blob: 3a795c962c1d5ada70423c6dc02a1edce2a66dd1 [file] [log] [blame]
Guido van Rossum51914632000-10-03 13:51:09 +00001#! /usr/local/bin/python
Guido van Rossum1c9daa81995-09-18 21:52:37 +00002
Guido van Rossum467d7232001-02-13 13:13:33 +00003# NOTE: the above "/usr/local/bin/python" is NOT a mistake. It is
4# intentionally NOT "/usr/bin/env python". On many systems
5# (e.g. Solaris), /usr/local/bin is not in $PATH as passed to CGI
6# scripts, and /usr/local/bin is the default directory where Python is
7# installed, so /usr/bin/env would be unable to find python. Granted,
8# binary installations by Linux vendors often install Python in
9# /usr/bin. So let those vendors patch cgi.py to match their choice
10# of installation.
11
Guido van Rossum72755611996-03-06 07:20:06 +000012"""Support module for CGI (Common Gateway Interface) scripts.
Guido van Rossum1c9daa81995-09-18 21:52:37 +000013
Guido van Rossum7aee3841996-03-07 18:00:44 +000014This module defines a number of utilities for use by CGI scripts
15written in Python.
Guido van Rossum72755611996-03-06 07:20:06 +000016"""
17
Jeremy Hyltonc253d9a2000-08-03 20:57:44 +000018# XXX Perhaps there should be a slimmed version that doesn't contain
19# all those backwards compatible and debugging classes and functions?
Guido van Rossum98d9fd32000-02-28 15:12:25 +000020
21# History
22# -------
Tim Peters88869f92001-01-14 23:36:06 +000023#
Guido van Rossum98d9fd32000-02-28 15:12:25 +000024# Michael McLay started this module. Steve Majewski changed the
25# interface to SvFormContentDict and FormContentDict. The multipart
26# parsing was inspired by code submitted by Andreas Paepcke. Guido van
27# Rossum rewrote, reformatted and documented the module and is currently
28# responsible for its maintenance.
Tim Peters88869f92001-01-14 23:36:06 +000029#
Guido van Rossum98d9fd32000-02-28 15:12:25 +000030
Guido van Rossum52b8c292001-06-29 13:06:06 +000031__version__ = "2.6"
Guido van Rossum0147db01996-03-09 03:16:04 +000032
Guido van Rossum72755611996-03-06 07:20:06 +000033
34# Imports
35# =======
36
Raymond Hettingerf871d832004-12-31 21:59:02 +000037from operator import attrgetter
Guido van Rossum72755611996-03-06 07:20:06 +000038import sys
39import os
Guido van Rossuma5e9fb61997-08-12 18:18:13 +000040import urllib
Moshe Zadkaa1a4b592000-08-25 21:47:56 +000041import UserDict
Brett Cannon721b1452008-08-16 22:00:27 +000042from test.test_support import catch_warning
43from warnings import filterwarnings
44with catch_warning(record=False):
45 filterwarnings("ignore", ".*mimetools has been removed",
46 DeprecationWarning)
47 import mimetools
48 filterwarnings("ignore", ".*rfc822 has been removed", DeprecationWarning)
49 import rfc822
50
Raymond Hettingera6172712004-12-31 19:15:26 +000051try:
52 from cStringIO import StringIO
53except ImportError:
54 from StringIO import StringIO
Guido van Rossum72755611996-03-06 07:20:06 +000055
Guido van Rossuma8423a92001-03-19 13:40:44 +000056__all__ = ["MiniFieldStorage", "FieldStorage", "FormContentDict",
57 "SvFormContentDict", "InterpFormContentDict", "FormContent",
58 "parse", "parse_qs", "parse_qsl", "parse_multipart",
59 "parse_header", "print_exception", "print_environ",
60 "print_form", "print_directory", "print_arguments",
61 "print_environ_usage", "escape"]
Guido van Rossumc204c701996-09-05 19:07:11 +000062
63# Logging support
64# ===============
65
Guido van Rossum45e2fbc1998-03-26 21:13:24 +000066logfile = "" # Filename to log to, if not empty
67logfp = None # File object to log to, if not None
Guido van Rossumc204c701996-09-05 19:07:11 +000068
69def initlog(*allargs):
70 """Write a log message, if there is a log file.
71
72 Even though this function is called initlog(), you should always
73 use log(); log is a variable that is set either to initlog
74 (initially), to dolog (once the log file has been opened), or to
75 nolog (when logging is disabled).
76
77 The first argument is a format string; the remaining arguments (if
78 any) are arguments to the % operator, so e.g.
79 log("%s: %s", "a", "b")
80 will write "a: b" to the log file, followed by a newline.
81
82 If the global logfp is not None, it should be a file object to
83 which log data is written.
84
85 If the global logfp is None, the global logfile may be a string
86 giving a filename to open, in append mode. This file should be
87 world writable!!! If the file can't be opened, logging is
88 silently disabled (since there is no safe place where we could
89 send an error message).
90
91 """
92 global logfp, log
93 if logfile and not logfp:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +000094 try:
95 logfp = open(logfile, "a")
96 except IOError:
97 pass
Guido van Rossumc204c701996-09-05 19:07:11 +000098 if not logfp:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +000099 log = nolog
Guido van Rossumc204c701996-09-05 19:07:11 +0000100 else:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000101 log = dolog
Guido van Rossum68468eb2003-02-27 20:14:51 +0000102 log(*allargs)
Guido van Rossumc204c701996-09-05 19:07:11 +0000103
104def dolog(fmt, *args):
105 """Write a log message to the log file. See initlog() for docs."""
106 logfp.write(fmt%args + "\n")
107
108def nolog(*allargs):
109 """Dummy function, assigned to log when logging is disabled."""
110 pass
111
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000112log = initlog # The current logging function
Guido van Rossumc204c701996-09-05 19:07:11 +0000113
114
Guido van Rossum72755611996-03-06 07:20:06 +0000115# Parsing functions
116# =================
117
Guido van Rossumad164711997-05-13 19:03:23 +0000118# Maximum input we will accept when REQUEST_METHOD is POST
119# 0 ==> unlimited input
120maxlen = 0
121
Guido van Rossume08c04c1996-11-11 19:29:11 +0000122def parse(fp=None, environ=os.environ, keep_blank_values=0, strict_parsing=0):
Guido van Rossum773ab271996-07-23 03:46:24 +0000123 """Parse a query in the environment or from a file (default stdin)
124
125 Arguments, all optional:
126
127 fp : file pointer; default: sys.stdin
128
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000129 environ : environment dictionary; default: os.environ
Guido van Rossum773ab271996-07-23 03:46:24 +0000130
131 keep_blank_values: flag indicating whether blank values in
Tim Peters88869f92001-01-14 23:36:06 +0000132 URL encoded forms should be treated as blank strings.
133 A true value indicates that blanks should be retained as
Guido van Rossum773ab271996-07-23 03:46:24 +0000134 blank strings. The default false value indicates that
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000135 blank values are to be ignored and treated as if they were
136 not included.
Guido van Rossume08c04c1996-11-11 19:29:11 +0000137
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000138 strict_parsing: flag indicating what to do with parsing errors.
139 If false (the default), errors are silently ignored.
140 If true, errors raise a ValueError exception.
Guido van Rossum773ab271996-07-23 03:46:24 +0000141 """
Raymond Hettingera1449002002-05-31 23:54:44 +0000142 if fp is None:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000143 fp = sys.stdin
Raymond Hettinger54f02222002-06-01 14:18:47 +0000144 if not 'REQUEST_METHOD' in environ:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000145 environ['REQUEST_METHOD'] = 'GET' # For testing stand-alone
Guido van Rossum7aee3841996-03-07 18:00:44 +0000146 if environ['REQUEST_METHOD'] == 'POST':
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000147 ctype, pdict = parse_header(environ['CONTENT_TYPE'])
148 if ctype == 'multipart/form-data':
149 return parse_multipart(fp, pdict)
150 elif ctype == 'application/x-www-form-urlencoded':
Eric S. Raymond7e9b4f52001-02-09 09:59:10 +0000151 clength = int(environ['CONTENT_LENGTH'])
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000152 if maxlen and clength > maxlen:
153 raise ValueError, 'Maximum content length exceeded'
154 qs = fp.read(clength)
155 else:
156 qs = '' # Unknown content-type
Raymond Hettinger54f02222002-06-01 14:18:47 +0000157 if 'QUERY_STRING' in environ:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000158 if qs: qs = qs + '&'
159 qs = qs + environ['QUERY_STRING']
Tim Peters88869f92001-01-14 23:36:06 +0000160 elif sys.argv[1:]:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000161 if qs: qs = qs + '&'
162 qs = qs + sys.argv[1]
163 environ['QUERY_STRING'] = qs # XXX Shouldn't, really
Raymond Hettinger54f02222002-06-01 14:18:47 +0000164 elif 'QUERY_STRING' in environ:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000165 qs = environ['QUERY_STRING']
Guido van Rossum7aee3841996-03-07 18:00:44 +0000166 else:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000167 if sys.argv[1:]:
168 qs = sys.argv[1]
169 else:
170 qs = ""
171 environ['QUERY_STRING'] = qs # XXX Shouldn't, really
Guido van Rossume08c04c1996-11-11 19:29:11 +0000172 return parse_qs(qs, keep_blank_values, strict_parsing)
Guido van Rossume7808771995-08-07 20:12:09 +0000173
174
Guido van Rossume08c04c1996-11-11 19:29:11 +0000175def parse_qs(qs, keep_blank_values=0, strict_parsing=0):
176 """Parse a query given as a string argument.
Guido van Rossum773ab271996-07-23 03:46:24 +0000177
178 Arguments:
179
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000180 qs: URL-encoded query string to be parsed
Guido van Rossum773ab271996-07-23 03:46:24 +0000181
182 keep_blank_values: flag indicating whether blank values in
Tim Peters88869f92001-01-14 23:36:06 +0000183 URL encoded queries should be treated as blank strings.
184 A true value indicates that blanks should be retained as
Guido van Rossum773ab271996-07-23 03:46:24 +0000185 blank strings. The default false value indicates that
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000186 blank values are to be ignored and treated as if they were
187 not included.
Guido van Rossume08c04c1996-11-11 19:29:11 +0000188
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000189 strict_parsing: flag indicating what to do with parsing errors.
190 If false (the default), errors are silently ignored.
191 If true, errors raise a ValueError exception.
Guido van Rossum773ab271996-07-23 03:46:24 +0000192 """
Guido van Rossum7aee3841996-03-07 18:00:44 +0000193 dict = {}
Guido van Rossum1946f0d1999-06-04 17:54:39 +0000194 for name, value in parse_qsl(qs, keep_blank_values, strict_parsing):
Raymond Hettinger54f02222002-06-01 14:18:47 +0000195 if name in dict:
Moshe Zadkaa1a4b592000-08-25 21:47:56 +0000196 dict[name].append(value)
197 else:
198 dict[name] = [value]
Guido van Rossum1946f0d1999-06-04 17:54:39 +0000199 return dict
200
201def parse_qsl(qs, keep_blank_values=0, strict_parsing=0):
202 """Parse a query given as a string argument.
203
Jeremy Hyltonafde7e22000-09-15 20:06:57 +0000204 Arguments:
Guido van Rossum1946f0d1999-06-04 17:54:39 +0000205
Jeremy Hyltonafde7e22000-09-15 20:06:57 +0000206 qs: URL-encoded query string to be parsed
Guido van Rossum1946f0d1999-06-04 17:54:39 +0000207
Jeremy Hyltonafde7e22000-09-15 20:06:57 +0000208 keep_blank_values: flag indicating whether blank values in
209 URL encoded queries should be treated as blank strings. A
210 true value indicates that blanks should be retained as blank
211 strings. The default false value indicates that blank values
212 are to be ignored and treated as if they were not included.
Guido van Rossum1946f0d1999-06-04 17:54:39 +0000213
Jeremy Hyltonafde7e22000-09-15 20:06:57 +0000214 strict_parsing: flag indicating what to do with parsing errors. If
215 false (the default), errors are silently ignored. If true,
Tim Peters88869f92001-01-14 23:36:06 +0000216 errors raise a ValueError exception.
Guido van Rossum1946f0d1999-06-04 17:54:39 +0000217
Jeremy Hyltonafde7e22000-09-15 20:06:57 +0000218 Returns a list, as G-d intended.
Guido van Rossum1946f0d1999-06-04 17:54:39 +0000219 """
Jeremy Hyltonafde7e22000-09-15 20:06:57 +0000220 pairs = [s2 for s1 in qs.split('&') for s2 in s1.split(';')]
221 r = []
222 for name_value in pairs:
Neil Schemenauer66edb622004-07-19 15:38:11 +0000223 if not name_value and not strict_parsing:
224 continue
Jeremy Hyltonafde7e22000-09-15 20:06:57 +0000225 nv = name_value.split('=', 1)
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000226 if len(nv) != 2:
227 if strict_parsing:
Walter Dörwald70a6b492004-02-12 17:35:32 +0000228 raise ValueError, "bad query field: %r" % (name_value,)
Brett Cannon8d9b60f2004-03-21 22:16:15 +0000229 # Handle case of a control-name with no equal sign
230 if keep_blank_values:
231 nv.append('')
232 else:
233 continue
Moshe Zadkaa1a4b592000-08-25 21:47:56 +0000234 if len(nv[1]) or keep_blank_values:
Eric S. Raymond7e9b4f52001-02-09 09:59:10 +0000235 name = urllib.unquote(nv[0].replace('+', ' '))
236 value = urllib.unquote(nv[1].replace('+', ' '))
Moshe Zadkaa1a4b592000-08-25 21:47:56 +0000237 r.append((name, value))
Guido van Rossum1946f0d1999-06-04 17:54:39 +0000238
239 return r
Guido van Rossum9a22de11995-01-12 12:29:47 +0000240
241
Guido van Rossum0147db01996-03-09 03:16:04 +0000242def parse_multipart(fp, pdict):
Guido van Rossum7aee3841996-03-07 18:00:44 +0000243 """Parse multipart input.
Guido van Rossum9a22de11995-01-12 12:29:47 +0000244
Guido van Rossum7aee3841996-03-07 18:00:44 +0000245 Arguments:
246 fp : input file
Johannes Gijsbersc7fc10a2005-01-08 13:56:36 +0000247 pdict: dictionary containing other parameters of content-type header
Guido van Rossum72755611996-03-06 07:20:06 +0000248
Tim Peters88869f92001-01-14 23:36:06 +0000249 Returns a dictionary just like parse_qs(): keys are the field names, each
250 value is a list of values for that field. This is easy to use but not
251 much good if you are expecting megabytes to be uploaded -- in that case,
252 use the FieldStorage class instead which is much more flexible. Note
253 that content-type is the raw, unparsed contents of the content-type
Guido van Rossum0147db01996-03-09 03:16:04 +0000254 header.
Tim Peters88869f92001-01-14 23:36:06 +0000255
256 XXX This does not parse nested multipart parts -- use FieldStorage for
Guido van Rossum0147db01996-03-09 03:16:04 +0000257 that.
Tim Peters88869f92001-01-14 23:36:06 +0000258
259 XXX This should really be subsumed by FieldStorage altogether -- no
Guido van Rossum0147db01996-03-09 03:16:04 +0000260 point in having two implementations of the same parsing algorithm.
Guido van Rossum9568b732006-08-10 17:41:07 +0000261 Also, FieldStorage protects itself better against certain DoS attacks
262 by limiting the size of the data read in one chunk. The API here
263 does not support that kind of protection. This also affects parse()
264 since it can call parse_multipart().
Guido van Rossum72755611996-03-06 07:20:06 +0000265
Guido van Rossum7aee3841996-03-07 18:00:44 +0000266 """
Guido van Rossum2e441f72001-07-25 21:00:19 +0000267 boundary = ""
Raymond Hettinger54f02222002-06-01 14:18:47 +0000268 if 'boundary' in pdict:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000269 boundary = pdict['boundary']
Guido van Rossum2e441f72001-07-25 21:00:19 +0000270 if not valid_boundary(boundary):
Walter Dörwald70a6b492004-02-12 17:35:32 +0000271 raise ValueError, ('Invalid boundary in multipart form: %r'
272 % (boundary,))
Tim Petersab9ba272001-08-09 21:40:30 +0000273
Guido van Rossum7aee3841996-03-07 18:00:44 +0000274 nextpart = "--" + boundary
275 lastpart = "--" + boundary + "--"
276 partdict = {}
277 terminator = ""
278
279 while terminator != lastpart:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000280 bytes = -1
281 data = None
282 if terminator:
283 # At start of next part. Read headers first.
Armin Rigo3a703b62005-09-19 09:11:04 +0000284 headers = mimetools.Message(fp)
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000285 clength = headers.getheader('content-length')
286 if clength:
287 try:
Eric S. Raymond7e9b4f52001-02-09 09:59:10 +0000288 bytes = int(clength)
289 except ValueError:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000290 pass
291 if bytes > 0:
292 if maxlen and bytes > maxlen:
293 raise ValueError, 'Maximum content length exceeded'
294 data = fp.read(bytes)
295 else:
296 data = ""
297 # Read lines until end of part.
298 lines = []
299 while 1:
300 line = fp.readline()
301 if not line:
302 terminator = lastpart # End outer loop
303 break
304 if line[:2] == "--":
Eric S. Raymond7e9b4f52001-02-09 09:59:10 +0000305 terminator = line.strip()
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000306 if terminator in (nextpart, lastpart):
307 break
308 lines.append(line)
309 # Done with part.
310 if data is None:
311 continue
312 if bytes < 0:
313 if lines:
314 # Strip final line terminator
315 line = lines[-1]
316 if line[-2:] == "\r\n":
317 line = line[:-2]
318 elif line[-1:] == "\n":
319 line = line[:-1]
320 lines[-1] = line
Eric S. Raymond7e9b4f52001-02-09 09:59:10 +0000321 data = "".join(lines)
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000322 line = headers['content-disposition']
323 if not line:
324 continue
325 key, params = parse_header(line)
326 if key != 'form-data':
327 continue
Raymond Hettinger54f02222002-06-01 14:18:47 +0000328 if 'name' in params:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000329 name = params['name']
330 else:
331 continue
Raymond Hettinger54f02222002-06-01 14:18:47 +0000332 if name in partdict:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000333 partdict[name].append(data)
334 else:
335 partdict[name] = [data]
Guido van Rossum72755611996-03-06 07:20:06 +0000336
Guido van Rossum7aee3841996-03-07 18:00:44 +0000337 return partdict
Guido van Rossum9a22de11995-01-12 12:29:47 +0000338
339
Guido van Rossum72755611996-03-06 07:20:06 +0000340def parse_header(line):
Guido van Rossum7aee3841996-03-07 18:00:44 +0000341 """Parse a Content-type like header.
342
343 Return the main content-type and a dictionary of options.
344
345 """
Raymond Hettingerf871d832004-12-31 21:59:02 +0000346 plist = [x.strip() for x in line.split(';')]
Raymond Hettinger46ac8eb2002-06-30 03:39:14 +0000347 key = plist.pop(0).lower()
Guido van Rossum7aee3841996-03-07 18:00:44 +0000348 pdict = {}
349 for p in plist:
Eric S. Raymond7e9b4f52001-02-09 09:59:10 +0000350 i = p.find('=')
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000351 if i >= 0:
Eric S. Raymond7e9b4f52001-02-09 09:59:10 +0000352 name = p[:i].strip().lower()
353 value = p[i+1:].strip()
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000354 if len(value) >= 2 and value[0] == value[-1] == '"':
355 value = value[1:-1]
Johannes Gijsbers9e15dd62004-08-14 15:39:34 +0000356 value = value.replace('\\\\', '\\').replace('\\"', '"')
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000357 pdict[name] = value
Guido van Rossum7aee3841996-03-07 18:00:44 +0000358 return key, pdict
Guido van Rossum72755611996-03-06 07:20:06 +0000359
360
Guido van Rossum243ddcd1996-03-07 06:33:07 +0000361# Classes for field storage
362# =========================
363
364class MiniFieldStorage:
365
Guido van Rossum0147db01996-03-09 03:16:04 +0000366 """Like FieldStorage, for use when no file uploads are possible."""
Guido van Rossum243ddcd1996-03-07 06:33:07 +0000367
Guido van Rossum7aee3841996-03-07 18:00:44 +0000368 # Dummy attributes
369 filename = None
370 list = None
371 type = None
Guido van Rossum773ab271996-07-23 03:46:24 +0000372 file = None
Guido van Rossum4032c2c1996-03-09 04:04:35 +0000373 type_options = {}
Guido van Rossum7aee3841996-03-07 18:00:44 +0000374 disposition = None
375 disposition_options = {}
376 headers = {}
Guido van Rossum243ddcd1996-03-07 06:33:07 +0000377
Guido van Rossum7aee3841996-03-07 18:00:44 +0000378 def __init__(self, name, value):
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000379 """Constructor from field name and value."""
380 self.name = name
381 self.value = value
Guido van Rossum773ab271996-07-23 03:46:24 +0000382 # self.file = StringIO(value)
Guido van Rossum7aee3841996-03-07 18:00:44 +0000383
384 def __repr__(self):
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000385 """Return printable representation."""
Walter Dörwald70a6b492004-02-12 17:35:32 +0000386 return "MiniFieldStorage(%r, %r)" % (self.name, self.value)
Guido van Rossum243ddcd1996-03-07 06:33:07 +0000387
388
389class FieldStorage:
390
Guido van Rossum7aee3841996-03-07 18:00:44 +0000391 """Store a sequence of fields, reading multipart/form-data.
Guido van Rossum243ddcd1996-03-07 06:33:07 +0000392
Guido van Rossum7aee3841996-03-07 18:00:44 +0000393 This class provides naming, typing, files stored on disk, and
394 more. At the top level, it is accessible like a dictionary, whose
395 keys are the field names. (Note: None can occur as a field name.)
396 The items are either a Python list (if there's multiple values) or
397 another FieldStorage or MiniFieldStorage object. If it's a single
398 object, it has the following attributes:
Guido van Rossum243ddcd1996-03-07 06:33:07 +0000399
Guido van Rossum7aee3841996-03-07 18:00:44 +0000400 name: the field name, if specified; otherwise None
Guido van Rossum243ddcd1996-03-07 06:33:07 +0000401
Guido van Rossum7aee3841996-03-07 18:00:44 +0000402 filename: the filename, if specified; otherwise None; this is the
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000403 client side filename, *not* the file name on which it is
404 stored (that's a temporary file you don't deal with)
Guido van Rossum243ddcd1996-03-07 06:33:07 +0000405
Guido van Rossum7aee3841996-03-07 18:00:44 +0000406 value: the value as a *string*; for file uploads, this
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000407 transparently reads the file every time you request the value
Guido van Rossum7aee3841996-03-07 18:00:44 +0000408
409 file: the file(-like) object from which you can read the data;
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000410 None if the data is stored a simple string
Guido van Rossum7aee3841996-03-07 18:00:44 +0000411
412 type: the content-type, or None if not specified
413
414 type_options: dictionary of options specified on the content-type
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000415 line
Guido van Rossum7aee3841996-03-07 18:00:44 +0000416
417 disposition: content-disposition, or None if not specified
418
419 disposition_options: dictionary of corresponding options
420
Armin Rigo3a703b62005-09-19 09:11:04 +0000421 headers: a dictionary(-like) object (sometimes rfc822.Message or a
422 subclass thereof) containing *all* headers
Guido van Rossum7aee3841996-03-07 18:00:44 +0000423
424 The class is subclassable, mostly for the purpose of overriding
425 the make_file() method, which is called internally to come up with
426 a file open for reading and writing. This makes it possible to
427 override the default choice of storing all files in a temporary
428 directory and unlinking them as soon as they have been opened.
429
430 """
431
Guido van Rossum773ab271996-07-23 03:46:24 +0000432 def __init__(self, fp=None, headers=None, outerboundary="",
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000433 environ=os.environ, keep_blank_values=0, strict_parsing=0):
434 """Constructor. Read multipart/* until last part.
Guido van Rossum7aee3841996-03-07 18:00:44 +0000435
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000436 Arguments, all optional:
Guido van Rossum7aee3841996-03-07 18:00:44 +0000437
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000438 fp : file pointer; default: sys.stdin
Guido van Rossumb1b4f941998-05-08 19:55:51 +0000439 (not used when the request method is GET)
Guido van Rossum7aee3841996-03-07 18:00:44 +0000440
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000441 headers : header dictionary-like object; default:
442 taken from environ as per CGI spec
Guido van Rossum7aee3841996-03-07 18:00:44 +0000443
Guido van Rossum773ab271996-07-23 03:46:24 +0000444 outerboundary : terminating multipart boundary
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000445 (for internal use only)
Guido van Rossum7aee3841996-03-07 18:00:44 +0000446
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000447 environ : environment dictionary; default: os.environ
Guido van Rossum773ab271996-07-23 03:46:24 +0000448
449 keep_blank_values: flag indicating whether blank values in
Tim Peters88869f92001-01-14 23:36:06 +0000450 URL encoded forms should be treated as blank strings.
451 A true value indicates that blanks should be retained as
Guido van Rossum773ab271996-07-23 03:46:24 +0000452 blank strings. The default false value indicates that
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000453 blank values are to be ignored and treated as if they were
454 not included.
Guido van Rossum773ab271996-07-23 03:46:24 +0000455
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000456 strict_parsing: flag indicating what to do with parsing errors.
457 If false (the default), errors are silently ignored.
458 If true, errors raise a ValueError exception.
Guido van Rossume08c04c1996-11-11 19:29:11 +0000459
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000460 """
461 method = 'GET'
462 self.keep_blank_values = keep_blank_values
463 self.strict_parsing = strict_parsing
Raymond Hettinger54f02222002-06-01 14:18:47 +0000464 if 'REQUEST_METHOD' in environ:
Eric S. Raymond7e9b4f52001-02-09 09:59:10 +0000465 method = environ['REQUEST_METHOD'].upper()
Facundo Batistaa6a4d502008-06-21 18:58:04 +0000466 self.qs_on_post = None
Guido van Rossum01852831998-06-25 02:40:17 +0000467 if method == 'GET' or method == 'HEAD':
Raymond Hettinger54f02222002-06-01 14:18:47 +0000468 if 'QUERY_STRING' in environ:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000469 qs = environ['QUERY_STRING']
470 elif sys.argv[1:]:
471 qs = sys.argv[1]
472 else:
473 qs = ""
474 fp = StringIO(qs)
475 if headers is None:
476 headers = {'content-type':
477 "application/x-www-form-urlencoded"}
478 if headers is None:
Guido van Rossumcff311a1998-06-11 14:06:59 +0000479 headers = {}
480 if method == 'POST':
481 # Set default content-type for POST to what's traditional
482 headers['content-type'] = "application/x-www-form-urlencoded"
Raymond Hettinger54f02222002-06-01 14:18:47 +0000483 if 'CONTENT_TYPE' in environ:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000484 headers['content-type'] = environ['CONTENT_TYPE']
Facundo Batistaa6a4d502008-06-21 18:58:04 +0000485 if 'QUERY_STRING' in environ:
486 self.qs_on_post = environ['QUERY_STRING']
Raymond Hettinger54f02222002-06-01 14:18:47 +0000487 if 'CONTENT_LENGTH' in environ:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000488 headers['content-length'] = environ['CONTENT_LENGTH']
489 self.fp = fp or sys.stdin
490 self.headers = headers
491 self.outerboundary = outerboundary
Guido van Rossum7aee3841996-03-07 18:00:44 +0000492
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000493 # Process content-disposition header
494 cdisp, pdict = "", {}
Raymond Hettinger54f02222002-06-01 14:18:47 +0000495 if 'content-disposition' in self.headers:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000496 cdisp, pdict = parse_header(self.headers['content-disposition'])
497 self.disposition = cdisp
498 self.disposition_options = pdict
499 self.name = None
Raymond Hettinger54f02222002-06-01 14:18:47 +0000500 if 'name' in pdict:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000501 self.name = pdict['name']
502 self.filename = None
Raymond Hettinger54f02222002-06-01 14:18:47 +0000503 if 'filename' in pdict:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000504 self.filename = pdict['filename']
Guido van Rossum7aee3841996-03-07 18:00:44 +0000505
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000506 # Process content-type header
Barry Warsaw302331a1999-01-08 17:42:03 +0000507 #
508 # Honor any existing content-type header. But if there is no
509 # content-type header, use some sensible defaults. Assume
510 # outerboundary is "" at the outer level, but something non-false
511 # inside a multi-part. The default for an inner part is text/plain,
512 # but for an outer part it should be urlencoded. This should catch
513 # bogus clients which erroneously forget to include a content-type
514 # header.
515 #
516 # See below for what we do if there does exist a content-type header,
517 # but it happens to be something we don't understand.
Raymond Hettinger54f02222002-06-01 14:18:47 +0000518 if 'content-type' in self.headers:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000519 ctype, pdict = parse_header(self.headers['content-type'])
Guido van Rossumce900de1999-06-02 18:44:22 +0000520 elif self.outerboundary or method != 'POST':
Barry Warsaw302331a1999-01-08 17:42:03 +0000521 ctype, pdict = "text/plain", {}
522 else:
523 ctype, pdict = 'application/x-www-form-urlencoded', {}
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000524 self.type = ctype
525 self.type_options = pdict
526 self.innerboundary = ""
Raymond Hettinger54f02222002-06-01 14:18:47 +0000527 if 'boundary' in pdict:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000528 self.innerboundary = pdict['boundary']
529 clen = -1
Raymond Hettinger54f02222002-06-01 14:18:47 +0000530 if 'content-length' in self.headers:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000531 try:
Eric S. Raymond7e9b4f52001-02-09 09:59:10 +0000532 clen = int(self.headers['content-length'])
Skip Montanarodb5d1442002-03-23 05:50:17 +0000533 except ValueError:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000534 pass
535 if maxlen and clen > maxlen:
536 raise ValueError, 'Maximum content length exceeded'
537 self.length = clen
Guido van Rossum7aee3841996-03-07 18:00:44 +0000538
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000539 self.list = self.file = None
540 self.done = 0
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000541 if ctype == 'application/x-www-form-urlencoded':
542 self.read_urlencoded()
543 elif ctype[:10] == 'multipart/':
Guido van Rossumf5745001998-10-20 14:43:02 +0000544 self.read_multi(environ, keep_blank_values, strict_parsing)
Barry Warsaw302331a1999-01-08 17:42:03 +0000545 else:
Guido van Rossum60a3bd81999-06-11 18:26:09 +0000546 self.read_single()
Guido van Rossum7aee3841996-03-07 18:00:44 +0000547
548 def __repr__(self):
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000549 """Return a printable representation."""
Walter Dörwald70a6b492004-02-12 17:35:32 +0000550 return "FieldStorage(%r, %r, %r)" % (
551 self.name, self.filename, self.value)
Guido van Rossum7aee3841996-03-07 18:00:44 +0000552
Guido van Rossum4061cbe2002-09-11 18:20:34 +0000553 def __iter__(self):
554 return iter(self.keys())
555
Guido van Rossum7aee3841996-03-07 18:00:44 +0000556 def __getattr__(self, name):
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000557 if name != 'value':
558 raise AttributeError, name
559 if self.file:
560 self.file.seek(0)
561 value = self.file.read()
562 self.file.seek(0)
563 elif self.list is not None:
564 value = self.list
565 else:
566 value = None
567 return value
Guido van Rossum7aee3841996-03-07 18:00:44 +0000568
569 def __getitem__(self, key):
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000570 """Dictionary style indexing."""
571 if self.list is None:
572 raise TypeError, "not indexable"
573 found = []
574 for item in self.list:
575 if item.name == key: found.append(item)
576 if not found:
577 raise KeyError, key
578 if len(found) == 1:
579 return found[0]
580 else:
581 return found
Guido van Rossum7aee3841996-03-07 18:00:44 +0000582
Moshe Zadkaa1a4b592000-08-25 21:47:56 +0000583 def getvalue(self, key, default=None):
584 """Dictionary style get() method, including 'value' lookup."""
Raymond Hettinger54f02222002-06-01 14:18:47 +0000585 if key in self:
Moshe Zadkaa1a4b592000-08-25 21:47:56 +0000586 value = self[key]
587 if type(value) is type([]):
Raymond Hettingerf871d832004-12-31 21:59:02 +0000588 return map(attrgetter('value'), value)
Moshe Zadkaa1a4b592000-08-25 21:47:56 +0000589 else:
590 return value.value
591 else:
592 return default
593
Guido van Rossum1bfb3882001-09-05 19:45:34 +0000594 def getfirst(self, key, default=None):
595 """ Return the first value received."""
Raymond Hettinger54f02222002-06-01 14:18:47 +0000596 if key in self:
Guido van Rossum1bfb3882001-09-05 19:45:34 +0000597 value = self[key]
598 if type(value) is type([]):
599 return value[0].value
600 else:
601 return value.value
602 else:
603 return default
604
605 def getlist(self, key):
606 """ Return list of received values."""
Raymond Hettinger54f02222002-06-01 14:18:47 +0000607 if key in self:
Guido van Rossum1bfb3882001-09-05 19:45:34 +0000608 value = self[key]
609 if type(value) is type([]):
Raymond Hettingerf871d832004-12-31 21:59:02 +0000610 return map(attrgetter('value'), value)
Guido van Rossum1bfb3882001-09-05 19:45:34 +0000611 else:
612 return [value.value]
613 else:
614 return []
615
Guido van Rossum7aee3841996-03-07 18:00:44 +0000616 def keys(self):
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000617 """Dictionary style keys() method."""
618 if self.list is None:
619 raise TypeError, "not indexable"
Georg Brandlaff85e22007-09-20 16:06:07 +0000620 return list(set(item.name for item in self.list))
Guido van Rossum7aee3841996-03-07 18:00:44 +0000621
Guido van Rossum0147db01996-03-09 03:16:04 +0000622 def has_key(self, key):
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000623 """Dictionary style has_key() method."""
624 if self.list is None:
625 raise TypeError, "not indexable"
Georg Brandlaff85e22007-09-20 16:06:07 +0000626 return any(item.name == key for item in self.list)
Guido van Rossum0147db01996-03-09 03:16:04 +0000627
Raymond Hettinger54f02222002-06-01 14:18:47 +0000628 def __contains__(self, key):
629 """Dictionary style __contains__ method."""
630 if self.list is None:
631 raise TypeError, "not indexable"
Georg Brandlaff85e22007-09-20 16:06:07 +0000632 return any(item.name == key for item in self.list)
Raymond Hettinger54f02222002-06-01 14:18:47 +0000633
Guido van Rossum88b85d41997-01-11 19:21:33 +0000634 def __len__(self):
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000635 """Dictionary style len(x) support."""
636 return len(self.keys())
Guido van Rossum88b85d41997-01-11 19:21:33 +0000637
Georg Brandlaff85e22007-09-20 16:06:07 +0000638 def __nonzero__(self):
639 return bool(self.list)
640
Guido van Rossum7aee3841996-03-07 18:00:44 +0000641 def read_urlencoded(self):
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000642 """Internal: read data in query string format."""
643 qs = self.fp.read(self.length)
Facundo Batistaa6a4d502008-06-21 18:58:04 +0000644 if self.qs_on_post:
645 qs += '&' + self.qs_on_post
Guido van Rossum1946f0d1999-06-04 17:54:39 +0000646 self.list = list = []
647 for key, value in parse_qsl(qs, self.keep_blank_values,
648 self.strict_parsing):
649 list.append(MiniFieldStorage(key, value))
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000650 self.skip_lines()
Guido van Rossum7aee3841996-03-07 18:00:44 +0000651
Guido van Rossum030d2ec1998-12-09 22:16:46 +0000652 FieldStorageClass = None
653
Guido van Rossumf5745001998-10-20 14:43:02 +0000654 def read_multi(self, environ, keep_blank_values, strict_parsing):
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000655 """Internal: read a part that is itself multipart."""
Guido van Rossum2e441f72001-07-25 21:00:19 +0000656 ib = self.innerboundary
657 if not valid_boundary(ib):
Walter Dörwald70a6b492004-02-12 17:35:32 +0000658 raise ValueError, 'Invalid boundary in multipart form: %r' % (ib,)
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000659 self.list = []
Facundo Batistaa6a4d502008-06-21 18:58:04 +0000660 if self.qs_on_post:
661 for key, value in parse_qsl(self.qs_on_post, self.keep_blank_values,
662 self.strict_parsing):
663 self.list.append(MiniFieldStorage(key, value))
664 FieldStorageClass = None
665
Guido van Rossum030d2ec1998-12-09 22:16:46 +0000666 klass = self.FieldStorageClass or self.__class__
Guido van Rossum2e441f72001-07-25 21:00:19 +0000667 part = klass(self.fp, {}, ib,
Guido van Rossum030d2ec1998-12-09 22:16:46 +0000668 environ, keep_blank_values, strict_parsing)
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000669 # Throw first part away
670 while not part.done:
Armin Rigo3a703b62005-09-19 09:11:04 +0000671 headers = rfc822.Message(self.fp)
Guido van Rossum2e441f72001-07-25 21:00:19 +0000672 part = klass(self.fp, headers, ib,
Guido van Rossum030d2ec1998-12-09 22:16:46 +0000673 environ, keep_blank_values, strict_parsing)
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000674 self.list.append(part)
675 self.skip_lines()
Guido van Rossum7aee3841996-03-07 18:00:44 +0000676
677 def read_single(self):
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000678 """Internal: read an atomic part."""
679 if self.length >= 0:
680 self.read_binary()
681 self.skip_lines()
682 else:
683 self.read_lines()
684 self.file.seek(0)
Guido van Rossum7aee3841996-03-07 18:00:44 +0000685
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000686 bufsize = 8*1024 # I/O buffering size for copy to file
Guido van Rossum7aee3841996-03-07 18:00:44 +0000687
688 def read_binary(self):
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000689 """Internal: read binary data."""
690 self.file = self.make_file('b')
691 todo = self.length
692 if todo >= 0:
693 while todo > 0:
694 data = self.fp.read(min(todo, self.bufsize))
695 if not data:
696 self.done = -1
697 break
698 self.file.write(data)
699 todo = todo - len(data)
Guido van Rossum7aee3841996-03-07 18:00:44 +0000700
701 def read_lines(self):
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000702 """Internal: read lines until EOF or outerboundary."""
Guido van Rossum52b8c292001-06-29 13:06:06 +0000703 self.file = self.__file = StringIO()
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000704 if self.outerboundary:
705 self.read_lines_to_outerboundary()
706 else:
707 self.read_lines_to_eof()
Guido van Rossum7aee3841996-03-07 18:00:44 +0000708
Guido van Rossum52b8c292001-06-29 13:06:06 +0000709 def __write(self, line):
710 if self.__file is not None:
711 if self.__file.tell() + len(line) > 1000:
712 self.file = self.make_file('')
713 self.file.write(self.__file.getvalue())
714 self.__file = None
715 self.file.write(line)
716
Guido van Rossum7aee3841996-03-07 18:00:44 +0000717 def read_lines_to_eof(self):
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000718 """Internal: read lines until EOF."""
719 while 1:
Guido van Rossum9568b732006-08-10 17:41:07 +0000720 line = self.fp.readline(1<<16)
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000721 if not line:
722 self.done = -1
723 break
Guido van Rossum52b8c292001-06-29 13:06:06 +0000724 self.__write(line)
Guido van Rossum7aee3841996-03-07 18:00:44 +0000725
726 def read_lines_to_outerboundary(self):
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000727 """Internal: read lines until outerboundary."""
728 next = "--" + self.outerboundary
729 last = next + "--"
730 delim = ""
Guido van Rossum9568b732006-08-10 17:41:07 +0000731 last_line_lfend = True
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000732 while 1:
Guido van Rossum9568b732006-08-10 17:41:07 +0000733 line = self.fp.readline(1<<16)
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000734 if not line:
735 self.done = -1
736 break
Guido van Rossum9568b732006-08-10 17:41:07 +0000737 if line[:2] == "--" and last_line_lfend:
Eric S. Raymond7e9b4f52001-02-09 09:59:10 +0000738 strippedline = line.strip()
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000739 if strippedline == next:
740 break
741 if strippedline == last:
742 self.done = 1
743 break
744 odelim = delim
745 if line[-2:] == "\r\n":
746 delim = "\r\n"
747 line = line[:-2]
Guido van Rossum9568b732006-08-10 17:41:07 +0000748 last_line_lfend = True
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000749 elif line[-1] == "\n":
750 delim = "\n"
751 line = line[:-1]
Guido van Rossum9568b732006-08-10 17:41:07 +0000752 last_line_lfend = True
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000753 else:
754 delim = ""
Guido van Rossum9568b732006-08-10 17:41:07 +0000755 last_line_lfend = False
Guido van Rossum52b8c292001-06-29 13:06:06 +0000756 self.__write(odelim + line)
Guido van Rossum7aee3841996-03-07 18:00:44 +0000757
758 def skip_lines(self):
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000759 """Internal: skip lines until outer boundary if defined."""
760 if not self.outerboundary or self.done:
761 return
762 next = "--" + self.outerboundary
763 last = next + "--"
Guido van Rossum9568b732006-08-10 17:41:07 +0000764 last_line_lfend = True
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000765 while 1:
Guido van Rossum9568b732006-08-10 17:41:07 +0000766 line = self.fp.readline(1<<16)
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000767 if not line:
768 self.done = -1
769 break
Guido van Rossum9568b732006-08-10 17:41:07 +0000770 if line[:2] == "--" and last_line_lfend:
Eric S. Raymond7e9b4f52001-02-09 09:59:10 +0000771 strippedline = line.strip()
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000772 if strippedline == next:
773 break
774 if strippedline == last:
775 self.done = 1
776 break
Guido van Rossum9568b732006-08-10 17:41:07 +0000777 last_line_lfend = line.endswith('\n')
Guido van Rossum7aee3841996-03-07 18:00:44 +0000778
Guido van Rossuma5e9fb61997-08-12 18:18:13 +0000779 def make_file(self, binary=None):
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000780 """Overridable: return a readable & writable file.
Guido van Rossum7aee3841996-03-07 18:00:44 +0000781
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000782 The file will be used as follows:
783 - data is written to it
784 - seek(0)
785 - data is read from it
Guido van Rossum7aee3841996-03-07 18:00:44 +0000786
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000787 The 'binary' argument is unused -- the file is always opened
788 in binary mode.
Guido van Rossum7aee3841996-03-07 18:00:44 +0000789
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000790 This version opens a temporary file for reading and writing,
791 and immediately deletes (unlinks) it. The trick (on Unix!) is
792 that the file can still be used, but it can't be opened by
793 another process, and it will automatically be deleted when it
794 is closed or when the current process terminates.
Guido van Rossum4032c2c1996-03-09 04:04:35 +0000795
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000796 If you want a more permanent file, you derive a class which
797 overrides this method. If you want a visible temporary file
798 that is nevertheless automatically deleted when the script
799 terminates, try defining a __del__ method in a derived class
800 which unlinks the temporary files you have created.
Guido van Rossum7aee3841996-03-07 18:00:44 +0000801
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000802 """
803 import tempfile
804 return tempfile.TemporaryFile("w+b")
Tim Peters88869f92001-01-14 23:36:06 +0000805
Guido van Rossum243ddcd1996-03-07 06:33:07 +0000806
807
Guido van Rossum4032c2c1996-03-09 04:04:35 +0000808# Backwards Compatibility Classes
809# ===============================
Guido van Rossum9a22de11995-01-12 12:29:47 +0000810
Moshe Zadkaa1a4b592000-08-25 21:47:56 +0000811class FormContentDict(UserDict.UserDict):
Guido van Rossuma3c6a8a2000-09-19 04:11:46 +0000812 """Form content as dictionary with a list of values per field.
Guido van Rossum72755611996-03-06 07:20:06 +0000813
Guido van Rossum7aee3841996-03-07 18:00:44 +0000814 form = FormContentDict()
815
816 form[key] -> [value, value, ...]
Raymond Hettinger54f02222002-06-01 14:18:47 +0000817 key in form -> Boolean
Guido van Rossum7aee3841996-03-07 18:00:44 +0000818 form.keys() -> [key, key, ...]
819 form.values() -> [[val, val, ...], [val, val, ...], ...]
820 form.items() -> [(key, [val, val, ...]), (key, [val, val, ...]), ...]
821 form.dict == {key: [val, val, ...], ...}
822
823 """
Georg Brandl05b3c452006-09-30 10:58:01 +0000824 def __init__(self, environ=os.environ, keep_blank_values=0, strict_parsing=0):
825 self.dict = self.data = parse(environ=environ,
826 keep_blank_values=keep_blank_values,
827 strict_parsing=strict_parsing)
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000828 self.query_string = environ['QUERY_STRING']
Guido van Rossum9a22de11995-01-12 12:29:47 +0000829
830
Guido van Rossum9a22de11995-01-12 12:29:47 +0000831class SvFormContentDict(FormContentDict):
Guido van Rossuma3c6a8a2000-09-19 04:11:46 +0000832 """Form content as dictionary expecting a single value per field.
Guido van Rossum7aee3841996-03-07 18:00:44 +0000833
Guido van Rossuma3c6a8a2000-09-19 04:11:46 +0000834 If you only expect a single value for each field, then form[key]
Guido van Rossum7aee3841996-03-07 18:00:44 +0000835 will return that single value. It will raise an IndexError if
Guido van Rossuma3c6a8a2000-09-19 04:11:46 +0000836 that expectation is not true. If you expect a field to have
Guido van Rossum7aee3841996-03-07 18:00:44 +0000837 possible multiple values, than you can use form.getlist(key) to
838 get all of the values. values() and items() are a compromise:
839 they return single strings where there is a single value, and
840 lists of strings otherwise.
841
842 """
843 def __getitem__(self, key):
Tim Peters88869f92001-01-14 23:36:06 +0000844 if len(self.dict[key]) > 1:
845 raise IndexError, 'expecting a single value'
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000846 return self.dict[key][0]
Guido van Rossum7aee3841996-03-07 18:00:44 +0000847 def getlist(self, key):
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000848 return self.dict[key]
Guido van Rossum7aee3841996-03-07 18:00:44 +0000849 def values(self):
Guido van Rossuma3c6a8a2000-09-19 04:11:46 +0000850 result = []
851 for value in self.dict.values():
852 if len(value) == 1:
853 result.append(value[0])
854 else: result.append(value)
855 return result
Guido van Rossum7aee3841996-03-07 18:00:44 +0000856 def items(self):
Guido van Rossuma3c6a8a2000-09-19 04:11:46 +0000857 result = []
858 for key, value in self.dict.items():
859 if len(value) == 1:
860 result.append((key, value[0]))
861 else: result.append((key, value))
862 return result
Guido van Rossum9a22de11995-01-12 12:29:47 +0000863
864
Guido van Rossum9a22de11995-01-12 12:29:47 +0000865class InterpFormContentDict(SvFormContentDict):
Tim Peters88869f92001-01-14 23:36:06 +0000866 """This class is present for backwards compatibility only."""
Guido van Rossuma3c6a8a2000-09-19 04:11:46 +0000867 def __getitem__(self, key):
868 v = SvFormContentDict.__getitem__(self, key)
Eric S. Raymond7e9b4f52001-02-09 09:59:10 +0000869 if v[0] in '0123456789+-.':
870 try: return int(v)
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000871 except ValueError:
Eric S. Raymond7e9b4f52001-02-09 09:59:10 +0000872 try: return float(v)
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000873 except ValueError: pass
Eric S. Raymond7e9b4f52001-02-09 09:59:10 +0000874 return v.strip()
Guido van Rossuma3c6a8a2000-09-19 04:11:46 +0000875 def values(self):
876 result = []
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000877 for key in self.keys():
878 try:
Guido van Rossuma3c6a8a2000-09-19 04:11:46 +0000879 result.append(self[key])
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000880 except IndexError:
Guido van Rossuma3c6a8a2000-09-19 04:11:46 +0000881 result.append(self.dict[key])
882 return result
883 def items(self):
884 result = []
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000885 for key in self.keys():
886 try:
Guido van Rossuma3c6a8a2000-09-19 04:11:46 +0000887 result.append((key, self[key]))
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000888 except IndexError:
Guido van Rossuma3c6a8a2000-09-19 04:11:46 +0000889 result.append((key, self.dict[key]))
890 return result
Guido van Rossum9a22de11995-01-12 12:29:47 +0000891
892
Guido van Rossum9a22de11995-01-12 12:29:47 +0000893class FormContent(FormContentDict):
Tim Peters88869f92001-01-14 23:36:06 +0000894 """This class is present for backwards compatibility only."""
Guido van Rossum0147db01996-03-09 03:16:04 +0000895 def values(self, key):
Raymond Hettinger54f02222002-06-01 14:18:47 +0000896 if key in self.dict :return self.dict[key]
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000897 else: return None
Guido van Rossum0147db01996-03-09 03:16:04 +0000898 def indexed_value(self, key, location):
Raymond Hettinger54f02222002-06-01 14:18:47 +0000899 if key in self.dict:
Guido van Rossuma3c6a8a2000-09-19 04:11:46 +0000900 if len(self.dict[key]) > location:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000901 return self.dict[key][location]
902 else: return None
903 else: return None
Guido van Rossum0147db01996-03-09 03:16:04 +0000904 def value(self, key):
Raymond Hettinger54f02222002-06-01 14:18:47 +0000905 if key in self.dict: return self.dict[key][0]
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000906 else: return None
Guido van Rossum0147db01996-03-09 03:16:04 +0000907 def length(self, key):
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000908 return len(self.dict[key])
Guido van Rossum0147db01996-03-09 03:16:04 +0000909 def stripped(self, key):
Raymond Hettinger54f02222002-06-01 14:18:47 +0000910 if key in self.dict: return self.dict[key][0].strip()
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000911 else: return None
Guido van Rossum7aee3841996-03-07 18:00:44 +0000912 def pars(self):
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000913 return self.dict
Guido van Rossum9a22de11995-01-12 12:29:47 +0000914
915
Guido van Rossum72755611996-03-06 07:20:06 +0000916# Test/debug code
917# ===============
Guido van Rossum9a22de11995-01-12 12:29:47 +0000918
Guido van Rossum773ab271996-07-23 03:46:24 +0000919def test(environ=os.environ):
Guido van Rossum7aee3841996-03-07 18:00:44 +0000920 """Robust test CGI script, usable as main program.
Guido van Rossum9a22de11995-01-12 12:29:47 +0000921
Guido van Rossum7aee3841996-03-07 18:00:44 +0000922 Write minimal HTTP headers and dump all information provided to
923 the script in HTML form.
924
925 """
Guido van Rossum7aee3841996-03-07 18:00:44 +0000926 print "Content-type: text/html"
927 print
928 sys.stderr = sys.stdout
929 try:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000930 form = FieldStorage() # Replace with other classes to test those
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000931 print_directory()
932 print_arguments()
Guido van Rossuma3c6a8a2000-09-19 04:11:46 +0000933 print_form(form)
934 print_environ(environ)
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000935 print_environ_usage()
936 def f():
937 exec "testing print_exception() -- <I>italics?</I>"
938 def g(f=f):
939 f()
940 print "<H3>What follows is a test, not an actual exception:</H3>"
941 g()
Guido van Rossum7aee3841996-03-07 18:00:44 +0000942 except:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000943 print_exception()
Guido van Rossumf85de8a1996-08-20 20:22:39 +0000944
Guido van Rossum57d51f22000-09-16 21:16:01 +0000945 print "<H1>Second try with a small maxlen...</H1>"
946
Guido van Rossumad164711997-05-13 19:03:23 +0000947 global maxlen
948 maxlen = 50
949 try:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000950 form = FieldStorage() # Replace with other classes to test those
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000951 print_directory()
952 print_arguments()
Guido van Rossuma3c6a8a2000-09-19 04:11:46 +0000953 print_form(form)
954 print_environ(environ)
Guido van Rossumad164711997-05-13 19:03:23 +0000955 except:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000956 print_exception()
Guido van Rossumad164711997-05-13 19:03:23 +0000957
Guido van Rossumf85de8a1996-08-20 20:22:39 +0000958def print_exception(type=None, value=None, tb=None, limit=None):
959 if type is None:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000960 type, value, tb = sys.exc_info()
Guido van Rossumf85de8a1996-08-20 20:22:39 +0000961 import traceback
962 print
Guido van Rossum7dd06962000-12-27 19:12:58 +0000963 print "<H3>Traceback (most recent call last):</H3>"
Guido van Rossumf85de8a1996-08-20 20:22:39 +0000964 list = traceback.format_tb(tb, limit) + \
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000965 traceback.format_exception_only(type, value)
Guido van Rossumf85de8a1996-08-20 20:22:39 +0000966 print "<PRE>%s<B>%s</B></PRE>" % (
Eric S. Raymond7e9b4f52001-02-09 09:59:10 +0000967 escape("".join(list[:-1])),
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000968 escape(list[-1]),
969 )
Guido van Rossumf15d1591997-09-29 23:22:12 +0000970 del tb
Guido van Rossum9a22de11995-01-12 12:29:47 +0000971
Guido van Rossum773ab271996-07-23 03:46:24 +0000972def print_environ(environ=os.environ):
Guido van Rossum7aee3841996-03-07 18:00:44 +0000973 """Dump the shell environment as HTML."""
974 keys = environ.keys()
975 keys.sort()
976 print
Guido van Rossum503e50b1996-05-28 22:57:20 +0000977 print "<H3>Shell Environment:</H3>"
Guido van Rossum7aee3841996-03-07 18:00:44 +0000978 print "<DL>"
979 for key in keys:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000980 print "<DT>", escape(key), "<DD>", escape(environ[key])
Tim Peters88869f92001-01-14 23:36:06 +0000981 print "</DL>"
Guido van Rossum7aee3841996-03-07 18:00:44 +0000982 print
Guido van Rossum72755611996-03-06 07:20:06 +0000983
984def print_form(form):
Guido van Rossum7aee3841996-03-07 18:00:44 +0000985 """Dump the contents of a form as HTML."""
986 keys = form.keys()
987 keys.sort()
988 print
Guido van Rossum503e50b1996-05-28 22:57:20 +0000989 print "<H3>Form Contents:</H3>"
Guido van Rossum57d51f22000-09-16 21:16:01 +0000990 if not keys:
991 print "<P>No form fields."
Guido van Rossum7aee3841996-03-07 18:00:44 +0000992 print "<DL>"
993 for key in keys:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000994 print "<DT>" + escape(key) + ":",
995 value = form[key]
Walter Dörwald70a6b492004-02-12 17:35:32 +0000996 print "<i>" + escape(repr(type(value))) + "</i>"
997 print "<DD>" + escape(repr(value))
Guido van Rossum7aee3841996-03-07 18:00:44 +0000998 print "</DL>"
999 print
1000
1001def print_directory():
1002 """Dump the current directory as HTML."""
1003 print
1004 print "<H3>Current Working Directory:</H3>"
1005 try:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +00001006 pwd = os.getcwd()
Guido van Rossum7aee3841996-03-07 18:00:44 +00001007 except os.error, msg:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +00001008 print "os.error:", escape(str(msg))
Guido van Rossum7aee3841996-03-07 18:00:44 +00001009 else:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +00001010 print escape(pwd)
Guido van Rossum7aee3841996-03-07 18:00:44 +00001011 print
Guido van Rossum9a22de11995-01-12 12:29:47 +00001012
Guido van Rossuma8738a51996-03-14 21:30:28 +00001013def print_arguments():
1014 print
Guido van Rossum503e50b1996-05-28 22:57:20 +00001015 print "<H3>Command Line Arguments:</H3>"
Guido van Rossuma8738a51996-03-14 21:30:28 +00001016 print
1017 print sys.argv
1018 print
1019
Guido van Rossum9a22de11995-01-12 12:29:47 +00001020def print_environ_usage():
Guido van Rossum7aee3841996-03-07 18:00:44 +00001021 """Dump a list of environment variables used by CGI as HTML."""
1022 print """
Guido van Rossum72755611996-03-06 07:20:06 +00001023<H3>These environment variables could have been set:</H3>
1024<UL>
Guido van Rossum9a22de11995-01-12 12:29:47 +00001025<LI>AUTH_TYPE
1026<LI>CONTENT_LENGTH
1027<LI>CONTENT_TYPE
1028<LI>DATE_GMT
1029<LI>DATE_LOCAL
1030<LI>DOCUMENT_NAME
1031<LI>DOCUMENT_ROOT
1032<LI>DOCUMENT_URI
1033<LI>GATEWAY_INTERFACE
1034<LI>LAST_MODIFIED
1035<LI>PATH
1036<LI>PATH_INFO
1037<LI>PATH_TRANSLATED
1038<LI>QUERY_STRING
1039<LI>REMOTE_ADDR
1040<LI>REMOTE_HOST
1041<LI>REMOTE_IDENT
1042<LI>REMOTE_USER
1043<LI>REQUEST_METHOD
1044<LI>SCRIPT_NAME
1045<LI>SERVER_NAME
1046<LI>SERVER_PORT
1047<LI>SERVER_PROTOCOL
1048<LI>SERVER_ROOT
1049<LI>SERVER_SOFTWARE
1050</UL>
Guido van Rossum7aee3841996-03-07 18:00:44 +00001051In addition, HTTP headers sent by the server may be passed in the
1052environment as well. Here are some common variable names:
1053<UL>
1054<LI>HTTP_ACCEPT
1055<LI>HTTP_CONNECTION
1056<LI>HTTP_HOST
1057<LI>HTTP_PRAGMA
1058<LI>HTTP_REFERER
1059<LI>HTTP_USER_AGENT
1060</UL>
Guido van Rossum9a22de11995-01-12 12:29:47 +00001061"""
1062
Guido van Rossum9a22de11995-01-12 12:29:47 +00001063
Guido van Rossum72755611996-03-06 07:20:06 +00001064# Utilities
1065# =========
Guido van Rossum9a22de11995-01-12 12:29:47 +00001066
Guido van Rossum64c66201997-07-19 20:11:53 +00001067def escape(s, quote=None):
Skip Montanaro97b2fa22005-08-02 02:50:25 +00001068 '''Replace special characters "&", "<" and ">" to HTML-safe sequences.
1069 If the optional flag quote is true, the quotation mark character (")
1070 is also translated.'''
Eric S. Raymond7e9b4f52001-02-09 09:59:10 +00001071 s = s.replace("&", "&amp;") # Must be done first!
1072 s = s.replace("<", "&lt;")
1073 s = s.replace(">", "&gt;")
Guido van Rossum64c66201997-07-19 20:11:53 +00001074 if quote:
Eric S. Raymond7e9b4f52001-02-09 09:59:10 +00001075 s = s.replace('"', "&quot;")
Guido van Rossum7aee3841996-03-07 18:00:44 +00001076 return s
Guido van Rossum9a22de11995-01-12 12:29:47 +00001077
Guido van Rossum2e441f72001-07-25 21:00:19 +00001078def valid_boundary(s, _vb_pattern="^[ -~]{0,200}[!-~]$"):
1079 import re
1080 return re.match(_vb_pattern, s)
Guido van Rossum9a22de11995-01-12 12:29:47 +00001081
Guido van Rossum72755611996-03-06 07:20:06 +00001082# Invoke mainline
1083# ===============
1084
1085# Call test() when this file is run as a script (not imported as a module)
Tim Peters88869f92001-01-14 23:36:06 +00001086if __name__ == '__main__':
Guido van Rossum7aee3841996-03-07 18:00:44 +00001087 test()