➜

This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

Author vstinner
Recipients frenzy, gregory.p.smith, hroncok, kj, lemburg, lukasz.langa, mdk, ned.deily, serhiy.storchaka, vstinner
Date 2021-03-24.13:41:34
SpamBayes Score -1.0
Marked as misclassified Yes
Message-id <1616593294.94.0.724662754225.issue42988@roundup.psfhosted.org>
In-reply-to
Content 
The "pydoc -p port" command only listen on the local link ("localhost") by default, even if it's possible to listen on another IPv4 address using -n HOSTNAME command line option.

While the "getfile" feature is convenient when the pydoc server is accessed from a different machine, I don't think that it's worth it, compared to the security risks and the complexity of PR 24285 and PR 24337 fixes.

I propose to simply remove the "getfile" feature with PR 25015, but keep links using file:// scheme. So we delegate the security to the web browser. If the web server is allowed to read sensitive data of a local Python file, it's not our problem: pydoc doesn't make things worse.
History
Date User Action Args
2021-03-24 13:41:34vstinnersetrecipients: + vstinner, lemburg, gregory.p.smith, ned.deily, lukasz.langa, serhiy.storchaka, mdk, hroncok, frenzy, kj
2021-03-24 13:41:34vstinnersetmessageid: <1616593294.94.0.724662754225.issue42988@roundup.psfhosted.org>
2021-03-24 13:41:34vstinnerlinkissue42988 messages
2021-03-24 13:41:34vstinnercreate