Re^3: Array values reformation

Ahh...

Do they all have the same pathname and extension? If so, then just write "../data/texts/$file.txt". However, I think I might have a better structure for the popup menu.

$i = 0;
foreach (@files) {
  %label_hash{$_} = $display_names[$i++];
}
#Have to have a hash in a -labels field,

print popup_menu(-name => 'choice", -values => \@files, -labels => %la
+bel_hash)
[download]

This way, your labels don't have to be the same as your values. Now your user sees pretty labels, while your param("choice") will still return full pathnames.

Peace,
LassiLantar

Comment on Re^3: Array values reformation Download Code

Replies are listed 'Best First'.
Re: Array values reformation by b10m (Vicar) on Jul 24, 2004 at 20:46 UTC
Now your user sees pretty labels, while your param("choice") will still return full pathnames. Yes, that makes it easier to go to things like "`http://server/script.cgi?choice=%2Fetc%2Fpasswd`" too ;) -- b10m All code is usually tested, but rarely trusted.	[reply] [d/l]
Re^2: Array values reformation by LassiLantar (Monk) on Jul 24, 2004 at 21:09 UTC
Hehe, good point b10m. So is the only way to pass things like this securely by storing them in local files inaccessible to the user since you can't pass anything between instances of the script (non-persistant environment) and you shouldn't pass anything as a value (not secure)? Peace, LassiLantar	[reply]
Re: Array values reformation by b10m (Vicar) on Jul 24, 2004 at 21:15 UTC
Well, you'll have to keep in mind that "(L)users are evil"™ Your first answer was already better, but I'm not exactly sure how Perl would handle input like "`../../../../etc/passwd\0`" (read: too lazy to test it). A little more secure would be to store the allowed files in a hash or array and give those choices to the l-user. -- b10m All code is usually tested, but rarely trusted.	[reply] [d/l]
A reply falls below the community's threshold of quality. You may see it by logging in.
A reply falls below the community's threshold of quality. You may see it by logging in.
A reply falls below the community's threshold of quality. You may see it by logging in.