use CGI qw(-private_tempfiles);
[download]

# Set this to a positive value to limit the size of a POSTing
# to a certain number of bytes:
$POST_MAX = -1;
[download]

- Tom

As for making sure it's a text file. My method doesn't test securely but it does check to make sure the filename is whatever you want. (doesn't mean they can't upload an exe and call it log.txt, mind you). Here's the snippet I use in all my upload scripts (change it to fit your needs):

my $type = uploadInfo($remotefile)->{'Content-Type'};
    unless ( $type eq 'image/pjpeg' || $type eq 'image/gif' || $type e
+q 'image/bmp') {
        print "Wrong!  This is not a supported file type.";
        exit;
    }
[download]

sulfericacid

"Age is nothing more than an inaccurate number bestowed upon us at birth as just another means for others to judge and classify us"

sulfericacid

I don't check input if it is only for DB insertion

If you use placeholders in your SQL queries, you don't need to worry about escaping issues, and you can write cleaner database queries that don't contain Perl code or variables.

There are modules that will determine file type for you, however if you just want to check for a text file you can probably just use this heuristic:

my $file = 'C:/tmp.zip';
open F, $file or die $!; 
read( F, my $buf, 1024 );
close F;
print is_text($buf) ? "$file is TEXT\n" : "$file is BIN\n";

# alternatively you can just...
print -T $file ? "-T $file is TEXT\n" : "-T $file is BIN\n";

sub is_text {
    my ($data) = @_;
  return 0 unless $data;
  return 0 if $data =~ m![\x00-\x08\x0b\x0e-\x1f]!;
  return 1;
}
[download]

All it does is look for any chars that should not be in a TEXT file but are found in binary files. The 1024 char is arbitrary but is the one used by file. There is also the -T file test in Perl which does something similar but needs a real file or handle rather than just a data buffer...

cheers

tachyon

s&&rsenoyhcatreve&&&s&n.+t&"$'$`$\"$\&"&ee&&y&srve&&d&&print

I don't shell user input, but I don't check input if it is only for DB insertion.

That's fine, but you should consider data coming out of the database to be tainted. I believe there's an option that can be passed to connect when you open the db handle that will cause data coming from the db to be marked as tainted. Then if you try to do anything insecure with it, you'll get an error relevant to what you were trying to do, so you know what your checking needs to ensure.

Further, what's to stop somebody from passing me an enormous file that crashes my server?

Bandwidth. If they have enough bandwith to send you a file large enough to crash your server, there are a dozen other ways they can DOS you. Set a limit if you're worried about it (other posts in the thread tell you how), but I doubt it will be a real issue.

$;=sub{$/};@;=map{my($a,$b)=($_,$;);$;=sub{$a.$b->()}}
split//,".rekcah lreP rehtona tsuJ";$\=$ ;->();print$/
[download]

I maintain that module, and feedback is welcome.

Mark