Kitware/tangelo — pull request #464 by ronichoudhury (2014-12-24 22:26:57+00:00)
Title: Access policy overhaul

This introduces two new option flags: ``--list-dir`` (``--no-list-dir``) and ``--show-py`` (``--no-show-py``).

``--list-dir`` causes Tangelo to serve a directory listing when a directory is requested, while ``--no-list-dir`` instead causes a "403 Forbidden" error. The default is **not** to serve directories when requested.

``--show-py`` causes Tangelo to serve Python source code when a Python file is requested, while ``--no-show-py`` will again cause a 403 error. As with directory contents, the default is to **not** show source code. (This option also applies to ``.pyc``, ``.pyo``, and other files that are artifacts of the Python compiler.)

Currently, any YAML file with the same name as a Python file in the same directory will not be served by Tangelo, as these are considered to be part of the Python service defined by the two files. However, this restriction does not apply to YAML files *without* an attendant Python file.

Together, this defines a more careful default security policy, with escape hatches to make the policy less restrictive, at the user's discretion. As such, this closes #430.

A given Python file can be selectively made readable by setting the ``show-py`` property of its configuration file to ``True``. This is necessary for plugins such as *VTKWeb*, which use Python modules to carry out some plugin-specific action. The general method of creating such a plugin is to use the ``tangelo.server.analyze_url()`` function to retrieve specific information about the file referenced by a given URL. Without the ability to open up a given Python file to the outside world, ``analyze_url()`` would report that such files were restricted from access. Therefore, this also closes #450.

Solving #451 is the natural follow-up to this PR.