in reply to Re: CGI and security
in thread CGI and security

use CGI::Carp qw(fatalsToBrowser); local $SIG{__WARN__} = \&Carp::cluck;
I tried putting this code. (I was looking for this piece of code. Thanks). It thrown this error "Software error: CGI open of tmpfile: Permission denied".

On googling I found like CGI defaults the temp directory to /usr/tmp. Is there any way to override this temporary path.

Replies are listed 'Best First'.
Re^3: CGI and security
by zentara (Cardinal) on Jul 12, 2012 at 14:59 UTC
    It thrown this error "Software error: CGI open of tmpfile: Permission denied".

    The way I interpret that error, is that your file upload script dosn't have permission to write to the designated upload directory. This is usually because it is not mode 0777 or world-writable, which is needed by file uploads ( unless your apache server is using su-exec).

    You really should post a minimal running code example which fails, so we can see where your problems are.

    It is 99% probable that the problem IS NOT due to the CGI module. People successfully run http file uploads all the time, but you must have your file paths and permissions correct.

    Here is a simple upload script to test with. In your cgi directory, where you place this script, make a subdir called "uploads" and chmod it to 0777. Then run this script thru the browser.

    #!/usr/bin/perl use warnings; use strict; use CGI; use CGI::Carp 'fatalsToBrowser'; my $maxsize = 1024 * 100; #max 100K my $query = new CGI; my $upload_dir = "uploads"; #permissions for dir are set 0777 print $query->header(); if($ENV{CONTENT_LENGTH} > $maxsize){ print "file too large - must be less than $maxsize bytes"; exit; } my $file = $query->param("file"); my $filename = $file; $filename =~s/.*[\/\\](.*)/$1/; open (UPLOADFILE, ">$upload_dir/$filename") or die "$!\n"; $/= \8192; # sets 8192 byte buffer chunks, perldoc perlvar while ( <$file> ){ print UPLOADFILE $_; } close UPLOADFILE; print <<END_HTML; <HTML> <HEAD> <TITLE>Thanks!</TITLE> </HEAD> <BODY bgcolor="#ffffff"><br> <P>Thanks for uploading file : $filename!</P> </BODY> </HTML> END_HTML

    I'm not really a human, but I play one on earth.
    Old Perl Programmer Haiku ................... flash japh
Re^3: CGI and security
by Your Mother (Archbishop) on Jul 15, 2012 at 22:32 UTC

    One side note: CGI::Carp::warningsToBrowser might be worth looking into.

Re^3: CGI and security
by Anonymous Monk on Jul 12, 2012 at 11:32 UTC

    On googling I found like CGI defaults the temp directory to /usr/tmp. Is there any way to override this temporary path.

    What does the CGI documentation say?

Re^3: CGI and security
by afoken (Chancellor) on Jul 14, 2012 at 05:07 UTC
    CGI open of tmpfile: Permission denied

    Hoster error. Contact support. See also Re: On uploading a file.

    Alexander

    --
    Today I will gladly share my knowledge and experience, for there are no sweeter words than "I told you so". ;-)