Re: Re: unix write command through system

The appropriateness of using write varies from culture to culture. In places where I've worked, it's never been regarded as a particular nuisance, although I don't believe we had automatic programs using it.

Anyways, for very short messages, something like this will work just as well, and be a little bit simpler:

system("echo '$message' |/usr/bin/write '$user' '$tty'");
[download]

Also, keep in mind that all of the techniques posted have been horribly insecure if you don't have control over the contents of all shell parameters. Consider what would happen if $user was set to:

'; rm -rf /; echo '

Comment on Re: Re: unix write command through system Select or Download Code

Replies are listed 'Best First'.
Re: Re: Re: unix write command through system by Jimbobbob (Initiate) on Oct 19, 2003 at 16:15 UTC
Thank you everyone, Zaxo's and sgifford's methods work perfectly. (I'm sure pg's would have too, but the other two are just simpler, i dont have to load a module.) And yes, i will certainly be verifying the parameters to make sure they're not doing anything like that!	[reply]
Re: Re: Re: unix write command through system by etcshadow (Priest) on Oct 20, 2003 at 03:08 UTC
Or, instead of just trying to verify the shell paramaters, you can properly escape them. Like: `for ($message,$user,tty) { s/'/'\\''/g; } system("echo '$message' \|/usr/bin/write '$user' '$tty'");` [download] That way if someone tries to pass in a $message of '; rm -rf /; echo ' then, it's cool, you just write that out, not execute it. ------------ :Wq Not an editor command: Wq	[reply] [d/l]