[mod_python] Re: mod_python.publisher and Cheetah

On Mon, Mar 14, 2005 at 04:17:37PM +0100,
 Stephane Bortzmeyer <bortzmeyer at nic.fr> wrote 
 a message of 75 lines which said:

> I always used Cheetah on Apache with a custom mod_python handler (see
> http://wiki.cheetahtemplate.org/cheetahrecipes.html). I would like to
> use mod_python's publisher
> http://www.modpython.org/live/current/doc-html/hand-pub.html, in order
> to limit my liability :-) specially for security reasons.

Well, it seems there is no other solution than to write your own
publisher. Graham sent one (which works fine), here is another
possible one, based on the mod_python.publisher.
-------------- next part --------------
--- /usr/lib/python2.3/site-packages/mod_python/publisher.py	2005-02-11 13:34:45.000000000 +0100
+++ codev-nic-publisher.py	2005-03-14 17:19:31.992143758 +0100
@@ -28,8 +28,8 @@
   5. Does not give special meaning to '.' and '..'.
 """
 
-import apache
-import util
+from mod_python import apache
+from mod_python import util
 
 import sys
 import os
@@ -67,7 +67,7 @@
     path, module_name =  os.path.split(req.filename)
     if not module_name:
         module_name = "index"
-
+    
     # get rid of the suffix
     #   explanation: Suffixes that will get stripped off
     #   are those that were specified as an argument to the
@@ -116,7 +116,7 @@
 
     # resolve the object ('traverse')
     try:
-        object = resolve_object(req, module, func_path, realm, user, passwd)
+        object = resolve_object(req, module, module_name, func_path, realm, user, passwd)
     except AttributeError:
         raise apache.SERVER_RETURN, apache.HTTP_NOT_FOUND
     
@@ -252,17 +252,18 @@
 
     return realm, user, passwd
 
-def resolve_object(req, obj, object_str, realm=None, user=None, passwd=None):
+def resolve_object(req, obj, module_name, object_str, realm=None, user=None, passwd=None):
     """
     This function traverses the objects separated by .
     (period) to find the last one we're looking for.
     """
 
     parts = object_str.split('.')
-
+    obj = getattr(obj, module_name)
+    instance = obj()
     for n in range(len(parts)):
 
-        obj = getattr(obj, parts[n])
+        obj = getattr(instance, parts[n])
         obj_type = type(obj)
 
         # object cannot be a module or a class