Re: R: about DBI

  This message is in MIME format.  The first part should be readable text,
  while the remaining parts are likely unreadable without MIME-aware tools.

---481066056-419073520-1204042959=:19675
Content-Type: TEXT/PLAIN; charset=iso-8859-1; format=flowed
Content-Transfer-Encoding: QUOTED-PRINTABLE

The behavior of "use" inside a Safe compartment is undefined and, I guess,=
=20
rather random. With DBI installed, mod_survey already "use":d DBI, and I=20
can't even guess what the consequences for local and global instances will=
=20
be inside a Safe department.

All in all, Safe was never intended for complex code relying on external=20
libraries. As far as I can understand, it rewrites the code it evaluates=20
to provide for a compartmentalized namespace, but the authors state in the=
=20
man file for example that "signals causing signals" affect the outside of=
=20
the compartment, and so do operations such as chroot().

Thus it'd be better to spawn a separate process outside Safe for complex=20
stuff such as DBI.

Did you try executing the script externally instead? For example:

   {\
     open(PIPE,"/usr/bin/perl /home/luca/myscript.pl |");
     $var =3D join('',<PIPE>);
     close(PIPE);
     print $var;
   \}

=2E. where "/home/luca/myscript.pl" is the script which worked on a console=
=20
prompt. With $compartment->deny_only(qw(:dangerous)); this should open an=
=20
external process which is not dependent on anything related to Safe or=20
mod_perl.

   // Joel


On Tue, 26 Feb 2008, Luca Notari wrote:

> I've tried to do $compartment->deny_only(qw(:dangerous));
>
> I still have problems in using DBI in perl snippet; as example, I put
> here a piece of code that I've used from shell environment with success,
> and inside mod_survey perl snippet without success:
>
> THIS WORKS:
> #!/usr/bin/perl
> use DBI;
> use DBD::mysql;
> my $dbh =3D DBI->connect('DBI:mysql:test','root','passwd')
>  or die "Couldn't connect to database: " . DBI->errstr;
> $query=3D"SELECT * from test.test";
> $query_handle =3D $dbh->prepare($query);
> $query_handle->execute();
> $query_handle->bind_columns(\$id, \$nome, \$descriz,\$user,\$email);
>
> while($query_handle->fetch()) {
>   print "$nome <br />";
> }
>
> AND THIS DOESN'T WORK:
> {\
> use DBD::mysql;
> use DBI;
>
> $dsn=3D"DBI:mysql:test:localhost:3306";
> $dbh =3D DBI->connect("DBI:mysql:test:localhost:3306","root","pwd");
> $query=3D"SELECT * from test.test";
> $query_handle =3D $dbh->prepare($query);
> $query_handle->execute();
> $query_handle->bind_columns(\$id, \$nome, \$descriz,\$user,\$email);
>
> while($query_handle->fetch()) {
>   print "$nome <br />";
> }
>
> \}
>
> It seems that this latter code make use of CPU very higher, and this not
> happens launching from shell.
> The limit of the IMPORT tag is that the retrieved variable is taken into
> the list of submitted variables (I don't want this!) and, above all,
> that is not possible to put 2 or more import tags into the same page.
> To do these SQL statements:
> 1. Select count(*) from tableA where column1=3D'something';
> 2. Select count(*) from tableA where column2=3D'something';
> 3. Select count(*) from tableA where column3=3D'something';
> 4. Select count(*) from tableA where column4=3D'something';
> 5. Select count(*) from tableA where column5=3D'something';
> If I'm right, I need at least 5 pages with IMPORT tag. What if I only
> have 4 pages or less?
>
> Luca Notari
> -----Messaggio originale-----
> Da: [email protected]
> [mailto:[email protected]] Per conto di Joel
> Palmius
> Inviato: venerd=EC 15 febbraio 2008 14.56
> A: [email protected]
> Cc: survey discussion list
> Oggetto: Re: survey-discussion-list: about DBI
>
>
> If you want to completely disable security checking, I'd suggest you
> change the permit line to:
>
>   $compartment->deny_only(qw(:dangerous));
>
> Ie, everything except in principle only dump() and chroot() is allowed.
> With this, for example the following is possible:
>
> <SURVEY TITLE=3D"test">
>
>   <CUSTOM ESCAPED=3D"no">
>     <pre>{&
>      open(PIPE,"/bin/ls -l /etc |");
>      $string =3D join('',<PIPE>);
>      close(FIL);
>      print $string;
>   &}</pre>
>   </CUSTOM>
>
>   <TEXT NAME=3D"test" CAPTION=3D"test" />
>
> </SURVEY>
>
> To avoid problems with clashes with how mod_survey uses use() and
> replaces
> things inside the code in the Safe department, I'd suggest making an
> external script which prints a value:
>
>   <ROUTE CONTINUE=3D"{&
>     $someguy =3D $ses->getValue("SUBMITTED_name");
>     open(PIPE,"/usr/bin/perl /home/me/myscript.pl $someguy |");
>     $allowed =3D <PIPE>;
>     close(PIPE);
>     chomp($allowed);
>
>     if($allowed eq "yes")
>     {
>       print "continuesurvey.survey";
>     }
>     else
>     {
>       print "quotaerror.survey";
>     }
>   &}" />
>
> The external script should have no problem with running DBI related
> stuff.
>
>   // Joel
>
>
>
>  On Fri, 15 Feb 2008, Luca Notari wrote:
>
>> Using IMPORT tag I can access a database via VARIABLE or ARRAY, and
>> this variable is included in the list of variables of the survey.
>>
>>
>> But what if I don't want to include the variable?
>>
>> to do this, I've tried to use DBI in perl snippet but In all cases,
>> doesn't work for me(continuous document error or display error; I've
>> opened the compartment->permit $compartment->permit(qw(:browse
>> :filesys_read :sys_db :filesys_open :filesys_write :subprocess
>> :base_core :default :base_io :others require
>> caller))
>> both in Display.pm and Document.pm
>>
>> I've also tried to use open function: open FILE,"myfile.txt", but,
>> again nothing works:
>>
>>
>> Document error
>>
>> Security exception: Undefined subroutine &Carp::longmess_heavy called
>> at /usr/lib/perl5/5.8.3/Carp.pm line 166, line 30.
>>
>> Platform: linux-suse
>> Modsurvey version 3.2.4
>> Perl 5.8.3
>> mod_perl 1.99
>>
>>
>>
>> The reason for which I have to fetch data from external is: check
>> quotas. If I'm a respondent out of quotas, I have to route to a page
>> named i.e. quotafull.survey. To do this, I 1) have to query my DBMS or
>
>> 2) read a text data or csv data from external
>>
>> Is there any possibility to fetch data from external source (text
>> files,
>> databases) and put in a .survey script page with Perl snippets?
>>
>>
>> (I can easy do this with php script, and try to call it via XMLHttp
>> using javascript; but, according my knowledge, i have to put variables
>
>> fetched somewhere in the page, for example using an 'hidden' field;
>> but for variables to be available for perl, i think i have to submit
>> them ; this is a problem as I need variables available in the same
>> page)
>>
>> thanks,
>>
>> Luca Notari
>>
>>
> Skickat av Joel Palmius <[email protected]>
> till survey-discussion
>
>
> Skickat av "Luca Notari" <[email protected]>
> till survey-discussion
>
---481066056-419073520-1204042959=:19675--
Skickat av Joel Palmius <[email protected]>
till survey-discussion