Change default allowedServers for ajp and scgi to ['127.0.0.1'].

Accept PATH_INFO from environment for scgi servers, in case
cgi2scgi is being used.

1 files changed, 8 insertions, 2 deletions

diff --git a/flup/server/ajp_base.py b/flup/server/ajp_base.py
index e86792a..e6c7aee 100644
--- a/flup/server/ajp_base.py
+++ b/flup/server/ajp_base.py
@@ -43,6 +43,9 @@ import threading
 
 __all__ = ['BaseAJPServer']
 
+class NoDefault(object):
+    pass
+
 # Packet header prefixes.
 SERVER_PREFIX = '\x12\x34'
 CONTAINER_PREFIX = 'AB'
@@ -758,7 +761,7 @@ class BaseAJPServer(object):
 
     def __init__(self, application, scriptName='', environ=None,
                  multithreaded=True, multiprocess=False,
-                 bindAddress=('localhost', 8009), allowedServers=None,
+                 bindAddress=('localhost', 8009), allowedServers=NoDefault,
                  loggingLevel=logging.INFO):
         """
         scriptName is the initial portion of the URL path that "belongs"
@@ -781,7 +784,8 @@ class BaseAJPServer(object):
 
         allowedServers must be None or a list of strings representing the
         IPv4 addresses of servers allowed to connect. None means accept
-        connections from anywhere.
+        connections from anywhere. By default, it is a list containing
+        the single item '127.0.0.1'.
 
         loggingLevel sets the logging level of the module-level logger.
         """
@@ -794,6 +798,8 @@ class BaseAJPServer(object):
         self.multithreaded = multithreaded
         self.multiprocess = multiprocess
         self._bindAddress = bindAddress
+        if allowedServers is NoDefault:
+            allowedServers = ['127.0.0.1']
         self._allowedServers = allowedServers
 
         # Used to force single-threadedness.