[mod_python] Publisher handler has a small problem...

Dave Cole djc at object-craft.com.au
Wed Jan 10 16:49:57 EST 2001

If I make the following module hello.py available via the publisher

        """ Publisher example """
        import os
        def say(req, what="NOTHING"):
            return "I am saying %s" % what        

Then a browser request which looks like this:


will actually work (as the apache user).  I am fairly sure that this
is not desirable...

If someone knows which modules you are importing in your code, they
will be able to call any non-builtin function anywhere in the

Maybe the publisher handler should only allow objects to be published
if they have some sort of special attribute, __publish__ for example.

- Dave


More information about the Mod_python mailing list