diff options
| -rw-r--r-- | Doc/lib/libsimplexmlrpc.tex | 9 | ||||
| -rw-r--r-- | Lib/DocXMLRPCServer.py | 4 | ||||
| -rw-r--r-- | Lib/SimpleXMLRPCServer.py | 28 |
3 files changed, 41 insertions, 0 deletions
diff --git a/Doc/lib/libsimplexmlrpc.tex b/Doc/lib/libsimplexmlrpc.tex index a25cabf6d5..7a9786125d 100644 --- a/Doc/lib/libsimplexmlrpc.tex +++ b/Doc/lib/libsimplexmlrpc.tex @@ -111,6 +111,15 @@ simple, stand alone XML-RPC servers. Registers the XML-RPC multicall function system.multicall. \end{methoddesc} +\begin{memberdesc}[SimpleXMLRPCServer]{rpc_paths} +An attribute value that must be a tuple listing valid path portions of +the URL for receiving XML-RPC requests. Requests posted to other +paths will result in a 404 ``no such page'' HTTP error. If this +tuple is empty, all paths will be considered valid. +The default value is \code{('/', '/RPC2')}. + \versionadded{2.5} +\end{memberdesc} + Example: \begin{verbatim} diff --git a/Lib/DocXMLRPCServer.py b/Lib/DocXMLRPCServer.py index 259fb18b86..86ed32b6fc 100644 --- a/Lib/DocXMLRPCServer.py +++ b/Lib/DocXMLRPCServer.py @@ -227,6 +227,10 @@ class DocXMLRPCRequestHandler(SimpleXMLRPCRequestHandler): Interpret all HTTP GET requests as requests for server documentation. """ + # Check that the path is legal + if not self.is_rpc_path_valid(): + self.report_404() + return response = self.server.generate_html_documentation() self.send_response(200) diff --git a/Lib/SimpleXMLRPCServer.py b/Lib/SimpleXMLRPCServer.py index db7749a14f..c7646cf2cc 100644 --- a/Lib/SimpleXMLRPCServer.py +++ b/Lib/SimpleXMLRPCServer.py @@ -423,6 +423,17 @@ class SimpleXMLRPCRequestHandler(BaseHTTPServer.BaseHTTPRequestHandler): XML-RPC requests. """ + # Class attribute listing the accessible path components; + # paths not on this list will result in a 404 error. + rpc_paths = ('/', '/RPC2') + + def is_rpc_path_valid(self): + if self.rpc_paths: + return self.path in self.rpc_paths + else: + # If .rpc_paths is empty, just assume all paths are legal + return True + def do_POST(self): """Handles the HTTP POST request. @@ -430,6 +441,11 @@ class SimpleXMLRPCRequestHandler(BaseHTTPServer.BaseHTTPRequestHandler): which are forwarded to the server's _dispatch method for handling. """ + # Check that the path is legal + if not self.is_rpc_path_valid(): + self.report_404() + return + try: # Get arguments by reading body of request. # We read this in chunks to avoid straining @@ -468,6 +484,18 @@ class SimpleXMLRPCRequestHandler(BaseHTTPServer.BaseHTTPRequestHandler): self.wfile.flush() self.connection.shutdown(1) + def report_404 (self): + # Report a 404 error + self.send_response(404) + response = 'No such page' + self.send_header("Content-type", "text/plain") + self.send_header("Content-length", str(len(response))) + self.end_headers() + self.wfile.write(response) + # shut down the connection + self.wfile.flush() + self.connection.shutdown(1) + def log_request(self, code='-', size='-'): """Selectively log an accepted request.""" |