Re: -T t t t t t o o late folks
by dws (Chancellor) on Apr 06, 2001 at 11:36 UTC
|
This one ranks in the top 10 list of "Things that bite Perl users on NT."
The -T is "too late" because, unlike Apache, IIS (and PWS) execute CGI scripts by first looking up the binding for .cgi in its internal scriptmap. The command in the scriptmap is then executed, and the name of the script is passed as an argument. Typically, the scriptmap for .cgi will be
.cgi "c:\perl\bin\perl.exe %s %s"
So when the CGI script is executed, there's no -T on the command line. The -T in the script header is "too late". One way to fix this is to edit the IIS scriptmap to change the binding to
.cgi "c:\perl\bin\perl.exe -T %s %s"
This means that all CGI scripts will run with taint checking. Since that might break other scripts, you might instead consider adding a scriptmap entry
.cgt "c:\perl\bin\perl.exe -T %s %s"
| [reply] [d/l] [select] |
|
Oh. i don't have control of this server - it's with an isp. they are so lame. i guess i have to call them and wait on hold for half an hour and see if they can fix it.
| [reply] |
Re: -T t t t t t o o late folks
by neophyte (Curate) on Apr 06, 2001 at 11:47 UTC
|
Let me guess: the webserver is IIS (or any other than apache)?
If I remember correctly, IIS and some others don't read the shebang-line in the way Apache does. So you have to tell IIS to call Perl with -T within the configuration of IIS.
Beware - if there are scripts on that server that haven't been designed for use with -T, they are likely to break.
neophyte Niederrhein.pm | [reply] |
Re: -T t t t t t o o late folks
by WebHick (Scribe) on Apr 07, 2001 at 01:52 UTC
|
Unfortunately, I'm having the same exact problem with CGI programs on both my laptop and my computer. I've added the -T to the registry like everyone says, but I still get the error message. Yes, I restarted my computer (and by extension, the service) after the changes were made.
I'm running Win98 with PWS on both machines, so if anyone has any suggestions, I'm all for it. As a side note, running the program from the command line with the -T works just fine. For now, I'm making do without by incrementally uploading my programs to my webhost so I can test via CGI with taint turned on, but it's a huge pain.
Update: Due to several complaints, removed signature
Sarah
| [reply] [d/l] [select] |
|
| [reply] [d/l] |
|
Yes, taking the -T out of the #! line will allow the program to run, but unfortunately, it also doesn't taint check.
I know that sounds really arrogant, but I tested this out. I created a tiny little file that purposely causes taint to scream:
#!perl -wT
use strict;
my $bad_stuff = $ENV{HOME};
system($bad_stuff);
I'm probably rehashing old news, but my testing shows that taint will puke over this whether or not the -T is in the #! line as long as perl is called with -T. But if I run it in the browser without the -T in the #! line, taint doesn't make a peep. This is all while the -T is still in the registry. But I'm probably misunderstanding the situation...
Update: Due to several complaints, removed signature
Sarah | [reply] [d/l] [select] |
|
|
|
|
|
what do you mean by add it to the registry?
| [reply] |
|