Re: CGI Scripting with CRM

On Sat, 7 Feb 2009 13:13:30 +0100
Paolo <[email protected]> wrote:

> On Fri, Feb 06, 2009 at 05:31:10AM -0700, Chris Babcock wrote:
> > I thought this might be of interest. CGI scripting with CRM114
> > happens to be insanely easy. The web page to be displayed is read
> > from stdout.
> 
> cool :)

I'd been avoiding CGI because I'm allergic to Perl and Python performs
better with WSGI, but I've gotten involved in a 15 yo Python app that
uses a CGI interface so I thought I better read up. When I saw how the
CGI spec used stdin/stdout, I had to try it with CRM.

The cool thing about it is that by the end of 2010 I'm going have a
really nice mailing list manager written entirely in CRM. From soup to
nuts it will be CRM for mangling text and calls to standard FOSS tools
for things like network services. It even deploys a driver architecture
so that the admin can choose between CRM native I/O or syscalls to a
database like mysql. The idea is that is should wrap around other
applications that might have their own store of email addresses, in my
case game servers.

> > syscall () (:environment:) /env/
> 
> hm, why (sys)calling env? special vars :_env_X: ar already set to the
> values of corresponding X ENV vars - eg :_env_HOME: = $HOME.

I just wanted a complete dump of what was available. I haven't *used*
the _env* vars yet so I just didn't think of it. 

> > match [:param:] (:hex: :value:) /%(..)/
> 
> use /%([[:xdigit:]][[:xdigit:]])/ else you'd add 'x' to
> invalid/dbl-encoded triplets like %%5c or %xy, looping forever
> (actually till buffer overflow) on latter case.

Ahh. Thank you.

> > match <fromend> [:environment:] (:eol:) /\n/
> 
> ah, ok just for fun :) - else you'd parse QUERY_* and others your
> script expects.

Even here, :_env_string: would have worked for the complete view of the
environment I wanted... now that you pointed out its children.
 
> > From there it's pretty straightforward to classify form input or
> 
> ok ...
> 
> > customize a webmail app to train Spam.
> 
> ... but that's usually done by a backend.

I'm saying that you can build a web widget to feed that back end from
any webmail package you host, like a meaningful "Spam" button in Horde
mail or a Squirrelmail fork.

One last thing, mucho importante... There's no guarantee of an EOF, so
a script that uses the post method needs to use a null window and input
from stdin with the CONTENT_LENGTH environment variable to restrict its
scope. At the very least, a rogue browser could tie up a web server 
process. I'm sure that worse exploits are possible.

Chris

------------------------------------------------------------------------------
Create and Deploy Rich Internet Apps outside the browser with Adobe(R)AIR(TM)
software. With Adobe AIR, Ajax developers can use existing skills and code to
build responsive, highly engaging applications that combine the power of local
resources and data with the reach of the web. Download the Adobe AIR SDK and
Ajax docs to start building applications today-http://p.sf.net/sfu/adobe-com

_______________________________________________
Crm114-general mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/crm114-general

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iQEcBAEBAgAGBQJJjZo4AAoJEASgqNsqZfCHmWAH/1KQfrftF1ZLLOWmY5VDsQAX
8gDf3u/F4C7uE+3WCBLVzBNrWMcRXZIFOlDx7CnMUfdq9XyJGK1YtKo6ahrHkv2P
Z1C2LkQa9p/elbO6/AVM8rur9hdhHot/S85kf5E10H+TQDKFhQ7bg67UV1t1GA0k
t16ZIEScioLeomdB8TAKiiafYxonfWuJSgTtZ8TisiIgX6KkWVcH/NJ2EKiNj8t6
iz1fDTifI/QAhK1QVmxQlQJkNuEsclvQcKBftCxbPGfIY+2apFCApUlTq8950s1p
Ydfu1uVrlkCql83jOzGWvA09w+KX1PcaClUiahY6zM1g2IWpn3xl6igxOYMNGA8=
=Z0Qf
-----END PGP SIGNATURE-----