wsgi/request.py
author Sylvain Thénault <sylvain.thenault@logilab.fr>
Fri, 12 Mar 2010 15:05:33 +0100
changeset 4897 e402e0b32075
parent 4212 ab6573088b4a
child 5155 1dea6e0fdfc1
child 5421 8167de96c523
permissions -rw-r--r--
[web] start a new message system based on id of message stored in session's data instead of using __message as today, which is problematic (allow message injection). Also we can have html in messages. Removed the __createdpath hack used to escape those limitation. The old system should still work though (and will probably for a while, though we should progressivly move to the new system where it's possible). Cleanup request paramaters handling on the way.

"""WSGI request adapter for cubicweb

NOTE: each docstring tagged with ``COME FROM DJANGO`` means that
the code has been taken (or adapted) from Djanco source code :
  http://www.djangoproject.com/

:organization: Logilab
:copyright: 2008-2010 LOGILAB S.A. (Paris, FRANCE), license is LGPL v2.
:contact: http://www.logilab.fr/ -- mailto:contact@logilab.fr
:license: GNU Lesser General Public License, v2.1 - http://www.gnu.org/licenses
"""

__docformat__ = "restructuredtext en"

from StringIO import StringIO
from urllib import quote

from logilab.common.decorators import cached

from cubicweb.web.request import CubicWebRequestBase
from cubicweb.wsgi import (pformat, qs2dict, safe_copyfileobj, parse_file_upload,
                        normalize_header)



class CubicWebWsgiRequest(CubicWebRequestBase):
    """most of this code COMES FROM DJANO
    """

    def __init__(self, environ, vreg, base_url=None):
        self.environ = environ
        self.path = environ['PATH_INFO']
        self.method = environ['REQUEST_METHOD'].upper()
        self._headers = dict([(normalize_header(k[5:]), v) for k, v in self.environ.items()
                              if k.startswith('HTTP_')])
        https = environ.get("HTTPS") in ('yes', 'on', '1')
        self._base_url = base_url or self.instance_uri()
        post, files = self.get_posted_data()
        super(CubicWebWsgiRequest, self).__init__(vreg, https, post)
        if files is not None:
            for fdef in files.itervalues():
                fdef[0] = unicode(fdef[0], self.encoding)
            self.form.update(files)
        # prepare output headers
        self.headers_out = {}

    def __repr__(self):
        # Since this is called as part of error handling, we need to be very
        # robust against potentially malformed input.
        form = pformat(self.form)
        meta = pformat(self.environ)
        return '<CubicWebWsgiRequest\FORM:%s,\nMETA:%s>' % \
            (form, meta)

    ## cubicweb request interface ################################################

    def base_url(self):
        return self._base_url

    def http_method(self):
        """returns 'POST', 'GET', 'HEAD', etc."""
        return self.method

    def relative_path(self, includeparams=True):
        """return the normalized path of the request (ie at least relative
        to the instance's root, but some other normalization may be needed
        so that the returned path may be used to compare to generated urls

        :param includeparams:
           boolean indicating if GET form parameters should be kept in the path
        """
        path = self.environ['PATH_INFO']
        path = path[1:] # remove leading '/'
        if includeparams:
            qs = self.environ.get('QUERY_STRING')
            if qs:
                return '%s?%s' % (path, qs)

        return path

    def get_header(self, header, default=None):
        """return the value associated with the given input HTTP header,
        raise KeyError if the header is not set
        """
        return self._headers.get(normalize_header(header), default)

    def set_header(self, header, value, raw=True):
        """set an output HTTP header"""
        assert raw, "don't know anything about non-raw headers for wsgi requests"
        self.headers_out[header] = value

    def add_header(self, header, value):
        """add an output HTTP header"""
        self.headers_out[header] = value

    def remove_header(self, header):
        """remove an output HTTP header"""
        self.headers_out.pop(header, None)

    def header_if_modified_since(self):
        """If the HTTP header If-modified-since is set, return the equivalent
        mx date time value (GMT), else return None
        """
        return None

    ## wsgi request helpers ###################################################

    def instance_uri(self):
        """Return the instance's base URI (no PATH_INFO or QUERY_STRING)

        see python2.5's wsgiref.util.instance_uri code
        """
        environ = self.environ
        url = environ['wsgi.url_scheme'] + '://'
        if environ.get('HTTP_HOST'):
            url += environ['HTTP_HOST']
        else:
            url += environ['SERVER_NAME']
            if environ['wsgi.url_scheme'] == 'https':
                if environ['SERVER_PORT'] != '443':
                    url += ':' + environ['SERVER_PORT']
            else:
                if environ['SERVER_PORT'] != '80':
                    url += ':' + environ['SERVER_PORT']
        url += quote(environ.get('SCRIPT_NAME') or '/')
        return url

    def get_full_path(self):
        return '%s%s' % (self.path, self.environ.get('QUERY_STRING', '') and ('?' + self.environ.get('QUERY_STRING', '')) or '')

    def is_secure(self):
        return 'wsgi.url_scheme' in self.environ \
            and self.environ['wsgi.url_scheme'] == 'https'

    def get_posted_data(self):
        files = None
        if self.method == 'POST':
            if self.environ.get('CONTENT_TYPE', '').startswith('multipart'):
                header_dict = dict((normalize_header(k[5:]), v)
                                   for k, v in self.environ.items()
                                   if k.startswith('HTTP_'))
                header_dict['Content-Type'] = self.environ.get('CONTENT_TYPE', '')
                post, files = parse_file_upload(header_dict, self.raw_post_data)
            else:
                post = qs2dict(self.raw_post_data)
        else:
            # The WSGI spec says 'QUERY_STRING' may be absent.
            post = qs2dict(self.environ.get('QUERY_STRING', ''))
        return post, files

    @property
    @cached
    def raw_post_data(self):
        buf = StringIO()
        try:
            # CONTENT_LENGTH might be absent if POST doesn't have content at all (lighttpd)
            content_length = int(self.environ.get('CONTENT_LENGTH', 0))
        except ValueError: # if CONTENT_LENGTH was empty string or not an integer
            content_length = 0
        if content_length > 0:
            safe_copyfileobj(self.environ['wsgi.input'], buf,
                    size=content_length)
        postdata = buf.getvalue()
        buf.close()
        return postdata

    def _validate_cache(self):
        """raise a `DirectResponse` exception if a cached page along the way
        exists and is still usable
        """
        # XXX
#         if self.get_header('Cache-Control') in ('max-age=0', 'no-cache'):
#             # Expires header seems to be required by IE7
#             self.add_header('Expires', 'Sat, 01 Jan 2000 00:00:00 GMT')
#             return
#         try:
#             http.checkPreconditions(self._twreq, _PreResponse(self))
#         except http.HTTPError, ex:
#             self.info('valid http cache, no actual rendering')
#             raise DirectResponse(ex.response)
        # Expires header seems to be required by IE7
        self.add_header('Expires', 'Sat, 01 Jan 2000 00:00:00 GMT')