server on remote machine what if we don' want users to be able to view some files on the serverfor examplein the next we will implement an encryption module for email account passwords on our serverit is in fact addressable as pymailcgi/cgi-bin/secret py allowing users to view that module' source code would make encrypted passwords shipped over the net much more vulnerable to cracking to minimize this potentialthe getfile script keeps listprivatesof restricted filenamesand uses the os path samefile built-in to check whether requested filename path points to one of the names on privates the samefile call checks to see whether the os stat built-in returns the same identifying information (device and inode numbersfor both file paths as resultpathnames that look different syntactically but reference the same file are treated as identical for exampleon the server used for this book' second editionthe following paths to the encryptor module were different stringsbut yielded true result from os path samefile/pymailcgi/secret py /home/crew/lutz/public_html/pymailcgi/secret py unfortunatelythe os path samefile call is supported on unixlinuxand macsbut not on windows to emulate its behavior in windowswe expand file paths to be absoluteconvert to common caseand compare ( shortened paths in the following with for display here)import os os path samefile attributeerror'moduleobject has no attribute 'samefileos getcwd(' :\\\pp \\dev\\examples\\pp \\internet\\webx os path abspath(/web/pymailcgi/cgi-bin/secret py'lower( os path abspath('pymailcgi/cgi-bin/secret py'lower( os path abspath(/pymailcgi/cgi-bin/cgi-bin/secret py'lower( ' :\\\pp \\dev\\examples\\pp \\internet\\web\\pymailcgi\\cgi-bin\\secret pyy ' :\\\pp \\dev\\examples\\pp \\internet\\web\\pymailcgi\\cgi-bin\\secret pyz ' :\\\pp \\dev\\examples\\pp \\internet\\web\\pymailcgi\\cgi-bin\\secret pyx =yy = (truetrueaccessing any of the three paths expanded here generates an error page like that in figure - notice how the names of secret files are global data in this moduleon the assumption that they pertain to files viewable across an entire sitethough we could allow for customization per sitechanging the script' globals per site is likely just as convenient as changing per-site customization files also notice that bona fide file errors are handled differently permission problems and attempts to access nonexistent filesfor exampleare trapped by different exception server-side scripting