Recent changes to patches

ServletFactory._importModuleFromDirectory should look at pyc

Andrew Gaul — Wed, 05 Dec 2007 19:45:47 -0000

ServletFactory._importModuleFromDirectory should look at pyc files in addition to py files. In our deployment we only ship pyc and WebWare creates a spurious py file which masks user settings or raise an exception on a read-only file system.

Transaction Monitoring and Control

Steve Schwarz — Wed, 03 Oct 2007 03:25:03 -0000

Hi,
I've been running a local patch for a couple weeks now with following features:

1 - Added two methods to ThreadedAppServer: startRequest() and endRequest() methods. These methods can be used to implement page statistics and/or click tracking by session. Default implementation supports feature 2 below.

2 - Allow real time monitoring of the requests being processed by each thread. A new ThreadControl page has been added to the Admin context. Setting 'TrackThreads' to True in AppServer.config enables this feature. If the supplied thread2.py module is loaded requests can be cancelled via this page.

3 - Support automatically cancelling requests taking more than a configurable amount of time. Setting 'CancelLongRequests' to the number of seconds after which a request should be cancelled in the AppServer.config file enables this feature. This feature also requires 'TrackThreads' to be enabled.

The patch is relatively small, if there is interest in looking at these changes and moving them into the mainline I'd be happy to forward them to anyone interested. Of course, comments and suggestions are very welcome.

The performance penalty for feature 1 is the cost of some accessors into the current transaction, a couple time() calls and two function calls. I would guess these changes should have a negligible impact on performance.

Features 2 and 3 use a new class which is basically a locked dictionary. So the cost is two additional mutex lock/unlocks for each transaction. If WebKit didn't support adding/removing threads dynamically that mutex could be removed and the additional overhead is some dictionary accesses.

I'd be happy to get feedback on these enhancements.

Thanks,
Steve

JSON security fix

Piéronne Jean-François — Mon, 09 Apr 2007 17:22:28 -0000

Recent study show that JSON protocol may be vulnerable to some form of hacking.
This patch fix this.
There is also a cosmetic update.

References: http://www.fortifysoftware.com/servlet/downloads/public/JavaScript_Hijacking.pdf http://getahead.org/blog/joe/2007/03/05/json_is_not_as_safe_as_people_think_it_is.html

clean.py fix

Piéronne Jean-François — Thu, 01 Feb 2007 09:45:19 -0000

Hi,

I have attach a patch for clean.py
Importing clean.py would not execute the clean code.

Useful if you browse the source tree using pydoc.

Funcs.normURI fix

Veros Kaplan — Tue, 02 Jan 2007 23:40:29 -0000

fixing typo in func normURI.

Am I the only one in the world who is using this function? :-)

Download patch on http://veros.koren.cz/patches/webware-webutils-funcs.patch

Servet .serverSidePath fix

Veros Kaplan — Tue, 02 Jan 2007 23:03:23 -0000

method Servlet.serverSidePath doesn't work as expected when using parameter with slash (eg. "servlets/TitlePage" )

The method creates cache attribute _serverSidePath which is computed from "path" parameter. And this is the problem, because _serverSidePath shouldn't depend on the parameter.

The problem appeared sometimes between 0.9.1 and 0.9.2

Patch is available on http://veros.koren.cz/patches/webware-servlet.patch

Migrating from 0.8.1 to 0.9.2

SessionDynamicStore - don't save one-shot sessions

Veros Kaplan — Fri, 29 Dec 2006 09:34:43 -0000

Patch to SessionDynamicStore.

PROBLEM: Crawler bots generates lot of sessions which aren't used more than once, as crawlers usually doesn't implements cookies.

Although these sessions aren't used they're still swapped to the Sessions directory and occupies space.

SOLUTION: The "one-shot sessions" aren't moved to FileStore on periodical clean-up. They are still saved on Session store shutdown.

This patch greatly reduces number of files in Sessions directory, especially on low traffic server.

Used on production server: http://www.cestovatel.cz/ with no problems (Webware 0.8), ported to last versions.

Download on http://veros.koren.cz/patches/webware-sessionstore.patch

Error reporting

Veros Kaplan — Tue, 17 Oct 2006 13:41:05 -0000

Default HTTPResponse doesn§t sent status 500 in case of
exception.

--- WebKit/HTTPResponse.py~ 2006-02-09
00:59:25.771571112 +0100
+++ WebKit/HTTPResponse.py 2006-02-09
00:59:32.088610776 +0100
@@ -277,6 +277,8 @@
"""
if debug: print "HTTPResponse commit"
self.recordSession()
+ if self._transaction.errorOccurred():
+ self.setStatus(500, 'Error
occurred')
self.writeHeaders()
self._committed = 1
self._strmOut.commit()

OpenVMS, non presistent environment, status header

Piéronne Jean-François — Tue, 11 Jul 2006 08:14:50 -0000

These patches are for the webkit directory:

Application.py and AppServer.py:
Fix a bug when webware is used in a non persistent
environment, don't start/stop the task manager in this case

HTTPResponse.py
writeHeaders method will now set the Status header if
there is none.

SelectRelease.py and UnknownFileTypeServlet.py
small OpenVMS specific patches

Regards,

Jean-François

mod_webkit APR compatibility patch

Richard Brodie — Wed, 01 Mar 2006 16:43:16 -0000

mod_webkit.c has latent support for apr_socket_create
gaining more parameters in APR 1.x

Unfortunately, as the required header file is not
included, APR_VERSION_MAJOR is always null.