mojodaddy has asked for the wisdom of the Perl Monks concerning the following question:

Hello Monks,

If I were to summarize what I'm trying to do, I think it comes down to this: I would like to find a way to access the shell by manipulating an HTML form on a CGI web page.

I built a CGI "control panel" that I use to monitor various processes that run on my system. Basically the CGI queries a database and shows the results in tabular form on a web page served by localhost. (It's only used by me locally.) I have a nice big "refresh" button on it and throughout the day I update the page to see what's going on.

The processes themselves are perl scripts that I start and stop from the command line, and I use the data from the control panel page to decide what to start/stop and when.

It works, but it's become a bit unwieldly lately in the sense that I am having to keep multiple console windows open, and flipping through the windows to find the right one is a clumsy process. I tried running them as background processes that print their output to logfiles and then periodically doing a tail -f but the problem is if I don't see it, I tend to forget about it.

I am imagining enhancing my control panel page to allow me to start and stop each process via the HTML form, specifically with checkboxes. Checked, the program takes off running. Uncheck it and it stops.

[refresh] .=-----------=. | data | data | [X] <-- checkboxes |=-----+------| | data | data | [X] |=-----+-----=| | data | data | [X] '=-----------='
And ideally (though I may be getting over my head here) some way to monitor the output like via tail. And I don't want to have to rewrite all the scripts to make them into CGIs! ;)

What I can't seem to figure out is how or whether a CGI can execute a non-CGI script. Something like :

<form name="myform" action="not_a_cgi.pl" method="get"> <input name="checkme" type="checkbox"/></form>
and some sort of event handler, I guess, so that I can start/stop the processes by just changing the checkbox instead of having to "submit" the form.

Is any of this possible?

A slight aside: In one of my google searches (or maybe it was here on PM) I came across something like this:

<script type="text/perlscript">[perl code here]</script>

But when I tried it my Firefox browser just laughed at me. Is that some kind of old-school thing? :)

Replies are listed 'Best First'.
Re: CGI "control panel" app
by stonecolddevin (Parson) on Jul 24, 2007 at 03:25 UTC

    what's wrong with cpanel or Plesk?

    this is definitely not something i'd attempt to reinvent the wheel on.

    meh.
      Aren't those commerical software packages for managing web hosting accounts...?

        My point wasn't so much the software package itself, as anonymonk pointed out, there are free open source versions.

        My point was this: from what i gleaned from your post, it seems like it could very well be something that's already been done, tried and tested. So I'd probably put a little more emphasis on using an existing package and maybe hacking at the internals a little bit, if nothing else than for learning experience. Just my thoughts.

        meh.
        and if they are? There are others, like webmin, ispmanager ....
Re: CGI "control panel" app
by Your Mother (Archbishop) on Jul 24, 2007 at 04:10 UTC

    You can do just about anything even–

    and some sort of event handler, I guess, so that I can start/stop the processes by just changing the checkbox instead of having to "submit" the form.

    could be done with Ajax + Perl. But you are talking about a monstrous amount of code (for example, you’d might need to daemonize a bunch of stuff unless for polling you're willing to do slower log/output parsing) with lots of inherent security issues (if it can go bad on the shell, it can be asked to go bad from the CGI) if you’re going to try to control a bunch of stuff.

    I agree with dhoss. There are things already out there which are nice and could be tailored if needed.

      Yipes! I'm beginning to think I've done a really bad job of asking this question.

      OK, forget everything I said before. What I really want to know is how to do this:

      <form name="myform" action="not_a_cgi.pl" method="get"> <input name="checkme" type="checkbox"/></form>

      in other words, have a form's action execute a regular perl script instead of a CGI.

      Addendum:

      In hindsight, maybe it was referring to my little web page as a "control panel" that led to the confusion. In reality it's a page with an HTML table on it and a refresh button that redraws the table. So maybe "control panel" was overstating it! :)

      And maybe "event handler" was the wrong term (obviously it was if it's something that would require a "monstrous amount" of code), but I just meant something like

      <input name="checkme" type="checkbox" onclick="submitform();">

      I was just too lazy to type it the first time as I wasn't 100% sure on the syntax.

      In any event, thank you for offering your suggestions.

        The only real difference between a CGI script and "not_a_cgi.pl" is that the former prints its results back to the browser along with a content-type header. If you are going to access the script via a regular HTML form submit, you need it to print something back, even if that something is just the same form getting redisplayed. If you use AJAX, you can make it so that the checkbox fires off a call to the script without submitting the form or refreshing the page and therefore the not_a_cgi.pl will work fine since it isn't expected to print a content-type header or anything else to the browser. You could also make a little CGI wrapper that calls the not_a_cgi.pl scripts and redisplays the form on success and displays an error message on failure.

        I think what you want to do is this:

        Create a CGI wrapper script around your "not a CGI script" script. Inside the wrapper, invoke the regular script using system(), or back ticks:

        $status = `not_a_cgi.pl`;

        Note that this is normally considered a bad idea (security risk, etc) - BUT, if you're only running on localhost, and no one else has access to your machine, and you have some way to guarantee that only you can see the control panel page (maybe a login page?) etc., etc. then it might be okay for what you want to do.

        BUT - keep in mind that the script will run with the user id of the web server. For example, if you're running Apache it usually runs as user "apache", so any files you need to access from within your script must be readable/writable by "apache".

        If this causes problems, you can modify the apache config file so that CGI scripts in your own CGI bin directory run with your user id instead (again, this is usually considered a bad idea, security risk, etc.) but may be okay for what you want.

        I've done stuff like this before, but always within a company intranet, behind a firewall, for internal tools, used only by myself, etc. I'd never recommend something like this out in the wild.

Re: CGI "control panel" app
by leocharre (Priest) on Jul 24, 2007 at 13:19 UTC
    I have a few thoughts.
    • My friend, first is that the "hottest places in hell" are reserved for shell abusers. - hitting calls to the computer via a browser is sketchy. Do things of this sort with the fear of theism in your heart.
    • Consider Nagios to monitor what goes on a system/network. We've used this in various networks, it's just the cutest swedish bikini team ever wrapped up in a red velvet napkin. Super useful software- I cannot highlight this enough. It could easily be overkill in your situation.
    • Lastly, and a more likely solution to what you speak of- is cron. I am assuming this is a posix machine and you have shell access(?)- do
      crontab -l; # to see what you have 
      vim ~/mycrontab; # insert your entries
      crontab ~/mycrontab; # set to use them
      crontab -l; # check it again
      
      This would likely be a much better alternative for you, to run processes on the machine. Google for "crontab examples"
      Nagios does seem a bit overkillish, especially given that the "processes" I'm monitoring are more "Hello world" than "netstat". : )

      It's cool that it even monitors temperature, though.

      As for cron, the thing is that I have to evaluate when to stop/start each of the processes, so having them run at set times every day/hour/whatever would be a bad thing.

        How do you evaluate when to stop or start? *You* the human being is who judges? What is an example of when to stop? When a certain cpu boundary is met? When something appears o n the screen? Is what these shell programs do just to retreive information and report it back? What would an example evalution be which you think you need a human being's intervention? I have a feeling whatever it is it could be logged, sent to you via email, triggered by a set of system conditions, etc.

        I'm sure you know this already; If you state an example of one of these programs, *what* it should do - not *how* - you will be shocked with how many ideas are out here from your perl brethren. You want to put a nail on a wall, but someone out here will show you how you can make the wall lie down on the nails and get them all in at once instead! I've had a lot of those moments here.

        Some of the things I would be curious about here concern security, not so much *if* these things can be done.

        Is this something only people with clearance would use? That is, someone who can usually root into the system would be using this (aside of what user the process runs as), just curious.