0
 
-	def examplePages(self):
+	def examplePages(self, plugInName=None):
 		"""Get a list of all example pages.
 
 		Returns a list of all the example pages for our particular plug-in.
@@ -50,15 +50,12 @@
 		give easy access to the other example pages.
 
 		"""
-		ctxName = self.request().contextName()
-		if ctxName == 'Examples':
+		if plugInName is None:
 			# Special case: We're in WebKit examples
 			from WebKit.Properties import WebKitConfig
 			return WebKitConfig['examplePages']
 		else:
 			# Any other plug-in:
-			assert ctxName[-8:] == 'Examples'
-			plugInName = ctxName[:-8]
 			plugIn = self.application().server().plugIn(plugInName)
 			return plugIn.examplePages()
 
@@ -70,23 +67,24 @@
 	def writeExamplesMenu(self):
 		servletPath = self.request().servletPath()
 		self.menuHeading('Examples')
-
+		ctx = self.request().contextName().split('/', 2)
+		plugIns = self.application().server().plugIns()
+		plugInName = len(ctx) > 1 and ctx[1] == 'Examples' and ctx[0]
 		# WebKit
 		self.menuItem('WebKit', '%s/Examples/' % servletPath)
-		if self.request().contextName() == 'Examples':
+		if not plugInName:
 			self.writeExamplePagesItems()
-
-		# Plug-ins
-		for plugIn in self.application().server().plugIns():
+		# Other plug-ins
+		for plugIn in plugIns:
 			if plugIn.hasExamplePages():
-				title = plugIn.name()
+				name = plugIn.name()
 				link = '%s/%s/' % (servletPath, plugIn.examplePagesContext())
-				self.menuItem(title, link)
-				if plugIn.name() == self.request().contextName()[:-8]:
-					self.writeExamplePagesItems()
+				self.menuItem(name, link)
+				if name == plugInName:
+					self.writeExamplePagesItems(name)
 
-	def writeExamplePagesItems(self):
-		for page in self.examplePages():
+	def writeExamplePagesItems(self, pluginName=None):
+		for page in self.examplePages(pluginName):
 			self.menuItem(page, page, indentLevel=2)
 
 	def writeOtherMenu(self):

Modified: Webware/trunk/WebKit/Examples/Welcome.py
==============================================================================
--- Webware/trunk/WebKit/Examples/Welcome.py	(original)
+++ Webware/trunk/WebKit/Examples/Welcome.py	Sun Apr 22 09:48:12 2007
@@ -23,7 +23,7 @@
 		<p>The <a href="%(path)s/Docs/">Docs</a> contexts allow you to browse
 		the documentation of <a href="%(path)s/WebKit/Docs/">WebKit</a>
 		and <a href="%(path)s/Docs/ComponentIndex.html">all other components</a>
-		of <a href="%(path)s/Docs/">Webware for Python</a>.</p>''' % locals())
+		of Webware for Python.</p>''' % locals())
 		from os.path import join
 		wr('<p>The location of the documentation on the server:</p>')
 		wr('<ul>')

Modified: Webware/trunk/WebKit/PlugIn.py
==============================================================================
--- Webware/trunk/WebKit/PlugIn.py	(original)
+++ Webware/trunk/WebKit/PlugIn.py	Sun Apr 22 09:48:12 2007
@@ -20,9 +20,9 @@
 
 	Instances of this class represent plug-ins which are ultimately Python
 	packages (see the Python Tutorial, 6.4: "Packages" at
-	http://www.python.org/doc/current/tut/node8.html#SECTION008400000000000000000).
+	http://docs.python.org/tut/node8.html#SECTION008400000000000000000).
 
-	A plug-in must also be a Webware component which at means that it will have
+	A plug-in must also be a Webware component which means that it will have
 	a Properties.py file advertising its name, version, requirements, etc.
 	You can ask a plug-in for its properties().
 
@@ -67,7 +67,8 @@
 		self._path = path
 		self._dir, self._name = os.path.split(path)
 		self._ver = '(unknown)'
-		self._examplePages = None
+		self._docs = self._docContext = None
+		self._examplePages = self._examplePagesContext = None
 
 	def load(self):
 		"""Loads the plug-in into memory, but does not yet install it.
@@ -107,33 +108,58 @@
 		if not os.path.exists(cacheDir):
 			os.mkdir(cacheDir)
 
+		self.setUpDocContext()
 		self.setUpExamplePages()
 
+	def setUpDocContext(self):
+		"""Add a context for the documentation."""
+		app = self._appServer.application()
+		if app.hasContext('Docs'):
+			self._docs = self._properties.get('docs', None) or None
+			if self.hasDocs():
+				docsPath = self.serverSidePath('Docs')
+				assert os.path.exists(docsPath), \
+					'Plug-in %s says it has documentation, ' \
+					'but there is no Docs/ subdir.' % self._name
+				ctxName = self._name + '/Docs'
+				if not app.hasContext(ctxName):
+					app.addContext(ctxName, docsPath)
+				self._docContext = ctxName
+
 	def setUpExamplePages(self):
-		# Add a context for the examples
+		"""Add a context for the examples."""
 		app = self._appServer.application()
 		if app.hasContext('Examples'):
 			config = self._properties.get('WebKitConfig', {})
-			self._examplePages = config.get('examplePages', None)
-			if self._examplePages is not None:
+			self._examplePages = config.get('examplePages', None) or None
+			if self.hasExamplePages():
 				examplesPath = self.serverSidePath('Examples')
 				assert os.path.exists(examplesPath), \
 					'Plug-in %s says it has example pages, ' \
 					'but there is no Examples/ subdir.' % self._name
-				ctxName = self._name + 'Examples'
+				ctxName = self._name + '/Examples'
 				if not app.hasContext(ctxName):
 					app.addContext(ctxName, examplesPath)
 				self._examplePagesContext = ctxName
 
+	def docs(self):
+		return self._docs
+
+	def hasDocs(self):
+		return self._docs is not None
+
+	def docsContext(self):
+		return self._docsContext
+
+	def examplePages(self):
+		return self._examplePages
+
 	def hasExamplePages(self):
 		return self._examplePages is not None
 
 	def examplePagesContext(self):
 		return self._examplePagesContext
 
-	def examplePages(self):
-		return self._examplePages
-
 	def install(self):
 		"""Install plug-in by invoking its required InstallInWebKit function."""
 		self._module.InstallInWebKit(self._appServer)

Modified: Webware/trunk/WebKit/Testing/TestIMS.py
==============================================================================
--- Webware/trunk/WebKit/Testing/TestIMS.py	(original)
+++ Webware/trunk/WebKit/Testing/TestIMS.py	Sun Apr 22 09:48:12 2007
@@ -29,7 +29,7 @@
 		servletPath = self.request().servletPath()
 		self.write('<h2>Test If-Modified-Since support in Webware</h2>')
 		# pick a static file which is served up by Webwares UnknownFileHandler
-		self.runTest('%s/PSPExamples/psplogo.png' % servletPath)
+		self.runTest('%s/PSP/Examples/psplogo.png' % servletPath)
 
 	def runTest(self, path):
 		import time

Modified: Webware/trunk/WebKit/Tests/Basic/Configs/Application.config
==============================================================================
--- Webware/trunk/WebKit/Tests/Basic/Configs/Application.config	(original)
+++ Webware/trunk/WebKit/Tests/Basic/Configs/Application.config	Sun Apr 22 09:48:12 2007
@@ -36,9 +36,10 @@
 
 Contexts = {}
 Contexts['Admin'] = WebKitPath + '/Admin'
+Contexts['Docs'] = WebwarePath + '/Docs'
+Contexts['WebKit/Docs'] = WebKitPath + '/Docs'
 Contexts['Examples'] = WebKitPath + '/Examples'
 Contexts['Testing'] = WebKitPath + '/Testing'
-Contexts['Docs'] = WebKitPath + '/Docs'
 Contexts['Test'] = 'TestContext'
 Contexts['default'] = 'TestContext'
 

Modified: Webware/trunk/install.py
==============================================================================
--- Webware/trunk/install.py	(original)
+++ Webware/trunk/install.py	Sun Apr 22 09:48:12 2007
@@ -145,21 +145,21 @@
 
 	def detectComponents(self):
 		print 'Scanning for components...'
-		dirnames = filter(lambda dir: not dir.startswith('.')
+		dirNames = filter(lambda dir: not dir.startswith('.')
 				and os.path.isdir(dir), os.listdir(os.curdir))
-		dirnames.sort()
-		self._maxCompLen = max(map(len, dirnames))
+		dirNames.sort()
+		self._maxCompLen = max(map(len, dirNames))
 		oldPyVersion = 0
 		column = 0
-		for dirname in dirnames:
-			propName = os.path.join(dirname, 'Properties.py')
+		for dirName in dirNames:
+			propName = dirName + '/Properties.py'
 			try:
-				print dirname.ljust(self._maxCompLen, '.'),
+				print dirName.ljust(self._maxCompLen, '.'),
 			except TypeError:
-				print dirname.ljust(self._maxCompLen),
+				print dirName.ljust(self._maxCompLen),
 			if os.path.exists(propName):
 				comp = PropertiesObject(propName)
-				comp['dirname'] = dirname
+				comp['dirname'] = dirName
 				for key in self._props.keys():
 					if not comp.has_key(key):
 						comp[key] = self._props[key]
@@ -204,7 +204,8 @@
 				print 'A password was specified on the command-line.'
 			password = None
 		print 'You can check the password after installation at:'
-		print 'WebKit/Configs/Application.config'
+		appConfig = 'WebKit/Configs/Application.config'
+		print os.path.normpath(appConfig)
 		if not password:
 			if defpass is None:
 				from string import letters, digits
@@ -213,7 +214,7 @@
 			else:
 				password = defpass
 		try: # read config file
-			data = open('WebKit/Configs/Application.config').read()
+			data = open(appConfig).read()
 		except IOError:
 			print 'Error reading Application.config file.'
 			print 'Password not replaced, make sure to edit it by hand.'
@@ -237,7 +238,7 @@
 				print "'AdminPassword' not found in config file."
 			return
 		try: # write back config file
-			open('WebKit/Configs/Application.config', 'w').write(data)
+			open(appConfig, 'w').write(data)
 		except IOError:
 			print 'Error writing Application.config (probably no permission).'
 			print 'Password not replaced, make sure to edit it by hand.'
@@ -292,7 +293,7 @@
 					print dir.ljust(self._maxCompLen, '.'),
 				except TypeError:
 					print dir.ljust(self._maxCompLen),
-			sourceDir = '%s/Docs/Source' % dir
+			sourceDir = dir + '/Docs/Source'
 			self.makeDir(sourceDir)
 			filesDir = sourceDir + '/Files'
 			self.makeDir(filesDir)
@@ -300,7 +301,7 @@
 			self.makeDir(summariesDir)
 			docsDir = sourceDir + '/Docs'
 			self.makeDir(docsDir)
-			for pyFilename in glob('%s/*.py' % dir):
+			for pyFilename in glob(dir + '/*.py'):
 				self.createHighlightedSource(pyFilename, filesDir)
 				self.createPySummary(pyFilename, summariesDir)
 				self.createPyDocs(pyFilename, docsDir)
@@ -461,8 +462,7 @@
 			comp['htDocs'] = ht
 			# Set up release notes
 			ht = []
-			files = glob(os.path.join(comp['dirname'],
-				'Docs', 'RelNotes-*.html'))
+			files = glob(comp['dirname'] + '/Docs/RelNotes-*.html')
 			if files:
 				releaseNotes = []
 				for filename in files:
@@ -488,7 +488,7 @@
 			ht = '\n'.join(ht)
 			comp['htReleaseNotes'] = ht
 			# Write file
-			filename = os.path.join(comp['dirname'], 'Docs', 'index.html')
+			filename = comp['dirname'] + '/Docs/index.html'
 			ht = self.processPyTemplate(index, comp)
 			open(filename, 'w').write(ht)
 		if not keep:
@@ -498,38 +498,19 @@
 	def createDocContexts(self):
 		"""Create a WebKit context for every Docs directory."""
 		print 'Making all Docs directories browsable via WebKit...'
+		# Place an __init__.py file in every Docs directory
 		docsDirs = ['Docs']
 		for comp in self._comps:
-			docsDirs.append(comp['dirname'] + '/Docs')
-		config = []
+			if comp.get('docs', None):
+				docsDir = comp['dirname'] + '/Docs'
+				if os.path.isdir(docsDir):
+					docsDirs.append(docsDir)
 		for docsDir in docsDirs:
-			if os.path.exists(docsDir):
-				open(docsDir + '/__init__.py', 'w').write(
-					'# Allows this directory to be used as a WebKit context.\n')
-			config.append("Contexts['%s'] = WebwarePath + '/%s'" % ((docsDir,)*2))
-		config = '\n'.join(config)
-		try: # read config file
-			data = open('WebKit/Configs/Application.config').read()
-		except IOError:
-			print 'Error reading Application.config file.'
-			print 'Docs cannot be made browsable via WebKit.'
-			data = ''
-		if data.find(config) < 0:
-			insertMark = "# Installer will insert Contexts['Docs'] here."
-			insertPos = data.find(insertMark)
-			if insertPos < 0:
-				print 'Configuration has already been changed.'
-				print 'Docs directories will not be added as context.'
-			else:
-				data = data[:insertPos] + config + data[insertPos+len(insertMark):]
-			try: # write back config file
-				open('WebKit/Configs/Application.config', 'w').write(data)
-			except IOError:
-				print 'Error writing Application.config (probably no permission).'
-				print 'Docs cannot be made browsable via WebKit.'
-		else:
-			print 'Docs directories are already registered with WebKit.'
-		# Copy favicon to the default context:
+			initFile = docsDir + '/__init__.py'
+			if not os.path.exists(initFile) or 1:
+				open(initFile, 'w').write(
+					'# this can be browsed as a Webware context\n')
+		# Copy favicon to the default context
 		open('WebKit/Examples/favicon.ico', 'wb').write(
 			open('Docs/favicon.ico', 'rb').read())
 		print

Author: chrisz
Date: Sun Apr 22 06:34:06 2007
New Revision: 6499

Modified:
   Webware/trunk/WebKit/Configs/Application.config

Log:
Reverted accidental checkin of modified Application.config.

Modified: Webware/trunk/WebKit/Configs/Application.config
==============================================================================
--- Webware/trunk/WebKit/Configs/Application.config	(original)
+++ Webware/trunk/WebKit/Configs/Application.config	Sun Apr 22 06:34:06 2007
@@ -1,7 +1,7 @@
 # Application.config file for Webware for Python
 
 # The password for the Admin context:
-AdminPassword = 'oTFpDKaP' # you cannot log in with an empty password
+AdminPassword = '' # you cannot log in with an empty password
 
 PrintConfigAtStartUp = True
 
@@ -38,17 +38,7 @@
 Contexts['Admin'] = WebKitPath + '/Admin'
 Contexts['Examples'] = WebKitPath + '/Examples'
 Contexts['Testing'] = WebKitPath + '/Testing'
-Contexts['Docs'] = WebwarePath + '/Docs'
-Contexts['CGIWrapper/Docs'] = WebwarePath + '/CGIWrapper/Docs'
-Contexts['COMKit/Docs'] = WebwarePath + '/COMKit/Docs'
-Contexts['KidKit/Docs'] = WebwarePath + '/KidKit/Docs'
-Contexts['MiddleKit/Docs'] = WebwarePath + '/MiddleKit/Docs'
-Contexts['MiscUtils/Docs'] = WebwarePath + '/MiscUtils/Docs'
-Contexts['PSP/Docs'] = WebwarePath + '/PSP/Docs'
-Contexts['TaskKit/Docs'] = WebwarePath + '/TaskKit/Docs'
-Contexts['UserKit/Docs'] = WebwarePath + '/UserKit/Docs'
-Contexts['WebKit/Docs'] = WebwarePath + '/WebKit/Docs'
-Contexts['WebUtils/Docs'] = WebwarePath + '/WebUtils/Docs'
+# Installer will insert Contexts['Docs'] here.
 Contexts['default'] = WebKitPath + '/Examples'
 
 SessionStore = 'Dynamic' # can be File or Dynamic or Memory

Author: chrisz
Date: Sun Apr 22 06:17:49 2007
New Revision: 6498

Modified:
   Webware/trunk/install.py

Log:
Installer improvements: Do not try to install components which need newer Python versions (e.g. KidKit), because running pydoc and compiling modules will fail. Print a warning for these modules instead. Also, do not compile by force any more, this speeds up the installation very much since running pydoc already compiled the modules and we don't need to do it twice.

Modified: Webware/trunk/install.py
==============================================================================
--- Webware/trunk/install.py	(original)
+++ Webware/trunk/install.py	Sun Apr 22 06:17:49 2007
@@ -103,12 +103,11 @@
 
 	def printHello(self):
 		from time import time, localtime, asctime
-		from string import replace
 		print '%(name)s %(versionString)s' % self._props
 		print 'Installer'
 		print
 		self.printKeyValue('Cur Date', asctime(localtime(time())))
-		self.printKeyValue('Python', replace(sys.version, ') [', ')\n['))
+		self.printKeyValue('Python', sys.version.replace(') [', ')\n['))
 		self.printKeyValue('Op Sys', os.name)
 		self.printKeyValue('Platform', sys.platform)
 		self.printKeyValue('Cur Dir', os.getcwd())
@@ -148,21 +147,28 @@
 		print 'Scanning for components...'
 		dirnames = filter(lambda dir: not dir.startswith('.')
 				and os.path.isdir(dir), os.listdir(os.curdir))
-		maxLen = max(map(len, dirnames))
+		dirnames.sort()
+		self._maxCompLen = max(map(len, dirnames))
+		oldPyVersion = 0
 		column = 0
 		for dirname in dirnames:
 			propName = os.path.join(dirname, 'Properties.py')
 			try:
-				print dirname.ljust(maxLen, '.'),
+				print dirname.ljust(self._maxCompLen, '.'),
 			except TypeError:
-				print dirname.ljust(maxLen),
+				print dirname.ljust(self._maxCompLen),
 			if os.path.exists(propName):
 				comp = PropertiesObject(propName)
 				comp['dirname'] = dirname
-				if not comp.has_key('releaseDate'):
-					comp['releaseDate'] = self._props['releaseDate']
-				self._comps.append(comp)
-				print 'yes',
+				for key in self._props.keys():
+					if not comp.has_key(key):
+						comp[key] = self._props[key]
+				if sys.version_info[:3] < comp['requiredPyVersion']:
+					oldPyVersion += 1
+					print 'no*',
+				else:
+					self._comps.append(comp)
+					print 'yes',
 			else:
 				print 'no ',
 			if column < 2 and not self._verbose:
@@ -173,6 +179,8 @@
 				column = 0
 		if column:
 			print
+		if oldPyVersion:
+			print "* some components require a newer Python version"
 		self._comps.sort(lambda a, b: cmp(a['name'], b['name']))
 		print
 
@@ -187,8 +195,8 @@
 				print 'a password will be automatically generated.'
 			else:
 				print 'the password specified on the command-line will be used.'
-			import getpass
-			password = getpass.getpass()
+			from getpass import getpass
+			password = getpass()
 		else:
 			if defpass is None:
 				print 'A password will be automatically generated.'
@@ -274,7 +282,6 @@
 	def createBrowsableSource(self):
 		"""Create HTML docs for class hierarchies, summaries, sources etc."""
 		print 'Creating html source, summaries and doc files...'
-		maxLen = max(map(lambda comp: len(comp['dirname']), self._comps))
 		column = 0
 		for comp in self._comps:
 			dir = comp['dirname']
@@ -282,9 +289,9 @@
 				print dir, '...'
 			else:
 				try:
-					print dir.ljust(maxLen, '.'),
+					print dir.ljust(self._maxCompLen, '.'),
 				except TypeError:
-					print dir.ljust(maxLen),
+					print dir.ljust(self._maxCompLen),
 			sourceDir = '%s/Docs/Source' % dir
 			self.makeDir(sourceDir)
 			filesDir = sourceDir + '/Files'
@@ -303,7 +310,7 @@
 			if not self._verbose:
 				print "ok",
 				if column < 2:
-					print '   ',
+					print '    ',
 					column += 1
 				else:
 					print
@@ -575,16 +582,19 @@
 			open(t, 'wb').write(open(s, 'rb').read())
 			print
 
-	def compileModules(self):
-		import compileall
+	def compileModules(self, force=0):
+		"""Compile modules in all installed componentes."""
+		from compileall import compile_dir
 		print 'Byte compiling all modules...'
-		try:
-			compileall.compile_dir(os.curdir, 10, None, 1, None, 1)
-		except TypeError: # workaround for Python < 2.3
-			stdout = sys.stdout
-			sys.stdout = StringIO()
-			compileall.compile_dir(os.curdir, 10, None, 1)
-			sys.stdout = stdout
+		for comp in self._comps:
+			dir = comp['dirname']
+			try:
+				compile_dir(dir, force=force, quiet=1)
+			except TypeError: # workaround for Python < 2.3
+				stdout = sys.stdout
+				sys.stdout = StringIO()
+				compile_dir(dir, force=force)
+				sys.stdout = stdout
 		print
 
 	def fixPermissions(self):

Author: chrisz
Date: Sun Apr 22 04:07:51 2007
New Revision: 6497

Modified:
   Webware/trunk/WebKit/Docs/Tutorial.html
   Webware/trunk/WebKit/Docs/UsersGuide.html

Log:
Recreated html docs.

Modified: Webware/trunk/WebKit/Docs/Tutorial.html
==============================================================================
--- Webware/trunk/WebKit/Docs/Tutorial.html	(original)
+++ Webware/trunk/WebKit/Docs/Tutorial.html	Sun Apr 22 04:07:51 2007
@@ -9,7 +9,7 @@
 </head>
 <body>
 <div class="document" id="beginner-tutorial">
-<h1 class="header">Beginner Tutorial</h1>
+<h1 class="title">Beginner Tutorial</h1>
 
 <p>Webware for Python</p>
 <table class="docutils field-list" frame="void" rules="none">
@@ -367,8 +367,5 @@
 </div>
 </div>
 </div>
-<div class="footer">
-Webware for Python (<a href="http://www.webwareforpython.org">www.webwareforpython.org</a>)
-</div>
 </body>
 </html>

Modified: Webware/trunk/WebKit/Docs/UsersGuide.html
==============================================================================
--- Webware/trunk/WebKit/Docs/UsersGuide.html	(original)
+++ Webware/trunk/WebKit/Docs/UsersGuide.html	Sun Apr 22 04:07:51 2007
@@ -9,7 +9,7 @@
 </head>
 <body>
 <div class="document" id="webkit-user-s-guide">
-<h1 class="header">WebKit User's Guide</h1>
+<h1 class="title">WebKit User's Guide</h1>
 
 <p>Webware for Python</p>
 <table class="docutils field-list" frame="void" rules="none">
@@ -411,8 +411,5 @@
 Servlets.</p>
 </div>
 </div>
-<div class="footer">
-Webware for Python (<a href="http://www.webwareforpython.org">www.webwareforpython.org</a>)
-</div>
 </body>
 </html>

Author: chrisz
Date: Sun Apr 22 04:04:41 2007
New Revision: 6496

Modified:
   Webware/trunk/.checksrc.config   (contents, props changed)
   Webware/trunk/.pylintrc   (contents, props changed)
   Webware/trunk/DocSupport/.checksrc.config   (props changed)
   Webware/trunk/Docs/StyleGuidelines.phtml
   Webware/trunk/KidKit/.checksrc.config   (contents, props changed)
   Webware/trunk/MiddleKit/.checksrc.config   (contents, props changed)
   Webware/trunk/MiscUtils/.checksrc.config   (contents, props changed)
   Webware/trunk/MiscUtils/Testing/TestDBPool.py
   Webware/trunk/PSP/.checksrc.config   (contents, props changed)
   Webware/trunk/UserKit/.checksrc.config   (contents, props changed)
   Webware/trunk/WebKit/.checksrc.config   (contents, props changed)
   Webware/trunk/WebKit/Docs/Tutorial.html
   Webware/trunk/WebKit/Docs/UsersGuide.html
   Webware/trunk/WebKit/HTTPContent.py
   Webware/trunk/WebUtils/.checksrc.config   (contents, props changed)
   Webware/trunk/bin/.checksrc.config   (props changed)
   Webware/trunk/bin/checksrc.py

Log:
Style guidelines now allow 100 instead of 80 characters per line.

Modified: Webware/trunk/.checksrc.config
==============================================================================
--- Webware/trunk/.checksrc.config	(original)
+++ Webware/trunk/.checksrc.config	Sun Apr 22 04:04:41 2007
@@ -1,6 +1,6 @@
-# .checksrc.config
-{
-	'DisableErrors': {
-		'UncapFN': ['clean', 'install'],
-	}
-}
+# .checksrc.config
+{
+	'DisableErrors': {
+		'UncapFN': ['clean', 'install'],
+	}
+}

Modified: Webware/trunk/.pylintrc
==============================================================================
--- Webware/trunk/.pylintrc	(original)
+++ Webware/trunk/.pylintrc	Sun Apr 22 04:04:41 2007
@@ -287,7 +287,8 @@
 [FORMAT]
 
 # Maximum number of characters on a single line.
-max-line-length=80
+#max-line-length=80
+max-line-length=100
 
 # Maximum number of lines in a module
 #max-module-lines=1000

Modified: Webware/trunk/Docs/StyleGuidelines.phtml
==============================================================================
--- Webware/trunk/Docs/StyleGuidelines.phtml	(original)
+++ Webware/trunk/Docs/StyleGuidelines.phtml	Sun Apr 22 04:04:41 2007
@@ -80,7 +80,7 @@
 
 <p>Some styles prefix the retrieval method with <code>get</code>, but Webware does not for the sake of brevity and because there are methods for which it is not always clear if a <code>get</code> prefix would make sense.</p>
 
-<p>Methods that return a Boolean are prefixed with <code>is</code> to make their semantics more obvious. Examples include <code>app.isRunning()</code>, <code>user.isActive()</code> and <code>appServer.isPersistent()</code>.</p>
+<p>Methods that return a Boolean are prefixed with <code>is</code> or <code>has</code> to make their semantics more obvious. Examples include <code>request.isSecure()</code>, <code>user.isActive()</code> and <code>response.hasHeader()</code>.</p>
 
 
 <a name="SynNaming_MethodCategories"></a><h3>Method Categories</h3>
@@ -149,9 +149,9 @@
 'why': 'For consistency and to match the capitalization convention used for classes.',
 'examples': 'Servlet.py WebKit.cgi HTTPServlet.py',
 'negatives': 'myClass.py session.py',
-'exceptions': 'Files located in Webware/bin/ that are intended solely for command line use are left in all lower case similar to other command line programs such as grep and find.'})%>
+'exceptions': 'Files located in <code>Webware/bin/</code> that are intended solely for command line use are left in all lower case similar to other command line programs such as grep and find.'})%>
 <%= convention({'what': 'Files do not contain <code>\\r</code> (on POSIX systems).',
-'why': "To avoid problems with POSIX tools that don't like <code>\\r</code> and confusion in the SVN repository which is hosted on Unix.<br>This problem typically happens when a Windows file is FTPed in binary mode to a Unix machine from which it is then checked in.<br>Note that the SVN client on Windows will properly translate back and forth between <code>\\r\\n</code> and <code>\\n</code> upon check out and check in, since we have set the <code>svn:eol-style</code> property to <code> native</code>."})%>
+'why': "To avoid problems with POSIX tools that don't like <code>\\r</code> and confusion in the SVN repository which is hosted on Unix.<br>This problem typically happens when a Windows file is FTPed in binary mode to a Unix machine from which it is then checked in. Note that the SVN client on Windows properly translates back and forth between <code>\\r\\n</code> and <code>\\n</code> upon check out and check in, since we have set the <code>svn:eol-style</code> property to <code> native</code>."})%>
 <%= convention({'what': 'Spaces are not used for indentation.',
 'why': "The real problem is mixing tabs and spaces for indentation as people have their tabs set to different widths (commonly 4 or 8). Tabs have been chosen because they're convenient, efficient and fast to cursor through."}) %>
 <%= convention({'what': 'Tabs are not used past initial indentation.',
@@ -163,7 +163,7 @@
 <%= convention({'what': 'Method names start with a lower case letter.',
 'why': 'For consistency and ease of typing. This convention is also used in almost every object-oriented language.',
 'examples': 'respond() isSecure() setTimeout() htForDict()',
-'negatives': 'Respond() IsSecure()'}) %>
+'negatives': 'Respond() IsSecure() SetTimeout() HtForDict()'}) %>
 <%= convention({'what': 'Method names do not start with <b>get</b>.',
 'why': 'See <a href="#SynNaming_MethodsAndAttrs">Methods and Attributes</a> above.',
 'examples': 'status() numRequests()',
@@ -193,7 +193,7 @@
 def hasValue(self, name):
 	return self._fields.has_key(name) or self._cookies.has_key(name)''',
 'exceptions': 'No category comment is added when the class implementation is <code>pass</code>.'}) %>
-<%= convention({'what': 'Use docstrings and the <a href="http://www.python.org/peps/pep-0257.html">PEP 257</a> conventions.',
+<%= convention({'what': 'Use docstrings and the <a href="http://www.python.org/dev/peps/pep-0257.html">PEP 257</a> conventions.',
 'why': 'This allows for creating appropriate code documentation automatically. Please note that in the past, this has not been heeded very well. But as the project matures and grows, the docstrings should be improved.',
 'examples': '''def function(a, b):
 	"""Do X and return a list."""''',
@@ -203,6 +203,10 @@
 'why': 'These things are easier to track if they are dated and marked in a consistent way.',
 'examples': '# @@ 2000-05-03 ce: This is bogus. Disregard for now.',
 'negatives': '# I think this is bogus !!'}) %>
+<%= convention({'what': 'Limit all lines to a maximum of 100 characters if possible.',
+'why': 'This has been settled as a compromise between the people wanting to utilize their huge monitors with line sizes of 130 characters and those wanting to follow the stricter Python style guide recommendation of only 80 characters.'}) %>
+<%= convention({'what': 'If not specified otherwise, follow the <a href="http://www.python.org/dev/peps/pep-008.html">PEP 008</a> conventions.',
+'why': "For historical and opinionated reasons of Webware's BDFL, Webware follows its own style guidelines which overrule the standard guidelines for Python. :-)"}) %>
 
 <a name="Structure"></a><h2>Structure and Patterns</h2>
 
@@ -254,7 +258,7 @@
 
 <a name="Structure_NamedObjs"></a><h3>Accessing Named Objects</h3>
 
-<p>Several classes in Webware store dictionaries of objects keyed by their name. HTTPRequest is one such class which stores a dictionary of form fields. The convention for providing an interface to this information is as follows:</p>
+<p>Several classes in Webware store dictionaries of objects keyed by their name. <code>HTTPRequest</code> is one such class which stores a dictionary of form fields. The convention for providing an interface to this information is as follows:</p>
 
 <pre class="py">
 ## Fields ##
@@ -313,6 +317,10 @@
 
 <a name="MiscNotes"></a><h2>Miscellaneous Notes</h2>
 
+<a name="Misc_Limitations"></a><h3>Limitations</h3>
+
+<p>Some features that have been introduced in newer Python versions, like properties or decorators, could be used to create more readable code. However, since we want Webware to be backward compatible, these newer features should currently not be used. In future versions of Webware we may certainly lift these restrictions and adapt the style guidelines accordingly.</p>
+
 
 <a name="Misc_Permissions"></a><h3>Permissions</h3>
 
@@ -321,7 +329,7 @@
 
 <a name="Misc_SendingUpdates"></a><h3>Sending Updates</h3>
 
-<p>Those who actually develop Webware should send messages to <a href="mailto:webware-discuss@...> when they update the repository.</p>
+<p>Those who actually develop Webware should send messages to <a href="mailto:webware-devel@...> when they update the repository.</p>
 
 <p>The subject should contain the word "update" so that release notes can be easily compiled.</p>
 
@@ -337,9 +345,9 @@
 
 <a name="Misc_checksrc"></a><h3>checksrc.py</h3>
 
-<p><code>checksrc.py</code> is a program located in Webware/bin used to check the syntax and naming conventions in the actual Webware source code. You can invoke the program with <code>-h</code> or <code>--help</code> to get information on how to use it and there is a good doc string at the top of file if you're interested in more details.</p>
+<p><code>checksrc.py</code> is a program located in <code>Webware/bin</code> used to check the syntax and naming conventions in the actual Webware source code. You can invoke the program with <code>-h</code> or <code>--help</code> to get information on how to use it and there is a good doc string at the top of file if you're interested in more details. <code>checksrc.py</code> should be run periodically and especially before each release of Webware.</p>
 
-<p><code>checksrc.py</code> should be run periodically and especially before each release of Webware.</p>
+<p>You can also use <code>pylint</code> (available from <a href="http://www.logilab.org">Logilab.org</a>) for this purpose, which can be easily integrated in most IDEs. A suitable rcfile <code>.pylintrc</code> has been placed in the Webware root directory.</p>
 
 
 <a name="Misc_Future"></a><h3>Future Work</h3>
@@ -347,7 +355,8 @@
 <p>A list of future work for this document:</p>
 
 <ul>
-	<li> Document the conventions for Webware components.</li>
+	<li>Document the conventions for Webware components.</li>
+    <li>Adapt the document regarding modern Python features.</li>
 </ul>
 
 <% footer() %>
\ No newline at end of file

Modified: Webware/trunk/KidKit/.checksrc.config
==============================================================================
--- Webware/trunk/KidKit/.checksrc.config	(original)
+++ Webware/trunk/KidKit/.checksrc.config	Sun Apr 22 04:04:41 2007
@@ -1,9 +1,11 @@
-# checksrc.config
-{
-	'DisableErrors': {
-		'ExtraUnder':
-			['KidExamplePage'],
-		'NoBlankLines':
-			['KidServletFactory'],
-	}
-}
+# checksrc.config
+{
+	'DisableErrors': {
+		'ExtraUnder':
+			['KidExamplePage'],
+		'LineSize':
+			['Properties'],
+		'NoBlankLines':
+			['KidServletFactory'],
+	}
+}

Modified: Webware/trunk/MiddleKit/.checksrc.config
==============================================================================
--- Webware/trunk/MiddleKit/.checksrc.config	(original)
+++ Webware/trunk/MiddleKit/.checksrc.config	Sun Apr 22 04:04:41 2007
@@ -2,6 +2,7 @@
 {
 	'SkipFiles': [],
 	'DisableErrors': {
+		'LineSize': ['Properties'],
 		'NoUnderAttr': ['Doc', 'Model', 'PerThreadDict', 'PerThreadList'],
 		'ExtraUnder': ['MiddleObject'],
 		'UncapFN': 'main',

Modified: Webware/trunk/MiscUtils/.checksrc.config
==============================================================================
--- Webware/trunk/MiscUtils/.checksrc.config	(original)
+++ Webware/trunk/MiscUtils/.checksrc.config	Sun Apr 22 04:04:41 2007
@@ -3,8 +3,10 @@
 	'SkipFiles': ['inspect', 'pydoc'],
 	'DisableErrors': {
 		'ClassNotCap': ['BasicDateTime'],
+		'LineSize': ['Properties'],
 		'MethCap': ['MixIn'],
-		'NoUnderAttr': ['BasicDateTime', 'DBPool', 'Error', 'M2PickleRPC', 'ParamFactory', 'PickleRPC', 'TestNamedValueAccess'],
+		'NoUnderAttr': ['BasicDateTime', 'DBPool', 'Error', 'M2PickleRPC',
+			'ParamFactory', 'PickleRPC', 'TestNamedValueAccess'],
 		'ExtraUnder': ['DBPool', 'M2PickleRPC', 'NamedValueAccess', 'PickleRPC'],
 	}
 }

Modified: Webware/trunk/MiscUtils/Testing/TestDBPool.py
==============================================================================
--- Webware/trunk/MiscUtils/Testing/TestDBPool.py	(original)
+++ Webware/trunk/MiscUtils/Testing/TestDBPool.py	Sun Apr 22 04:04:41 2007
@@ -1,9 +1,11 @@
 """
 FUTURE
 
-* Parameterize the database and everything else. Currently hard coded to pgdb template1 database.
+* Parameterize the database and everything else.
+  Currently hard coded to pgdb template1 database.
 
-* We don't really test performance here. e.g., we don't do benchmarks to see if DBPool actually helps or not.
+* We don't really test performance here.
+  E.g., we don't do benchmarks to see if DBPool actually helps or not.
 
 """
 

Modified: Webware/trunk/PSP/.checksrc.config
==============================================================================
--- Webware/trunk/PSP/.checksrc.config	(original)
+++ Webware/trunk/PSP/.checksrc.config	Sun Apr 22 04:04:41 2007
@@ -1,10 +1,11 @@
-# checksrc.config
-{
-	'DisableErrors': {
-		'GetMeth': ['Context', 'StreamReader'],
-		'MethCap': ['StreamReader'],
-		'NoUnderAttr': ['BraceConverter', 'Generators', 'ParseEventHandler',
-			'PSPParser', 'StreamReader'],
-		'UncapFN': ['cl_psp'],
-	}
-}
+# checksrc.config
+{
+	'DisableErrors': {
+		'GetMeth': ['Context', 'StreamReader'],
+		'LineSize': ['Properties'],
+		'MethCap': ['StreamReader'],
+		'NoUnderAttr': ['BraceConverter', 'Generators', 'ParseEventHandler',
+			'PSPParser', 'StreamReader'],
+		'UncapFN': ['cl_psp'],
+	}
+}

Modified: Webware/trunk/UserKit/.checksrc.config
==============================================================================
--- Webware/trunk/UserKit/.checksrc.config	(original)
+++ Webware/trunk/UserKit/.checksrc.config	Sun Apr 22 04:04:41 2007
@@ -1,6 +1,7 @@
-# checksrc.config
-{
-	'DisableErrors': {
-		'ExtraUnder': ['GenUserForMKTest'],
-	}
-}
+# checksrc.config
+{
+	'DisableErrors': {
+		'ExtraUnder': ['GenUserForMKTest'],
+		'LineSize': ['Properties'],
+	}
+}

Modified: Webware/trunk/WebKit/.checksrc.config
==============================================================================
--- Webware/trunk/WebKit/.checksrc.config	(original)
+++ Webware/trunk/WebKit/.checksrc.config	Sun Apr 22 04:04:41 2007
@@ -11,6 +11,8 @@
 			['Image'],
 		'ExtraUnder':
 			['AjaxPage', 'HTTPServer', 'JSONRPCServlet', 'XMLRPCServlet'],
+		'LineSize':
+			['Properties'],
 		'NoBlankLines':
 			['Image'],
 		'NoUnderAttr':

Modified: Webware/trunk/WebKit/Docs/Tutorial.html
==============================================================================
--- Webware/trunk/WebKit/Docs/Tutorial.html	(original)
+++ Webware/trunk/WebKit/Docs/Tutorial.html	Sun Apr 22 04:04:41 2007
@@ -9,7 +9,7 @@
 </head>
 <body>
 <div class="document" id="beginner-tutorial">
-<h1 class="title">Beginner Tutorial</h1>
+<h1 class="header">Beginner Tutorial</h1>
 
 <p>Webware for Python</p>
 <table class="docutils field-list" frame="void" rules="none">
@@ -367,5 +367,8 @@
 </div>
 </div>
 </div>
+<div class="footer">
+Webware for Python (<a href="http://www.webwareforpython.org">www.webwareforpython.org</a>)
+</div>
 </body>
 </html>

Modified: Webware/trunk/WebKit/Docs/UsersGuide.html
==============================================================================
--- Webware/trunk/WebKit/Docs/UsersGuide.html	(original)
+++ Webware/trunk/WebKit/Docs/UsersGuide.html	Sun Apr 22 04:04:41 2007
@@ -9,7 +9,7 @@
 </head>
 <body>
 <div class="document" id="webkit-user-s-guide">
-<h1 class="title">WebKit User's Guide</h1>
+<h1 class="header">WebKit User's Guide</h1>
 
 <p>Webware for Python</p>
 <table class="docutils field-list" frame="void" rules="none">
@@ -411,5 +411,8 @@
 Servlets.</p>
 </div>
 </div>
+<div class="footer">
+Webware for Python (<a href="http://www.webwareforpython.org">www.webwareforpython.org</a>)
+</div>
 </body>
 </html>

Modified: Webware/trunk/WebKit/HTTPContent.py
==============================================================================
--- Webware/trunk/WebKit/HTTPContent.py	(original)
+++ Webware/trunk/WebKit/HTTPContent.py	Sun Apr 22 04:04:41 2007
@@ -366,7 +366,8 @@
 
 		"""
 		handler.writeln('''
-<p>Servlets can provide debugging information here by overriding <tt>writeExceptionReport()</tt>.</p><p>For example:</p>
+<p>Servlets can provide debugging information here by overriding
+<tt>writeExceptionReport()</tt>.</p><p>For example:</p>
 <pre>
     exceptionReportAttrs = 'foo bar baz'.split()
     def writeExceptionReport(self, handler):

Modified: Webware/trunk/WebUtils/.checksrc.config
==============================================================================
--- Webware/trunk/WebUtils/.checksrc.config	(original)
+++ Webware/trunk/WebUtils/.checksrc.config	Sun Apr 22 04:04:41 2007
@@ -2,6 +2,7 @@
 {
 	'SkipFiles': ['cgitb', 'Cookie', 'FieldStorage'],
 	'DisableErrors': {
+		'LineSize': ['HTMLTag', 'HTTPStatusCodes', 'Properties'],
 		'NoUnderAttr': ['HTMLTag'],
 	}
 }

Modified: Webware/trunk/bin/checksrc.py
==============================================================================
--- Webware/trunk/bin/checksrc.py	(original)
+++ Webware/trunk/bin/checksrc.py	Sun Apr 22 04:04:41 2007
@@ -130,6 +130,8 @@
 
 	## Init ##
 
+	_maxLineSize = 100
+
 	_errors = {
 		'UncapFN':
 			'Uncapitalized filename.',
@@ -138,6 +140,8 @@
 		'StrayTab':
 			'Stray tab after other characters.'
 			' No tabs allowed other than initial indentation.',
+		'LineSize':
+			'Limit line to a maximum of %d characters.' % _maxLineSize,
 		'SpaceIndent':
 			'Found space as part of indentation. Use only tabs.',
 		'NoBlankLines':
@@ -482,6 +486,7 @@
 	def checkFileLine(self, line):
 		line = line.rstrip()
 		if line:
+			self.checkLineSize(line)
 			line = self.clearStrings(line)
 			if line:
 				self.checkTabsAndSpaces(line)
@@ -506,6 +511,10 @@
 			self._blankLines += 1
 		self._lineNum += 1
 
+	def checkLineSize(self, line):
+		if len(line) > self._maxLineSize:
+			self.error('LineSize')
+
 	def clearStrings(self, line):
 		"""Return line with all quoted strings cleared."""
 		index = 0
@@ -606,8 +615,9 @@
 				if len(name) > 3 and name[:3].lower() == 'get':
 					self.error('GetMeth', locals())
 
-	_exprKeywords = dict([(k, None) for k in
-		'if while for with return yield'.split()])
+	_exprKeywords = {}
+	for k in 'if while for with return yield'.split():
+		_exprKeywords[k] = None
 
 	def checkExtraParens(self, parts, line):
 		if (len(parts) > 1 and self._exprKeywords.has_key(parts[0])
@@ -617,8 +627,9 @@
 			keyword = parts[0]
 			self.error('ExtraParens', locals())
 
-	_blockKeywords = dict([(k, None) for k in
-		'if elif else: try: except: while for with'.split()])
+	_blockKeywords = {}
+	for k in 'if elif else: try: except: while for with'.split():
+		_blockKeywords[k] = None
 
 	def checkCompStmts(self, parts, line):
 		if (len(parts) > 1 and self._blockKeywords.has_key(parts[0])
@@ -632,6 +643,10 @@
 
 	# Any kind of access of self
 	_accessRE = re.compile(r'self\.(\w+)\s*(\(?)')
+	# Irregular but allowed attribute names
+	_allowedAttrNames = {}
+	for k in 'assert_ has_key'.split():
+		_allowedAttrNames[k] = None
 
 	def checkAttrNames(self, line):
 		for match in self._accessRE.findall(line):
@@ -655,7 +670,8 @@
 					inner = attribute[1:]
 				else:
 					inner = attribute
-			if inner.find('_') >= 0 and inner != 'has_key':
+			if inner.find('_') >= 0 \
+					and not self._allowedAttrNames.has_key(inner):
 				self.error('ExtraUnder', locals())
 
 	# Assignment operators
@@ -682,8 +698,9 @@
 				self.error('OpNoSpace', {'op': match[1] + '='})
 
 	# Augmented assignment operators
-	_augmOp = dict([(k, None) for k in
-		'+ - * / % ** >> << & ^ |'.split()])
+	_augmOp = {}
+	for k in '+ - * / % ** >> << & ^ |'.split():
+		_augmOp[k] = None
 
 	def checkAugmStmts(self, parts):
 		if len(parts) > 4 and parts[1] == '=' \

Author: chrisz
Date: Sat Apr 21 19:15:25 2007
New Revision: 6495

Modified:
   Webware/trunk/COMKit/Examples/ADOSample.py
   Webware/trunk/COMKit/__init__.py

Log:
COMKit seems to be the only place where nested scopes are used. Changed this so that Python < 2.2 does not complain about this any more. (We decided to require newer Python versions only after Webware 1.0.) Checked that everything works fine using the ADOSample with ODBC and a PostgreSQL database.

Modified: Webware/trunk/COMKit/Examples/ADOSample.py
==============================================================================
--- Webware/trunk/COMKit/Examples/ADOSample.py	(original)
+++ Webware/trunk/COMKit/Examples/ADOSample.py	Sat Apr 21 19:15:25 2007
@@ -7,10 +7,9 @@
 # AppServer.config file; you'll have to create a database with a table
 # called Customers that has a CustomerName field; and you'll
 # have to create a System DSN called MyDataSource that points to
-# that database.  Then, install this file in the Examples
+# that database.  Then, install this file in the WebKit/Examples
 # directory and try it out.  It ought to work with any database
-# accessible through ODBC and/or ADO, but I've only tested it with
-# SQL Server.
+# accessible through ODBC and/or ADO.
 #
 # The recordset function below should go into a base class so it
 # can be shared among many servlets.
@@ -41,6 +40,10 @@
 	def writeContent(self):
 		# Grab some data from the database and display it
 		rs = self.recordset('SELECT CustomerName FROM Customers ORDER BY CustomerName')
+		self.writeln('<h1>ADO Sample</h1>')
+		self.writeln('<h3>Your Customers are:</h3>')
+		self.writeln('<ul>')
 		while not rs.EOF:
-			self.writeln('<p>%s' % rs.Fields('CustomerName').Value)
+			self.writeln('<li>%s</li>' % rs.Fields('CustomerName').Value)
 			rs.MoveNext()
+		self.writeln('</ul>')

Modified: Webware/trunk/COMKit/__init__.py
==============================================================================
--- Webware/trunk/COMKit/__init__.py	(original)
+++ Webware/trunk/COMKit/__init__.py	Sat Apr 21 19:15:25 2007
@@ -8,6 +8,7 @@
 To use COM, simply set EnableCOM to 1 in your AppServer.config file.
 This causes the app server threads to be configured properly for
 COM free-threading.  Then go ahead and use win32com inside your servlets.
+
 """
 
 __all__ = []
@@ -25,33 +26,35 @@
 		# Get the win32 extensions
 		import pythoncom
 
+		# Set references to the COM initialize and uninitialize functions
+		appServer._initCOM = pythoncom.COINIT_MULTITHREADED
+		appServer.initCOM  = pythoncom.CoInitializeEx
+		appServer.closeCOM  = pythoncom.CoUninitialize
+
 		# Grab references to the original initThread and delThread bound
 		# methods, which we will replace
-		original_initThread = appServer.initThread
-		original_delThread = appServer.delThread
+		appServer.originalInitThread = appServer.initThread
+		appServer.originalDelThread = appServer.delThread
 
 		# Create new versions of initThread and delThread which will call the
 		# old versions
-		def new_initThread(self):
-			# This must be called at the beginning of any thread that uses COM
-			pythoncom.CoInitializeEx(pythoncom.COINIT_MULTITHREADED)
 
+		def newInitThread(self):
+			# This must be called at the beginning of any thread that uses COM
+			self.initCOM(self._initCOM)
 			# Call the original initThread
-			original_initThread()
+			self.originalInitThread()
 
-		def new_delThread(self):
+		def newDelThread(self):
 			# Call the original delThread
-			original_delThread()
-
+			self.originalDelThread()
 			# Uninitialize COM
-			pythoncom.CoUninitialize()
+			self.closeCOM()
 
 		# Replace the initThread and delThread with our new versions, for
 		# this instance of the appserver only
 		import new
-		appServer.initThread = new.instancemethod(new_initThread, appServer, appServer.__class__)
-		appServer.delThread = new.instancemethod(new_delThread, appServer, appServer.__class__)
+		appServer.initThread = new.instancemethod(newInitThread, appServer, appServer.__class__)
+		appServer.delThread = new.instancemethod(newDelThread, appServer, appServer.__class__)
 
 		print 'COM has been enabled.'
-
-

Author: chrisz
Date: Sat Apr 21 18:46:18 2007
New Revision: 6494

Modified:
   Webware/trunk/PSP/ServletWriter.py
   Webware/trunk/WebKit/URLParser.py

Log:
As recommended in the docs, and since file does not exist in Python < 2.2, use open() instead of file() for opening files.

Modified: Webware/trunk/PSP/ServletWriter.py
==============================================================================
--- Webware/trunk/PSP/ServletWriter.py	(original)
+++ Webware/trunk/PSP/ServletWriter.py	Sat Apr 21 18:46:18 2007
@@ -82,7 +82,7 @@
 			# The operation may fail on some Unix flavors
 			# if the files are on different filesystems.
 			# In this case, we try to move the files manually:
-			f = file(self._pyfilename, 'wb')
+			f = open(self._pyfilename, 'wb')
 			try:
 				f.write(open(self._temp, 'rb').read())
 			finally:

Modified: Webware/trunk/WebKit/URLParser.py
==============================================================================
--- Webware/trunk/WebKit/URLParser.py	(original)
+++ Webware/trunk/WebKit/URLParser.py	Sat Apr 21 18:46:18 2007
@@ -209,7 +209,7 @@
 							print 'Creating ' \
 								'__init__.py file for context:', name
 							try:
-								file(f, 'w').write(
+								open(f, 'w').write(
 									'# Auto-generated by WebKit' + os.linesep)
 							except Exception:
 								print 'Error: ' \

Author: chrisz
Date: Sat Apr 21 18:05:40 2007
New Revision: 6493

Modified:
   Webware/trunk/COMKit/Docs/UsersGuide.phtml
   Webware/trunk/WebKit/Monitor.py

Log:
Removed references to AsyncThreadedAppServer since it doesn't exist any more.

Modified: Webware/trunk/COMKit/Docs/UsersGuide.phtml
==============================================================================
--- Webware/trunk/COMKit/Docs/UsersGuide.phtml	(original)
+++ Webware/trunk/COMKit/Docs/UsersGuide.phtml	Sat Apr 21 18:05:40 2007
@@ -19,7 +19,7 @@
 due to the fact that each thread used with COM needs to be initialized properly for COM usage.  This plug-in provides the
 proper initialization of each WebKit thread to allow COM to work properly.</p>
 
-<p>When this plug-in is enabled, it configures COM in free-threading mode when used in conjunction with ThreadedAppServer or AsyncThreadedAppServer.
+<p>When this plug-in is enabled, it configures COM in free-threading mode when used in conjunction with ThreadedAppServer.
 If you've never used COM before, or if you'd like to learn what "free-threading mode" means, you should get a copy of the fine book
 Python Programming on Win32 by Mark Hammond and Andy Robinson and pay special attention to the chapters about COM and also Appendix D
 for details on COM threading models.</p>

Modified: Webware/trunk/WebKit/Monitor.py
==============================================================================
--- Webware/trunk/WebKit/Monitor.py	(original)
+++ Webware/trunk/WebKit/Monitor.py	Sat Apr 21 18:05:40 2007
@@ -268,15 +268,14 @@
 
 Optional arguments:
 
-"AppServer": The AppServer class to use
-             (AsyncThreadedAppServer or ThreadedAppServer)
+"AppServer": The AppServer class to use (currently only ThreadedAppServer)
 daemon:      If "daemon" is specified, the Monitor will run
              as a background process.
 
 """
 
 arguments = ["start", "stop"]
-servernames = ["AsyncThreadedAppServer", "ThreadedAppServer"]
+servernames = ["ThreadedAppServer"]
 optionalargs = ["daemon"]
 
 if __name__ == '__main__':