here is also the whole index.pl....if you are not bored have a look.....undef @isfile{@files}; exists $isfile{$file} or die;
Sorry for the mess i caused and please excuse me for my curiocity.....but anyways no harm is done. All works great now... :-) Lucky me!#!/usr/bin/perl -w use CGI::Carp qw(fatalsToBrowser); use CGI qw(:standard); use DBI; use DBD::mysql; use Mail::Sendmail; $xronos = scalar(localtime(time + 10800)); $xronos =~ s/:\d{2} \d{4}//g; $ip = $ENV{'REMOTE_ADDR'}; @numbers = split (/\./,$ip); $address = pack ("C4", @numbers); $host = gethostbyaddr ($address, 2) || $ip; print header( -charset=>'iso-8859-7' ); print start_html( -title=>'Ψυχωφελή Πνευματικά Κείμενα!', -background= +>'../data/images/night.jpg' ); $db = ($ENV{'SERVER_NAME'} ne 'nikos.50free.net') ? DBI->connect('DBI:mysql:nikos_db', 'root', '') : DBI->connect('DBI:mysql:nikos_db:50free.net', '********', '***** +*') or print font({-size=>5, -color=>'Lime'}, $DBI::errstr) and exit 0 +; @files = <../data/texts/*>; foreach (@files) { $_ =~ s/.*[\/\\](.*)/$1/; } print start_form(-action=>"index.pl"); print p( {-align=>'center'}, font( {-size=>5, -color=>'Lime'}, 'Λόγ +ος Ψυχωφελής και Θαυμάσιος => ' ), popup_menu( -name=>'select', -values=> +\@files ), submit('ok')); print end_form(); $file = param("select") || $files[rand(@files)]; undef @isfile{@files}; exists $isfile{$file} or die; open(IN, "../data/texts/$file") or die $!; @data = <IN>; close(IN); $data = join("", @data); $data =~ s/\n/\\n/g; #********************************************************************* +********** print <<ENDOFHTML; <html><head><title></title> <script type="text/javascript"> var textToShow = "$data"; var tm; var pos = 0; var counter = 0; function init() { tm = setInterval("type()", 50) } function type() { if (textToShow.length != pos) { d = document.getElementById("DivText"); c = textToShow.charAt(pos++); if (c.charCodeAt(0) != 10) d.appendChild(document.createTextNode(c)); else d.appendChild(document.createElement("br")); counter++; if (counter >= 1800 && (c.charCodeAt(0) == 10 || c == ".")) { d.appendChild(document.createElement("br")); d.appendChild(document.createTextNode("Press any key...")); counter = 0; clearInterval(tm); document.body.onkeypress = function () { document.getElementB +yId("DivText").innerHTML = ''; tm = setInterval("type()", 50); docume +nt.body.onkeypress = null; }; } } else clearInterval(tm); } </script> <body onload=init()> <center> <div id="DivText" align="Left" style=" background: url(../data/images/blueblack.jpg); border-color: Yellow; border-style: Groove; border-width: 10; width: 900; height: 500; color: Lightblue; font-face: Com; font-size: 19"> </div> </body> </html> ENDOFHTML #********************************************************************* +********** print br(), br(); print start_form(-action=>"show.pl"); print table( {-border=>1, -width=>"65%", -align=>"center", -style=>"bo +rder: ridge magenta; color: lime; font-size: 18", -background=>"../da +ta/images/fire.jpg"}, Tr( {-align=>'center'}, td( "Πώς σε λένε αδελφέ?" ), + td( textfield( 'onoma' ))), Tr( {-align=>'center'}, td( "Ποιά είναι η γνώμη σου για την ευχή + του Ιησού 'Κύριε Ιησού Χριστέ Ελέησον Μ +ε' ?" ), td( textarea( -name=>'sxolio', -rows=>5, -columns=>30 ))), Tr( {-align=>'center'}, td( "Μοιράσου μαζί μας μία κατά τη γνώμη + σου θαυμαστή προσωπική σου πνευματική ε +μπειρία από κάποιον γέροντα προς ώφελος των υπολοίπων αδελφών αν φυσικά έχεις . +..." ), td( textarea( -name=>'empeiria', -rows=>7, -columns=>30 ))) +, Tr( {-align=>'center'}, td( "Ποιό είναι το e-mail σου?" ), + td( textfield( 'email' ))), Tr( {-align=>'center'}, td( submit( 'Εμφάνιση' )), + td( submit( 'Αποστολή' )))); print end_form(), br(), br(); open(IN, "<../data/texts/tips") or die $!; @tips = <IN>; close(IN); @tips = grep { !/^\s*\z/s } @tips; $tip = $tips[int(rand(@tips))]; print table( {-width=>"90%", -align=>"center", -style=>"border: ridge +lightgreen; color: yellow; font-size: 18", -background=>"../data/imag +es/blue.jpg"}, Tr( {-align=>'center'}, td( font( {-size=>3, -color=>'white'}, b +( $tip ))))); $db->do( "UPDATE counter SET visitor = visitor + 1" ); $st = $db->prepare( "SELECT visitor FROM counter" ); $st->execute(); $row = $st->fetchrow_hashref; print font( {-size=>4, -color=>'Yellow'}, "<br>$host<br>" ); print font( {-size=>4, -color=>'Orange'}, "<br>$xronos<br>" ); print font( {-size=>4, -color=>'Cyan'}, "<br>$row->{visitor}<br><br> +" ); print a( {href=>'games.pl'}, img {src=>'. +./data/images/games.gif'} ); print p( {-align=>'right'}, a( {href=>'../data/photos/'}, font( {-size +=>4, -color=>'Lime'}, 'Π' ))); if ($host =~ /thes530-.*?\.otenet\.gr|millennium-.*?\.ccf\.auth\.gr/) +{ exit 0; } open(OUT, ">>../data/texts/log") or die $!; print OUT $host, " "x(40-length($host)), "-> ", $xronos, "\n"; close(OUT); if ($ENV{'SERVER_NAME'} ne 'nikos.50free.net') { exit 0; } #%mail = ( To => 'nik0s@mycosmos.gr', # From => 'roufianos@kyp.gr', # Subject => "Επισκέπτης από $host" # ); #sendmail(%mail) or die $Mail::Sendmail::error;
20040524 Edit by Corion: Removed DB username and password
In reply to Re: Re: Re: Company hacks through my Perl's Website Security hole
by Nik
in thread Company hacks through my Perl's Website Security hole
by Nik
| For: | Use: | ||
| & | & | ||
| < | < | ||
| > | > | ||
| [ | [ | ||
| ] | ] |