Christoph Zwerschke wrote:
> Currently I am considering about delivering a Webware application to a
> customer without the source code ot the servlets, i.e. only handing out the
> *.pyo files. This may prevent a little bit from fiddling around with the
> sources, though I know it is not a real protection since it is possible to
> recompile. Anyway, the problem is: Webware will not work if you take away
> the *.py files. It will ignore the *.pyc and *.pyo files even if you remove
> them from FilesToHide. The reason is that '.py' is hardcoded as the (only)
> extension for the PythonServletFactory.
>
> So, my question is: Is there a good reason why the class
> PythonServletFactory has only
>
> def extensions(self):
> return ['.py']
>
> and not
>
> def extensions(self):
> return ['.py', '.pyc', '.pyo']
>
> I suggest adding the two extensions.
I think the reason (if there was one) for not including .pyc and .pyo
files is that it could be seen as a potential security hole, in that
removing the .py file would not be sufficient to delete the servlet if
the .pyc file had been created. Though part of it was probably also the
lack of cascading extensions -- i.e., you had to have one matching
extension, instead of multiple files with servable extensions (as you'll
typically have if you serve .pyc files). You can now have this by
setting the appropriate settings, but this aspect persists.
I don't really see the importance of this change -- you can certainly
make the change for your application, and it's neither a large change,
nor is distribution much of a problem because you're obviously going to
be distributing the entire package including Webware.
Ian
|