head	1.1;
access;
symbols
	pkgsrc-2013Q2:1.1.0.46
	pkgsrc-2013Q2-base:1.1
	pkgsrc-2012Q4:1.1.0.44
	pkgsrc-2012Q4-base:1.1
	pkgsrc-2011Q4:1.1.0.42
	pkgsrc-2011Q4-base:1.1
	pkgsrc-2011Q2:1.1.0.40
	pkgsrc-2011Q2-base:1.1
	pkgsrc-2009Q4:1.1.0.38
	pkgsrc-2009Q4-base:1.1
	pkgsrc-2008Q4:1.1.0.36
	pkgsrc-2008Q4-base:1.1
	pkgsrc-2008Q3:1.1.0.34
	pkgsrc-2008Q3-base:1.1
	cube-native-xorg:1.1.0.32
	cube-native-xorg-base:1.1
	pkgsrc-2008Q2:1.1.0.30
	pkgsrc-2008Q2-base:1.1
	pkgsrc-2008Q1:1.1.0.28
	pkgsrc-2008Q1-base:1.1
	pkgsrc-2007Q4:1.1.0.26
	pkgsrc-2007Q4-base:1.1
	pkgsrc-2007Q3:1.1.0.24
	pkgsrc-2007Q3-base:1.1
	pkgsrc-2007Q2:1.1.0.22
	pkgsrc-2007Q2-base:1.1
	pkgsrc-2007Q1:1.1.0.20
	pkgsrc-2007Q1-base:1.1
	pkgsrc-2006Q4:1.1.0.18
	pkgsrc-2006Q4-base:1.1
	pkgsrc-2006Q3:1.1.0.16
	pkgsrc-2006Q3-base:1.1
	pkgsrc-2006Q2:1.1.0.14
	pkgsrc-2006Q2-base:1.1
	pkgsrc-2006Q1:1.1.0.12
	pkgsrc-2006Q1-base:1.1
	pkgsrc-2005Q4:1.1.0.10
	pkgsrc-2005Q4-base:1.1
	pkgsrc-2005Q3:1.1.0.8
	pkgsrc-2005Q3-base:1.1
	pkgsrc-2005Q2:1.1.0.6
	pkgsrc-2005Q2-base:1.1
	pkgsrc-2005Q1:1.1.0.4
	pkgsrc-2005Q1-base:1.1
	pkgsrc-2004Q4:1.1.0.2;
locks; strict;
comment	@# @;


1.1
date	2005.02.16.14.00.09;	author salo;	state dead;
branches
	1.1.2.1;
next	;

1.1.2.1
date	2005.02.16.14.00.09;	author salo;	state Exp;
branches;
next	;


desc
@@


1.1
log
@file patch-an was initially added on branch pkgsrc-2004Q4.
@
text
@@


1.1.2.1
log
@Pullup ticket 289 - requested by Matthias Drochner
security fix for python

Patches hand-rolled, based on the following commit:

   Module Name:    pkgsrc
   Committed By:   drochner
   Date:           Fri Feb  4 15:39:04 UTC 2005

   Modified Files:
           pkgsrc/lang/python22: Makefile distinfo
           pkgsrc/lang/python23: Makefile distinfo
           pkgsrc/lang/python23-nth: Makefile
           pkgsrc/lang/python24: Makefile distinfo
   Added Files:
           pkgsrc/lang/python22/patches: patch-an
           pkgsrc/lang/python23/patches: patch-an
           pkgsrc/lang/python24/patches: patch-an

   Log Message:
   apply the security fix from
   http://www.python.org/security/PSF-2005-001/
   This disables hierarchical object lookups in SimpleXMLRPCServer.
   Unfortunately, this breaks some applications (eg kenosis). Don't
   shoot me for this.
   bump PKGREVISION
@
text
@a0 82
$NetBSD: patch-an,v 1.1 2005/02/04 15:39:04 drochner Exp $

--- Lib/SimpleXMLRPCServer.py.orig	2004-10-04 01:21:44.000000000 +0200
+++ Lib/SimpleXMLRPCServer.py
@@@@ -106,14 +106,22 @@@@ import BaseHTTPServer
 import sys
 import os
 
-def resolve_dotted_attribute(obj, attr):
+def resolve_dotted_attribute(obj, attr, allow_dotted_names=True):
     """resolve_dotted_attribute(a, 'b.c.d') => a.b.c.d
 
     Resolves a dotted attribute name to an object.  Raises
     an AttributeError if any attribute in the chain starts with a '_'.
+
+    If the optional allow_dotted_names argument is false, dots are not
+    supported and this function operates similar to getattr(obj, attr).
     """
 
-    for i in attr.split('.'):
+    if allow_dotted_names:
+        attrs = attr.split('.')
+    else:
+        attrs = [attr]
+
+    for i in attrs:
         if i.startswith('_'):
             raise AttributeError(
                 'attempt to access private attribute "%s"' % i
@@@@ -155,7 +163,7 @@@@ class SimpleXMLRPCDispatcher:
         self.funcs = {}
         self.instance = None
 
-    def register_instance(self, instance):
+    def register_instance(self, instance, allow_dotted_names=False):
         """Registers an instance to respond to XML-RPC requests.
 
         Only one instance can be installed at a time.
@@@@ -173,9 +181,23 @@@@ class SimpleXMLRPCDispatcher:
 
         If a registered function matches a XML-RPC request, then it
         will be called instead of the registered instance.
+
+        If the optional allow_dotted_names argument is true and the
+        instance does not have a _dispatch method, method names
+        containing dots are supported and resolved, as long as none of
+        the name segments start with an '_'.
+
+            *** SECURITY WARNING: ***
+
+            Enabling the allow_dotted_names options allows intruders
+            to access your module's global variables and may allow
+            intruders to execute arbitrary code on your machine.  Only
+            use this option on a secure, closed network.
+
         """
 
         self.instance = instance
+        self.allow_dotted_names = allow_dotted_names
 
     def register_function(self, function, name = None):
         """Registers a function to respond to XML-RPC requests.
@@@@ -294,7 +316,8 @@@@ class SimpleXMLRPCDispatcher:
                 try:
                     method = resolve_dotted_attribute(
                                 self.instance,
-                                method_name
+                                method_name,
+                                self.allow_dotted_names
                                 )
                 except AttributeError:
                     pass
@@@@ -373,7 +396,8 @@@@ class SimpleXMLRPCDispatcher:
                     try:
                         func = resolve_dotted_attribute(
                             self.instance,
-                            method
+                            method,
+                            self.allow_dotted_names
                             )
                     except AttributeError:
                         pass
@