Re: [CGI] Base Directory Path question
[email protected] ("Roy Schroeder") Fri, 19 Jul 2002 08:34:38 -0700
| Newsgroups | perl.macperl.webcgi |
|---|---|
| Message-ID | <015001c22f39$cb33b4c0$493c91d8@ras> |
If your provider instituted new security measures, perhaps they are doing a chroot() before executing your CGI. Try writing a simple CGI that shows what your current path is. If it's not /home/sites/site134/web/... then you are probably in a chroot'd environment. If it looks like /web/... then you have been chroot'd to /home/sites/site134. Adjust your paths accordingly. Regards Roy ----- Original Message ----- From: "tedd" <[email protected]> To: "CGI List" <[email protected]> Cc: <[email protected]> Sent: Friday, July 19, 2002 8:02 AM Subject: [CGI] Base Directory Path question > Hi: > > I wrote the following "news posting" program from bits and pieces of > other programs I found. The cgi script worked very well until my host > move my web site from one system to another and now it no longer > works. I suspect that it has something to do with his new security, > but my pleas with him to help me have fallen on deaf ears. So, can > anyone help me? > > I know that the problem IS with the $BaseDir path. If it helps, the > ENV results for the site are at the end of this email. > > Many thanks for all relies. > > tedd > > The code follows; use as you want; watch out for line breaks; and > I've changed my domain to mywebsite: > > --- start of code: > > #!/usr/bin/perl > > # The only things that need to be changed are: ; > # 1) $BaseDir -- which is provided by an EVN call; > # 2) $www -- which is the web address of the site; > > $Password = "ay7tx13"; > $DataFile = "news.data"; > $allow_html = 0; # Set to 1 to allow html commands in the text > > if ($^O eq 'MacOS') > { > #$rootdir = 'Path:To:Dir'; > $BaseDir = "Main:rootdir:bulletins:"; > $www = "http://192.168.0.1/"; > } > else > { > #$rootdir = 'Path/To/Dir'; > $BaseDir = "/home/sites/site134/web/bulletins/"; > $www = "http://www.mywebsite.com/"; > } > > $BaseURL = $www . "bulletins"; > $CGI_URL = $www . "cgi-bin/news.cgi"; > $pathFlag = $www . "bulletins/gifs/right.gif"; > $pathBar = $www . "bulletins/gifs/bar.gif"; > $backGround = $www . "bulletins/gifs/background.gif"; > > $Header = <<HEAD; > <html> > <head> > <meta http-equiv="content-type" content="text/html;charset=ISO-8859-1"> > <title>Current News</title> > </head> > <body bgcolor="#ffffff" background=$backGround> > <div align="center"> > <h1><font face="Times New Roman,Georgia,Times" size="5"><b>Current > News</b></font> > <spacer type="horizontal" size="20"> > > <img src=$pathFlag width="68" height="50" border="0"></h1> > <img src=$pathBar width="504" height="6" border="0"> > > </div> > HEAD > > > $Footer = <<FOOT; > <div align="center"> > <img src=$pathBar width="504" height="6" border="0"> > <p> > <FONT SIZE=2> > <a href=$www>Home </a> > <spacer type="horizontal" size="32"> > <a href=$CGI_URL>News</a> > <p> > Copyright 2000 - 2002 <a href="http://www.sperling.com">Sperling > Corporation</a> > </p> > </div> > </body> > </html> > FOOT > > > #--------------------------- > > if ($ENV{'QUERY_STRING'} ne "") > { # Parse the query string > &UnWeb1; > $Q = 1; > } > else > { > &UnWeb; > $Q = 0; > } > > # Get the Date for Entry > $date = `date +"%A, %B %d, %Y at %T (%Z)"`; > > # chop($date); > $shortdate = `date +"%D %T %Z"`; > chop($shortdate); > $date2 = `date`; > > # This adds a new item to the directory > > if ($in{'action'} eq "add") > { > &PrintHeader; > print "<HTML>\n"; > print "<HEAD>\n"; > print " <TITLE>Add News</TITLE>\n"; > print "</HEAD>\n"; > print "<BODY BGCOLOR=\"#ffffff\">\n"; > print "\n"; > print "<FORM method=post action=\"$CGI_URL\">\n"; > print "<input type=hidden name=\"action\" value=\"add2\">\n"; > > print "\n"; > print "<div align=\"center\">\n"; > print "<P><FONT SIZE=4><b>Add New News Story</b></p>\n"; > > print "<img src=\"$pathBar\" width=\"504\" height=\"6\" > border=\"0\">\n"; > > print "</div>\n"; > print "</P><P><FONT SIZE=3>To add a new news story to the > file, enter:\n"; > print "<br>\n"; > print "<spacer type=\"horizontal\" size=\"10\"> 1) The password;\n"; > print "<br>\n"; > print "<spacer type=\"horizontal\" size=\"10\"> 2) The filename;\n"; > print "<br>\n"; > print "<spacer type=\"horizontal\" size=\"10\"> 3) The > headline for the story;\n"; > print "<br>\n"; > print "<spacer type=\"horizontal\" size=\"10\"> 4) The lead > paragraph for the story (one paragraph);\n"; > print "<br>\n"; > print "<spacer type=\"horizontal\" size=\"10\"> 5) And, the > body (rest) of the story.\n"; > print "<P>\n"; > print "Entering other than standard characters may cause > failure to post.\n"; > print "<P>\n"; > print "The headline and lead paragraph will be shown to users\n"; > print " in the list of all current news.\n"; > print "<br><p>\n"; > print "<b>All fields are required.<b></FONT></P>\n"; > print "</P>\n"; > print "\n"; > print "<P><TABLE WIDTH=\"100%\" BORDER=\"0\" > CELLSPACING=\"0\" CELLPADDING=\"0\">\n"; > print "<TR>\n"; > print "<TD WIDTH=\"92\"><P ALIGN=RIGHT><B><FONT > SIZE=-1>Password:</FONT></B></TD>\n"; > print "<TD WIDTH=\"80%\"><INPUT NAME=\"Password\" > TYPE=\"password\" SIZE=\"30\"></TD></TR>\n"; > > > print "<TD VALIGN=\"TOP\"><P ALIGN=RIGHT><B><FONT > SIZE=-1>Filename:</FONT></B></TD>\n"; > print "<TD><INPUT NAME=\"Filename\" TYPE=\"text\" SIZE=\"25\" > MAXLENGTH=\"25\"></TD></TR>\n"; > print "<TR>\n"; > > print "<TD VALIGN=\"TOP\"><P ALIGN=RIGHT><B><FONT > SIZE=-1>Headline:</FONT></B></TD>\n"; > print "<TD><INPUT NAME=\"Headline\" TYPE=\"text\" SIZE=\"50\" > MAXLENGTH=\"200\"></TD></TR>\n"; > print "<TR>\n"; > > print "<TD VALIGN=\"TOP\"><P ALIGN=RIGHT><B><FONT > SIZE=-1>Lead Paragraph:</FONT></B></TD>\n"; > print "<TD><TEXTAREA NAME=\"Lead\" WRAP=\"VIRTUAL\" > ROWS=\"4\" COLS=\"50\"\n"; > print "></TEXTAREA></TD></TR>\n"; > print "<TR>\n"; > > print "<TD VALIGN=\"TOP\"><P ALIGN=RIGHT><B><FONT > SIZE=-1>Body of Story:</FONT></B></TD>\n"; > print "<TD><TEXTAREA NAME=\"Body\" WRAP=\"VIRTUAL\" > ROWS=\"10\" COLS=\"50\"\n"; > print "></TEXTAREA></TD></TR>\n"; > > print "</TABLE>\n"; > print "</P>\n"; > print "\n"; > print "<div align=\"center\">\n"; > print "<P ALIGN=CENTER><INPUT NAME=\"name\" TYPE=\"submit\" > VALUE=\"Submit\"><INPUT \n"; > print "NAME=\"name\" TYPE=\"reset\" VALUE=\"Reset\"></P>\n"; > print "\n"; > print "</div>\n"; > print "$Footer\n"; > } > > > if ($in{'action'} eq "add2") > { > if (($in{'Filename'} eq "") || # Check to see if all > information was provided > ($in{'Headline'} eq "") || > ($in{'Lead'} eq "") || > ($in{'Body'} eq "") || > ($in{'Password'} eq "")) > { > &Error (Information_Incomplete); # Not all > information was provided > } > unless ($in{'Password'} eq $Password) # Check password > { > &Error ("Password_Incorrect"); # Password is incorrect > } > > $in{'Filename'} =~ s/ //g;; # takes out > spaces and other unwanted things > $in{'Lead'} =~s/\n/ /g; #removes all > returns and replaces with spaces > $in{'Body'} =~ s/\n/<BR>\n/go; # Expand the comments for html > > # Write the information to the file > > $file = $BaseDir.$in{'Filename'}.".html"; > open (NEWSFILE,">$file"); > print NEWSFILE "$Header\n"; > print NEWSFILE "<b><center><h2>$in{'Headline'}</h2></center></b>\n"; > print NEWSFILE "$in{'Lead'}<p>\n"; > print NEWSFILE "$in{'Body'}<p>\n"; > print NEWSFILE "Posted on: $date<p>\n"; > print NEWSFILE "$Footer\n"; > close NEWSFILE; > > # Update the index file for that directory. > > $file = $BaseDir.$DataFile; > open(GW,">>$file"); > print GW "$in{'Headline'}\t$in{'Filename'}.html\t$in{'Lead'}\n"; > close GW; > > &PrintHeader; > print "<html>\n"; > print " <head>\n"; > print " <title>News Posted</title>\n"; > print " </head>\n"; > print "$Header\n"; > print "<center><h1>News Posted!</h1>\n"; > print "The News entitled $in{'Filename'} has been posted.\n"; > > if ($^O eq 'MacOS') # only show where if running MacOS > { > $file = $BaseDir.$in{'Filename'}; > print "<br>$file.<p>\n"; > } > > print "</center>\n"; > print "$Footer\n"; > } > > # *** This deletes a news item from the directory *** > > if ($in{'action'} eq "delete") > { > > # Read in the datafile > > $file = $BaseDir.$DataFile; > open (DATA, "$file"); > @Data = <DATA>; > close DATA; > > $Count = 0; > foreach $Line (@Data) > { > @Temp = split (/\t/, $Line); > $StoryLine[$Count] = "<OPTION value=\"$Temp[1]\">$Temp[0]\n"; > $Count++; > } > > &PrintHeader; > print "<HTML>\n"; > print "<HEAD>\n"; > print " <TITLE>Delete News</TITLE>\n"; > print "</HEAD>\n"; > print "<BODY BGCOLOR=\"#ffffff\">\n"; > print "\n"; > print "<FORM method=post action=\"$CGI_URL\">\n"; > print "<input type=hidden name=\"action\" value=\"delete2\">\n"; > > print "\n"; > print "<div align=\"center\">\n"; > print "<P><FONT SIZE=4><b>Delete News Story</b></p>\n"; > print "<img src=$pathBar width=\"504\" height=\"6\" border=\"0\">\n"; > print "</div>\n"; > print "</P><P><FONT SIZE=3>To delete a news story from the > file, enter:\n"; > print "<br>\n"; > print "<spacer type=\"horizontal\" size=\"10\"> 1) The password;\n"; > print "<br>\n"; > print "<spacer type=\"horizontal\" size=\"10\"> 2) Select > the story's headline;\n"; > print "<br>\n"; > print "<spacer type=\"horizontal\" size=\"10\"> 3) Press > the Delete Button;\n"; > print "<br>\n"; > print "<P>\n"; > > print "\n"; > print "<P ALIGN=CENTER><TABLE WIDTH=\"3%\" BORDER=\"0\" > CELLSPACING=\"0\" CELLPADDING=\n"; > print "\"0\">\n"; > print "<TR>\n"; > print "<TD WIDTH=\"46%\"><P ALIGN=RIGHT><B><FONT > SIZE=-1>Password:</FONT></B></TD>\n"; > print "<TD WIDTH=\"54%\"><INPUT NAME=\"Password\" > TYPE=\"password\" SIZE=\"30\"></TD></TR>\n"; > print "<TR>\n"; > print "<TD><P ALIGN=RIGHT><B><FONT SIZE=-1>Choose the story > to delete:</FONT></B></TD>\n"; > print "<TD><SELECT name=\"Filename\">\n"; > foreach $Story (@StoryLine) > { > print "$Story"; > } > print "</SELECT></TD></TR>\n"; > print "</TABLE>\n"; > print "</P>\n"; > print "\n"; > print "<div align=\"center\">\n"; > print "<P ALIGN=CENTER><INPUT TYPE=\"submit\" > VALUE=\"Delete\"><INPUT \n"; > print "NAME=\"name\" TYPE=\"reset\" VALUE=\"Reset\"></P>\n"; > print "</div>\n"; > print "\n"; > print "$Footer\n"; > } > > if ($in{'action'} eq "delete2") > { > if (($in{'Password'} eq "") || ($in{'Filename'} eq "")) > { > &Error ("Information_Incomplete"); # Information incomplete > } > > unless ($in{'Password'} eq $Password) > { > &Error ("Password_Incorrect"); # The wrong password > } > > $file = $BaseDir.$in{'Filename'}; > unlink ("$file"); > > # Update the index file for that directory. > > $file = $BaseDir.$DataFile; > open(GW,"$file"); > @lines = <GW>; > close GW; > > $file = $BaseDir.$DataFile; > open(GB,">$file"); > foreach $line (@lines) > { > chop $line; > @TempData = split (/\t/, $line); > > if ($TempData[1] ne "$in{'Filename'}") > { > print GB "$line\n"; > } > } > close GB; > > &PrintHeader; > print "<html>\n"; > print " <head>\n"; > print " <title>News Deleted</title>\n"; > print " </head>\n"; > print "$Header\n"; > print "<center><h1>News Deleted!</h1>\n"; > print "The news $in{'Filename'} has been deleted.<p>\n"; > print "</center>\n"; > print "$Footer\n"; > } > > # This displays all stories > > if ($in{'action'} eq "") > { > # Open the datafile > > $file = $BaseDir.$DataFile; > open (DATA, "$file"); > @Data = <DATA>; > close DATA; > > &PrintHeader; > print "<html>\n"; > print " <head>\n"; > print " <title>View News</title>\n"; > print " </head>\n"; > print "$Header\n"; > > print "<br>\n"; > print "<font size=2>Click on a headline to view the full > article:</font>\n"; > print "<hr>\n"; > > foreach $Story (@Data) > { > @Temp = split (/\t/, $Story); > print "<a > href=\"$CGI_URL?action=view&item=$Temp[1]\"><h3>$Temp[0]</a></h3>\n"; > print "$Temp[2]<p><hr><p>\n"; > } > print "$Footer\n"; > } > > if ($in{'action'} eq "view") > { > print "Location: $BaseURL/$in{'item'}\n\n"; > } > > > # Handle errors > > sub Error > { > local($UserError) = @_; > > if ($UserError eq "Information_Incomplete") > { > &PrintHeader; > print "<html>\n"; > print " <head>\n"; > print " <title>Information Incomplete</title>\n"; > print " </head>\n"; > print "$Header\n"; > print "<center><h2>Information Incomplete!</h2>\n"; > print "You did not fill out all required information.<br>\n"; > print "Please go back and make sure every field is > filled in before submitting.<p>\n"; > print "</center>\n"; > print "$Footer\n"; > exit; > } > > if ($UserError eq "Password_Incorrect") > { > &PrintHeader; > print "<html>\n"; > print " <head>\n"; > print " <title>Incorrect Password</title>\n"; > print " </head>\n"; > print "$Header\n"; > print "<center><h2>Incorrect Password!</h2>\n"; > print "The password you entered was incorrect.<br>\n"; > print "Please go back and re-enter your password.<p>\n"; > print "</center>\n"; > print "$Footer\n"; > exit; > } > } > > # > > sub UnWeb1 > { > # Get the input > # read(STDIN, $buffer, $ENV{'QUERY_STRING'}); > > # Split the name-value pairs > @pairs = split(/&/, $ENV{'QUERY_STRING'}); > > foreach $pair (@pairs) > { > ($name, $value) = split(/=/, $pair); > > # Un-Webify plus signs and %-encoding > $value =~ tr/+/ /; > $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg; > $value =~ s/<!--(.|\n)*-->//g; > > if ($allow_html != 1) # handle encoded HTML stuff > { > $value =~ s/<([^>]|\n)*>//g; > } > else > { > unless ($name eq 'body') > { > $value =~ s/<([^>]|\n)*>//g; > } > } > $in{$name} = $value; > } > } > > sub UnWeb > { > > # Get the input > read(STDIN, $buffer, $ENV{'CONTENT_LENGTH'}); > > # Split the name-value pairs > @pairs = split(/&/, $buffer); > > foreach $pair (@pairs) > { > ($name, $value) = split(/=/, $pair); > > > # Un-Webify plus signs and %-encoding > $value =~ tr/+/ /; > $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg; > $value =~ s/<!--(.|\n)*-->//g; > > if ($AllowHTML != 1) > { > $value =~ s/<([^>]|\n)*>//g; > } > else > { > unless ($name eq 'body') > { > $value =~ s/<([^>]|\n)*>//g; > } > } > $in{$name} = $value; > } > } > > > ####################### > # Print HTML Header > > sub PrintHeader > { > print "Content-type: text/html\n\n"; > } > > --- end of code > > --- start of ENV for the site: > > [SERVER_SOFTWARE] Apache/1.3.3 Cobalt (Unix) (Red Hat/Linux) > [GATEWAY_INTERFACE] CGI/1.1 > [DOCUMENT_ROOT] /home/sites/site134/web > [REMOTE_ADDR] XXX.XXX.XXX.XXX <-- address removed > [REQUEST_METHOD] GET > [QUERY_STRING] > [HTTP_ACCEPT] image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, > image/png, */* > [REMOTE_PORT] 1206 > [HTTP_ACCEPT_LANGUAGE] en,pdf > [REDIRECT_UNIQUE_ID] PTgl88-k8A4AAEVtSio > [SCRIPT_FILENAME] /usr/cgiwrap/cgiwrap > [HTTP_ACCEPT_ENCODING] gzip > [REDIRECT_STATUS] 200 > [SERVER_NAME] www.mywebsite.com > [SERVER_PORT] 80 > [PATH_TRANSLATED] /home/sites/site134/web/cgi-bin/ev.cgi > [SERVER_ADMIN] site134 > [UNIQUE_ID] PTgl88-k8A4AAEVtSio > [REDIRECT_URL] /cgi-bin/ev.cgi > [SCRIPT_URI] http://www.mywebsite.com/cgi-bin/ev.cgi > [SCRIPT_URL] /cgi-bin/ev.cgi > [SERVER_SIGNATURE] > [SERVER_PROTOCOL] HTTP/1.0 > [HTTP_REFERER] bookmarks > [HTTP_USER_AGENT] Mozilla/4.79 (Macintosh; U; PPC) > [PATH] /sbin:/usr/sbin:/bin:/usr/bin > [HTTP_CONNECTION] Keep-Alive > [REDIRECT_SCRIPT_URI] http://www.mywebsite.com/cgi-bin/ev.cgi > [SCRIPT_NAME] /cgi-bin/ev.cgi > [REDIRECT_SCRIPT_URL] /cgi-bin/ev.cgi > [HTTP_ACCEPT_CHARSET] iso-8859-1,*,utf-8 > [REQUEST_URI] /cgi-bin/ev.cgi > [PATH_INFO] /cgi-bin/ev.cgi > [HTTP_HOST] www.mywebsite.com > -- > http://sperling.com >