Re: [Catalyst] Authorization header and fastcgi

2009-02-20 Thread Ian Docherty

Mark.
I was not looking at $c-engine-env, but now that I am, there is no 
Authorization or HTTP_AUTHORIZATION there either.


I have decided to side-step this issue and create an 'Authentication' 
header rather than an 'Authorization' header and to hell with the 
'standard'.


(Besides the 'standard' is badly named anyway!)

Thanks everyone for help with this matter.

Regards
Ian

Mark Trostler wrote:

are you looking in  $c-engine-env?
Mark

Ian Docherty wrote:

Matt Pitts wrote:

-Original Message-
From: Ian Docherty [mailto:catal...@iandocherty.com]
Sent: Tuesday, February 17, 2009 9:51 AM
To: The elegant MVC web framework
Subject: [Catalyst] Authorization header and fastcgi

Hi
The 'Authorization' header is not being passed to my Catalyst
application.

I have read the archives about fastcgi not passing the header and I
have
tried the following in my Apache 2 config

RewriteCond %{HTTP:Authorization} ^(.+)
RewriteRule ^(.*)$ $1 [E=HTTP_AUTHORIZATION:%1,PT]

FastCgiIpcDir /var/fcgi_ipc
FastCgiServer
/var/www/www.pharmaventures.com/script/pharmaventures_fastcgi.pl
-pass-header HTTP_AUTHORIZATION -pass-header Authorization -processes


5
 

-initial-env PV_DEBUG=0 -initial-env PV_HBX=1 -initial-env
PV_DSN=dbi:mysql:port=3306:host=127.0.0.1

I don't see a header and I don't see any environment variable in my


Cat
 

app.

I have tried variations on the -pass-header Authorization -pass-header
AUTHORIZATION but neither works.

Any other ideas?



The following is working for me in Apache 2.2 with 
FastCgiExternalServer

and Cat 5.8014

RewriteEngine On
RewriteCond %{HTTP:Authorization} ^(.+)
RewriteRule ^(.*)$ $1 [E=HTTP_AUTHORIZATION:%1,PT]

Without any special declarations on my FastCgiExternalServer directive.

Could it be something specific to running the FastCGI internal vs.
external?

Did you forget to turn RewriteEngine On?

v/r
-matt pitts

__

'RewriteEngine On' was there, it makes no difference.

I too am on Cat 5.7014

I will experiment with changing between FastCGI static and dynamic 
mode to see if that makes any difference.


Regards
Ian


___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: 
http://www.mail-archive.com/catalyst@lists.scsys.co.uk/

Dev site: http://dev.catalyst.perl.org/




___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: 
http://www.mail-archive.com/catalyst@lists.scsys.co.uk/

Dev site: http://dev.catalyst.perl.org/




___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


Re: [Catalyst] RFC: New to Catalyst questions

2009-02-20 Thread Kieren Diment


On 20/02/2009, at 8:49 PM, Octavian Rasnita wrote:


From: Dan Dascalescu ddascalescu+catal...@gmail.com

Regarding wiki questions:

The Catalyst wiki runs on MojoMojo (http://mojomojo.org),


Too bad that it doesn't run under Windows.



Why not?  I can't think of any practical reason why it wouldn't.

___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


Re: [Catalyst] RFC: New to Catalyst questions

2009-02-20 Thread Octavian Rasnita
From: Kieren Diment kie...@diment.org

 On 20/02/2009, at 8:49 PM, Octavian Rasnita wrote:
 
 From: Dan Dascalescu ddascalescu+catal...@gmail.com
 Regarding wiki questions:

 The Catalyst wiki runs on MojoMojo (http://mojomojo.org),

 Too bad that it doesn't run under Windows.

 
 Why not?  I can't think of any practical reason why it wouldn't.
 

First I was not able to install File::NFSLock with cpan, but I found a ppm 
distribution for it.
But I've seen that after doing this, more other cpan modules couldn't be 
installed, and one of them is Cache::FastMmap which I know that it can't be 
installed under Windows.

Octavian





___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


Re: [Catalyst] RFC: New to Catalyst questions

2009-02-20 Thread Rodrigo

 First I was not able to install File::NFSLock with cpan, but I found a ppm
 distribution for it.
 But I've seen that after doing this, more other cpan modules couldn't be
 installed, and one of them is Cache::FastMmap which I know that it can't be
 installed under Windows.


I switched Cache::FastMmap for Cache::FileCache (in MojoMojo.pm) which seems
to work fine, but I haven't run a full test suite or used in production. I
didn't have a problem with File::NFSLock compiling with the latest
Strawberry version.

-rodrigo
___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


Re: [Catalyst] RFC: New to Catalyst questions

2009-02-20 Thread Rodrigo
On Fri, Feb 20, 2009 at 8:21 AM, Dan Dascalescu 
ddascalescu+catal...@gmail.com ddascalescu%2bcatal...@gmail.com wrote:


 Rodrigo,
 MojoMojo now supports custom styles. A different theme can be seen at
 http://nordaaker.no/wiki/. We think the typography needs improvement,
 and a Mediawiki-like theme would be very good to have.


I know. I brute-forced the main catalystframework.org css into a MojoMojo
theme to see how it would look. I'm not a web-designer, so don't expect
wonders... You can see it here:

http://rodrigolive.googlepages.com/catmojo.jpg

Is the Catalyst Wiki code in the svn repository or backed-up somewhere? I
think it would be good to have a development version (with the current
content snapshot) so I can work on a makeover.
___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


Re: [Catalyst] Templating languages (was RFC: The paradox of choice in web development)

2009-02-20 Thread Dermot
2009/2/19 Byron Young byron.yo...@riverbed.com:
 Jonathan Rockway wrote on 2009-02-19:
 * On Wed, Feb 18 2009, Dermot wrote:
 Yes there is, at first glance, a lot of choice but is there. I would
 say TT and Mason are the only realistic choices (for HTML).

 If by realistic you mean unmaintainable for both designers and
 developers, then yes, you've described Mason and TT.

 The only qualities that Mason and TT have over other options is that
 they have been around for a while.

 Jonathan,

 Can I ask - what are the limitations with Mason (and TT) in your opinion?  I 
 have been using it as the templating language for my Cat app (seemed better 
 than TT because I could exclude having to learn a new language for the 
 templates - I can just keep writing perl code).

TT is perl. It's not a different language. It's a bit of a learning
curve. It provides familiar methods* like keys, splice, exists and
substr.
I *_* TT
Dp.


* http://template-toolkit.org/docs/manual/VMethods.html

___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


Re: [Catalyst] RFC: New to Catalyst questions

2009-02-20 Thread Dan Dascalescu
 http://rodrigolive.googlepages.com/catmojo.jpg

Wow, quite neat, really.

 I didn't have a problem with File::NFSLock compiling with the latest 
 Strawberry version.

I did, and I'm not the only one:
http://rt.cpan.org/Public/Bug/Display.html?id=40185

PS: Cache::Memory is a bogus dependency. I just removed it.

___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


[Catalyst] Re: Templating languages (was RFC: The paradox of choice in web development)

2009-02-20 Thread Aristotle Pagaltzis
* Dermot paik...@googlemail.com [2009-02-20 12:15]:
 TT is perl. It's not a different language.

You’re joking, right?

 It provides familiar methods* like keys, splice, exists and
 substr.

By that argument, Javascript is Perl.

Regards,
-- 
Aristotle Pagaltzis // http://plasmasturm.org/

___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


Re: [Catalyst] RFC: New to Catalyst questions

2009-02-20 Thread Marcus Ramberg
On Fri, Feb 20, 2009 at 11:32 AM, Rodrigo rodrigol...@gmail.com wrote:

 On Fri, Feb 20, 2009 at 8:21 AM, Dan Dascalescu 
 ddascalescu+catal...@gmail.com ddascalescu%2bcatal...@gmail.com wrote:


 Rodrigo,
 MojoMojo now supports custom styles. A different theme can be seen at
 http://nordaaker.no/wiki/. We think the typography needs improvement,
 and a Mediawiki-like theme would be very good to have.


 I know. I brute-forced the main catalystframework.org css into a MojoMojo
 theme to see how it would look. I'm not a web-designer, so don't expect
 wonders... You can see it here:

 http://rodrigolive.googlepages.com/catmojo.jpg

 Is the Catalyst Wiki code in the svn repository or backed-up somewhere? I
 think it would be good to have a development version (with the current
 content snapshot) so I can work on a makeover.


Looks nice.

MojoMojo is hosted in git. You can check it out from
http://github.com/marcusramberg/mojomojo/tree/master. There is a sql
snapshot with the user passwords stripped out at
http://dev.thefeed.no/stuff/wiki_dump.sql.gz . We are quite interested in
getting a catalyst theme for mojomojo.


With regards
Marcus Ramberg
___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


Re: [Catalyst] Re: Templating languages (was RFC: The paradox of choice in web development)

2009-02-20 Thread Dermot
2009/2/20 Aristotle Pagaltzis pagalt...@gmx.de:
 * Dermot paik...@googlemail.com [2009-02-20 12:15]:
 TT is perl. It's not a different language.

 You're joking, right?

narff. Perhaps written in Perl.

 It provides familiar methods* like keys, splice, exists and
 substr.

 By that argument, Javascript is Perl.

The point is the are familiar functions. There isn't nothing new in it.
Dp.

___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


Re: [Catalyst] RFC: New to Catalyst questions

2009-02-20 Thread Octavian Rasnita
From: Rodrigo rodrigol...@gmail.com
 First I was not able to install File::NFSLock with cpan, but I found a ppm
 distribution for it.
 But I've seen that after doing this, more other cpan modules couldn't be
 installed, and one of them is Cache::FastMmap which I know that it can't be
 installed under Windows.

 
 I switched Cache::FastMmap for Cache::FileCache (in MojoMojo.pm) which seems
 to work fine, but I haven't run a full test suite or used in production. I
 didn't have a problem with File::NFSLock compiling with the latest
 Strawberry version.
 
 -rodrigo

I've just tried to do the same thing using ActivePerl, but without success. 
Cache::memory can't be installed with cpan, and I also couldn't find a ppm 
distribution for it.

I don't know if Strawberry can be used with Active State's Perl Developer Kit 
and I think it might appear some conflicts if I would have 2 perl distributions 
installed in the same time...

Octavian


___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


Re: [Catalyst] RFC: New to Catalyst questions

2009-02-20 Thread Octavian Rasnita
From: Dan Dascalescu ddascalescu+catal...@gmail.com
 I didn't have a problem with File::NFSLock compiling with the latest 
 Strawberry version.
 
 I did, and I'm not the only one:
 http://rt.cpan.org/Public/Bug/Display.html?id=40185
 
 PS: Cache::Memory is a bogus dependency. I just removed it.
 

I have also removed it, but I found that I can't install 
DBIx::Class::EncodedColumn  with cpan, and there is no ppm distribution for it.

Octavian


___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


Re: [Catalyst] RFC: New to Catalyst questions

2009-02-20 Thread Rodrigo

 I have also removed it, but I found that I can't install
 DBIx::Class::EncodedColumn  with cpan, and there is no ppm distribution for
 it.

 Octavian


Wow. I haven't had a problem with that either, in at least 5 different XP
machines. Are you running Vista? What's the error?

I'm using the October 2008 versions, so I've just downloaded Jan 2009
Strawberry 5.10.0.4, installed it to c:\strawberry, ran cpan, then notest
install DBIx::Class::EncodedColumn and it installed it ok. On the other
hand, DBIx::Class didn't due to SQLite issues, but EncodedColumn didn't seem
to care. Obviously that would need some testing, but as far as installation
goes, it seems to be fine.
___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


Re: [Catalyst] RFC: New to Catalyst questions

2009-02-20 Thread Octavian Râsnita
From: Rodrigo 
  I have also removed it, but I found that I can't install 
DBIx::Class::EncodedColumn  with cpan, and there is no ppm distribution for it.

 Wow. I haven't had a problem with that either, in at least 5 different XP 
machines. Are you running Vista? What's the error?

I run Win XP Pro SP3. The error is below.

I think the relevant error is:

t/02digest1/32 Can't call method keysize on an undefined value at 
E:/perl510/site/lib/Crypt/OpenPGP.pm line 525.

I have tried a:

cpan install Crypt::OpenPGP

But I received the message that this module is up to date.

I use ActivePerl 5.10.0 build 1004.

The full output is:

CPAN.pm: Going to build G/GR/GRODITI/DBIx-Class-EncodedColumn-0.2.tar.gz
Cannot determine perl version info from lib/DBIx/Class/EncodedColumn.pm
Checking if your kit is complete...
Looks good
Writing Makefile for DBIx::Class::EncodedColumn
Microsoft (R) Program Maintenance Utility Version 8.00.50727.42
Copyright (C) Microsoft Corporation.  All rights reserved.
cp lib/DBIx/Class/EncodedColumn/Crypt/Eksblowfish/Bcrypt.pm 
blib\lib\DBIx\Class\EncodedColumn\Crypt\Eksblowfish\Bcrypt.pm
cp lib/DBIx/Class/EncodedColumn.pm blib\lib\DBIx\Class\EncodedColumn.pm
cp lib/DBIx/Class/EncodedColumn/Digest.pm 
blib\lib\DBIx\Class\EncodedColumn\Digest.pm
cp lib/DBIx/Class/EncodedColumn/Crypt/OpenPGP.pm 
blib\lib\DBIx\Class\EncodedColumn\Crypt\OpenPGP.pm
GRODITI/DBIx-Class-EncodedColumn-0.2.tar.gz
nmake -- OK
Running make test
Microsoft (R) Program Maintenance Utility Version 8.00.50727.42
Copyright (C) Microsoft Corporation. All rights reserved.
E:\perl510\bin\perl.exe -MExtUtils::Command::MM -e test_harness(0, 
'inc', 'blib\lib', 'blib\arch') t/*.t
t/01load..ok
t/02digest1/32 Can't call method keysize on an undefined value at 
E:/perl510/site/lib/Crypt/OpenPGP.pm line 525.
# Looks like you planned 32 tests but ran 26.
# Looks like your test exited with 2 just after 26.
t/02digest Dubious, test returned 2 (wstat 512, 0x200)
Failed 6/32 subtests
Test Summary Report
---
t/02digest (Wstat: 512 Tests: 26 Failed: 0)
Non-zero exit status: 2
Parse errors: Bad plan.  You planned 32 tests but ran 26.
Files=2, Tests=27,  2 wallclock secs ( 0.03 usr +  0.00 sys =  0.03 CPU)
Result: FAIL
Failed 1/2 test programs. 0/27 subtests failed.
NMAKE : fatal error U1077: 'E:\perl510\bin\perl.exe' : return code '0x2'
Stop.
GRODITI/DBIx-Class-EncodedColumn-0.2.tar.gz
nmake test -- NOT OK
//hint// to see the cpan-testers results for installing this module, try:
reports GRODITI/DBIx-Class-EncodedColumn-0.2.tar.gz
Running make install
make test had returned bad status, won't install without force
Failed during this command:
GRODITI/DBIx-Class-EncodedColumn-0.2.tar.gz: make_test NO
cpan
___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


Re: RFC local::lib + CPAN shell support in CatalystX::Starter (was: Re: [Catalyst] RFC: The paradox of choice in web development)

2009-02-20 Thread Tomas Doran


On 19 Feb 2009, at 18:27, Matt Pitts wrote:


All this talk about Perl/Catalyst/CPAN pains, has got me thinking...

Anybody like the idea of having a local::lib bootstrap option to
CatalystX::Starter and possible integration of a script that would
launch a CPAN shell for installing into the local::lib folder?


CatalystX::Starter is for boot strapping a Catalyst component, not an  
application. You'd be looking to add to Catalyst::Devel



Or, maybe a separate module Catalyst::Starter::LocalLib?

The idea would be to help folks bootstrap Cat apps and get all the  
deps

inside the app folder right from the start for easier deployment. Of
course it won't eliminate the need for a shell, but it's still an
improvement.


You'd be looking to have local::lib support built into the scripts   
etc which Catalyst generates, and an additional shell script in your  
scripts directory to start a CPAN shell pointing at your  
application's local::lib and tricks to install all the non perl core  
dependencies into that directory?


That sounds like a good idea, and I've considered hacking on it  
myself, but never found the tuits.


I could probably put together a patch if I can get some best  
practice

ideas.


I'm thinking of rails' ability to 'freeze' rails into your  
application here. In actual fact, I've never found this feature very  
useful as I want to freeze all the dependencies too (this is  
possible, but involves hacking environment.rb and etc in the same way  
as manually attaching a local::lib to your Cat app).


I guess the biggest argument is likely to be what the correct name  
for the directory containing your local::lib is. I also expect there  
would be a fair amount of toolchain related yak-shaving to get it  
right, but its certainly a feature I'd like to see happen.


Cheers
t0m


___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


Re: [Catalyst] Re: decoding in core (Was: [Announce] Catalyst-Runtime-5.8000_05)

2009-02-20 Thread Tomas Doran


On 6 Feb 2009, at 17:36, Bill Moseley wrote:


Sure.  IIRC, I think there's already been some patches and code posted
so maybe I can dig that up again off the archives.


Please do.


But, sounds like
it's not that important of an issue.


The fact that nobody is working on it currently is not an indication  
that it isn't an important problem to try to solve.


Cheers
t0m


___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


Re: [Catalyst] RFC: New to Catalyst questions

2009-02-20 Thread Tomas Doran


On 20 Feb 2009, at 01:18, Trevor Phillips wrote:

What is the best practices for Wiki updates?


There isn't one specifically.


Should new articles be posted to this list first, for discussion, or
should they be just whacked into the Wiki, then posted here for
review/deletion?


I'd do the latter, as it doesn't block getting your content out and  
editable by a bunch of people. If people don't care - they won't read  
your list post, if they do care then it's going to be easier for  
everyone to contribute if the text is in the wiki than if you have to  
tease apart a mailing list thread of comments and re-post.


Although giving the list  heads up if you add anything significant  
that you'd like reviewing is totally cool :)



Is there an alert/review process for Wiki edits? Is there a core team
that will be notified of changes/additions, so they can review/delete?


No, there isn't.


As someone fairly new to Catalyst, I'm happy to contribute, but I'm
hesitant to jump in  start making changes  additions... Perhaps
there should be a prominent page on the Wiki on how to best contribute
to the Wiki?


Well done, you just volunteered to write that page (and some others  
if I was hearing right) :)


Cheers
t0m


___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


[Catalyst] windows install issues (Was: RFC: New to Catalyst questions)

2009-02-20 Thread Rodrigo

 I think the relevant error is:

 t/02digest1/32 Can't call method keysize on an undefined value at
 E:/perl510/site/lib/Crypt/OpenPGP.pm line 525.
 I have tried a:

 cpan install Crypt::OpenPGP

 But I received the message that this module is up to date.

 I use ActivePerl 5.10.0 build 1004.



Oops, ok, sorry, I thought you had Strawberry. Last year I swapped all
things Active for Strawberry Perl.

In any case, maybe you can tinker with the ActivePerl cpan Config.pm so that
it uses the MinGW compiler and the Strawberry cpan settings. The idea would
be to make ActivePerl compile its modules using the Strawberry config
settings.Don't know if that would work.

Another way (if don't want to switch to strawberry flavored perl) is to just
install Strawberry, then edit your PATH and strip off all c:\strawberry\...
directories so that it won't disturb your ActivePerl installation. Then
create a little bat file that will give you a strawberry prompt. Install
modules with strawberry cpan, then copy them from strawberry\perl\site (and
auto) into ActivePerl's \site directories.
___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


[Catalyst] Malformed requests may break $c-req-uri_for()

2009-02-20 Thread Merlyn Kline

I've been using $c-req-uri_for()-as_string() to generate URLs for actions
when I need to switch between schemes (http and https). I've discovered that
this breaks for some malformed requests (using Catalyst 5.7015 on
Apache/2.2.9 (Debian)): if I do this:

   telnet myserver 80
   GET xxx HTTP/1.1
   Host: myserver

Then $c-req-uri_for('action')-as_string() returns
'myserverxxx/action'. I wouldn't care much except that I'm required to
pass a security scan which appears to be being done by Nessus. One of the
checks it does is basically this:

   telnet myserver 80
   GET IMG%20SRC=\javascript:alert(cross_site_scripting.nasl);\ /
HTTP/1.1
   Host: myserver

So the returned page includes their XSS test code in any https links because
I generated them from $c-req-uri_for()-as_string(), and so the security
test fails.

I've fixed this by generating the URLs differently
($c-req-uri_for()-host() seems unaffected) so it's not a problem any
more.

I thought a more generic fix might be useful but after a quick look at the
code it's too complex for me to come up with something right now. Hopefully
I can revisit this soon. Meanwhile, this message is intended to get some
relavant keywords into the list archive in case anyone else searches there
and might find it useful.

I'm not currently using Catalyst::Plugin::RequireSSL so I don't know if
that's affected by this. I expect I will discover that soon...

Merlyn Kline


___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


Re: [Catalyst] Re: decoding in core

2009-02-20 Thread Jonathan Rockway

Braindump follows.

* On Fri, Feb 20 2009, Tomas Doran wrote:
 On 6 Feb 2009, at 17:36, Bill Moseley wrote:

 Sure.  IIRC, I think there's already been some patches and code posted
 so maybe I can dig that up again off the archives.

 Please do.

 But, sounds like
 it's not that important of an issue.

 The fact that nobody is working on it currently is not an indication
 that it isn't an important problem to try to solve.

I meant to write a plugin to do this a long time ago, but I guess I
never cared enough.

The problem with writing a plugin or making this core is that people
really really want to misuse Unicode, and will whine when you try to
force correctness upon them.

The only place where you are really allowed to use non-ASCII characters
are in the request and response.  (HTTP has a way of representing the
character encoding of its payload -- URLs and Cookies don't.)

C::P::Unicode handles this correct usage correctly.  The problem is that
people want Unicode to magically work where it's not allowed.  This
includes HTTP headers (WTF!?), and URLs.  (BTW, when I say Unicode, I
don't necessarily mean Unicode... I mean non-ASCII characters.  The
Japanese character sets contain non-Unicode characters, and some people
want to put these characters in their URLs or HTTP headers.  I wish I
was making ths up, but I am not.  The Unicode process really fucked over
the Asian languages.)

So anyway, the plugin basically needs to have the following config
options, so users can specify what they want.  Inside Catalyst, only
Perl characters should be allowed, unless you mark the string as binary
(there is a CPAN module that does this, Something::BLOB).

  * Input HTTP header encoding (ASCII default)
(this is for data in $c-req-headers, cookies, etc.)
(perhaps cookies should be separately configured)

  * Input URI encoding (probably UTF-8 default)
(the dispatcher will dispatch on the decoded characters)
(source code encoding is handled by Perl, hopefully)

  * Input request body encoding (read HTTP headers and decide)

  * Output HTTP headers encoding (maybe die if this happens, because
it's totally illegal to have non-ascii in the headers)

  * Output URI encoding ($c-uri_for and friends will use this to
translate the names of actions that are named with wide characters)

  * Output response body encoding (this needs to update the HTTP
headers, namely the charset= part of Content-type)

I think that is everything.

There are subtle issues, like knowing not to touch XML (it's binary),
dealing with $c-res-body( filehandle ), and so on.

One last thing, if this becomes core, it will definitely break people's
apps.  Many, many apps are blissfully unaware of characters and treat
text as binary... and their apps kind-of appear to work.  As soon as
they get some real characters in their app, though, they will have
double-encoded nonsense all over the place, and will blame you for this.
(I loaded Catalyst::Plugin::Unicode, and my app broke!  It's all your
fault.  Yup, people mail that to me privately all the time.  For some
reason, they think I am going to personally fix their app, despite
having written volumes of documentation about this.  Wrong.)

Anyway, I just wanted to get this out of my head and onto paper, for
someone else to look at and perhaps implement. :)

Regards,
Jonathan Rockway

--
print just = another = perl = hacker = if $,=$

___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


Re: [Catalyst] Re: decoding in core

2009-02-20 Thread Jonathan Rockway
* On Fri, Feb 20 2009, Jonathan Rockway wrote:
 Braindump follows.

Oh yeah, one other thing.  IDNs will need to be decoded/encoded,
probably.  ($c-req-host should contain perl characters, but links
should probably be punycoded.  Fun!)

--
print just = another = perl = hacker = if $,=$

___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


[Catalyst] MojoMojo now has it's own mailing list.

2009-02-20 Thread Marcus Ramberg
I just thought I'd mention that we've created a separate mailing list for
MojoMojo at
http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/mojomojo

Please subscribe if you are interested in using or developing the wiki that
powers dev.catalyst.perl.org.

With regards
Marcus Ramberg
___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


Re: [Catalyst] Plugin::Authentication overrides $c-req-user

2009-02-20 Thread Tomas Doran


On 20 Feb 2009, at 22:57, Daniel Westermann-Clark wrote:


On 2009-02-11 21:53:48 +, Tomas Doran wrote:

Why not just add a remote_user() method on $c-req instead? It's a
little more typing, but is more explicit about where the value comes
from and doesn't potentially break any existing apps.


Patches on 5.80 welcome :)


Attached is a set of patches to add support for $c-req-remote_user,
including a basic test.


Good stuff, thanks. I've branched 5.80 trunk and applied your Runtime  
change, and then I've fiddled the 'do we warn' logic to be a bit  
safer. Have a look and let me know what you think?


http://dev.catalystframework.org/repos/Catalyst/Catalyst-Runtime/5.80/ 
branches/deprecate_req_user/


Test for the new functionality looks fine.


There is also a deprecation warning for non-Catalyst packages calling
$c-req-user.


Is anything in the current test suite triggering the new warning? If  
so, can you switch it over to be calling -remote_user instead, and  
can you add a call to read -user which provokes the warning, and  
test you get the expected warning (see t/deprecated.t r9354 - you  
could just add the warning test here/to that app which already has  
its global logger overridden?)



I'm not sure about the engine patches, but it seemed like a
forward-compatible way to add support now for the new method.


They look totally sane to me. Lets get Runtime right and a nod from  
andyg before applying them however :)


Feel free to supply another patch against the branch, or hop on irc  
and grab a commit bit so you can commit yourself?


Cheers
t0m


___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


Re: [Catalyst] Catalyst needing LOTS of RAM

2009-02-20 Thread Alejandro Imass
Although this does not directly address your issue it just might give
you some new ideas for scaling up Catalyst. I agree with many here
that you should profile your app for leaky culprits. Since you don't
give much detail on you platform or other details it's little what one
can recommend.

Anyway, this aside I just want to share that I have had
___excellent___ experience with Apache mod_worker instead of pre-fork.
If your app is designed for a large number of concurrent requests you
will benefit greatly from multi-threaded Apahe mod_worker and Catalyst
with mod_perl. You will be able to spawn many, many more threads with
a lot less overall consumption of RAM. The catch is that you have to
be more careful with leaks, but you can use the special worker MPM
directives like MaxRequestsPerChild which will kill and restart a
child after N requests as safeguard for non-thread safe or leaky
modules.

Best,
Alejandro Imass

On Wed, Feb 18, 2009 at 10:14 AM, Neo [GC] n...@gothic-chat.de wrote:
 Hello guys,

 after fiddling around with Catalyst+DBIx starup time, here comes my next
 issue:

 Is there some way to tune Catalyst to use less RAM? Is there even some kind
 of explanation for the really FAT memory footprint?

 Currently, our project allocates 330MB RAM right after startup (with
 myproject_server.pl or fastcgi). Over the time this is getting worse; some
 month after the projects start it used about 80MB and we think with some
 additional controllers and stuff it will need over 500MB. I know there is
 some advent calendar entry about restartig the catalyst-process when it
 reaches a memory limit (what is good - our processes tend to grow up to
 1GB), but this doesn't help at startup.
 Is this normal behaviour?

 The problem is, we use multiple instances of the application. So every
 customer has his own catalyst instance with own database and - of course -
 own fastcgi-process. Currently we are running it on a machine with 16GB of
 RAM and will soon get to the physical and budgetary limits.
 Is Catalyst just not intended for this kind of use (and more like one
 server, one site) or is there some black magic we just haven't found yet?


 Btw: Neither reducing the count of the DBIx-models nor disabling the
 debug-mode does have an impact on memory footprint.


 Thanks and regards,
 Thomas Weber

 ___
 List: Catalyst@lists.scsys.co.uk
 Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
 Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
 Dev site: http://dev.catalyst.perl.org/


___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/