in reply to Printer module from web interface

You've hit a Taint issue. How is $pr_cmd formed? You should be able to untaint $pr_cmd by running it through a regex match and using a matched string as the value for $pr_cmd.

True laziness is hard work

Replies are listed 'Best First'.
Re^2: Printer module from web interface
by ksublondie (Friar) on Mar 08, 2011 at 00:13 UTC
    $pr_cmd is set in the Printer::Unix module: 
    my $pr_cmd = "| lpr -P $self->{'printer'}{$OSNAME}";

    [download]
    I've added: 
    $pr_cmd=~/^(.*)$/;
$pr_cmd=$1;

    [download]
    and I've even tried hard-coding $pr_cmd="| lpr -P lp" but I'm still getting the same error. Interesting observation: 
    open PRINTER, $pr_cmd
          or warn
          "Can't open printer connection to lp: $!";

    [download]
    Doesn't show my warning text. Is that to be expected?
[reply]
[d/l]
[select]

      Oh!. Maybe you need to untaint $ENV{PATH}. If it's used by open, which is likely, then you'd get that error and your script would die horribly before hitting the warning.

      True laziness is hard work
[reply]
        (server died yesterday, so I'm back on this issue after wasting precious time...*sigh*)

        So, I've modified the beginning of the Printer::Unix file in the standard Printer module (which, BTW, I feel so inadequate to modify a CPAN module): 

        use Env qw(PRINTER LPDEST NPRINTER NGPRINTER PATH);
#added the two following lines
$ENV{'PATH'}='/usr/local/sbin';
delete @ENV{'IFS', 'CDPATH', 'ENV', 'BASH_ENV'};

############################################################
sub list_printers {
...

        [download]
        If I understand correctly, this should properly untaint $ENV{'PATH'}, right? I'm still getting the exact same error. Is there something I'm forgetting or missing or just plain ol' not understanding?

        I've verified the location permissions. Anything I set it to is non-world writable, but still tanks.

        I don't know if it's relevant, but I found this. It appears to be very similar to what I'm experiencing, however, with a different module. Of course the fix given in that post is specific to the MIME::Lite module...not helping here.

[reply]
[d/l]

In Section Seekers of Perl Wisdom