in reply to Re: Failed System/Exec Call under Right Permission with CGI
in thread Failed System/Exec Call under Right Permission with CGI

Dear McDarren,
You are right about the "taint" checking. But this is just a simplified example of the larger application I have. I am simply localizing the problem.
Secondly, why bother calling an external script in the first place? What's wrong with simply writing to the output file from within the same script?
As I mentioned inside the snippet. I have several perl scripts that interacts with each other (e.g. taking output as arg of another script). Putting them together would clutter the code and make it hard to maintain.

---
neversaint and everlastingly indebted.......
  • Comment on Re^2: Failed System/Exec Call under Right Permission with CGI

Replies are listed 'Best First'.
Re^3: Failed System/Exec Call under Right Permission with CGI
by McDarren (Abbot) on Jul 19, 2006 at 09:19 UTC
    Right. Well you need to decide whether you want system or exec. Although they are used in similar ways, their behaviour is very different. exec will terminate the current program, execute the external command - and never return. If that's not what you want, then use system.

    Next thing is to use the multi-arg form of system. This bypasses shell processing and hence protects against the scenario I alluded to above. So you'll want something like this:

    my @args = ('/path/to/prn_to_file.pl', $param1, '/path/to/results/outp +ut.txt'); system(@args) == 0 or die "Blah blah...:$!\n";

    Three things to note:

    1. system will use the first argument in the list as the external command to be executed, and the remaining arguments will be passed to that command. So obviously in the above example, prn_to_file.pl needs to expect two arguments and know what to do with them.
    2. system will return the exit status of the external command (not its output) - so the "or die" may have to be adjusted accordingly.
    3. You should supply the full pathnames to any external commands or scripts. (This is probably why your initial attempts were failing, but I've deliberately left this point till last).

    Cheers,
    Darren :)

    Update: - fixed code example (thanks Corion).

      McDarren,
      Following your advice, I have this snippet.
      my @args = ('perl', '/home/myname/public_html/somedir/cgi-bin/prn_to_file.pl',$param1, ,'>','/home/myname/public_html/somedir/results/output.txt'); system(@args) == 0 or die "Code does not work $!";
      While it does prints/shows this text in the browser (which is not what I really want):
      THIS IS YOUR INPUT TEXT: foo bar
      But still, no file is created. Did I still miss anything?

      Regards,
      Edward
        I think you mis-understood my first point above. The whole idea of using the multi-arg form of system is to avoid shell processing. The (small) price you pay for this is that you can't do redirection or piping like you might using the single-arg form.

        In your code snippet above, you are effectively calling perl and passing it 4 arguments, the last three of which it won't know what to do with.

        If I understand correctly what you are trying to achieve, then I would suggest that you need to modify your prn_to_file.pl script so that it accepts two arguments. The first will be the text to be printed, and the second will be the name of the file it prints to. Then you make your system call as per my previous example.

        Cheers,
        Darren

Re^3: Failed System/Exec Call under Right Permission with CGI
by shmem (Chancellor) on Jul 20, 2006 at 06:43 UTC
    I have several perl scripts that interacts with each other
    There might be no need for system or exec, then. See do FILE and require. You can handle all perl code in one single interpreter instance.

    --shmem

    _($_=" "x(1<<5)."?\n".q·/)Oo.  G°\        /
                                  /\_¯/(q    /
    ----------------------------  \__(m.====·.(_("always off the crowd"))."·
    ");sub _{s./.($e="'Itrs `mnsgdq Gdbj O`qkdq")=~y/"-y/#-z/;$e.e && print}