# WebKit 0.9 Release Notes

WebKit version 0.9 released on 11/13/05

## Introduction

It has taken much longer than usual to finish this release, and it is impossible to track and list every change. So the following will mention only a few of the many changes, improvements and bugfixes that have been made.

## New Features

- Added If-Modified-Since support to HTTPServlet. A Servlet can provide a lastModified() method which returns the modification time of the data. This has been integrated into the UnknownFileType servlet for handling static files.
- The AppServer script detects `-u` (unbuffered output) and `-O` (optimize) parameters and passes them to Python. These parameters must precede any other parameters. Other parameters will be passed to `ThreadedAppServer` normally.
- Configuration parameters can now be overridden with the command line. You can run AppServer with switches in the form `ClassName.SettingName=value`, e.g. `AppServer.AdapterPort=8087`.
- Configuration files can be written as Python modules instead of as Python dictionaries. Any global variables in the module are equivalent to top-level keys in the configuration dictionary.
- MakeAppWorkDir.py accepts a new option `-d` allowing to point the default context to a location not inside the working directory, so you can keep your code completely separate from the working directory. It also accepts `-l` options to add multiple application library dirs to the Python path, and options to set the ownership of the working directory files. To see all options, run the command without any parameters.
- Added `EnterDebuggerOnException` option to Application.config. If True, and if the AppServer is running from an interactive terminal, an uncaught exception will cause the AppServer to enter the debugger, allowing the developer to call functions, investigate variables, etc. See Python debugger (pdb) docs for more information. You will certainly want to turn this off when deploying the site. Defaults to False (off).
- The AppServer now includes an experimental built-in HTTP web server. See the InstallGuide for more details.
- Added new Application.config option `UseCookieSessions` that defaults to True. If set to False, then a session cookie will never be sent in the response. Use this along with `UseAutomaticPathSessions` to only use path sessions and never use cookie sessions.
- Added `HTTPRequest.setSessionId()` method which allows the use of session IDs that are sent via means other than cookies or URL parameters (an example would be via an XML-RPC parameter). See the docstring for more details.
- Added `DebugAppServer`, a single-threaded app server that makes it possible to debug servlets using a standard Python debugger. Tested on Windows only, using both PythonWin and JEdit with the JPyDbg plugin. See WebKit/DebugAppServer.py for details.
- New debugging feature: by turning on the configuration variable `IncludeErrorLink` in Application.config, an [edit] link will be put next to each line in tracebacks. That link will point to a file of type `application/x-webkit-edit-file`, which you should configure your browser to run with Webware/bin/editfile.py (and edit editfile.py so that it opens your editor).

## Improvements and Refinements

- `WebKit.Object` now inherits Python's object. This affects all other classes for which Super() should now work.
- Unknown file types (those for whom `mimetypes.guess_type()` cannot return something meaningful) are now served up with a mime type of `application/octet-stream` instead of `text/html`.
- Fixed incompatibility between the NT Service code and win32all 163.
- AutoReload no longer catches servlet updates (since servlets can be reloaded without restarting the entire server anyway).
- `XMLRPCServlet` now allows `xmlrpclib.Fault` exceptions to be passed through unmolested.
- `Page` has been refactored into `HTTPContent` and `Page`. `HTTPContent` can be used as a base class for servlets which generate non-HTML content. As `Page` inherits from `HTTPContent` (which inherits from `HTTPServlet`), `Page` still contains all the methods it previously did, and this change should not require any changes to end-user code.
- `XMLRPCServlets` are now allowed to return None as part of their marshaled response. This improves usability in an all-Python environment at the possible cost of compatibility problems with non-Python clients. To revert to the old behavior, where an attempt to respond with `None` caused an exception, add `allow_none = False` to your `XMLRPCServlet`-derived servlets at class level (adding `self.allow_none = False` in the `__init__` should also work).
- Fixed problem where SessionDynamicStore would unpickle the same object twice.
- Added `transaction()` method to `RPCServlet` so that there's a way for a method to get the transaction object if needed.

- Previously, attempting to start an already-running AppServer would fail when it couldn't grab the socket to listen on, but it would have already overwritten the pid file.

  Now pid file handling is much improved:

  - The AppServer will refuse to start if it detects that the pid file exists and the process is still running.
  - A stale pid file left over from a crash or forcible termination will be detected and removed.
  - You can override the path of the pid file using the `PidFile` setting in AppServer.config. By default, the pid is written to appserverpid.txt in the working directory (or WebKit path if you're not using a working directory).
  - You can disable the use of the pid file by setting it to `None` in AppServer.config. This seems to be a good idea on Windows because Windows often reuses the same pid right away, so if the appserver crashes, and it tries to restart and it happens to reuse the same pid, the restart will fail.

- The shutdown handling has been improved. Sending `SIGHUP` now results in exiting with exit code 3 which is used for reloading via the AppServer script.

- The Launch.py file has been improved and supports several new command line options.
- The AppServer and Launch.py don't need to be called from the working directory any more, and the location of the working directory is assumed to be the location of the script, and not hard coded in Launch.py. You can still change this at the top of the script, however.
- The Unix start script WebKit/webkit which was based on RedHat Linux has been replaced by a folder WebKit/StartScripts with a bunch of start sripts for various flavors of Unix, including a "generic" version. The installer will try to copy the most appropriate start script to WebKit/webkit. If instead of copying, you create a link to the start script in your working directory, it will find out the location of the working directory automatically.
- The Examples and Admin sections have been improved and adapted to the API changes.

## Changes

- The `Port` setting in AppServer.config has been deprecated in favor of the new `AdapterPort` setting. The `Port` setting in your config file will still be honored, but you are encouraged to update your AppServer.config as the `Port` setting will be removed in the future.
- The scripts ThreadedAppServerService.py in the WebKit directory and NTService created by MakeAppWorkDir.py were both renamed to AppServerService.py.
- Removed the Application.config setting `OldStyleActions` and re-implemented support of the `methodNameForAction()` transformation. Note that "old style" actions took an additional `transaction` parameter, but otherwise the action handling is now downward compatible.
- In `WebKit.Page` resp. `WebKit.HTTPContent`, removed both the internal method `_actionSet()` and the internal dictionary `_actionDict` which cached the list of actions for the servlet. This was redundant code, and its removal allows a servlet to use dynamic actions (i.e. to make the action list dependent on the permissions of the logged-in user).

- The semantics for the awake-respond-sleep cycle have changed so that Servlet.sleep() is always called, even when an unhandled exception occurs in Servlet.awake() or Servlet.respond(). Servlet.sleep() is called even when Page.endResponse() or Page.sendRedirectAndEnd() have been called to end servlet processing prematurely. This behavior differs from previous versions, in which sleep() was called only if awake() succeeded.

  The intent of this change is to guarantee servlets the chance to free resources, without having to be prepared to catch all possible exceptions within awake() to do so.

  The programmer should ensure that sleep does not attempt to free resources which were never allocated, as sleep() may be called even when awake() did not succeed.

      		def awake(...):
      			initialize resource A
      			initialize resource B

      		def sleep(...):
      			if resource B was initialized:
      				finalize resource B
      			if resource A was initialized:
      				finalize resource A

- The PythonServletFactory had only served `.py` source files so far. Now it will serve `.pyc` and `.pyo` files as well. For the default configuration, this makes no difference, since `.pyc` and `.pyo` are in both settings `ExtensionsToIgnore` and `FilesToHide`, so they will not be served anyway. By removing `.pyc` and `.pyo` away from these settings, you can now install servlets without their source code. This will be a little bit more performant in the production environment, but most of all it will prevent customers and administrators from messing around with the source code and give a certain level of protection as closed source (this feature had been requested several times). Before, `.pyc` and `.pyo` had not been executed, but delivered as unknown file tyes which does not make much sense and can be a security problem, for instance when database passwords and other information is stored in the servlets. By using `ExtensionCascadeOrder`, you can also determine a priority, such as `.py` first (if available), then `.pyo`, then `.pyc`. However, the standard configuration still ignores/hides `.pyc` and `.pyo` files completely and looks only at the `.py` file, so you still have to change the settings explicitely in AppServer.config if you want to use this. Also, note that `.pyc` and `.pyo` files can be decompiled so this will be no real unsurmountable protection.

## Bugfixes

- Fixed handling of expired sessions. Previously, if you tried to access an expired session before the session sweeper thread had cleaned it out, you'd get that expired session for one request, but on the second request you'd get a new session. Now it correctly returns a new empty session with a new session ID on the first request after expiration.
- Fixed a bug in `mod_webkit` for Apache 2.X that might have been causing `mod_webkit` to retry connections to the app server unnecessarily in some cases. (This does not apply to the Apache 1.3 version of `mod_webkit`.)