$ENV{DOCUMENT_ROOT}, for web config files

Spidy has asked for the wisdom of the Perl Monks concerning the following question:

Greetings Fellow Monks,

I've recently been doing some work writing web systems that use Perl, CGI, and MySQL to get stuff done. Now, in order to make things easy to install on various sytems, I've included a file(install.cgi), in which users fill out their MySQL database information, for the system to use. This information is then written, in hash form, to a file that's located at

"$ENV{DOCUMENT_ROOT}/../systemname.cfv"
[download]

Which is then retrieved by my configuration script.

Now, in practice and testing situations, this has worked perfectly fine. However, I've been having some nagging doubts recently: what happens when this system is installed on two subdomains of the same main domain? Will the second installations config file clobber the first installation's, or is this okay?

Thanks,
Spidy

My Website
Get Eated!

Comment on $ENV{DOCUMENT_ROOT}, for web config files Download Code

Replies are listed 'Best First'.
Re: $ENV{DOCUMENT_ROOT}, for web config files by jdtoronto (Prior) on Aug 03, 2006 at 02:07 UTC
Spidy On my servers (a pretty typical configuration) each subdomain is in a directory below the public_html of the root domain. A CGI in the subdomain has its DOCUMENT_ROOT as it own root directory. So it would not have any issues on my systems, but it is possible that some setups would. Personally I would change your approach so that the systemname.cfv had a unique name for each sub-domain thus they would not clash with each other. I would also be inclined to save it in the same directory as the CGI itself, or in a directory off the document root. Although it is not a Perl application, the techniques used in MySQL's Eventum event manager ( a PHP application ) are worthy of study. It does pretty much what youare doing. jdtoronto	[reply]
Re^2: $ENV{DOCUMENT_ROOT}, for web config files by Spidy (Chaplain) on Aug 03, 2006 at 02:39 UTC
The problem with saving off the document root or in the same directory is that the system's source code is being passed around; theoretically, anyone with malicious intent who got ahold of it would be able to get at someone's config file easily, and retrieve the important information. Putting things into DOCUMENT_ROOT/../systemname.cfv puts the file above public_html, so that people cannot access it with a web browser. Which is what I need. My Website Get Eated!	[reply]
Re: $ENV{DOCUMENT_ROOT}, for web config files by Anonymous Monk on Aug 03, 2006 at 04:09 UTC
what happens when this system is installed on two subdomains of the same main domain? If the hostnames are unique this should work: `"$ENV{DOCUMENT_ROOT}/../$ENV{HTTP_HOST}.cfv"` [download]	[reply] [d/l]