/ 
WebDyne-3.022

Changes for version 3.022 - 2026-08-25

  • Hardened the helper script defaults for the built-in WebDyne indexer. webdyne.psgi, webdyne.pagi, and webdyne.apache now leave index handling disabled by default unless DOCUMENT_DEFAULT, a user option file, or an explicit --index option enables it.
  • Added WEBDYNE_INDEX_SOURCE_ENABLE and --view-source support for the helper scripts. The built-in index page source viewer is now disabled unless both index handling and source viewing are explicitly enabled, preserving the directory listing/debugging workflow without exposing page source by default.
  • Added PSGI and PAGI application builder support for wrapper-style initialization, including optional static handling and document-root .webdyne.conf.pl loading via the new constructor options. The helper scripts now opt in to this behaviour while direct WebDyne::PSGI->new(...)->to_app and WebDyne::PAGI->new(...)->to_app construction retains conservative defaults.
  • Fixed PSGI API fallback path traversal by rejecting dot path segments before route discovery and verifying discovered API files remain inside the document root using canonical relative-path checks. Added regression coverage for traversal attempts and normal API routing.
  • Restored end-of-string matching for WebDyne PSP filenames so files such as report.psp.pdf are not treated as executable PSP pages. This fixes a double-extension execution regression introduced when WEBDYNE_PSP_EXT became configurable.
  • Re-enabled CGI form value escaping by default and fixed the WebDyne::HTML::Tiny entity encoder override so WEBDYNE_CGI_AUTOESCAPE works as documented. Sticky text, password, and file form fields now escape request-derived values before rendering them into HTML attributes.
  • Applied automatic HTML escaping to request, environment, and method substitution operators (+{...}, *{...}, and ^{...}) when WEBDYNE_CGI_AUTOESCAPE is enabled. The raw ${...} substitution operator remains available for trusted, already-rendered values.
  • Added secure session cookie defaults and configuration constants for Secure, HttpOnly, and SameSite attributes. WebDyne sessions now emit Secure, HttpOnly, and SameSite=Lax cookies by default, with documented constants for deployments that need to adjust those attributes.
  • Preserved <start_html> shortcut version overrides and added regression coverage for local-configuration isolation so tests are not affected by a developer's document-root .webdyne.conf.pl.
  • Updated the XML documentation, markdown sidecars, MANIFEST, and test suite for the new helper defaults, index source controls, escaping behaviour, PSP extension matching, PSGI/PAGI initialization, API traversal checks, and session cookie flags.

Documentation

Changes.md
INSTALL.md
README.md
SECURITY.md
wdapacheinit
Install or uninstall WebDyne Apache configuration files
wdcompile
parse and display internal data representation of WebDyne files
wddebug
enable or disable debugging in the WebDyne packages
wddump
dump the data structure of a WebDyne page in the cache directory
wdlint
check Perl syntax embedded in a WebDyne file
wdrender
parse and render WebDyne files

Modules

WebDyne
Primary runtime module for the WebDyne framework, with support for standalone .psp to HTML rendering
WebDyne::CGI
Provides abstracted access to GET and POST parameters and file upload objects.
WebDyne::CGI::Simple
CGI-style parameter wrapper used by WebDyne request handling
WebDyne::Cache
WebDyne module to cache dynamic output for improved performance.
WebDyne::Chain
WebDyne chaining module, allows extension of base WebDyne handler pipeline with additional modules.
WebDyne::Chain::Constant
constant namespace for WebDyne::Chain
WebDyne::Compile
compiler for WebDyne .psp source files
WebDyne::Constant
WebDyne module that sets constants and defaults for WebDyne processing
WebDyne::Err
error rendering and eval-error support for WebDyne
WebDyne::Err::Constant
error-template and low-level error-mode constants for WebDyne
WebDyne::Filter
request and response filter module for the WebDyne handler chain
WebDyne::Filter::Constant
request and response filter callback constants for WebDyne
WebDyne::HTML::Tiny
HTML::Tiny subclass with WebDyne page and form helpers
WebDyne::HTML::TreeBuilder
HTML::TreeBuilder subclass used by the WebDyne compiler
WebDyne::Handler
WebDyne handler module, forces use non-chained WebDyne handler.
WebDyne::Install
base installation helper for WebDyne cache setup
WebDyne::Install::Apache
Apache configuration installer for WebDyne
WebDyne::Install::Apache::Constant
Apache-install discovery and template constants for WebDyne
WebDyne::Install::Constant
installer defaults used by WebDyne installation helpers
WebDyne::PAGI
PAGI application wrapper for WebDyne
WebDyne::PAGI::Constant
PAGI runtime constants for WebDyne
WebDyne::PSGI
PSGI application wrapper for WebDyne
WebDyne::PSGI::Constant
PSGI runtime constants for WebDyne
WebDyne::Request::Apache
Apache mod_perl request adapter for WebDyne
WebDyne::Request::Common
helper functions for building normalized WebDyne request adapters
WebDyne::Request::Fake
synthetic request/response object used for direct WebDyne rendering
WebDyne::Request::PAGI
PAGI request adapter for WebDyne
WebDyne::Request::PSGI
PSGI request adapter for WebDyne
WebDyne::Request::PSGI::Constant
request-adapter constants for the PSGI request layer
WebDyne::Request::PSGI::Static
simple static-file responder for WebDyne PSGI request flows
WebDyne::Session
simple session-cookie module for the WebDyne handler chain
WebDyne::Session::Constant
session-cookie constants for WebDyne
WebDyne::Static
WebDyne module to flag pages as static and compile once to HTML
WebDyne::Template
wrapper-template module for embedding WebDyne page output
WebDyne::Util
debugging and error-stack utility functions for WebDyne

Provides

WebDyne::CGI::Simple::Upload
in lib/WebDyne/CGI/Simple.pm
WebDyne::Request::Apache::Body
in lib/WebDyne/Request/Apache.pm
WebDyne::TieHandle
in lib/WebDyne.pm
error_require
in t.error/error_require.pm

Examples

Other files