Re: Security flaws in recommended CGI setup?
"Jonathan Ellis" <[email protected]>
| Newsgroups | gmane.comp.python.spyce.general |
|---|---|
| Message-ID | <[email protected]> |
On Sat, 08 Jul 2006 21:14:06 +0300, "Pauli Virtanen" <[email protected]> said: > Apparently, php-cgi works around this by checking whether > Apache-specific REDIRECT_STATUS is set in environ. In spyce this should > be equivalent to something like the following: > > def doSpyce( (stdin, stdout, stderr, environ) ): > if environ.get('REDIRECT_STATUS', '') != '200': > stdout.write("Content-type: > text/html\n\n<html><body><h1>Forbidden</h1></body></html>\r\n") > return -1 > path = None > if len(sys.argv)<=1 or not os.path.isfile(sys.argv[1]): > try: path = findScriptFile(environ['PATH_TRANSLATED']) > except: pass > result = spyceCmd.spyceMain(cgimode=1, cgiscript=path, > stdout=stdout, stdin=stdin, stderr=stderr, environ=environ) > return result > > Perhaps it would be nice to also have Spyce behave like this by default? Sure, if you'd like to submit a patch, I will put it in. -Jonathan -- C++ is history repeated as tragedy. Java is history repeated as farce. --Scott McKay ------------------------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642