_chain_params: make an internal-only function as seems to have little plausible exter...

[cgi-auth-flexible.git] / caf.pod

diff --git a/caf.pod b/caf.pod
index 7fefd16cac78f97f3f64e78b2777fd4be41c498f..ed4c6c9c9d53903ce275c8f75110e21a6599b7f1 100644 (file)
--- a/caf.pod
+++ b/caf.pod
@@ -461,15 +461,6 @@ Returns the value of the secret cookie.  CGI::Auth::Flexible sets this
 cookie in the forms generated by C<check_ok>.  You may also set it
 yourself (and indeed you must do so if you use C<check_divert>).
 
-=item C<< $authreq->chain_params() >>
-
-Returns a hash of the "relevant" parameters to this request, in a form
-used by XXX.  This is all of the query parameters which are not
-related to CGI::Auth::Flexible.  The PATH_INFO from the request is
-returned as the parameter C<< '' >>.
-
-xxx why use this function
-
 =back
 
 =head OTHER FUNCTIONS AND METHODS
@@ -999,7 +990,11 @@ can be written directly to the named file: there is no need to
 write to a temporary file and rename.
 
 The default implementation is the module function
-C<srcdump_process_item>.  It searches the item and its parent
+C<srcdump_process_item>.
+
+It skips directories for which C<srcdump_system_dir> returns true.
+
+It then searches the item and its parent
 directories for a vcs metadata directory (one of the names in
 C<srcdump_vcs_dirs>); if found, it calls the C<srcdump_byvcs> hook
 (after checking and updaeing C<%dirsdone>).
@@ -1055,16 +1050,61 @@ of C<srcdump_novcs>.  The default value is C<['*~','*.bak','*.tmp','#*#']>.
 
 Entries must not contain C<'> or C<\>.
 
+=item C<srcdump_listitems($cgi,$verifier)>
 
-xxx conditions on listitems implied by srcdump_dirscan_prepare
-xxx listitems enoent behaviour
-The de
+Returns an array of directories which might contain source code of the
+web application and which should be therefore be considered for
+including in the source code delivery.
 
-xxx syntax of srcdump_excludes
+Used by the default implementation of C<srcdump_prepare>.
 
+Entries must be directories, plain files, or nonexistent; they may
+also be symlinks which resolve to one of those.
 
-=back
+If C<.> is included it may be treated specially - see
+C<srcdump_filter_cwd>.
+
+The default implementation returns 
+C<(@INC, $ENV{'SCRIPT_FILENAME'}, $0)>.
+
+=item C<srcdump_system_dir($cgi,$verifier,$dir)>
+
+Determines whether C<$dir> is a "system directory", in which any
+source code used by the application should nevertheless not be
+included in the source code dump.
+
+Used by the default implementation of C<srcdump_item>.
 
+The default implementation is as follows: Things in C</etc/> are
+system directories.  Things in C</usr/> are too, unless they are in
+C</usr/local/> or C</usr/lib/cgi*>.
+
+=item C<srcdump_filter_cwd>
+
+Boolean which controls the handling of C<.> if it appears in the
+return value from C<srcdump_listitems>.  Used only by the default
+implementation of C<srcdump_prepare>.
+
+If set to false, C<.> is treated normally and no special action is
+taken.
+
+However often the current directory may be C</>, or a data directory,
+or some other directory containing data which is confidential, or
+should not be included in the public source code distribution for
+other reasons.  And for historical reasons Perl has C<@INC> containing
+C<.> by default (which is arguably dangerous and wrong).
+
+So the default this setting is true, which has the following effects:
+
+C<.> is not searched for source code even if it appears in C<@INC>.
+C<.> is removed from C<@INC> and C<%INC> is checked to see if any
+modules appear to have already been loaded by virtue of C<.> appearing
+in C<@INC> and if they have it is treated as a fatal error.
+
+Only the literal string C<.> is affected.  If the cwd is included by
+any other name it is not treated specially regardless of this setting.
+
+=back
 
 =head1 DATABASE TABLES