From: Andy Grundman <andy@hybridized.org>
Date: Wed, 23 Nov 2005 20:41:16 +0000 (+0000)
Subject: Merged latest Static::Simple into core
X-Git-Tag: 5.7099_04~839
X-Git-Url: http://git.shadowcat.co.uk/gitweb/gitweb.cgi?p=catagits%2FCatalyst-Runtime.git;a=commitdiff_plain;h=4ca033b16e92507bd5474ff45064f564807afbf5;hp=0afeb5f5303b4806e30c09cfae58e8448a64177a

Merged latest Static::Simple into core
---

diff --git a/Changes b/Changes
index 0502811..43c0656 100644
--- a/Changes
+++ b/Changes
@@ -4,6 +4,11 @@ This file documents the revision history for Perl extension Catalyst.
         - Improved PAR support
         - Replaced -short with auto-detection
         - Fixed prereqs, added File::Copy::Recursive
+        - Static::Simple changes:
+            - Made prepare_action play nice with other plugins by not short-
+              circuiting.
+            - Added tmpl to the ignored extensions.
+            - Fixed security problem if req->path contained '..'.
 
 5.57    2005-11-20 22:45:00
         - Updated uri_for to accept undef actions
diff --git a/lib/Catalyst/Plugin/Static/Simple.pm b/lib/Catalyst/Plugin/Static/Simple.pm
index ea5c86e..827c272 100644
--- a/lib/Catalyst/Plugin/Static/Simple.pm
+++ b/lib/Catalyst/Plugin/Static/Simple.pm
@@ -9,7 +9,7 @@ use IO::File;
 use MIME::Types;
 use NEXT;
 
-our $VERSION = '0.11';
+our $VERSION = '0.12';
 
 __PACKAGE__->mk_classdata( qw/_static_mime_types/ );
 __PACKAGE__->mk_accessors( qw/_static_file
@@ -29,12 +29,10 @@ sub prepare_action {
             if ( $c->_locate_static_file ) {
                 $c->_debug_msg( 'from static directory' )
                     if ( $c->config->{static}->{debug} );
-                return;
             } else {
                 $c->_debug_msg( "404: file not found: $path" )
                     if ( $c->config->{static}->{debug} );
                 $c->res->status( 404 );
-                return;
             }
         }
     }
@@ -42,7 +40,7 @@ sub prepare_action {
     # Does the path have an extension?
     if ( $path =~ /.*\.(\S{1,})$/xms ) {
         # and does it exist?
-        return if ( $c->_locate_static_file );
+        $c->_locate_static_file;
     }
     
     return $c->NEXT::ACTUAL::prepare_action(@_);
@@ -92,7 +90,8 @@ sub setup {
     $c->config->{static}->{dirs} ||= [];
     $c->config->{static}->{include_path} ||= [ $c->config->{root} ];
     $c->config->{static}->{mime_types} ||= {};
-    $c->config->{static}->{ignore_extensions} ||= [ qw/tt tt2 html xhtml/ ];
+    $c->config->{static}->{ignore_extensions} 
+        ||= [ qw/tmpl tt tt2 html xhtml/ ];
     $c->config->{static}->{ignore_dirs} ||= [];
     $c->config->{static}->{debug} ||= $c->debug;
     if ( ! defined $c->config->{static}->{no_logs} ) {
@@ -112,7 +111,7 @@ sub setup {
 sub _locate_static_file {
     my $c = shift;
     
-    my $path = catdir(no_upwards(splitdir( $c->req->path )));
+    my $path = catdir( no_upwards( splitdir( $c->req->path ) ) );
     
     my @ipaths = @{ $c->config->{static}->{include_path} };
     my $dpaths;
@@ -337,11 +336,12 @@ For example:
 
 There are some file types you may not wish to serve as static files.  Most
 important in this category are your raw template files.  By default, files
-with the extensions tt, tt2, html, and xhtml will be ignored by Static::Simple
-in the interest of security.  If you wish to define your own extensions to
-ignore, use the ignore_extensions option:
+with the extensions tmpl, tt, tt2, html, and xhtml will be ignored by
+Static::Simple in the interest of security.  If you wish to define your own
+extensions to ignore, use the ignore_extensions option:
 
-    MyApp->config->{static}->{ignore_extensions} = [ qw/tt tt2 html xhtml/ ];
+    MyApp->config->{static}->{ignore_extensions} 
+        = [ qw/tmpl tt tt2 html xhtml/ ];
     
 =head2 Ignoring entire directories
 
@@ -372,17 +372,11 @@ you may enter your own extension to MIME type mapping.
         png => 'image/png',
     };
 
-=head2 Bypassing other plugins
+=head2 Compatibility with other plugins
 
-This plugin checks for a static file in the prepare_action stage.  If the
-request is for a static file, it will bypass all remaining prepare_action
-steps.  This means that by placing Static::Simple before all other plugins,
-they will not execute when a static file is found.  This can be helpful by
-skipping session cookie checks for example.  Or, if you want some plugins
-to run even on static files, list them before Static::Simple.
-
-Currently, work done by plugins in any other prepare method will execute
-normally.
+Since version 0.12, Static::Simple plays nice with other plugins.  It no
+longer short-circuits the prepare_action stage as it was causing too many
+compatibility issues with other plugins.
 
 =head2 Debugging information