[mod_python] questions about mod_python publisher

David Geller wrote:

> Hi,
> 
> I have been using the publisher handler for development purposes (after 
> having used the more general handler paradigm previously), and am 
> considering deployment..
> 
> Some questions:
> 
> 1. Is the publisher suitable for public access, in terms of security, etc.?

I'm using it publicly. I'm unaware of any intrinsic security issues. It 
will only be as secure as the apps you write.

> 2. With the publisher, can you store your python programs outside the 
> document root? (I couldn't figure out a way for this)

Yes, but there are different answers to this question. You can place 
your files anywhere on the system, and use the Alias directive in your 
apache configuration:

  Alias /snake/ /var/www/python/

Then you would use this URL:

  http://www.example.com/snake/

You can also develop packages and install them in the site-packages 
directory alongside other 3rd party packages. Then they will be in your 
path for easy importing and sharing among applications. Of course, you 
will still need at least one python file to run under apache, but the 
bulk of your code will be completely out of the web directory.

> 3. With publisher, is it possible to hide the ".py" suffix?

I don't need to use the suffix. My httpd.conf looks like this (Debian 
Woody: apache 1.3.26, mod_python 2.7.8):

<Directory /var/www/documentroot>
   AddHandler python-program .py
   PythonHandler mod_python.publisher
   PythonDebug On
</Directory>

I can access function foobar in app.py like this:

  http://www.example.com/app/foobar

> 4. I guess I would like to know what the publisher is really good for - 
> it is convenient, but is it just better to code your own handler by hand?

I can't imagine why. Publisher is clean and crisp. I love it!

As an example of its convenience, I wrote and tested an entire module on 
a Windows machine and copied it to my Linux server. I added a single 
function to handle the request from a web page and serve as a frontend 
to the rest of the application. I've never encountered that kind of 
portability before.