Permalink
Feb 13, 2001
Mar 7, 1996
Feb 6, 2022
Feb 28, 2000
Mar 26, 1998
Sep 5, 1996
Apr 29, 2021
Sep 5, 1996
Jul 14, 2011
May 13, 1997
Feb 14, 2021
Mar 26, 1998
Feb 14, 2021
Jan 14, 2011
Mar 26, 1998
Mar 26, 1998
Mar 26, 1998
May 8, 2017
May 8, 2017
Jun 15, 2020
Dec 4, 2008
Mar 7, 1996
Mar 7, 1996
Mar 26, 1998
Mar 7, 1996
Mar 26, 1998
Jan 14, 2011
Mar 7, 1996
Mar 7, 1996
Mar 7, 1996
Jan 14, 2011
Jan 14, 2011
Mar 26, 1998
Mar 26, 1998
Jan 14, 2011
Oct 19, 2018
Mar 26, 1998
Mar 26, 1998
Jan 14, 2011
Mar 26, 1998
Jun 11, 1998
Jan 12, 2014
Jan 14, 2011
Jan 12, 2014
Jan 14, 2011
Mar 26, 1998
Jan 8, 1999
Jan 8, 1999
Mar 26, 1998
Aug 23, 2013
Feb 6, 2015
Mar 26, 1998
Mar 26, 1998
Aug 25, 2000
Sep 5, 2001
Jun 1, 2002
Jan 12, 2014
Mar 26, 1998
Jan 14, 2011
Jan 14, 2011
Jan 14, 2011
Jan 14, 2011
Mar 29, 2015
Oct 23, 2018
Jan 14, 2011
Aug 18, 2015
Oct 23, 2018
Mar 26, 1998
Jan 14, 2011
Mar 26, 1998
Jan 14, 2011
Mar 26, 1998
Aug 28, 2007
Jan 14, 2011
Jan 14, 2011
Jan 14, 2011
Jan 14, 2011
Jun 17, 2013
Mar 26, 1998
Jan 14, 2011
Mar 26, 1998
Mar 26, 1998
Mar 26, 1998
Jan 14, 2011
Mar 7, 1996
Mar 26, 1998
Mar 26, 1998
Aug 20, 1996
Jan 12, 1995
Oct 15, 2010
Jan 12, 1995
Feb 9, 2007
Jan 12, 1995
Jan 12, 1995
Mar 7, 1996
Jan 12, 1995
Jan 14, 2011
Mar 6, 1996
Newer
100755
1012 lines (869 sloc)
33.6 KB
3
# NOTE: the above "/usr/local/bin/python" is NOT a mistake. It is
4
# intentionally NOT "/usr/bin/env python". On many systems
5
# (e.g. Solaris), /usr/local/bin is not in $PATH as passed to CGI
6
# scripts, and /usr/local/bin is the default directory where Python is
7
# installed, so /usr/bin/env would be unable to find python. Granted,
8
# binary installations by Linux vendors often install Python in
9
# /usr/bin. So let those vendors patch cgi.py to match their choice
10
# of installation.
11
14
This module defines a number of utilities for use by CGI scripts
15
written in Python.
16
17
The global variable maxlen can be set to an integer indicating the maximum size
18
of a POST request. POST requests larger than this size will result in a
19
ValueError being raised during parsing. The default value of this variable is 0,
20
meaning the request size is unlimited.
26
# Michael McLay started this module. Steve Majewski changed the
27
# interface to SvFormContentDict and FormContentDict. The multipart
28
# parsing was inspired by code submitted by Andreas Paepcke. Guido van
29
# Rossum rewrote, reformatted and documented the module and is currently
30
# responsible for its maintenance.
62
logfile = "" # Filename to log to, if not empty
63
logfp = None # File object to log to, if not None
64
65
def initlog(*allargs):
66
"""Write a log message, if there is a log file.
67
68
Even though this function is called initlog(), you should always
69
use log(); log is a variable that is set either to initlog
70
(initially), to dolog (once the log file has been opened), or to
71
nolog (when logging is disabled).
72
73
The first argument is a format string; the remaining arguments (if
74
any) are arguments to the % operator, so e.g.
75
log("%s: %s", "a", "b")
76
will write "a: b" to the log file, followed by a newline.
77
78
If the global logfp is not None, it should be a file object to
79
which log data is written.
80
81
If the global logfp is None, the global logfile may be a string
82
giving a filename to open, in append mode. This file should be
83
world writable!!! If the file can't be opened, logging is
84
silently disabled (since there is no safe place where we could
85
send an error message).
86
87
"""
89
warnings.warn("cgi.log() is deprecated as of 3.10. Use logging instead",
90
DeprecationWarning, stacklevel=2)
101
102
def dolog(fmt, *args):
103
"""Write a log message to the log file. See initlog() for docs."""
104
logfp.write(fmt%args + "\n")
105
106
def nolog(*allargs):
107
"""Dummy function, assigned to log when logging is disabled."""
108
pass
109
110
def closelog():
111
"""Close the log file."""
112
global log, logfile, logfp
113
logfile = ''
114
if logfp:
115
logfp.close()
116
logfp = None
117
log = initlog
118
125
# Maximum input we will accept when REQUEST_METHOD is POST
126
# 0 ==> unlimited input
127
maxlen = 0
128
129
def parse(fp=None, environ=os.environ, keep_blank_values=0,
130
strict_parsing=0, separator='&'):
146
strict_parsing: flag indicating what to do with parsing errors.
147
If false (the default), errors are silently ignored.
148
If true, errors raise a ValueError exception.
149
150
separator: str. The symbol to use for separating the query arguments.
151
Defaults to &.
155
156
# field keys and values (except for files) are returned as strings
157
# an encoding is required to decode the bytes read from self.fp
158
if hasattr(fp,'encoding'):
159
encoding = fp.encoding
160
else:
161
encoding = 'latin-1'
162
163
# fp.read() must return bytes
164
if isinstance(fp, TextIOWrapper):
165
fp = fp.buffer
166
170
ctype, pdict = parse_header(environ['CONTENT_TYPE'])
171
if ctype == 'multipart/form-data':
184
if qs: qs = qs + '&'
185
qs = qs + sys.argv[1]
186
environ['QUERY_STRING'] = qs # XXX Shouldn't, really
190
if sys.argv[1:]:
191
qs = sys.argv[1]
192
else:
193
qs = ""
194
environ['QUERY_STRING'] = qs # XXX Shouldn't, really
209
value is a list of values for that field. For non-file fields, the value
210
is a list of strings.
213
# represented as 7bit US-ASCII.
214
boundary = pdict['boundary'].decode('ascii')
215
ctype = "multipart/form-data; boundary={}".format(boundary)
216
headers = Message()
217
headers.set_type(ctype)
218
try:
219
headers['Content-Length'] = pdict['CONTENT-LENGTH']
220
except KeyError:
221
pass
231
end = s.find(';', end + 1)
232
if end < 0:
233
end = len(s)
234
f = s[:end]
235
yield f.strip()
236
s = s[end:]
237
239
"""Parse a Content-type like header.
240
241
Return the main content-type and a dictionary of options.
242
243
"""
259
# Classes for field storage
260
# =========================
261
262
class MiniFieldStorage:
263
277
"""Constructor from field name and value."""
278
self.name = name
279
self.value = value
289
"""Store a sequence of fields, reading multipart/form-data.
290
291
This class provides naming, typing, files stored on disk, and
292
more. At the top level, it is accessible like a dictionary, whose
293
keys are the field names. (Note: None can occur as a field name.)
294
The items are either a Python list (if there's multiple values) or
295
another FieldStorage or MiniFieldStorage object. If it's a single
296
object, it has the following attributes:
297
298
name: the field name, if specified; otherwise None
299
300
filename: the filename, if specified; otherwise None; this is the
301
client side filename, *not* the file name on which it is
302
stored (that's a temporary file you don't deal with)
308
file: the file(-like) object from which you can read the data *as
309
bytes* ; None if the data is stored a simple string
310
311
type: the content-type, or None if not specified
312
313
type_options: dictionary of options specified on the content-type
315
316
disposition: content-disposition, or None if not specified
317
318
disposition_options: dictionary of corresponding options
319
322
323
The class is subclassable, mostly for the purpose of overriding
324
the make_file() method, which is called internally to come up with
325
a file open for reading and writing. This makes it possible to
326
override the default choice of storing all files in a temporary
327
directory and unlinking them as soon as they have been opened.
328
329
"""
330
def __init__(self, fp=None, headers=None, outerboundary=b'',
331
environ=os.environ, keep_blank_values=0, strict_parsing=0,
340
Can be :
341
1. a TextIOWrapper object
342
2. an object whose read() and readline() methods return bytes
344
headers : header dictionary-like object; default:
345
taken from environ as per CGI spec
356
blank values are to be ignored and treated as if they were
357
not included.
358
359
strict_parsing: flag indicating what to do with parsing errors.
360
If false (the default), errors are silently ignored.
361
If true, errors raise a ValueError exception.
362
363
limit : used internally to read parts of multipart/form-data forms,
364
to exit from the reading loop when reached. It is the difference
365
between the form content-length and the number of bytes already
366
read
367
368
encoding, errors : the encoding and error handler used to decode the
369
binary stream to strings. Must be the same as the charset defined
370
for the page sending the form (content-type : meta http-equiv or
371
header)
372
373
max_num_fields: int. If set, then __init__ throws a ValueError
374
if there are more than n fields read by parse_qsl().
375
376
"""
377
method = 'GET'
378
self.keep_blank_values = keep_blank_values
379
self.strict_parsing = strict_parsing
387
qs = environ['QUERY_STRING']
388
elif sys.argv[1:]:
389
qs = sys.argv[1]
390
else:
391
qs = ""
392
qs = qs.encode(locale.getpreferredencoding(), 'surrogateescape')
393
fp = BytesIO(qs)
394
if headers is None:
395
headers = {'content-type':
396
"application/x-www-form-urlencoded"}
397
if headers is None:
398
headers = {}
399
if method == 'POST':
400
# Set default content-type for POST to what's traditional
401
headers['content-type'] = "application/x-www-form-urlencoded"
408
else:
409
if not (isinstance(headers, (Mapping, Message))):
410
raise TypeError("headers must be mapping or an instance of "
411
"email.message.Message")
412
self.headers = headers
413
if fp is None:
414
self.fp = sys.stdin.buffer
415
# self.fp.read() must return bytes
416
elif isinstance(fp, TextIOWrapper):
417
self.fp = fp.buffer
418
else:
419
if not (hasattr(fp, 'read') and hasattr(fp, 'readline')):
420
raise TypeError("fp must be file pointer")
421
self.fp = fp
422
423
self.encoding = encoding
424
self.errors = errors
425
426
if not isinstance(outerboundary, bytes):
427
raise TypeError('outerboundary must be bytes, not %s'
428
% type(outerboundary).__name__)
437
cdisp, pdict = parse_header(self.headers['content-disposition'])
438
self.disposition = cdisp
439
self.disposition_options = pdict
440
self.name = None
449
#
450
# Honor any existing content-type header. But if there is no
451
# content-type header, use some sensible defaults. Assume
452
# outerboundary is "" at the outer level, but something non-false
453
# inside a multi-part. The default for an inner part is text/plain,
454
# but for an outer part it should be urlencoded. This should catch
455
# bogus clients which erroneously forget to include a content-type
456
# header.
457
#
458
# See below for what we do if there does exist a content-type header,
459
# but it happens to be something we don't understand.
463
ctype, pdict = "text/plain", {}
464
else:
465
ctype, pdict = 'application/x-www-form-urlencoded', {}
485
486
self.list = self.file = None
487
self.done = 0
488
if ctype == 'application/x-www-form-urlencoded':
489
self.read_urlencoded()
490
elif ctype[:10] == 'multipart/':
495
def __del__(self):
496
try:
497
self.file.close()
498
except AttributeError:
499
pass
500
501
def __enter__(self):
502
return self
503
504
def __exit__(self, *args):
505
self.file.close()
506
518
if self.file:
519
self.file.seek(0)
520
value = self.file.read()
521
self.file.seek(0)
522
elif self.list is not None:
523
value = self.list
524
else:
525
value = None
526
return value
532
found = []
533
for item in self.list:
534
if item.name == key: found.append(item)
535
if not found:
542
def getvalue(self, key, default=None):
543
"""Dictionary style get() method, including 'value' lookup."""
558
return value[0].value
559
else:
560
return value.value
561
else:
562
return default
563
564
def getlist(self, key):
565
""" Return list of received values."""
581
def __contains__(self, key):
582
"""Dictionary style __contains__ method."""
583
if self.list is None:
591
def __bool__(self):
592
if self.list is None:
593
raise TypeError("Cannot be converted to bool.")
597
"""Internal: read data in query string format."""
598
qs = self.fp.read(self.length)
599
if not isinstance(qs, bytes):
600
raise ValueError("%s should return bytes, got %s" \
601
% (self.fp, type(qs).__name__))
602
qs = qs.decode(self.encoding, self.errors)
605
query = urllib.parse.parse_qsl(
606
qs, self.keep_blank_values, self.strict_parsing,
621
query = urllib.parse.parse_qsl(
622
self.qs_on_post, self.keep_blank_values, self.strict_parsing,
628
first_line = self.fp.readline() # bytes
629
if not isinstance(first_line, bytes):
630
raise ValueError("%s should return bytes, got %s" \
631
% (self.fp, type(first_line).__name__))
632
self.bytes_read += len(first_line)
633
634
# Ensure that we consume the file until we've hit our inner boundary
635
while (first_line.strip() != (b"--" + self.innerboundary) and
636
first_line):
637
first_line = self.fp.readline()
638
self.bytes_read += len(first_line)
639
640
# Propagate max_num_fields into the sub class appropriately
641
max_num_fields = self.max_num_fields
642
if max_num_fields is not None:
643
max_num_fields -= len(self.list)
644
645
while True:
646
parser = FeedParser()
647
hdr_text = b""
648
while True:
649
data = self.fp.readline()
650
hdr_text += data
651
if not data.strip():
652
break
653
if not hdr_text:
654
break
655
# parser takes strings, not bytes
656
self.bytes_read += len(hdr_text)
657
parser.feed(hdr_text.decode(self.encoding, self.errors))
658
headers = parser.close()
659
660
# Some clients add Content-Length for part headers, ignore them
661
if 'content-length' in headers:
662
del headers['content-length']
663
670
if max_num_fields is not None:
671
max_num_fields -= 1
672
if part.list:
673
max_num_fields -= len(part.list)
674
if max_num_fields < 0:
675
raise ValueError('Max number of fields exceeded')
684
"""Internal: read an atomic part."""
685
if self.length >= 0:
686
self.read_binary()
687
self.skip_lines()
688
else:
689
self.read_lines()
690
self.file.seek(0)
700
data = self.fp.read(min(todo, self.bufsize)) # bytes
701
if not isinstance(data, bytes):
702
raise ValueError("%s should return bytes, got %s"
703
% (self.fp, type(data).__name__))
704
self.bytes_read += len(data)
705
if not data:
706
self.done = -1
707
break
708
self.file.write(data)
709
todo = todo - len(data)
713
if self._binary_file:
714
self.file = self.__file = BytesIO() # store data as bytes for files
715
else:
716
self.file = self.__file = StringIO() # as strings for other fields
717
if self.outerboundary:
718
self.read_lines_to_outerboundary()
719
else:
720
self.read_lines_to_eof()
726
self.file = self.make_file()
727
data = self.__file.getvalue()
728
self.file.write(data)
730
if self._binary_file:
731
# keep bytes
732
self.file.write(line)
733
else:
734
# decode to string
735
self.file.write(line.decode(self.encoding, self.errors))
748
"""Internal: read lines until outerboundary.
749
Data is read as bytes: boundaries and line ends must be converted
750
to bytes for comparisons.
751
"""
752
next_boundary = b"--" + self.outerboundary
753
last_boundary = next_boundary + b"--"
754
delim = b""
760
break
761
line = self.fp.readline(1<<16) # bytes
762
self.bytes_read += len(line)
763
_read += len(line)
770
if line.startswith(b"--") and last_line_lfend:
771
strippedline = line.rstrip()
772
if strippedline == next_boundary:
786
elif line.endswith(b"\r"):
787
# We may interrupt \r\n sequences if they span the 2**16
788
# byte boundary
789
delim = b"\r"
790
line = line[:-1]
791
last_line_lfend = False
798
"""Internal: skip lines until outer boundary if defined."""
799
if not self.outerboundary or self.done:
800
return
801
next_boundary = b"--" + self.outerboundary
802
last_boundary = next_boundary + b"--"
822
The file will be used as follows:
823
- data is written to it
824
- seek(0)
825
- data is read from it
830
This version opens a temporary file for reading and writing,
831
and immediately deletes (unlinks) it. The trick (on Unix!) is
832
that the file can still be used, but it can't be opened by
833
another process, and it will automatically be deleted when it
834
is closed or when the current process terminates.
836
If you want a more permanent file, you derive a class which
837
overrides this method. If you want a visible temporary file
838
that is nevertheless automatically deleted when the script
839
terminates, try defining a __del__ method in a derived class
840
which unlinks the temporary files you have created.
843
if self._binary_file:
844
return tempfile.TemporaryFile("wb+")
845
else:
846
return tempfile.TemporaryFile("w+",
847
encoding=self.encoding, newline = '\n')
854
"""Robust test CGI script, usable as main program.
855
856
Write minimal HTTP headers and dump all information provided to
857
the script in HTML form.
858
859
"""
864
form = FieldStorage() # Replace with other classes to test those
865
print_directory()
866
print_arguments()
884
form = FieldStorage() # Replace with other classes to test those
885
print_directory()
886
print_arguments()
892
def print_exception(type=None, value=None, tb=None, limit=None):
893
if type is None:
905
928
print("<i>" + html.escape(repr(type(value))) + "</i>")
929
print("<DD>" + html.escape(repr(value)))
944
946
print()
947
print("<H3>Command Line Arguments:</H3>")
948
print()
949
print(sys.argv)
950
print()
952
def print_environ_usage():
957
<LI>AUTH_TYPE
958
<LI>CONTENT_LENGTH
959
<LI>CONTENT_TYPE
960
<LI>DATE_GMT
961
<LI>DATE_LOCAL
962
<LI>DOCUMENT_NAME
963
<LI>DOCUMENT_ROOT
964
<LI>DOCUMENT_URI
965
<LI>GATEWAY_INTERFACE
966
<LI>LAST_MODIFIED
967
<LI>PATH
968
<LI>PATH_INFO
969
<LI>PATH_TRANSLATED
970
<LI>QUERY_STRING
971
<LI>REMOTE_ADDR
972
<LI>REMOTE_HOST
973
<LI>REMOTE_IDENT
974
<LI>REMOTE_USER
975
<LI>REQUEST_METHOD
976
<LI>SCRIPT_NAME
977
<LI>SERVER_NAME
978
<LI>SERVER_PORT
979
<LI>SERVER_PROTOCOL
980
<LI>SERVER_ROOT
981
<LI>SERVER_SOFTWARE
982
</UL>
983
In addition, HTTP headers sent by the server may be passed in the
984
environment as well. Here are some common variable names:
985
<UL>
986
<LI>HTTP_ACCEPT
987
<LI>HTTP_CONNECTION
988
<LI>HTTP_HOST
989
<LI>HTTP_PRAGMA
990
<LI>HTTP_REFERER
991
<LI>HTTP_USER_AGENT
992
</UL>
994
1001
if isinstance(s, bytes):
1002
_vb_pattern = b"^[ -~]{0,200}[!-~]$"
1003
else:
1004
_vb_pattern = "^[ -~]{0,200}[!-~]$"
1006
1007
# Invoke mainline
1008
# ===============
1009
1010
# Call test() when this file is run as a script (not imported as a module)