Merlyn's Basic Cookie Management (1)

tel2 has asked for the wisdom of the Perl Monks concerning the following question:

Hi Monks,

I'm trying to use (Merlyn's Basic Cookie Management) script, and it's working, but I have a some questions about it:

1. Creates files under: /tmp/File::Cache, but I'm on a shared webhost, and I'd rather have them under my own local tmp dir, in /home/username/tmp/File::Cache. How can I change the code to use that path? I see CGI has a -path switch, but I tried inserting this line:
-path => '/home/username/tmp',
after line 14 of Merlyn's code, but cache files are still being created in /tmp/File::Cache, and I would have thought that File::Cache controls where they are placed, but I can't see how to change that path in File::Cache.

2. I notice that if the directory structure under /tmp/File::Cache exists, but there are no cache files created in it yet, I get this error when I run the code:
"Insecure dependency in chdir while running with -T switch at /usr/lib/perl5/5.8.8/File/Find.pm line 751."
How should I get around this error? I see that removing the "-T" switch from the shebang line avoids it, and changing from File::Cache to Cache::FileCache seems to also, but I'm wondering if there's a better way.

Thanks.

Comment on Merlyn's Basic Cookie Management (1)

Replies are listed 'Best First'.
Re: Merlyn's Basic Cookie Management (1) by ELISHEVA (Prior) on Dec 20, 2010 at 08:49 UTC
You really do not want to remove the -T switch. That switch turns on taint mode which helps prevent someone from taking over your script and making it do nasty things like wipe out your hard disk, remove key system files or run a DB query that will bring your website to its knees. There is a nice explanation here: http://gunther.web66.com/FAQS/taintmode.html To perform system operations while in taint mode you have to make sure that any variable you have passed to those system functions has been validated and marked as untainted. To untaint data you pass it through a regular expression. The fields you extract from the regular expression will be marked as untainted, but the original data will continue to be tainted. The regular expression should validate the data, removing any unexpected characters. For example, `# data expected to be a number my ($iCount) = ($dataFromTheWeb =~ /^(\d+)$/); # data expected to be a user name my ($sUser) = ($dataFromTheWeb =~ /^(\w+)$/); # data expected to be a server path (POSIX syntax) my ($sPath) = ($dataFromTheWeb =~ /^([\w\/]+)$/); # and so on...` [download] If you aren't sure whether or not a variable has been de-tainted, you can call `Scalar::Util::tainted($var)`. You must, of course, put `use Scalar::Util` at the top of your script under `use strict; use warnings;` and your other `use` statements, if it isn't there already. To make system calls or run scripts/modules that make them, you also need to clear the environment (`%ENV`) of certain environment variables, in particular `PATH`. Taint mode wants to make sure it knows exactly which executable is being executed so anything that would allow a relative path to an executable (e.g. `PATH`) needs to go away, like this: `$ENV{PATH} = '';`	[reply] [d/l] [select]
Re: Merlyn's Basic Cookie Management (1) by Khen1950fx (Canon) on Dec 20, 2010 at 08:34 UTC
File::Cache has been deprecated. You'll need to use Cache::Cache instead. Put the -T back on the shebang line. Just run your script with -T on the command line, too.	[reply]
Re^2: Merlyn's Basic Cookie Management (1) by Your Mother (Archbishop) on Dec 20, 2010 at 14:42 UTC
Cache::Cache has been deprecated (well, no, not really). You should use CHI instead (yes, probably).	[reply]
Re: Merlyn's Basic Cookie Management (1) by Anonyrnous Monk (Hermit) on Dec 20, 2010 at 09:35 UTC
but I can't see how to change that path in File::Cache. Both File::Cache and Cache::FileCache use the `tmpdir()` routine from File::Spec. If you weren't running in taint mode, you could simply set the environment variable TMPDIR, but in taint mode, the variable is ignored. So, a quick hack around this would be to monkey patch Cache::FileCache's `_Get_Temp_Directory()` routine: `use Cache::FileCache; { no warnings 'redefine'; sub Cache::FileCache::_Get_Temp_Directory { return File::Spec->_tmpdir( '/home/username/tmp' ); } }` [download] The directory must exist, i.e. it isn't created by the call. Also note the underscore in `_tmpdir`. This is the routine which is normally (internally) called like this `$self->_tmpdir( $ENV{TMPDIR}, "/tmp" );`	[reply] [d/l] [select]
Re: Merlyn's Basic Cookie Management (1) by tel2 (Pilgrim) on Dec 23, 2010 at 00:09 UTC
Many thanks to all of you for your helpful responses! Good to have you on the PerlMonks team. Feel free to have a Christmas break now (I think you deserve it), and don't forget the reason for the season. tel2	[reply]