Ok, I got your code to work by checking for tainted data. Can you take a look at the reg expressions that I used - is what I did secure enough? The main perl script that I am trying to create is a simple web page creation program that will allow users to create their own pages. I'm using a scalar called $drt to pass on the value of what ever user might be uploading files or deleting them. so for example in this line of code: my @files=glob("/Library/WebServer/Documents/userpages/$drt/*.*"); I'm passing the folder name of one of the users (bob_jones or whatever). Is this a bad way to do things? I have also checked for tainted data on this scalar -- does my regex make sense for this? Overall what can I do to make all of this more secure? Also one last thing. I need to be able to print out all the files in the directory that I am deleting from so users can select them properly. However with the glob function is prints out the whole path - how can I just print out the file names? Thanks in advance. Here's the code 

####
# Delete File
####

sub delete_file {

my $query;
# check for tainted data
my $files = $q->param( "files") || error( $q, "couldn't read File valu
+es");
$files =~ /^([\/.\w.]+)$/;
# The "untainted" file is now in $1
$files = $1;
die "Bad filename" unless $files;

print<<HTML;
<html>
<head>
        <meta http-equiv="content-type" content="text/html;charset=ISO
+-8859-1">
        <title>Upload - File Deleted</title>
    </head>

    <body bgcolor="#ffffff">
    <form action="upload.cgi" Method="post" ENCTYPE="multipart/form-da
+ta">
    <P>File(s) Have Been Deleted:
    <INPUT TYPE="HIDDEN" NAME="drt" VALUE="uploads2">
    <br>
HTML


foreach ($q->param("files")){
unlink($_);
}

print<<HTML;

                <br>
                <INPUT TYPE="submit" NAME="action" VALUE="Back To Main
+">
    </FORM>
        <p></p>
<!-- trying to get dir_files to print here -->
HTML


}

#### end of delete file

####
# Get File List
####

sub get_file_list {

my $drt = $q->param( "drt") || error( $q, "couldn't get drt value");
$drt =~ /^([\w.]+)$/;
# The "untainted" file is now in $1
$drt = $1;
die "Bad filename for value drt" unless $drt;

#opendir(DIR,$dfiles);
#my @files = grep { $_ ne '.' && $_ ne '..' } readdir(DIR);
#closedir(DIR);

my @files=glob("/Library/WebServer/Documents/userpages/$drt/*.*");

print<<HTML;
<html>
    <head>
        <meta http-equiv="content-type" content="text/html;charset=ISO
+-8859-1">
        <title>Upload - Delete Files</title>
    </head>
    <body bgcolor="#ffffff">
    <form action="upload.cgi" Method="post" ENCTYPE="multipart/form-da
+ta">
    <P>List of Files:
    <br>
    <INPUT TYPE="HIDDEN" NAME="drt" VALUE="uploads2">
HTML

foreach (@files) {
print "<br> Delete this File: $_ <INPUT TYPE=\"checkbox\" NAME=\"files
+\" VALUE=\"$_\">\n";
}

print<<HTML;
                <br>
                <br>
                <INPUT TYPE="submit" NAME="action" VALUE="Remove File(
+s)">
    </FORM>
HTML

}

### end of get file list

[download]

In reply to Re: Re: Allow User to Select Which Files to Delete by lex2001
in thread Allow User to Select Which Files to Delete by lex2001

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.