[issue34576] [EASY doc] http.server, SimpleHTTPServer: warn users on security

Senthil Kumaran added the comment: This is resolved. Thank you, all. -- stage: patch review -> resolved status: open -> closed ___ Python tracker ___

[issue34576] [EASY doc] http.server, SimpleHTTPServer: warn users on security

Senthil Kumaran added the comment: New changeset 8be1c043a6d10d375f7a73c681cb2d7ec2f2d361 by Senthil Kumaran in branch '3.6': [3.6] - bpo-34576 : Backport eeab510 3.6 (GH-10113) https://github.com/python/cpython/commit/8be1c043a6d10d375f7a73c681cb2d7ec2f2d361 --

[issue34576] [EASY doc] http.server, SimpleHTTPServer: warn users on security

Senthil Kumaran added the comment: New changeset bb1876acd815a05744cea4a7d4098231ef499e52 by Senthil Kumaran in branch '3.7': [3.7] bpo-34576 : Backport eeab510 (#10114) https://github.com/python/cpython/commit/bb1876acd815a05744cea4a7d4098231ef499e52 --

[issue34576] [EASY doc] http.server, SimpleHTTPServer: warn users on security

Senthil Kumaran added the comment: New changeset 971089fc2a09e4bcb872efac52c1b014af16fff9 by Senthil Kumaran in branch '2.7': [2.7] bpo-34576 : Backport eeab510 2.7 (#10115) https://github.com/python/cpython/commit/971089fc2a09e4bcb872efac52c1b014af16fff9 --

[issue34576] [EASY doc] http.server, SimpleHTTPServer: warn users on security

Senthil Kumaran added the comment: This should be it - https://github.com/python/cpython/pull/10116 https://github.com/python/cpython/pull/10114 https://github.com/python/cpython/pull/10113 https://github.com/python/cpython/pull/10115 Lets merge these simple PRs and close this issue.

[issue34576] [EASY doc] http.server, SimpleHTTPServer: warn users on security

Change by Senthil Kumaran : -- pull_requests: +9449 ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue34576] [EASY doc] http.server, SimpleHTTPServer: warn users on security

Change by Senthil Kumaran : -- pull_requests: +9448 ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue34576] [EASY doc] http.server, SimpleHTTPServer: warn users on security

Change by Senthil Kumaran : -- pull_requests: +9446, 9447 ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue34576] [EASY doc] http.server, SimpleHTTPServer: warn users on security

Change by Senthil Kumaran : -- pull_requests: +9446 ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue34576] [EASY doc] http.server, SimpleHTTPServer: warn users on security

Change by Senthil Kumaran : -- pull_requests: +9445 ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue34576] [EASY doc] http.server, SimpleHTTPServer: warn users on security

STINNER Victor added the comment: "http.server is meant for demo purposes and does not implement the stringent security checks needed of a real HTTP server. We do not recommend using this module directly in production." I'm not sure about "demo" and "real" in this warning. I propose:

[issue34576] [EASY doc] http.server, SimpleHTTPServer: warn users on security

Senthil Kumaran added the comment: New changeset eeab510bb7e51802c18b3770cbb23ae0ca91da6b by Senthil Kumaran in branch 'master': bpo-34576 - Fix the formatting for security considerations in http.server.rst (#10005)

[issue34576] [EASY doc] http.server, SimpleHTTPServer: warn users on security

Senthil Kumaran added the comment: Please approve this one - https://github.com/python/cpython/pull/10005 and I adopt the backports according the reverts. -- ___ Python tracker

[issue34576] [EASY doc] http.server, SimpleHTTPServer: warn users on security

Senthil Kumaran added the comment: No problem, Ned. I will update it. -- ___ Python tracker ___ ___ Python-bugs-list mailing list

[issue34576] [EASY doc] http.server, SimpleHTTPServer: warn users on security

Ned Deily added the comment: Sorry, Senthil, I reverted the original PRs for 3.7.1 and 3.6.7 so you may need to redo your new PR. -- priority: deferred blocker -> ___ Python tracker

[issue34576] [EASY doc] http.server, SimpleHTTPServer: warn users on security

Ned Deily added the comment: New changeset 32fe7b0188bb73c84c0bde80643b6a3bfd03ba93 by Ned Deily in branch '3.7': bpo-34576: Revert doc change until it can be properly fixed (GH-9720) https://github.com/python/cpython/commit/32fe7b0188bb73c84c0bde80643b6a3bfd03ba93 --

[issue34576] [EASY doc] http.server, SimpleHTTPServer: warn users on security

Ned Deily added the comment: New changeset 92fe93e48a852d22ba33c0fa12112ae664724202 by Ned Deily in branch '3.6': bpo-34576: Revert doc change until it can be properly fixed (GH-9720) https://github.com/python/cpython/commit/92fe93e48a852d22ba33c0fa12112ae664724202 -- nosy:

[issue34576] [EASY doc] http.server, SimpleHTTPServer: warn users on security

Senthil Kumaran added the comment: Fixed it here - https://github.com/python/cpython/pull/10005 And tested the rendering too https://screenshots.firefox.com/9Wlq9v1Y7M4DZBsG/localhost Upon review / approval, I will merge this. Thank you! -- ___

[issue34576] [EASY doc] http.server, SimpleHTTPServer: warn users on security

Change by Senthil Kumaran : -- assignee: -> orsenthil ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue34576] [EASY doc] http.server, SimpleHTTPServer: warn users on security

Change by Senthil Kumaran : -- pull_requests: +9346 ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue34576] [EASY doc] http.server, SimpleHTTPServer: warn users on security

Change by Ned Deily : -- priority: normal -> deferred blocker ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue34576] [EASY doc] http.server, SimpleHTTPServer: warn users on security

Senthil Kumaran added the comment: @Victor - Surprising. Thanks for noticing this. I will fix it shortly. -- ___ Python tracker ___

[issue34576] [EASY doc] http.server, SimpleHTTPServer: warn users on security

STINNER Victor added the comment: The render is surprising: it looks like the full documentation is part of the § Security Considerations: https://docs.python.org/dev/library/http.server.html#security-considerations I suggest to add a new title for the rest of the documentation. --

[issue34576] [EASY doc] http.server, SimpleHTTPServer: warn users on security

miss-islington added the comment: New changeset 57038bcb24407a46e6d278d0ab4b6ad25bbf by Miss Islington (bot) in branch '3.7': bpo-34576 warn users on security for http.server (GH-9720) https://github.com/python/cpython/commit/57038bcb24407a46e6d278d0ab4b6ad25bbf --

[issue34576] [EASY doc] http.server, SimpleHTTPServer: warn users on security

miss-islington added the comment: New changeset 3baee3b39765f5e8ec616b2b71b731b140486394 by Miss Islington (bot) in branch '3.6': bpo-34576 warn users on security for http.server (GH-9720) https://github.com/python/cpython/commit/3baee3b39765f5e8ec616b2b71b731b140486394 -- nosy:

[issue34576] [EASY doc] http.server, SimpleHTTPServer: warn users on security

Change by miss-islington : -- pull_requests: +9176 ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue34576] [EASY doc] http.server, SimpleHTTPServer: warn users on security

Change by miss-islington : -- pull_requests: +9178 ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue34576] [EASY doc] http.server, SimpleHTTPServer: warn users on security

Senthil Kumaran added the comment: New changeset 1d26c72e6a9c5b28b27c158f2f196217707dbb0f by Senthil Kumaran (Felipe Rodrigues) in branch 'master': bpo-34576 warn users on security for http.server (#9720) https://github.com/python/cpython/commit/1d26c72e6a9c5b28b27c158f2f196217707dbb0f

[issue34576] [EASY doc] http.server, SimpleHTTPServer: warn users on security

Change by Felipe Rodrigues : -- keywords: +patch pull_requests: +9103 stage: -> patch review ___ Python tracker ___ ___

[issue34576] [EASY doc] http.server, SimpleHTTPServer: warn users on security

Martin Panter added the comment: FYI Senthil made an earlier suggestion for wording at -- nosy: +martin.panter ___ Python tracker

[issue34576] [EASY doc] http.server, SimpleHTTPServer: warn users on security

Prashant Sharma added the comment: Should this change be done? If so, I would want to take up this issue. -- nosy: +gutsytechster ___ Python tracker ___

[issue34576] [EASY doc] http.server, SimpleHTTPServer: warn users on security

Felipe Rodrigues added the comment: Well, even if we do fix some security issues in SimpleHTTPServer, it doesn't change the fact that it shouldn't really be used for sensitive applications. I like how Django docs handles a similar issue regarding their development server

[issue34576] [EASY doc] http.server, SimpleHTTPServer: warn users on security

Benjamin Peterson added the comment: There was some disagreement later on the list about adding this warning. We will fix security issues in SimpleHTTPServer. -- nosy: +benjamin.peterson ___ Python tracker

[issue34576] [EASY doc] http.server, SimpleHTTPServer: warn users on security

Change by STINNER Victor : -- keywords: +easy title: SimpleHTTPServer: warn users on security -> [EASY doc] http.server, SimpleHTTPServer: warn users on security ___ Python tracker