Kitware / tangelo

A simple, quick, powerful web framework
http:/tangelohub.org/tangelo/
Apache License 2.0
185 stars 35 forks source link

.py file 403 behavior clashes with plugin development #450

Closed waxlamp closed 9 years ago

waxlamp commented 9 years ago

The VTKWeb plugin works by accepting POST requests that include the full path to a Python file - but not a Python file that is necessarily connected to any Tangelo web services. Because Tangelo nominally considers all Python files to be (potential) web services, it restricts access to them at all times.

The fix for this is to harden Tangelo's policies about restricting/allowing access to Python files (#430) and to better document the analyze_url() function (#451), which is the recommended (but as yet undocumented) way to write plugins that require access to web paths, as VTKWeb does.