On 10/21/05, Christoph Zwerschke <cito@...> wrote:
> I just checked in a change that makes the PythonServletFactory
> responsible for .pyc and .pyo files as well besides .py files.
>
> For the default configuration, this makes no difference,
> since .pyc and .pyo are in both ExtensionsToIgnore and FilesToHide
> so they will not be served anyway.
>
> But by taking .pyc and .pyo away from ExtensionsToIgnore and FilesToHide
> you can now install servlets without their source code. This will be a
> little bit more perfomant in the production environment, but most of all
> it will prevent customers and administrators from messing around with
> the source code and give a certain level of protection as closed source.
> This feature has been requested on the mailing list several times.
>
> The former behavior was that if you took .pyc and .pyo away from
> ExtensionsToIgnore and FilesToHide, then they would be delivered as
> Files via the UnknownServletFactory. This could even be a security
> problem since the servlets could contain database passwords or other
> information. I think it makes much more sense to execute .pyc servlets
> instead of delivering them as files.
>
> By using ExtensionCascadeOrder you can also determine a priority, such
> as '.py' first (if available), then '.pyo', then '.pyc'.
>
> I'm using this feature since long and it has proven to be very handy.
>
> However, I kept the standard configuration that ignores/hides .pyc and
> .pyo files completely, so you still have to set it explicitely in the
> configuration if you want to use this.
>
> Hope everybody agrees.
>
> -- Christoph
Sounds good. Thanks for giving us an update.
-Chuck
|