|
Re: use variable as name for new file
by davorg (Chancellor) on Jun 16, 2006 at 12:14 UTC
|
I dont know why the above doesnt work
You need to expand a bit on this. In what way doesn't it work? What unexpected behaviour are you seeing? What error messages do you get? Is anything written to the web server error log?
Just saying "it doesn't work" means that any help we can give you is purely based on guesswork.
--
< http://dave.org.uk>
"The first rule of Perl club is you do not talk about
Perl club."
-- Chip Salzenberg
| [reply] |
Re: use variable as name for new file
by samizdat (Vicar) on Jun 16, 2006 at 12:54 UTC
|
Welcome!
The Perl CGI script is being run under the userid of the webserver (I'm assuming this is Apache under FreeBSD or Linux?), not your own. The directory where your file is to be created/opened needs to be writable by the webserver.
First, find out what userid the httpd daemons are running as:
$ ps -aux | grep httpd
root 17714 0.0 0.2 5184 4456 ?? Ss 7Jun06 0:12.49 /usr/lo
+cal/sbin/httpd
www 17715 0.0 0.4 9164 8272 ?? I 7Jun06 0:00.24 /usr/lo
+cal/sbin/httpd
www 17716 0.0 0.4 8744 7864 ?? I 7Jun06 0:00.15 /usr/lo
+cal/sbin/httpd
www 17717 0.0 0.4 8768 7996 ?? I 7Jun06 0:00.19 /usr/lo
+cal/sbin/httpd
www 17724 0.0 0.4 8748 7788 ?? I 7Jun06 0:00.19 /usr/lo
+cal/sbin/httpd
www 17756 0.0 0.4 8772 7820 ?? I 7Jun06 0:00.20 /usr/lo
+cal/sbin/httpd
dwilde 7928 0.0 0.0 1512 988 p7 S+ 6:28AM 0:00.00 grep ht
+tpd
You'll note that the primary (on my system) is running as root, the rest as user 'www'. Therefore, the directory on the filesystem -- and it should be fully specified, such as '/var/web/root/logs/mylog.log' -- needs to be writable by www, or whatever your server is set up as. Apache configurations are very flexible, and it's equally likely your server will be running under user 'nobody'. In any event,
make writing possible:
$ su
Password:
# chown www /var/web/root/logs
# chmod 744 /var/web/root/logs
# exit
$
As has been mentioned, allowing somebody to open a file on your server and write to it can cause mucho heartburn. Be very careful what you allow and who you allow to do it. I'd suggest that you force the directory and only allow the filename to be chosen:
my $subject = param('subject');
open (LOG, ">/var/web/root/logs/$subject") || die "Error opening file
+: $!\n";
And make sure that your script is limited as to how much information can be written to the file. Bear in mind that Perl can be used to poke a webserver as well as being poked, and some nasty little script kiddie will surely use it to do so at some point in your life. =8^O
Don Wilde
"There's more than one level to any answer."
| [reply]
[d/l]
[select] |
|
|
THis is the error Im getting
createfile.cgi did not produce a valid header (name without value: got line "syntax error at createfile.cgi line 27, near "$subject")
| [reply] |
|
|
I see that you've posted more, thanks. It's not the file write at all. You should create a CGI query object and use the OO interface. If you use the functional interface there's another step to it, before you can read parameters. Forgotten what it is at the moment, sorry.
my $q = new CGI;
my $subject = $q->param('subject');
Is the page this is run from _sending_ the parameters??? This might be your real problem. Is your <form> set up properly?
Don Wilde
"There's more than one level to any answer."
| [reply]
[d/l] |
|
|
|
|
Re: use variable as name for new file
by Fletch (Bishop) on Jun 16, 2006 at 12:08 UTC
|
Well, several things stand out.
- better practice is to use the three arg form of open: open( LOG, ">", $subject )
- it'd be good to include $! in your error message so you know why the open failed
- it's probably not a good idea to take an arbitrary path from J Random Formsubmitter and use it willy-nilly as a path (and if you're running with tainting enabled Perl should have screamed at you for trying to do so; see perlsec)
- "Perl" is the language, "perl" is the implementation; "PERL" is just wrong
| [reply]
[d/l] |
Re: use variable as name for new file
by kabeldag (Hermit) on Jun 16, 2006 at 12:05 UTC
|
Yeah. Use the $! var.
$! will only be set if a system call fails.
Your syntax is fine. You probably want to look at file permissions. | [reply] |
Re: use variable as name for new file
by eric256 (Parson) on Jun 16, 2006 at 14:46 UTC
|
You could help us all by using <code></code> tags. Your print statments look a little crazy right now. Then \n will do the new line you dont need to include a newline in it as well.
$name = $subject; needs a my in front of it just like the declerations above it. You also need to uncomment the line that is printing the header.
| [reply]
[d/l]
[select] |
|
|
Thanks. Now I did the change as you stated. Now Im getting this:
Insecure dependency in open while running with -T switch at /pw/data/PWWWDEVL/cgi-bin/eng/strudyn/devl/survey/zal/createfile.cgi line 27.
| [reply] |
|
|
Thats perls way of telling you that you are trying to open a file with a name supplied by a user and you REALY REALY don't want a user to be able to open any file they want. So at very least you need to check the file name coming from the user and verify that it is okay to open, but better would be to figure out how not to have the user specify the file name.
| [reply] |
|
|
|
|
|
|
Re: use variable as name for new file
by jesuashok (Curate) on Jun 16, 2006 at 11:47 UTC
|
Hi
Welcome to monks. :-)
I assume you are not giving any file path in Subject.
you should add the relative path name while opening the file.
1) check whether $subject is empty or not.
2) check whether the file name already exists or not.
open ( LOG,">/home/user/log/$subject") or die("Error in opening the fi
+le :$!:");
"Keep pouring your ideas"
| [reply]
[d/l] |
|
|
Hi Jesuahok
Thanks for the reply. I did the above and still is not working. Are there other tricks you can think of to make the above work.
| [reply] |
A reply falls below the community's threshold of quality. You may see it by logging in.
|