SVN: r25336 - in trunk/quixote: . demo
Neil Schemenauer <nascheme-fVcApmY9cLvQ3/1i3zOLAti2O/[email protected]> Thu, 14 Oct 2004 13:06:01 -0400
| Newsgroups | gmane.comp.web.quixote.cvs |
|---|---|
| Message-ID | <[email protected]> |
Author: nascheme
Date: 2004-10-14 13:05:37 -0400 (Thu, 14 Oct 2004)
New Revision: 25336
Modified:
trunk/quixote/demo/pages.ptl
trunk/quixote/html.py
trunk/quixote/http_request.py
trunk/quixote/publish.py
trunk/quixote/util.py
Log:
Remove HTTPRequest.dump_html() method and add dump_request to 'util'
module. Remove obsolete functions html_quote(), value_quote() and
link() from 'html' module.
Modified: trunk/quixote/demo/pages.ptl
===================================================================
--- trunk/quixote/demo/pages.ptl 2004-10-14 16:14:05 UTC (rev 25335)
+++ trunk/quixote/demo/pages.ptl 2004-10-14 17:05:37 UTC (rev 25336)
@@ -5,6 +5,7 @@
__revision__ = "$Id$"
+from quixote.util import dump_request
def _q_index [html] (request):
print "debug message from the index page"
@@ -68,10 +69,10 @@
can do whatever it likes to provide a friendly page.
</p>
<p>Here's the exception that was raised:<br />
- <code>%s (%s)</code>.</p>
+ <code>%r (%s)</code>.</p>
</body>
</html>
- """ % (repr(exc), str(exc))
+ """ % (exc, exc)
def dumpreq [html] (request):
"""
@@ -80,7 +81,7 @@
<body>
<h1>HTTPRequest Object</h1>
"""
- htmltext(request.dump_html())
+ dump_request(request)
"""
</body>
</html>
Modified: trunk/quixote/html.py
===================================================================
--- trunk/quixote/html.py 2004-10-14 16:14:05 UTC (rev 25335)
+++ trunk/quixote/html.py 2004-10-14 17:05:37 UTC (rev 25336)
@@ -3,7 +3,7 @@
$Id$
These functions are fairly simple but it is critical that they be
-used correctly. Many security problems are caused by quoting errors
+used correctly. Many security problems are caused by escaping errors
(cross site scripting is one example). The HTML and XML standards on
www.w3c.org and www.xml.com should be studied, especially the sections
on character sets, entities, attribute and values.
@@ -17,21 +17,6 @@
string and returns a htmltext instance. htmlescape() does nothing to
htmltext instances.
-
-html_quote
-----------
-
-Use for quoting data that will be used within attribute values or as
-element contents (if the [html] template type is not being used).
-Examples:
-
- '<title>%s</title>' % html_quote(title)
- '<input type="hidden" value="%s" />' % html_quote(data)
- '<a href="%s">something</a>' % html_quote(url)
-
-Note that the \" character should be used to surround attribute values.
-
-
url_quote
---------
@@ -41,23 +26,20 @@
...
'<a href="/search?keyword=%s">' % url_quote(input)
-Note that URLs are usually used as attribute values and should be quoted
-using html_quote. For example:
+Note that URLs are usually used as attribute values and might need to have
+HTML special characters escaped. As an example of incorrect usage:
- url = 'http://example.com/?a=1©=0'
+ url = 'http://example.com/?a=1©=0' # INCORRECT
+ url = 'http://example.com/?a=1&copy=0' # CORRECT
...
- '<a href="%s">do something</a>' % html_quote(url)
+ '<a href="%s">do something</a>' % url
-If html_quote is not used, old browsers would treat "©" as an entity
-reference and replace it with the copyright character. XML processors should
-treat it as an invalid entity reference.
-
+Old browsers would treat "©" as an entity reference and replace it with
+the copyright character. XML processors should treat it as an invalid entity
+reference.
"""
-__revision__ = "$Id$"
-
import urllib
-from types import UnicodeType
try:
# faster C implementation
@@ -67,9 +49,9 @@
from quixote._py_htmltext import htmltext, htmlescape, _escape_string, \
TemplateIO
-ValuelessAttr = ["valueless_attr"] # magic singleton object
+ValuelessAttr = object() # magic singleton object
-def htmltag(tag, xml_end=0, css_class=None, **attrs):
+def htmltag(tag, xml_end=False, css_class=None, **attrs):
"""Create a HTML tag.
"""
r = ["<%s" % tag]
@@ -115,71 +97,8 @@
raise ValueError, "value is None and no fallback supplied"
else:
return fallback
- if isinstance(value, UnicodeType):
+ if isinstance(value, unicode):
value = value.encode('iso-8859-1')
else:
value = str(value)
return urllib.quote(value)
-
-
-#
-# The rest of this module is for Quixote applications that were written
-# before 'htmltext'. If you are writing a new application, ignore them.
-#
-
-def html_quote(value, fallback=None):
- """html_quote(value : any [, fallback : string]) -> str
-
- Quotes 'value' for use in an HTML page. The special characters &,
- <, > are replaced by SGML entities. If value is None, then the
- behavior depends on the fallback argument. If it is not supplied
- then an error is raised. Otherwise, the fallback value is returned
- unquoted.
- """
- if value is None:
- if fallback is None:
- raise ValueError, "value is None and no fallback supplied"
- else:
- return fallback
- elif isinstance(value, UnicodeType):
- value = value.encode('iso-8859-1')
- else:
- value = str(value)
- value = value.replace("&", "&") # must be done first
- value = value.replace("<", "<")
- value = value.replace(">", ">")
- value = value.replace('"', """)
- return value
-
-
-def value_quote(value):
- """Quote HTML attribute values. This function is of marginal
- utility since html_quote can be used.
-
- XHTML 1.0 requires that all values be quoted. weblint claims
- that some clients don't understand single quotes. For compatibility
- with HTML, XHTML 1.0 requires that ampersands be encoded.
- """
- assert value is not None, "can't pass None to value_quote"
- value = str(value).replace('&', '&')
- value = value.replace('"', '"')
- return '"%s"' % value
-
-
-def link(url, text, title=None, name=None, **kwargs):
- return render_tag("a", href=url, title=title, name=name,
- **kwargs) + str(text) + "</a>"
-
-
-def render_tag(tag, xml_end=0, **attrs):
- r = "<%s" % tag
- for (attr, val) in attrs.items():
- if val is ValuelessAttr:
- r += ' %s="%s"' % (attr, attr)
- elif val is not None:
- r += " %s=%s" % (attr, value_quote(val))
- if xml_end:
- r += " />"
- else:
- r += ">"
- return r
Modified: trunk/quixote/http_request.py
===================================================================
--- trunk/quixote/http_request.py 2004-10-14 16:14:05 UTC (rev 25335)
+++ trunk/quixote/http_request.py 2004-10-14 17:05:37 UTC (rev 25336)
@@ -31,7 +31,6 @@
from types import ListType
from quixote.http_response import HTTPResponse
-from quixote.html import html_quote
# Various regexes for parsing specific bits of HTTP, all from RFC 2616.
@@ -334,28 +333,6 @@
return found
- def dump_html(self):
- row_fmt=('<tr valign="top"><th align="left">%s</th><td>%s</td></tr>')
- lines = ["<h3>form</h3>",
- "<table>"]
-
- for k,v in self.form.items():
- lines.append(row_fmt % (html_quote(k), html_quote(v)))
- lines += ["</table>",
- "<h3>cookies</h3>",
- "<table>"]
- for k,v in self.cookies.items():
- lines.append(row_fmt % (html_quote(k), html_quote(v)))
-
- lines += ["</table>",
- "<h3>environ</h3>"
- "<table>"]
- for k,v in self.environ.items():
- lines.append(row_fmt % (html_quote(k), html_quote(str(v))))
- lines.append("</table>")
-
- return "\n".join(lines)
-
def dump(self):
result=[]
row='%-15s %s'
Modified: trunk/quixote/publish.py
===================================================================
--- trunk/quixote/publish.py 2004-10-14 16:14:05 UTC (rev 25335)
+++ trunk/quixote/publish.py 2004-10-14 17:05:37 UTC (rev 25336)
@@ -17,6 +17,7 @@
from quixote import errors
from quixote.html import htmltext
+from quixote.util import dump_request
from quixote.http_request import HTTPRequest, get_content_type
from quixote.http_response import HTTPResponse, Stream
from quixote.upload import HTTPUploadRequest
@@ -268,7 +269,7 @@
self.access_log.write('%s %s %s %d "%s %s %s" %s %r %0.2fsec\n' %
(request.environ.get('REMOTE_ADDR'),
- str(user),
+ user,
timestamp,
os.getpid(),
request.get_method(),
@@ -407,7 +408,7 @@
hook = cgitb.Hook(file=error_file)
hook(exc_type, exc_value, tb)
error_file.write('<h2>Original Request</h2>')
- error_file.write(request.dump_html())
+ error_file.write(dump_request(request))
error_file.write('<h2>Original Response</h2><pre>')
original_response.write(error_file)
error_file.write('</pre>')
Modified: trunk/quixote/util.py
===================================================================
--- trunk/quixote/util.py 2004-10-14 16:14:05 UTC (rev 25335)
+++ trunk/quixote/util.py 2004-10-14 17:05:37 UTC (rev 25336)
@@ -24,7 +24,8 @@
import xmlrpclib
from cStringIO import StringIO
from rfc822 import formatdate
-from quixote import errors, html
+from quixote import errors
+from quixote.html import htmltext, TemplateIO
from quixote.http_response import Stream
if hasattr(os, 'urandom'):
@@ -248,8 +249,8 @@
# FIXME: this is not a valid HTML document!
out = StringIO()
if self.list_directory:
- template = html.htmltext('<a href="%s">%s</a>%s')
- print >>out, (html.htmltext("<h1>%s</h1>")
+ template = htmltext('<a href="%s">%s</a>%s')
+ print >>out, (htmltext("<h1>%s</h1>")
% request.environ['REQUEST_URI'])
print >>out, "<pre>"
print >>out, template % ('..', '..', '')
@@ -324,3 +325,25 @@
def __call__(self, request):
return request.redirect(self.location, self.permanent)
+
+
+def dump_request(request):
+ """Dump an HTTPRequest object as HTML."""
+ row_fmt = htmltext('<tr><th>%s</th><td>%s</td></tr>')
+ r = TemplateIO(html=1)
+ r += htmltext('<h3>form</h3>'
+ '<table>')
+ for k, v in self.form.items():
+ r += row_fmt % (k, v)
+ r += htmltext('</table>'
+ '<h3>cookies</h3>'
+ '<table>')
+ for k, v in self.cookies.items():
+ r += row_fmt % (k, v)
+ r += htmltext('</table>'
+ '<h3>environ</h3>'
+ '<table>')
+ for k, v in self.environ.items():
+ r += row_fmt % (k, v)
+ r += htmltext('</table>')
+ return r.getvalue()