2009/1/30 gert <[email protected]>: > > On Jan 30, 2:20 am, Graham Dumpleton <[email protected]> > wrote: >> 2009/1/30 gert <[email protected]>: >> > On Jan 29, 1:58 am, Graham Dumpleton <[email protected]> >> > wrote: >> >> 2009/1/29 gert <[email protected]>: >> >> > On Jan 28, 3:00 am, gert <[email protected]> wrote: >> >> >> On Jan 28, 2:41 am, Graham Dumpleton <[email protected]> >> >> >> > This is for two reasons. The first is that a wrong configuration of >> >> >> > Apache will mean that people can download your source code, including >> >> >> > database logins and passwords if kept in those files. Second is that >> >> >> > if using .py extensions for WSGI script files and Python path being >> >> >> > set to be directory where WSGI script files are located, you can >> >> >> > double import WSGI script files under file name. The latter occurs >> >> >> > because mod_wsgi doesn't use standard Python module importer and so >> >> >> > using 'import' for name of WSGI script file will import it a second >> >> >> > time. >> >> >> > Ok so let say we have >> >> > /usr/httpd/htdocs/wsgi/double.py >> >> > WSGIPythonPath is set too /usr/httpd/htdocs/wsgi/ >> >> > document root /usr/httpd/htdocs/ >> >> > and apache is running embedded mode AddHandler wsgi-script .py >> >> >> > Does it do a double import of double.py when opening browser with >> >> >http://..../wsgi/double.py? >> >> >> We have had this discussion before some time back from memory. Last >> >> time I pointed you at: >> >> >> http://code.google.com/p/modwsgi/wiki/ReloadingSourceCode >> >> >> If you have two .py WSGI script files in that directory, eg. single.py >> >> and double.py, and both were used as WSGI script files, and in >> >> single.py it did 'import double', then you will end up with two copies >> >> of double.py in memory. >> >> >> That imported using 'import' from single.py will have __name__ set to >> >> 'double'. That loaded by mod_wsgi as WSGI script file will have >> >> __name__ set differently and will be stored separately in sys.modules. >> >> >> Thus, it isn't the act of sticking them in the directory, it is doing >> >> a separate 'import' of the WSGI script file from another WSGI script >> >> file or from some other Python module on sys.path. >> >> > Also if double.py does not contain def application(environ, >> > response): ? >> >> > /htdocs/wsgi/single.py >> > import double <------ MEMORY DUPLICATE IMPORT >> > def application(environ, response): >> > h = double.Hello() >> >> > /htdocs/wsgi/double.py >> > class Hello(object): >> > def __init__(): >> >> If someone accesses a URL which maps to double.py and it doesn't have >> a 'application' entry point, it is still loaded, but would result in >> 404 response. That a duplicate occurred here would not be an issue >> unless the module was doing things at global scope which were >> cumulative. For example, if it added directories to sys.path, because >> it would be loaded twice, that directory would be added to sys.path >> twice. > > ok what about > > /htdocs/wsgi/single.py > import double <------ MEMORY DUPLICATE IMPORT > def application(environ, response): > h = double.Hello() > > /htdocs/wsgi/double.py > import triple > class Hello(object): > def __init__(): > > where triple would be some big sucker like sqlite or something ? > Can you not make a WSGIPythonPath that mod_wsgi doesn't load > please :-)
WSGIPythonPath does not need to change. The way you are doing things needs to change. Simply put any common Python modules/packages that are not WSGI script files outside of any document directory which has an 'AddHandler wsgi-script .py' directive applying to it. That external directory would be added to WSGIPythonPath. Alternatively, simply do not use .py extension for WSGI script files. Use .wsgi extension like all the examples I use. At the same time as using .wsgi extension for WSGI script files, it you really want common .py files in the same document directories, then add to your configuration: <Files *.py> Deny from all </Files> This will ensure that no one can download your source code. Graham --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "modwsgi" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/modwsgi?hl=en -~----------~----~----~----~------~----~------~--~---
