Re: "admin only mode" (disallowing normal users from using mod_ruby)

Shugo Maeda wrote:
> Sorry to be late.
> The disk of modruby.net was crached:-(

Sorry to hear that. So that's why I got "read only partition" error when 
I tried to access the wiki the other day.

> # But the subversion repository is alive:-)
> 
> David Garamond wrote:
> 
>> The problem is, for security reasons, we do not want to allow access 
>> to mod_ruby from .htaccess, as the webserver is shared and normal 
>> hosting users are allowed to use .htaccess.
>>
>> I remember a while back suggesting something like "PerlMode normal" / 
>> "PerlMode adminonly" directive to the mod_perl mailing list, where in 
>> the "PerlMode adminonly" mode we deny all Perl* directives in 
>> .htaccess. Unfortunately, I didn't get any reply. But I'm sure there 
>> are many server admins like myself who would like the ability to write 
>> Apache modules in Ruby/Perl but without having to give access to 
>> Ruby/Perl interpreter to normal users.
>>
>> The patch to do the above is simple, but I ended up doing the simpler 
>> thing (modifying the directives definition in mod_perl.c from OR_ALL 
>> to RSRC_CONF).
>>
>> Now what about mod_ruby? Is there any interest to do like the above? I 
>> believe this will increase the usefulness of mod_ruby, especially for 
>> people in my situation (shared hosting).
> 
> The concept is good, but the name RubyMode sounds too generic for me.
> Can you suggest other names?

Yeah, I knew it's not a good name. I was hoping someone else (or you) 
could come up with a better name. :-)

Anyway, here's some suggestions:

* RubyDirectives         [normal | confonly] # default is 'normal'

reasoning: a quite short name

* RubyRestrictDirectives [off | on]          # default is 'off'

reasoning: we also have 'RubyAddPath' which is a verb + noun form too

* RubyAdminMode          [off | on]          # default is 'off'

reasoning: we also have 'RubyOutputMode'

my favorite is RubyRestrictDirectives. RubyAdminMode might still sound 
too generic.


Regards,
dave