Webware for Python

Am 15.07.2011 11:06 schrieb F. Behrens:
> If you send a POST form with an URL that includes GET data then
> FieldStorage will include both. Especially if you POST something like
> "id=42" and have "id=23" in the URL, FieldStorage will end up with "id:
> [42,23]", breaking code that expects a number here.
>
> Typically this unwantedly happens with forms that use POST but have been
> created from a GET request and do not explicitly specify an ACTION
> property in the FORM tag.
>
> This behaviour is new with 1.* and did not occur in older versions of
> WebWare.

Hi Fionn,

we need to break this bug/feature down a bit.

POST and GET parameters being merged into the request fields is actually 
a WebKit quirk that was added in version 0.6 already 
(http://www.webwareforpython.org/WebKit/Docs/RelNotes-0.6.html) and is 
sometimes useful so I don't want to change that.

However, the WebKit behavior has been that on merging, POST parameters 
would actually *overwrite* GET parameters with the same name, not append 
to them. I.e. if "id=23" is in the URL and "id=42" is a POST parameter, 
then request.field('id') should be just '42', not '23' or ['42', '23']. 
So what you are reporting here looks like a bug.

I haven't really looked into this so far, but a quick tests showed that 
this bug happens only with Python 2.6 or newer. Can you confirm? When 
upgrading to Webware 1.x, did you also upgrade the Python version?

-- Christoph

Am 15.07.2011 15:44 schrieb Christoph Zwerschke:
> I haven't really looked into this so far, but a quick tests showed that
> this bug happens only with Python 2.6 or newer. Can you confirm? When
> upgrading to Webware 1.x, did you also upgrade the Python version?

I have now analyzed this a bit more and found that indeed Python 2.6 
handles POST requests with query string parameters differently by adding 
these values to the fields sent via POST, but contrary to how WebKit did 
this before, appending values to existing parameters instead of 
overriding the existing parameters with those sent via POST.

In order to stay compatible with how we did this since WebKit 0.6 and 
because it seems more reasonable to me, I have restored the old behavior 
even with Python 2.6 so that Webware behaves the same, independently of 
the Python version.

The fix has been commited to the trunk in r8162 and backported to the 
1.0 branch in r8163. I've also added a twill test for this behavior.

-- Christoph

Christoph Zwerschke wrote:

> The fix has been commited to the trunk in r8162 and backported to the 
> 1.0 branch in r8163. I've also added a twill test for this behavior.
        
Sorry to dig this up again but I just upgraded our development server to
the 1.1 release and this bug still prevails.
        
Do you happen to have the patches you did around and could mail them to
me for a quick glance so I can get an idea about what to look after?
        
-- 
kind regards,
                                Fionn Behrens

Am 24.10.2011 18:37, schrieb F. Behrens:
> Do you happen to have the patches you did around and could mail them to
> me for a quick glance so I can get an idea about what to look after?

I'll send you the patch but you can also get it by checking out 
http://svn.w4py.org/Webware/trunk and then "svn diff -c 8162".

There is a test for this in WebKit/Testing/FieldStorage which is called 
by the Twill tests in WebKit/Tests/twill/Testing.twill. I'm pretty sure 
I've checked it with all possible Python version.

-- Christoph