head 1.2; access; symbols pkgsrc-2013Q2:1.2.0.18 pkgsrc-2013Q2-base:1.2 pkgsrc-2012Q4:1.2.0.16 pkgsrc-2012Q4-base:1.2 pkgsrc-2011Q4:1.2.0.14 pkgsrc-2011Q4-base:1.2 pkgsrc-2011Q2:1.2.0.12 pkgsrc-2011Q2-base:1.2 pkgsrc-2009Q4:1.2.0.10 pkgsrc-2009Q4-base:1.2 pkgsrc-2008Q4:1.2.0.8 pkgsrc-2008Q4-base:1.2 pkgsrc-2008Q3:1.2.0.6 pkgsrc-2008Q3-base:1.2 cube-native-xorg:1.2.0.4 cube-native-xorg-base:1.2 pkgsrc-2008Q2:1.2.0.2 pkgsrc-2008Q2-base:1.2 pkgsrc-2008Q1:1.1.0.28 pkgsrc-2008Q1-base:1.1 pkgsrc-2007Q4:1.1.0.26 pkgsrc-2007Q4-base:1.1 pkgsrc-2007Q3:1.1.0.24 pkgsrc-2007Q3-base:1.1 pkgsrc-2007Q2:1.1.0.22 pkgsrc-2007Q2-base:1.1 pkgsrc-2007Q1:1.1.0.20 pkgsrc-2007Q1-base:1.1 pkgsrc-2006Q4:1.1.0.18 pkgsrc-2006Q4-base:1.1 pkgsrc-2006Q3:1.1.0.16 pkgsrc-2006Q3-base:1.1 pkgsrc-2006Q2:1.1.0.14 pkgsrc-2006Q2-base:1.1 pkgsrc-2006Q1:1.1.0.12 pkgsrc-2006Q1-base:1.1 pkgsrc-2005Q4:1.1.0.10 pkgsrc-2005Q4-base:1.1 pkgsrc-2005Q3:1.1.0.8 pkgsrc-2005Q3-base:1.1 pkgsrc-2005Q2:1.1.0.6 pkgsrc-2005Q2-base:1.1 pkgsrc-2005Q1:1.1.0.4 pkgsrc-2005Q1-base:1.1 pkgsrc-2004Q4:1.1.0.2; locks; strict; comment @# @; 1.2 date 2008.04.25.16.11.13; author tnn; state dead; branches; next 1.1; 1.1 date 2005.02.04.15.39.04; author drochner; state Exp; branches 1.1.2.1; next ; 1.1.2.1 date 2005.02.04.15.39.04; author salo; state dead; branches; next 1.1.2.2; 1.1.2.2 date 2005.02.16.14.00.08; author salo; state Exp; branches; next ; desc @@ 1.2 log @De-orbit support for python 2.0 and python 2.2 under the "three major releases is enough" rule of thumb. (python 2.3 was released 5 years ago.) Keep python 1.5 and 2.1 though, because there are a handful of packages that still need them. @ text @$NetBSD: patch-an,v 1.1 2005/02/04 15:39:04 drochner Exp $ --- Lib/SimpleXMLRPCServer.py.orig 2001-09-29 06:54:33.000000000 +0200 +++ Lib/SimpleXMLRPCServer.py @@@@ -161,7 +161,8 @@@@ class SimpleXMLRPCRequestHandler(BaseHTT try: func = _resolve_dotted_attribute( self.server.instance, - method + method, + self.allow_dotted_names ) except AttributeError: pass @@@@ -178,11 +179,20 @@@@ class SimpleXMLRPCRequestHandler(BaseHTT BaseHTTPServer.BaseHTTPRequestHandler.log_request(self, code, size) -def _resolve_dotted_attribute(obj, attr): +def _resolve_dotted_attribute(obj, attr, allow_dotted_names=True): """Resolves a dotted attribute name to an object. Raises an AttributeError if any attribute in the chain starts with a '_'. + + If the optional allow_dotted_names argument is false, dots are not + supported and this function operates similar to getattr(obj, attr). """ - for i in attr.split('.'): + + if allow_dotted_names: + attrs = attr.split('.') + else: + attrs = [attr] + + for i in attrs: if i.startswith('_'): raise AttributeError( 'attempt to access private attribute "%s"' % i @@@@ -206,7 +216,7 @@@@ class SimpleXMLRPCServer(SocketServer.TC self.instance = None SocketServer.TCPServer.__init__(self, addr, requestHandler) - def register_instance(self, instance): + def register_instance(self, instance, allow_dotted_names=False): """Registers an instance to respond to XML-RPC requests. Only one instance can be installed at a time. @@@@ -225,9 +235,23 @@@@ class SimpleXMLRPCServer(SocketServer.TC If a registered function matches a XML-RPC request, then it will be called instead of the registered instance. + + If the optional allow_dotted_names argument is true and the + instance does not have a _dispatch method, method names + containing dots are supported and resolved, as long as none of + the name segments start with an '_'. + + *** SECURITY WARNING: *** + + Enabling the allow_dotted_names options allows intruders + to access your module's global variables and may allow + intruders to execute arbitrary code on your machine. Only + use this option on a secure, closed network. + """ self.instance = instance + self.allow_dotted_names = allow_dotted_names def register_function(self, function, name = None): """Registers a function to respond to XML-RPC requests. @ 1.1 log @apply the security fix from http://www.python.org/security/PSF-2005-001/ This disables hierarchical object lookups in SimpleXMLRPCServer. Unfortunately, this breaks some applications (eg kenosis). Don't shoot me for this. bump PKGREVISION @ text @d1 1 a1 1 $NetBSD$ @ 1.1.2.1 log @file patch-an was added on branch pkgsrc-2004Q4 on 2005-02-04 15:39:04 +0000 @ text @d1 70 @ 1.1.2.2 log @Pullup ticket 289 - requested by Matthias Drochner security fix for python Patches hand-rolled, based on the following commit: Module Name: pkgsrc Committed By: drochner Date: Fri Feb 4 15:39:04 UTC 2005 Modified Files: pkgsrc/lang/python22: Makefile distinfo pkgsrc/lang/python23: Makefile distinfo pkgsrc/lang/python23-nth: Makefile pkgsrc/lang/python24: Makefile distinfo Added Files: pkgsrc/lang/python22/patches: patch-an pkgsrc/lang/python23/patches: patch-an pkgsrc/lang/python24/patches: patch-an Log Message: apply the security fix from http://www.python.org/security/PSF-2005-001/ This disables hierarchical object lookups in SimpleXMLRPCServer. Unfortunately, this breaks some applications (eg kenosis). Don't shoot me for this. bump PKGREVISION @ text @a0 70 $NetBSD: patch-an,v 1.1.2.1 2005/02/16 14:00:08 salo Exp $ --- Lib/SimpleXMLRPCServer.py.orig 2001-09-29 06:54:33.000000000 +0200 +++ Lib/SimpleXMLRPCServer.py @@@@ -161,7 +161,8 @@@@ class SimpleXMLRPCRequestHandler(BaseHTT try: func = _resolve_dotted_attribute( self.server.instance, - method + method, + self.allow_dotted_names ) except AttributeError: pass @@@@ -178,11 +179,20 @@@@ class SimpleXMLRPCRequestHandler(BaseHTT BaseHTTPServer.BaseHTTPRequestHandler.log_request(self, code, size) -def _resolve_dotted_attribute(obj, attr): +def _resolve_dotted_attribute(obj, attr, allow_dotted_names=True): """Resolves a dotted attribute name to an object. Raises an AttributeError if any attribute in the chain starts with a '_'. + + If the optional allow_dotted_names argument is false, dots are not + supported and this function operates similar to getattr(obj, attr). """ - for i in attr.split('.'): + + if allow_dotted_names: + attrs = attr.split('.') + else: + attrs = [attr] + + for i in attrs: if i.startswith('_'): raise AttributeError( 'attempt to access private attribute "%s"' % i @@@@ -206,7 +216,7 @@@@ class SimpleXMLRPCServer(SocketServer.TC self.instance = None SocketServer.TCPServer.__init__(self, addr, requestHandler) - def register_instance(self, instance): + def register_instance(self, instance, allow_dotted_names=False): """Registers an instance to respond to XML-RPC requests. Only one instance can be installed at a time. @@@@ -225,9 +235,23 @@@@ class SimpleXMLRPCServer(SocketServer.TC If a registered function matches a XML-RPC request, then it will be called instead of the registered instance. + + If the optional allow_dotted_names argument is true and the + instance does not have a _dispatch method, method names + containing dots are supported and resolved, as long as none of + the name segments start with an '_'. + + *** SECURITY WARNING: *** + + Enabling the allow_dotted_names options allows intruders + to access your module's global variables and may allow + intruders to execute arbitrary code on your machine. Only + use this option on a secure, closed network. + """ self.instance = instance + self.allow_dotted_names = allow_dotted_names def register_function(self, function, name = None): """Registers a function to respond to XML-RPC requests. @