Changeset 1056

Timestamp:

04/22/06 15:22:44

Author:

fumanchu

Message:

Fixed static tool and test.

Files:

• trunk/cherrypy/lib/static.py (modified) (3 diffs)
• trunk/cherrypy/test/test_static_filter.py (modified) (3 diffs)
• trunk/cherrypy/tools.py (modified) (3 diffs)

trunk/cherrypy/lib/static.py

@@ -60 +60 @@
-    # That is, CherryPy should not guess where the application root is.
-    # It certainly should *not* use cwd (since CP may be invoked from a
-static_filter
-static_filter
+tools.static
+tools.static
-    if not os.path.isabs(path):
-        raise ValueError("'%s' is not an absolute path." % path)
@@ -149 +149 @@
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
-        # you can set the content types for a
-        # complete directory per extension
-        content_type = None
-        if content_types:
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
-            content_type = content_types.get(ext[1:], None)
-        serve_file(filename, contentType=content_type)
@@ -224 +164 @@
-        # request. We might find a dynamic handler instead.
-        return False
+
+def get_dir(section, dir, root="", match="", content_types=None, index=""):
+    if match and not re.search(match, cherrypy.request.object_path):
+        return False
+    
+    # If dir is relative, make absolute using "root".
+    if not os.path.isabs(dir):
+        if not root:
+            msg = "Static tool requires an absolute dir or root."
+            raise cherrypy.WrongConfigValue(msg)
+        dir = os.path.join(root, dir)
+    
+    # Determine where we are in the object tree relative to 'section'
+    # (where the static tool was defined).
+    if section == 'global':
+        section = "/"
+    section = section.rstrip(r"\/")
+    branch = cherrypy.request.object_path[len(section) + 1:]
+    branch = urllib.unquote(branch.lstrip(r"\/"))
+    
+    # If branch is "", filename will end in a slash
+    filename = os.path.join(dir, branch)
+    
+    # There's a chance that the branch pulled from the URL might
+    # have ".." or similar uplevel attacks in it. Check that the final
+    # filename is a child of dir.
+    if not os.path.normpath(filename).startswith(os.path.normpath(dir)):
+        raise cherrypy.HTTPError(403) # Forbidden
+    
+    handled = _attempt(filename, content_types)
+    if not handled:
+        # Check for an index file if a folder was requested.
+        if index and filename[-1] in (r"\/"):
+            handled = _attempt(os.path.join(filename, index), content_types)
+    return handled
+
+def get_file(filename, root=None, match="", content_types=None):
+    if match and not re.search(match, cherrypy.request.object_path):
+        return False
+    
+    # If filename is relative, make absolute using "root".
+    if not os.path.isabs(filename):
+        if not root:
+            msg = "Static tool requires an absolute filename (got '%s')." % filename
+            raise cherrypy.WrongConfigValue(msg)
+        filename = os.path.join(root, filename)
+    
+    return _attempt(filename, content_types)

trunk/cherrypy/test/test_static_filter.py

@@ -30 +30 @@
-    cherrypy.config.update({
-        'global': {
-Tru
+Fals
-            'server.environment': 'production',
-        },
@@ -40 +40 @@
-        '/style.css': {
-            'tools.staticfile.on': True,
-
+name
-        },
-        '/docroot': {
@@ -106 +106 @@
-        self.assertBody('Hello, world\r\n')
-        
- WrongConfigValue
+n
-        self.getPage("/error/thing.html")
-        self.assertErrorPage(500)
-
-
-
+
+
-        
-        # Test up-level security

trunk/cherrypy/tools.py

@@ -26 +26 @@
-
-import cherrypy
-from cherrypy.lib import cptools, encodings, static
-
-# These modules are themselves Tools
-from cherrypy.lib import caching, xmlrpc
-
-
@@ -94 +90 @@
-
-
+#                              Builtin tools                              #
+
+from cherrypy.lib import cptools, encodings, static
+
-base_url = Tool('before_request_body', cptools.base_url)
-response_headers = Tool('before_finalize', cptools.response_headers)
@@ -102 +102 @@
-gzip = Tool('before_finalize', encodings.gzip)
-
-
+
+
+
+
+
+
+
+
+
+
+
+
-staticfile = MainTool(static.get_file)
-
+# These modules are themselves Tools
+from cherrypy.lib import caching, xmlrpc