R: R: about DBI

Ok, I'll try this
(I'haven't noticed that an answer to this was just written in
precedence.... :( )=20


-----Messaggio originale-----
Da: [email protected]
[mailto:[email protected]] Per conto di Joel
Palmius
Inviato: marted=EC 26 febbraio 2008 17.23
A: [email protected]
Oggetto: Re: R: survey-discussion-list: about DBI


The behavior of "use" inside a Safe compartment is undefined and, I
guess,=20
rather random. With DBI installed, mod_survey already "use":d DBI, and I

can't even guess what the consequences for local and global instances
will=20
be inside a Safe department.

All in all, Safe was never intended for complex code relying on external

libraries. As far as I can understand, it rewrites the code it evaluates

to provide for a compartmentalized namespace, but the authors state in
the=20
man file for example that "signals causing signals" affect the outside
of=20
the compartment, and so do operations such as chroot().

Thus it'd be better to spawn a separate process outside Safe for complex

stuff such as DBI.

Did you try executing the script externally instead? For example:

   {\
     open(PIPE,"/usr/bin/perl /home/luca/myscript.pl |");
     $var =3D join('',<PIPE>);
     close(PIPE);
     print $var;
   \}

.. where "/home/luca/myscript.pl" is the script which worked on a
console=20
prompt. With $compartment->deny_only(qw(:dangerous)); this should open
an=20
external process which is not dependent on anything related to Safe or=20
mod_perl.

   // Joel


On Tue, 26 Feb 2008, Luca Notari wrote:

> I've tried to do $compartment->deny_only(qw(:dangerous));
>
> I still have problems in using DBI in perl snippet; as example, I put=20
> here a piece of code that I've used from shell environment with=20
> success, and inside mod_survey perl snippet without success:
>
> THIS WORKS:
> #!/usr/bin/perl
> use DBI;
> use DBD::mysql;
> my $dbh =3D DBI->connect('DBI:mysql:test','root','passwd')
>  or die "Couldn't connect to database: " . DBI->errstr; $query=3D"SELEC=
T

> * from test.test"; $query_handle =3D $dbh->prepare($query);
> $query_handle->execute();
> $query_handle->bind_columns(\$id, \$nome, \$descriz,\$user,\$email);
>
> while($query_handle->fetch()) {
>   print "$nome <br />";
> }
>
> AND THIS DOESN'T WORK:
> {\
> use DBD::mysql;
> use DBI;
>
> $dsn=3D"DBI:mysql:test:localhost:3306";
> $dbh =3D DBI->connect("DBI:mysql:test:localhost:3306","root","pwd");
> $query=3D"SELECT * from test.test";
> $query_handle =3D $dbh->prepare($query); $query_handle->execute();
> $query_handle->bind_columns(\$id, \$nome, \$descriz,\$user,\$email);
>
> while($query_handle->fetch()) {
>   print "$nome <br />";
> }
>
> \}
>
> It seems that this latter code make use of CPU very higher, and this=20
> not happens launching from shell. The limit of the IMPORT tag is that=20
> the retrieved variable is taken into the list of submitted variables=20
> (I don't want this!) and, above all, that is not possible to put 2 or=20
> more import tags into the same page. To do these SQL statements:
> 1. Select count(*) from tableA where column1=3D'something';
> 2. Select count(*) from tableA where column2=3D'something';
> 3. Select count(*) from tableA where column3=3D'something';
> 4. Select count(*) from tableA where column4=3D'something';
> 5. Select count(*) from tableA where column5=3D'something';
> If I'm right, I need at least 5 pages with IMPORT tag. What if I only
> have 4 pages or less?
>
> Luca Notari
> -----Messaggio originale-----
> Da: [email protected]
> [mailto:[email protected]] Per conto di Joel=20
> Palmius
> Inviato: venerd=EC 15 febbraio 2008 14.56
> A: [email protected]
> Cc: survey discussion list
> Oggetto: Re: survey-discussion-list: about DBI
>
>
> If you want to completely disable security checking, I'd suggest you=20
> change the permit line to:
>
>   $compartment->deny_only(qw(:dangerous));
>
> Ie, everything except in principle only dump() and chroot() is=20
> allowed. With this, for example the following is possible:
>
> <SURVEY TITLE=3D"test">
>
>   <CUSTOM ESCAPED=3D"no">
>     <pre>{&
>      open(PIPE,"/bin/ls -l /etc |");
>      $string =3D join('',<PIPE>);
>      close(FIL);
>      print $string;
>   &}</pre>
>   </CUSTOM>
>
>   <TEXT NAME=3D"test" CAPTION=3D"test" />
>
> </SURVEY>
>
> To avoid problems with clashes with how mod_survey uses use() and=20
> replaces things inside the code in the Safe department, I'd suggest=20
> making an external script which prints a value:
>
>   <ROUTE CONTINUE=3D"{&
>     $someguy =3D $ses->getValue("SUBMITTED_name");
>     open(PIPE,"/usr/bin/perl /home/me/myscript.pl $someguy |");
>     $allowed =3D <PIPE>;
>     close(PIPE);
>     chomp($allowed);
>
>     if($allowed eq "yes")
>     {
>       print "continuesurvey.survey";
>     }
>     else
>     {
>       print "quotaerror.survey";
>     }
>   &}" />
>
> The external script should have no problem with running DBI related=20
> stuff.
>
>   // Joel
>
>
>
>  On Fri, 15 Feb 2008, Luca Notari wrote:
>
>> Using IMPORT tag I can access a database via VARIABLE or ARRAY, and=20
>> this variable is included in the list of variables of the survey.
>>
>>
>> But what if I don't want to include the variable?
>>
>> to do this, I've tried to use DBI in perl snippet but In all cases,=20
>> doesn't work for me(continuous document error or display error; I've=20
>> opened the compartment->permit $compartment->permit(qw(:browse=20
>> :filesys_read :sys_db :filesys_open :filesys_write :subprocess=20
>> :base_core :default :base_io :others require
>> caller))
>> both in Display.pm and Document.pm
>>
>> I've also tried to use open function: open FILE,"myfile.txt", but,=20
>> again nothing works:
>>
>>
>> Document error
>>
>> Security exception: Undefined subroutine &Carp::longmess_heavy called

>> at /usr/lib/perl5/5.8.3/Carp.pm line 166, line 30.
>>
>> Platform: linux-suse
>> Modsurvey version 3.2.4
>> Perl 5.8.3
>> mod_perl 1.99
>>
>>
>>
>> The reason for which I have to fetch data from external is: check=20
>> quotas. If I'm a respondent out of quotas, I have to route to a page=20
>> named i.e. quotafull.survey. To do this, I 1) have to query my DBMS=20
>> or
>
>> 2) read a text data or csv data from external
>>
>> Is there any possibility to fetch data from external source (text=20
>> files,
>> databases) and put in a .survey script page with Perl snippets?
>>
>>
>> (I can easy do this with php script, and try to call it via XMLHttp=20
>> using javascript; but, according my knowledge, i have to put=20
>> variables
>
>> fetched somewhere in the page, for example using an 'hidden' field;=20
>> but for variables to be available for perl, i think i have to submit=20
>> them ; this is a problem as I need variables available in the same
>> page)
>>
>> thanks,
>>
>> Luca Notari
>>
>>
> Skickat av Joel Palmius <[email protected]>
> till survey-discussion
>
>
> Skickat av "Luca Notari" <[email protected]>
> till survey-discussion
>


Skickat av "Luca Notari" <[email protected]>
till survey-discussion