Sponsored Content
Top Forums Web Development Accessing a Perl CGI script, security issue Post 302339167 by z1dane on Thursday 30th of July 2009 02:07:16 AM
Old 07-30-2009
Thank you very much for your reply pludi.

>If the HTTP server is configured wrong and doesn't recognize the scripts as executables, and serves the content instead

I guess this isn't a problem, since http://domain/script.pl executes.

>If another application on the same server is vulnerable to relative path errors, eg instead of calling /xyz/cgi-bin/script.pl

Could you give me an example of such an application?

>If you've got a script that uses templates with variables passed through POST. Those could be set also via GET and potentially serve content you wanted hidden

I'll keep this in mind when I'm building forms and passing variables.

Thanks again,

Dave
 

10 More Discussions You Might Find Interesting

1. UNIX for Advanced & Expert Users

concurrency issue while Accessing Mail Box from shell script

Hi Bros, I am in a serious trouble with concurrency issue while using mailx. I have a shell script which reads all the emails of a unix user account and create a copy (another mbox for processing and archive purpose). This script works fine for 99.99% of the time but sometime it start creating... (2 Replies)
Discussion started by: Sumit_Fundoo
2 Replies

2. Shell Programming and Scripting

[Perl] Accessing array elements within a sed command in Perl script

I am trying to use a script to replace the header of each file, whose filename are stored within the array $test, using the sed command within a Perl script as follows: $count = 0; while ( $count < $#test ) { `sed -e 's/BIOGRF 321/BIOGRF 332/g' ${test} > 0`; `cat 0 >... (2 Replies)
Discussion started by: userix
2 Replies

3. Shell Programming and Scripting

call shell script from perl cgi script problem

hi,, i have perl scipt with line : system('./try.sh $t $d $m'); in shell scipt try.sh i have the line: echo $1 its not printing value of $t that i hav passed..y is it so..i am running it from apache web server (2 Replies)
Discussion started by: raksha.s
2 Replies

4. Web Development

in cgi perl script a form

hi,i hav a form in cgi perl script.this script accepts a value from user from another html form, and depending upon this value,i need to disable /enable radio buttons in cgi-perl script wen second page is displayed on executing cgi perl script.how do i do it using javascript? (0 Replies)
Discussion started by: raksha.s
0 Replies

5. Web Development

perl cgi script not working

Hello, Met a problem learning perl cgi script. 1 #!/usr/bin/perl -wT 2 3 use strict; 4 use CGI qw(:standard); 5 6 my $q = new CGI; 7 8 my $filename = $q->param('/home/yifangt/hello.cgi'); 9 my $contenttype = $q->uploadInfo($filename)->{'Content-Type'}; 10... (5 Replies)
Discussion started by: yifangt
5 Replies

6. Web Development

problem with exporting vairable from one perl cgi to another perl cgi script while redirecting.

Can anyone tell me how to export a variable from one perl CGI script to another perl cgi script when using a redirect. Upon running the login.pl the user is prompted to enter user name and password. Upon entering the correct credentials (admin/admin) the user is redirected to welcome page. My... (3 Replies)
Discussion started by: Arun_Linux
3 Replies

7. Programming

CGI Perl script to execute bash script- unable to create folder

Hi I have a bash script which takes parameters sh /tmp/gdg.sh -b BASE-NAME -n 1 -s /source/data -p /dest/data/archive -m ARC gdg.sh will scan the /source/data and will move the contents to /dest/data/archive after passing through some filters. Its working superb from bash I have... (0 Replies)
Discussion started by: rakeshkumar
0 Replies

8. Shell Programming and Scripting

Perl : embedding java script with cgi perl script

Hi All, I am aware that html tags can be embedded in cgi script as below.. In the same way is it possible to embed the below javascript in perl cgi script ?? print("<form action="action.htm" method="post" onSubmit="return submitForm(this.Submitbutton)">"); print("<input type = "text"... (1 Reply)
Discussion started by: scriptscript
1 Replies

9. Shell Programming and Scripting

Perl cgi pages out of cgi-bin folder in WINDOWS

Hi team, I have a typical problem with cgi pages in apache webserver in WINDOWS I am able to execute(display) the pages that are saved in cgi-bin folder. But I am not able to execute the pages stored in htdocs or other folder other than cgi-bin folder. Could anyone please let me know how... (1 Reply)
Discussion started by: scriptscript
1 Replies

10. Shell Programming and Scripting

Perl CGI : unable to download the excel sheet from perl cgi page

Hi All, I have written an cgi perl script that displays an image(Excel image) and when clicked on that Image I need to download a excel sheet. I made sure that excel sheet exists in the folder with the given name but still I am not able to download the sheet. print "<center><table... (2 Replies)
Discussion started by: scriptscript
2 Replies
DJVUSERVE(1)							   DjVuLibre-3.5						      DJVUSERVE(1)

NAME
djvuserve - Generate indirect DjVu documents on the fly. DESCRIPTION
Program djvuserve is a CGI program that can be executed by a HTTP server for serving DjVu documents. This program is able to convert a bundled multi-page document into an indirect document on the fly. USING DJVUSERVE
Program djvuserve must first be installed as a CGI program for your web server. There are several ways to achieve this. The Apache web server, for instance, often defines a specific directory for CGI programs using the ScriptAlias directive. Assume that the file httpd.conf contains the following line: ScriptAlias /cgi-bin/ "/var/www/cgi-bin" It is then sufficient to create a small executable shell script /var/www/cgi-bin/djvuserve containing the following lines: #!/bin/sh exec /full/path/to/djvuserve Suppose that a large bundled multi-page DjVu document is available at the following URL. http://server/dir/doc.djvu The CGI program djvuserve lets you access this same document as an indirect multi-page DjVu document using the following URL. http://server/cgi-bin/djvuserve/dir/doc.djvu/index.djvu Serving indirect multi-page DjVu documents provides for efficiently browsing large document without transferring unnecessary pages over the network. See djvu(1) for more information. Furthermore djvuserve searches certain keywords among the CGI arguments of the URL. The keyword bundled forces serving a bundled document using http://server/cgi-bin/djvuserve/dir/doc.djvu?bundled The keyword download inserts a content disposition HTTP header that suggests to display a save dialog instead of displaying the document. http://server/cgi-bin/djvuserve/dir/doc.djvu?download USING DJVUSERVE AS A HANDLER
The Apache web server provides a way to automatically execute djvuserve for all DjVu documents. This can be achieved using the following directives in either the Apache configuration file or the .htaccess files. Action djvu-server /cgi-bin/djvuserve/ AddHandler djvu-server .djvu Apache then executes program djvuserve for serving all DjVu files. Providing the URL of DjVu file serves this DjVu file as usual, except that bundled multipage documents are converted to indirect documents on the fly. This convenience comes at the expense of the computa- tional cost of executing djvuserve whenever a DjVu file is requested. TECHNICAL DETAILS
Program djvuserve provides a mean to directly access any component of a bundled multi-page DjVu document can be accessed using an extended URL. Suppose that the component file representing page 1 is named p0001.djvu. The following URL provides a direct access to this page: http://server/cgi-bin/djvuserve/dir/doc.djvu/p0001.djvu It is preferred however to access individual pages using the CGI style arguments described in nsdejavu(1), as in the following URL. http://server/cgi-bin/djvuserve/dir/doc.djvu?djvuopts&page=12 The special component file name index.djvu is recognized as a request for the index of the corresponding indirect multi-page document. In fact, when you access a bundled document using djvuserve, the browser gets redirected to the following URL: http://server/cgi-bin/djvuserve/dir/doc.djvu/index.djvu and then behaves as if the bundled file was a directory containing the various component files of an equivalent indirect document. ACCESS CONTROL
Program djvuserve, like many CGI programs, bypasses a number of access protections established in a web server. Assume for instance that your web site contains DjVu files protected by a password. Program djvuserve knows nothing about this protection and will happily serve any DjVu file associated with a valid URL. Access control with djvuserve can be implemented by first remembering that the web server always executes program djvuserve via shell script /var/www/cgi-bin/djvuserve. This script can decide to execute the real program djvuserve on the basis of the target filename available in the environment variable PATH_TRANSLATED. There can be several such scripts providing access to various collections of DjVu files. Each of these scripts can be password protected using the usual methods supported by your web server. KNOWN BUGS
Hyperlinks specified using a relative URL may not work with djvuserve. These URLs are relative to the URL of the DjVu document. Yet djvuserve changes the apparent document URL http://server/dir/doc.djvu into the more complicated URL http://server/cgi-bin/djvuserve/dir/doc.djvu/index.djvu. The extra components change the interpretation of relative URLs. CREDITS
This program was written by Leon Bottou <leonb@users.sourceforge.com>. SEE ALSO
djvu(1), djvmcvt(1), nsdejavu(1) DjVuLibre-3.5 01/22/2002 DJVUSERVE(1)
All times are GMT -4. The time now is 08:32 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy