Re: [Mailman-Developers] [Mailman-checkins] SF.net SVN: mailman: [8090] trunk/mailman/Mailman
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On Nov 8, 2006, at 8:14 PM, tkikuchi@users.sourceforge.net wrote:
Revision: 8090 http://svn.sourceforge.net/mailman/?rev=8090&view=rev Author: tkikuchi Date: 2006-11-08 17:13:59 -0800 (Wed, 08 Nov 2006)
Log Message:
MailList.py ... GetScriptURL() absolute again because we need it
for email notifications. wsgi_app.py ... URI normalization by stripping trailing slash. We
need Special care for 'private'. Strip dot only components in the PATH_INFO for sanitization.
Hi Tokio,
I'm not so sure about this change. It breaks the ability to access
the web page urls by both the wsgi path and the apache ScriptAlias
path at the same time. I've tried to make sure that worked because
it's pretty useful for debugging.
I'm trying to keep the principle that all internal web page urls are
relative, which is why we currently try to figure out the prefix to
the script and then reproduce that in the cookie path (see
SecurityManager.py). I've also been thinking about trying to get rid
of mlist.web_page_url (I don't much like hard coding that in the
list's data).
I understand that we'll need absolute paths in the email
notifications, and I've read the note about not exposing wsgi_app
interface to the internet. I'm not sure I agree with the latter
though, and besides, I'd like us to be as flexible as possible for
wsgi integration. I think we should try to find some other way to do
the email notification urls and keep GetScriptURL() returning
relative paths.
E.g. when I try to use r8090 via the Apache ScriptAlias path, I end
up getting three slashes between the host and the 'mailman' prefix.
- -Barry
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (Darwin)
iQCVAwUBRVaCEXEjvBPtnXfVAQIOIQP8DTdlILSlUli9+WgSdskfl2+i44ON3gvx 0uoEZZ1lPon6NgJFg5Y3BCAr7YLAXsrj4pyXrhAxxLomgnjt6eM9BKdIWkSmZMl9 smQ/En31Xs5tKd69jtekaiMNMy4kMx0Yo53ci0E7yp6tVkpIh05Vg0wAB/wQr71Y 6etMJUeeJ78= =gFtd -----END PGP SIGNATURE-----
Hi Tokio,
I'm not so sure about this change. It breaks the ability to access
the web page urls by both the wsgi path and the apache ScriptAlias
path at the same time. I've tried to make sure that worked because
it's pretty useful for debugging.
Well, I was inclined to abolish ScriptAlias (CGI) method because of SGUI complexities. ;-)
I'm trying to keep the principle that all internal web page urls are
relative, which is why we currently try to figure out the prefix to
the script and then reproduce that in the cookie path (see
SecurityManager.py). I've also been thinking about trying to get rid
of mlist.web_page_url (I don't much like hard coding that in the
list's data).I understand that we'll need absolute paths in the email
notifications, and I've read the note about not exposing wsgi_app
interface to the internet. I'm not sure I agree with the latter
though, and besides, I'd like us to be as flexible as possible for
wsgi integration. I think we should try to find some other way to do
the email notification urls and keep GetScriptURL() returning
relative paths.
Like VirtualHostMonster in Zope?
E.g. when I try to use r8090 via the Apache ScriptAlias path, I end
up getting three slashes between the host and the 'mailman' prefix.
Oops, I'll try restore ScriptAlias.
- -Barry
-- Tokio Kikuchi, tkikuchi@is.kochi-u.ac.jp http://weather.is.kochi-u.ac.jp/
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On Nov 11, 2006, at 9:38 PM, Tokio Kikuchi wrote:
I'm not so sure about this change. It breaks the ability to access the web page urls by both the wsgi path and the apache ScriptAlias path at the same time. I've tried to make sure that worked because it's pretty useful for debugging.
Well, I was inclined to abolish ScriptAlias (CGI) method because of
SGUI complexities. ;-)
That's definitely another way to go. OTOH, it's possible that folks
will reverse proxy MM2.2 through the /mailman/ prefix, or possibly a
totally different prefix, so I think we still need to support
relative urls as much as possible. But you might be right that it's
unreasonable to continue to support CGI now that we have a better way
to do it.
I understand that we'll need absolute paths in the email notifications, and I've read the note about not exposing wsgi_app interface to the internet. I'm not sure I agree with the latter though, and besides, I'd like us to be as flexible as possible for wsgi integration. I think we should try to find some other way to do the email notification urls and keep GetScriptURL() returning relative paths.
Like VirtualHostMonster in Zope?
Possibly something like it -- which I think ultimately boils down to
encoding enough of the original url in a rewrite rule so that the
back-end Mailman in this case can figure out how the front-end was
accessed. The only other alternative would be to hard code it in the
config file I guess.
E.g. when I try to use r8090 via the Apache ScriptAlias path, I end up getting three slashes between the host and the 'mailman' prefix.
Oops, I'll try restore ScriptAlias.
Cool, thanks. I may commit a few changes in this area, but I'll try
not to mess you up too much ;).
- -Barry
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (Darwin)
iQCVAwUBRVaM5XEjvBPtnXfVAQKiDwP/XxPA/yi9MG+uewogi+pOH22U2L5iwBgq WK9ZFsZxgLMxx3w11oHFemSVyzujqi+WMudqjahRzb7w4V8Chl1IxwUHf98F4zg/ rCZnSWfT3nfnTp02Pa9kC9DVTfLe1X/r9XjDnD+W7id2wQ7OrwGZ2VOa2n0Rdfqp tpniGsxaYj4= =NZu5 -----END PGP SIGNATURE-----
Hi Barry,
E.g. when I try to use r8090 via the Apache ScriptAlias path, I end up getting three slashes between the host and the 'mailman' prefix. Oops, I'll try restore ScriptAlias.
Cool, thanks. I may commit a few changes in this area, but I'll try
not to mess you up too much ;).
I was wrong in writing wsgi_app.py at SCRIPT_NAME CGI environment variable. It was not merely the name of the script but the script path.
Now the script can be accessed by /listinfo, /mailman/listinfo, or even /mailman/blah/listinfo etc. etc. You can now write httpd.conf like so: ProxyPass /mailman/ http://localhost:2580/mailman/
By this, we can use the same SCRIPT_NAME (or script path) for both wsgi backend and apache frontend. We might be able to get rid of the HTTP_REFERER and '../' things from our code but I've only checked in thus far.
Please check and test it.
-- Tokio Kikuchi, tkikuchi@is.kochi-u.ac.jp http://weather.is.kochi-u.ac.jp/
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On Nov 13, 2006, at 7:53 AM, Tokio Kikuchi wrote:
I was wrong in writing wsgi_app.py at SCRIPT_NAME CGI environment variable. It was not merely the name of the script but the script
path.Now the script can be accessed by /listinfo, /mailman/listinfo, or
even /mailman/blah/listinfo etc. etc. You can now write httpd.conf like
so: ProxyPass /mailman/ http://localhost:2580/mailman/By this, we can use the same SCRIPT_NAME (or script path) for both
wsgi backend and apache frontend. We might be able to get rid of the HTTP_REFERER and '../' things from our code but I've only checked in thus far.Please check and test it.
I haven't tested getting rid of HTTP_REFERER either, but what you
checked in appears to work great from both wsgi and ScriptAlias.
Thanks!
- -barry
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (Darwin)
iQCVAwUBRV0/cHEjvBPtnXfVAQIj2QP/dwES+GVgSqotSlL9ewnfm9IP/tl9QGH2 kbSOFrUVVJTo0MI410xtl0bHyv+ZL5ykZeuVKtRghBtRQPe5eXOEv39fs6AEEQRO /qgdbumJhzkkrY+L00JFKwxi/j5UmdKNYTnECuKKLpKzIL4UTRoN/BOyhh4t/rzN rx8RH/X6+OY= =jlWc -----END PGP SIGNATURE-----
participants (2)
-
Barry Warsaw -
Tokio Kikuchi