in reply to Having trouble creating a text file

In your first snippet, one problem could be where "$storyfile" comes from. Is a portion of it coming from a source that taint mode would frown upon? That's my thought; that you'e accepting at least a portion of $storyfile from a source that could be considered tainted (or taintable).

In your second snippet, you're not even opening the file for output; you're opening it for input. And "Could not write..." is fooling you; it's your own error message. It should actually say, "Could not read from..." (since you're opening the file for reading in that second snippet). And the reason it's failing to open for reading is probably that it doesn't exist yet since you haven't written it yet.

By the way; use the three-arg version of open: open STORY, '>', $storyfile or die .....

Oh, that reminds me of another problem; in your first snippet you're using the wrong "or"; since there aren't any parens around the open argument list, you need to use "or" instead of "||", or else you get into precedence trouble.


Dave

Replies are listed 'Best First'.
Re^2: Having trouble creating a text file
by greymoose (Beadle) on May 06, 2007 at 23:56 UTC
    Thanks davido,
    That was exactly the problem. When I went through and untainted the data from the form as part of the process it worked a dream.

      Just a few words of warning then; if data submitted via a web form is dictating a portion of the filename, you could have a security vulnerability, and the fact that you've subverted taint-checking on $filename doesn't necessarily mean it's safe. Tread carefully in these waters.


      Dave

        Thanks for the advice. The files that are created are articles for a community newspaper's website. Everything in them is public domain and they are non executable text files.
        Only the site itself will need to access them once they are created and only staff at the newspaper will be able to create them. I don't think there is much of a security risk involved in this instance. (I've been wrong before though.)