[Paste] redirecting paster serve --daemon log output to an executable

2008-07-23 Thread Michael Bayer
In this case the executable in question is "rotatelogs". Two ways this could be achieved would be: a. if paster supported a "stdout" option for logging. Currently if you dont specify a --log-file option, it goes straight to "paster.log". b. if the --log-file option supported pipes, such as

Re: [Paste] redirecting paster serve --daemon log output to an executable

2008-07-23 Thread Gary Bernhardt
Paste will automatically interpret your ini file as a logging module config file if the "loggers" key is present. See the "Basic Logging Configuration" section at . The example in that section sends all logging to stderr, which seems to be what y

Re: [Paste] redirecting paster serve --daemon log output to an executable

2008-07-23 Thread Michael Bayer
the .ini file in use has that exact logging configuration already. paster with the "--daemon" option redirects stdout and stderr to paster.log. Here is the source code from PasteScript's "script.py" which does this: if getattr(self.options, 'daemon', False): if not self.opti

[Paste] limiting POST size, not reading the whole stream, then kicking the client out

2008-07-23 Thread Michael Bayer
This is one I've already decided its best to do on the Apache side (im using mod_proxy to talk to paster serve), but here's the issue on the Python side. I'm not sure if theres anything that can be done in Paste here since it seems to be the behavior of "socket" actually causing the ultim

Re: [Paste] limiting POST size, not reading the whole stream, then kicking the client out

2008-07-23 Thread Sergey Schetinin
I didn't read all the code in the linked page, so I could be wrong, but it seems that DirectCascade ignores the fact that a failed app could consume some or all of data from environ['wsgi.input'] and will thus break the apps later in the cascade. The right thing to do, I think, would be to insert m

Re: [Paste] redirecting paster serve --daemon log output to an executable

2008-07-23 Thread Gary Bernhardt
On Wed, Jul 23, 2008 at 2:03 PM, Michael Bayer <[EMAIL PROTECTED]> wrote: > > the .ini file in use has that exact logging configuration already. paster > with the "--daemon" option redirects stdout and stderr to paster.log. > > Here is the source code from PasteScript's "script.py" which does thi

Re: [Paste] limiting POST size, not reading the whole stream, then kicking the client out

2008-07-23 Thread Michael Bayer
On Jul 23, 2008, at 3:50 PM, Sergey Schetinin wrote: > I didn't read all the code in the linked page, so I could be wrong, > but it seems that DirectCascade ignores the fact that a failed app > could consume some or all of data from environ['wsgi.input'] and will > thus break the apps later in th

Re: [Paste] limiting POST size, not reading the whole stream, then kicking the client out

2008-07-23 Thread Sergey Schetinin
> Whether or not CONTENT_LENGTH is set (and it wouldn't be present in the case > of a malicious attack, though not sure if some other part of the HTTP stack > catches that), > the current approaches read the whole stream into a tempfile. It's not entirely up to the attacker, it depends on the ser

Re: [Paste] limiting POST size, not reading the whole stream, then kicking the client out

2008-07-23 Thread Michael Bayer
On Jul 23, 2008, at 4:47 PM, Sergey Schetinin wrote: >> Whether or not CONTENT_LENGTH is set (and it wouldn't be present in >> the case >> of a malicious attack, though not sure if some other part of the >> HTTP stack >> catches that), >> the current approaches read the whole stream into a te

Re: [Paste] limiting POST size, not reading the whole stream, then kicking the client out

2008-07-23 Thread Sergey Schetinin
Here's a snippet from paste.httpserver try: content_length = int(self.headers.get('Content-Length', '0')) except ValueError: content_length = 0 if not hasattr(self.connection, 'get_context'): rfile = LimitedLengthFile(rfile, c

Re: [Paste] limiting POST size, not reading the whole stream, then kicking the client out

2008-07-23 Thread Michael Bayer
On Jul 23, 2008, at 5:27 PM, Sergey Schetinin wrote: > Here's a snippet from paste.httpserver > > try: >content_length = int(self.headers.get('Content- > Length', '0')) >except ValueError: >content_length = 0 >if not hasattr(self.connection