Re: about DBI

If you want to completely disable security checking, I'd suggest you 
change the permit line to:

   $compartment->deny_only(qw(:dangerous));

Ie, everything except in principle only dump() and chroot() is allowed. 
With this, for example the following is possible:

<SURVEY TITLE="test">

   <CUSTOM ESCAPED="no">
     <pre>{&
      open(PIPE,"/bin/ls -l /etc |");
      $string = join('',<PIPE>);
      close(FIL);
      print $string;
   &}</pre>
   </CUSTOM>

   <TEXT NAME="test" CAPTION="test" />

</SURVEY>

To avoid problems with clashes with how mod_survey uses use() and replaces 
things inside the code in the Safe department, I'd suggest making an 
external script which prints a value:

   <ROUTE CONTINUE="{&
     $someguy = $ses->getValue("SUBMITTED_name");
     open(PIPE,"/usr/bin/perl /home/me/myscript.pl $someguy |");
     $allowed = <PIPE>;
     close(PIPE);
     chomp($allowed);

     if($allowed eq "yes")
     {
       print "continuesurvey.survey";
     }
     else
     {
       print "quotaerror.survey";
     }
   &}" />

The external script should have no problem with running DBI related stuff.

   // Joel



  On Fri, 15 Feb 2008, Luca Notari wrote:

> Using IMPORT tag I can access a database via VARIABLE or ARRAY, and this
> variable is included in the list of variables of the survey.
>
>
> But what if I don't want to include the variable?
>
> to do this, I've tried to use DBI in perl snippet but In all cases,
> doesn't work for me(continuous document error or display error; I've
> opened the compartment->permit
> $compartment->permit(qw(:browse :filesys_read :sys_db :filesys_open
> :filesys_write :subprocess :base_core :default :base_io :others require
> caller))
> both in Display.pm and Document.pm
>
> I've also tried to use open function: open FILE,"myfile.txt", but, again
> nothing works:
>
>
> Document error
>
> Security exception: Undefined subroutine &Carp::longmess_heavy called at
> /usr/lib/perl5/5.8.3/Carp.pm line 166, line 30.
>
> Platform: linux-suse
> Modsurvey version 3.2.4
> Perl 5.8.3
> mod_perl 1.99
>
>
>
> The reason for which I have to fetch data from external is: check
> quotas. If I'm a respondent out of quotas, I have to route to a page
> named i.e. quotafull.survey.
> To do this, I 1) have to query my DBMS or 2) read a text data or csv
> data from external
>
> Is there any possibility to fetch data from external source (text files,
> databases) and put in a .survey script page with Perl snippets?
>
>
> (I can easy do this with php script, and try to call it via XMLHttp
> using javascript; but, according my knowledge, i have to put variables
> fetched somewhere in the page,
> for example using an 'hidden' field; but for variables to be available
> for perl, i think i have to submit them ; this is a problem as I need
> variables available in the same page)
>
> thanks,
>
> Luca Notari
>
>
Skickat av Joel Palmius <[email protected]>
till survey-discussion