Cgi on IIS

[maureen]

I hope someone can help me out.

I set up this cgi file and html form on a Unix server. The script
changes a user's password in a text file.

This works correctly on a Unix Server. However, I need to move these
files to an IIS server.
In testing on the IIS server,  I get an HTTP Error 405- Method not
allowed when the form is submitted. 

I did some research, but was unable to determine how to correct the
error. 

If anyone could help me out, I'd really appreciate it.

Thanks, Maureen

#!/usr/bin/perl
require "cgi-lib.pl";
#process incoming form data 
&ReadParse;
#set content type
print &PrintHeader;
#initialize variables
$pwfile =
"/data1/hypermart.net/worldwidewebstrategies/datafile/pwdata.txt";
$tmpfile =
"/data1/hypermart.net/worldwidewebstrategies/datafile/pwdata.tmp";
$lokfile =
"/data1/hypermart.net/worldwidewebstrategies/datafile/pwlock.fil";
#Print initial tags for web page
print "\n";
#check for existence of password file
unless (-e $pwfile)
{ 
#password file doesn't exist!
#print message & shut down
print <<"PrintTag";
Sorry!
$pwfile has't been uploaded to the
proper directory. Please contact the webmaster.


PrintTag
exit(0);
}
#check for blank form fields
if ($in{'oldname'}eq"" || $in{'oldpw'}eq"")
{
#re-create form and shut down program
print <<"PrintTag";
ERROR: Please type your current username and
password in the spaces provided.
http://server37.hypermart.net/worldwidewebstrategies/cgi-bin/changepw.cgi";
METHOD="post">
Your current username:

Your current password:

Your new password:

Type your new password again:


PrintTag
if ($in{'delete'} eq "yes")
{
print "\n";
}
else
{
print "\n";
}
print <<"PrintTag";





PrintTag
exit(0);  
} 
#make sure new passwords match 
if ($in{'newpw1'} ne $in{'newpw2'})
{ 
#re-create form and shut down program  
print <<"PrintTag";
ERROR: Your new passwords didn't match. 
You must type your new password exactly the same way twice. 
Please try again.
http://server37.hypermart.net/worldwidewebstrategies/cgi-bin/changepw.cgi";
METHOD="post">
Your current username:

Your current password:

Your new password:

Type your new password again:





PrintTag
exit(0);  
}
#check for existence of lock file  
if (-e $lokfile)   
{ 
#lock file exists! print message & shut down   
print <<"PrintTag";
Try again!  
The database is in use. Please try again later.  
  
  
PrintTag
exit(0);  
} 
#everything is okay. Create lock file.  
open(LOCK_FILE, ">$lokfile") || 
die "Couldn't create $lokfile\n";
#open password file in read-only mode 
open(FILE,"$pwfile") || 
die "Can't find $pwfile.\n"; 
#store database contents in an array and close file
@indata = ;
close(FILE);
#open temp file in overwrite mode 
open(TEMP,">$tmpfile") || 
die "Can't create $tmpfile.\n"; 
#copy password file contents to temp file 
#use a foreach loop to process each record in the array
foreach $i (@indata)
{
#remove hard return character from each record
chomp($i);
#split fields on pipe character
#assign a variable name to each of the fields
($username,$password) = split(/\|/,$i);
if ($username eq $in{'oldname'} && 
$password eq $in{'oldpw'} && 
$in{'delete'} ne "yes")
{
print TEMP "$in{'oldname'}|$in{'newpw1'}\n";   
print " Success!Your password has been changed.\n";
}
elsif ($username eq $in{'oldname'} && 
$in{'delete'} eq "yes")
{
print "Your password has been deleted.\n";
}
else
{
print TEMP "$i\n";
}
} 
#close temp file 
close(TEMP);
#change file names 
rename($pwfile, $pwfile.".old"); 
rename($tmpfile, $pwfile); 
#close and delete lock file 
close(LOCK_FILE); 
unlink($lokfile);
#close web page
print "Thank you! \n";
print "\n";
#end of script

-- 
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

PERL CGI on IIS

[Mike Garner]

I've written a PERL cgi script that I'd like to use to reset a user's
password within Microsoft's Active Directory.  The script runs well from the
command line of the web server and from any other windows box (with PERL
installed). However, when it is executed from IIS, the security of IIS
prevents it from completing one of the methods of the Win32::OLE module so
the script fails. Posing this question to general IIS/Windows support groups
returns the result of "Ask the PERL folks". I'm hoping someone within this
forum can help (though I believe the problem to be IIS security related,
maybe someone here has experienced this themselves).

 

My script:

use strict;

use CGI ':standard';

use Win32::OLE;

use URI;

 

# snip -retrieve values from form, etc

 

###--Create LDAP Connection to Active Directory

my $adsinamespaces = CreateObject Win32::OLE 'ADsNameSpaces'||print qq(Nope,
step 1);

my $ldapnamespace= $adsinamespaces->getobject("","LDAP:")||print qq(nope,
step2);

my
$userdsobject=$ldapnamespace->OpenDSObject("LDAP://winad1.wsc.western.edu/OU
=Users,dc=wsc,dc=western,dc=edu","cn=$user,ou=$ou,OU=Users,dc=wsc,dc=western
,dc=edu",$old_password,1)||print qq(nope, step 3);

 

###--Bind to specific user account

my $ADsPath="LDAP://CN=$user,OU=$ou,OU=Users,DC=WSC,DC=western,DC=edu";||
print qq (nope, step 4);

 

##the next line always fails via CGI

my $u = Win32::OLE->GetObject($ADsPath)||print qq(nope, get object failed);

$u->SetPassword($new_password);

$u->SetInfo();

 

The script always fails on the GetObject method line when it is executed via
CGI. What is that command doing that IIS doesn't appreciate?

 

Any suggestions?

 

Thanks,

Mike

Re: Cgi on IIS

[K.L. Hayes]

Hello Maureen,

The only time I've seen the HTTP Error 405- when submitting a form is
when I've inadvertently used action="post" instead of action="POST"
which I see you've done in your script.

I must have banged my head on that for over an hour before I figured
it out. Hope this helps.

-- 
Best regards,
K.L. Hayes
mailto:[EMAIL PROTECTED]

Wednesday, January 16, 2002, 1:18:39 PM, you wrote:

m> I hope someone can help me out.

m> I set up this cgi file and html form on a Unix server. The script
m> changes a user's password in a text file.

m> This works correctly on a Unix Server. However, I need to move these
m> files to an IIS server.
m> In testing on the IIS server,  I get an HTTP Error 405- Method not
m> allowed when the form is submitted. 

m> I did some research, but was unable to determine how to correct the
m> error. 

m> If anyone could help me out, I'd really appreciate it.

m> Thanks, Maureen

m> #!/usr/bin/perl
m> require "cgi-lib.pl";
m> #process incoming form data 
m> &ReadParse;
m> #set content type
m> print &PrintHeader;
m> #initialize variables
m> $pwfile =
m> "/data1/hypermart.net/worldwidewebstrategies/datafile/pwdata.txt";
m> $tmpfile =
m> "/data1/hypermart.net/worldwidewebstrategies/datafile/pwdata.tmp";
m> $lokfile =
m> "/data1/hypermart.net/worldwidewebstrategies/datafile/pwlock.fil";
m> #Print initial tags for web page
m> print "\n";
m> #check for existence of password file
m> unless (-e $pwfile)
m> { 
m> #password file doesn't exist!
m> #print message & shut down
m> print <<"PrintTag";
m> Sorry!
m> $pwfile has't been uploaded to the
m> proper directory. Please contact the webmaster.
m> 
m> 
m> PrintTag
m> exit(0);
m> }
m> #check for blank form fields
m> if ($in{'oldname'}eq"" || $in{'oldpw'}eq"")
m> {
m> #re-create form and shut down program
m> print <<"PrintTag";
m> ERROR: Please type your current username and
m> password in the spaces provided.
m>  ACTION="http://server37.hypermart.net/worldwidewebstrategies/cgi-bin/changepw.cgi";
METHOD="post">>
m> Your current username:
m> 
m> Your current password:
m> 
m> Your new password:
m> 
m> Type your new password again:
m> 
m> 
m> PrintTag
m> if ($in{'delete'} eq "yes")
m> {
m> print " NAME=\"delete\" VALUE=\"yes\" CHECKED>\n";
m> }
m> else
m> {
m> print "\n";
m> }
m> print <<"PrintTag";
m> 
m> 
m> 
m> 
m> 
m> PrintTag
m> exit(0);  
m> } 
m> #make sure new passwords match 
m> if ($in{'newpw1'} ne $in{'newpw2'})
m> { 
m> #re-create form and shut down program  
m> print <<"PrintTag";
m> ERROR: Your new passwords didn't match. 
m> You must type your new password exactly the same way twice. 
m> Please try again.
m>  ACTION="http://server37.hypermart.net/worldwidewebstrategies/cgi-bin/changepw.cgi";
METHOD="post">>
m> Your current username:
m> 
m> Your current password:
m> 
m> Your new password:
m> 
m> Type your new password again:
m> 
m> 
m> 
m> 
m> 
m> PrintTag
m> exit(0);  
m> }
m> #check for existence of lock file  
m> if (-e $lokfile)   
m> { 
m> #lock file exists! print message & shut down   
m> print <<"PrintTag";
m> Try again!  
m> The database is in use. Please try again later.  
m>   
m>   
m> PrintTag
m> exit(0);  
m> } 
m> #everything is okay. Create lock file.  
open(LOCK_FILE, ">>$lokfile") || 
m> die "Couldn't create $lokfile\n";
m> #open password file in read-only mode 
m> open(FILE,"$pwfile") || 
m> die "Can't find $pwfile.\n"; 
m> #store database contents in an array and close file
m> @indata = ;
m> close(FILE);
m> #open temp file in overwrite mode 
open(TEMP,">>$tmpfile") || 
m> die "Can't create $tmpfile.\n"; 
m> #copy password file contents to temp file 
m> #use a foreach loop to process each record in the array
m> foreach $i (@indata)
m> {
m> #remove hard return character from each record
m> chomp($i);
m> #split fields on pipe character
m> #assign a variable name to each of the fields
m> ($username,$password) = split(/\|/,$i);
m> if ($username eq $in{'oldname'} && 
m> $password eq $in{'oldpw'} && 
m> $in{'delete'} ne "yes")
m> {
m> print TEMP "$in{'oldname'}|$in{'newpw1'}\n";   
m> print " Success!Your password has been changed.\n";
m> }
m> elsif ($username eq $in{'oldname'} && 
m> $in{'delete'} eq "yes")
m> {
m> print "Your password has been deleted.\n";
m> }
m> else
m> {
m> print TEMP "$i\n";
m> }
m> } 
m> #close temp file 
m> close(TEMP);
m> #change file names 
m> rename($pwfile, $pwfile.".old"); 
m> rename($tmpfile, $pwfile); 
m> #close and delete lock file 
m> close(LOCK_FILE); 
m> unlink($lokfile);
m> #close web page
m> print "Thank you! \n";
m> print "\n";
m> #end of script



-- 
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

RE: Cgi on IIS

[Gary Hawkins]

Maybe the file name has a .cgi extension?  .cgi is not set for exeeute by
default.  Try renaming it .pl assuming you installed ActivePerl.  Or in
Internet Services Manager right click the scripts folder, and take a look at
the instructions in the attached mail of few days ago.  I'm figuring that'll
probably do it.

Note that last time I installed ActivePerl it set .pl to perl "%s" %s as I
recall, but the extra double quotes may not matter, or maybe would apply if
your path/to/script had a space in it.

/g

> -Original Message-
> From: maureen [mailto:[EMAIL PROTECTED]]
> Sent: Wednesday, January 16, 2002 1:19 PM
> To: Beginners CGI List; [EMAIL PROTECTED]
> Subject: Cgi on IIS
>
>
>
> I hope someone can help me out.
>
> I set up this cgi file and html form on a Unix server. The script
> changes a user's password in a text file.
>
> This works correctly on a Unix Server. However, I need to move these
> files to an IIS server.
> In testing on the IIS server,  I get an HTTP Error 405- Method not
> allowed when the form is submitted.
>
> I did some research, but was unable to determine how to correct the
> error.
>
> If anyone could help me out, I'd really appreciate it.
>
> Thanks, Maureen
>
> #!/usr/bin/perl
> require "cgi-lib.pl";
> #process incoming form data
> &ReadParse;
> #set content type
> print &PrintHeader;
> #initialize variables
> $pwfile =
> "/data1/hypermart.net/worldwidewebstrategies/datafile/pwdata.txt";
> $tmpfile =
> "/data1/hypermart.net/worldwidewebstrategies/datafile/pwdata.tmp";
> $lokfile =
> "/data1/hypermart.net/worldwidewebstrategies/datafile/pwlock.fil";
> #Print initial tags for web page
> print "\n";
> #check for existence of password file
> unless (-e $pwfile)
> {
> #password file doesn't exist!
> #print message & shut down
> print <<"PrintTag";
> Sorry!
> $pwfile has't been uploaded to the
> proper directory. Please contact the webmaster.
> 
> 
> PrintTag
> exit(0);
> }
> #check for blank form fields
> if ($in{'oldname'}eq"" || $in{'oldpw'}eq"")
> {
> #re-create form and shut down program
> print <<"PrintTag";
> ERROR: Please type your current username and
> password in the spaces provided.
>  ACTION="http://server37.hypermart.net/worldwidewebstrategies/cgi-bin/
> changepw.cgi"
> METHOD="post">
> Your current username:
> 
> Your current password:
> 
> Your new password:
> 
> Type your new password again:
> 
> 
> PrintTag
> if ($in{'delete'} eq "yes")
> {
> print " NAME=\"delete\" VALUE=\"yes\" CHECKED>\n";
> }
> else
> {
> print "\n";
> }
> print <<"PrintTag";
> 
> 
> 
> 
> 
> PrintTag
> exit(0);
> }
> #make sure new passwords match
> if ($in{'newpw1'} ne $in{'newpw2'})
> {
> #re-create form and shut down program
> print <<"PrintTag";
> ERROR: Your new passwords didn't match.
> You must type your new password exactly the same way twice.
> Please try again.
>  ACTION="http://server37.hypermart.net/worldwidewebstrategies/cgi-bin/
> changepw.cgi"
> METHOD="post">
> Your current username:
> 
> Your current password:
> 
> Your new password:
> 
> Type your new password again:
> 
> 
> 
> 
> 
> PrintTag
> exit(0);
> }
> #check for existence of lock file
> if (-e $lokfile)
> {
> #lock file exists! print message & shut down
> print <<"PrintTag";
> Try again!
> The database is in use. Please try again later.
> 
> 
> PrintTag
> exit(0);
> }
> #everything is okay. Create lock file.
> open(LOCK_FILE, ">$lokfile") ||
> die "Couldn't create $lokfile\n";
> #open password file in read-only mode
> open(FILE,"$pwfile") ||
> die "Can't find $pwfile.\n";
> #store database contents in an array and close file
> @indata = ;
> close(FILE);
> #open temp file in overwrite mode
> open(TEMP,">$tmpfile") ||
> die "Can't create $tmpfile.\n";
> #copy password file contents to temp file
> #use a foreach loop to process each record in the array
> foreach $i (@indata)
> {
> #remove hard return character from each record
> chomp($i);
> #split fields on pipe character
> #assign a variable name to each of the fields
> ($username,$password) = split(/\|/,$i);
> if ($username eq $in{'oldname'} &&
> $password e

CGI on IIS <- bad idea?

[Eric Wang]

Thanks! can you explain what does the taint option do?
I usually just use #!/script/perl.exe

Thanks for your help!
eric

On Tue, 14 Aug 2001, Curtis Poe wrote:

> --- Eric Wang <[EMAIL PROTECTED]> wrote:
> > Can you run CGI on IIS?
> > sorry, I always thought you either need apache or httpd for unix/linux but
> > if IIS can run CGI,it'll be great!
> >
> > eric
>
> Eric,
>
> You can run CGI on IIS, but if you run ActiveState Perl, it will set up IIS to run 
>your CGI
> scripts through ISAPI (Internet Server Application Programming Interface) instead of 
>as straight
> CGI.  ISAPI runs your Perl scripts through the perlis.dll which which has the 
>advantage of being
> persistent in memory, thus giving you faster response time, but has the disadvantage 
>of not being
> able to pass certain switches to Perl.  In particular, you can't pass the -T switch 
>and activate
> taint checking.  This is a significant security problem.  You can read more about 
>this at
> http://www.perlmonks.org/index.pl?node_id=82619.
>
> Cheers,
> Curtis Poe
>
> =
> Senior Programmer
> Onsite! Technology (http://www.onsitetech.com/)
> "Ovid" on http://www.perlmonks.org/
>
> __
> Do You Yahoo!?
> Make international calls for as low as $.04/minute with Yahoo! Messenger
> http://phonecard.yahoo.com/
>
> --
> To unsubscribe, e-mail: [EMAIL PROTECTED]
> For additional commands, e-mail: [EMAIL PROTECTED]
>


-- 
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: CGI on IIS <- bad idea?

[Curtis Poe]

--- Eric Wang <[EMAIL PROTECTED]> wrote:
> Thanks! can you explain what does the taint option do?
> I usually just use #!/script/perl.exe
> 
> Thanks for your help!
> eric

Eric,

If you enable taint checking, any data coming into your program from outside of the 
program is
considered "tainted".  Perl tries to ensure that tainted data is not used to affect 
anything
outside of the program and will kill the program rather than allow Bad Things to 
happen.  This
script will die if you try to run it:

#!/usr/bin/perl -wT
use strict;

my $file = ;
chomp $file;

open "> $file" or die "Can't open $file for writing: $!";

Note that the "or die" is not what's killing the script.  Trying to use a tainted 
variable ($file)
to open a file for writing is what kills the script, assuming taint mode is enabled.  
Trying to
read from the file is considered safe, however:

open "< $file" or die "Can't open $file for writing: $!";

Unfortunately, this causes problems in many programs where someone enters something 
like
"/etc/passwd" in a CGI script and potentially gains access to info that they shouldn't 
(of course,
that ignores that the system should be using shadow passwords, but this is just an 
example).  On
Unix-like systems, you can also append a pipe to the filename and that will cause an 
attempt to
execute the file instead of opening it.  That's why we have taint checking:  it forces 
us to
examine these variables and make sure that the data is safe.

To learn more about taint checking and how to "untaint" a variable, open a command 
prompt and type
"perldoc perlsec".  This will also explain exactly what Perl considers tainted.

You can also read Lesson Three of my online CGI course and gain a *basic* 
understanding of CGI
security:

http://www.easystreet.com/~ovid/cgi_course/lesson_three/lesson_three.html

Cheers,
Curtis Poe

=
Senior Programmer
Onsite! Technology (http://www.onsitetech.com/)
"Ovid" on http://www.perlmonks.org/

__
Do You Yahoo!?
Make international calls for as low as $.04/minute with Yahoo! Messenger
http://phonecard.yahoo.com/

-- 
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: Re: CGI on IIS <- bad idea?

[Mark Bergeron]

Taint won't run on Win32 anyway.

-Original Message-
From: "Curtis Poe"<[EMAIL PROTECTED]>
To: "CGI Beginners"<[EMAIL PROTECTED]>
Date: Tue Aug 14 15:02:40 PDT 2001
Subject: Re: CGI on IIS <- bad idea?

>--- Eric Wang <[EMAIL PROTECTED]> wrote:
>> Thanks! can you explain what does the taint option do?
>> I usually just use #!/script/perl.exe
>> 
>> Thanks for your help!
>> eric
>
>Eric,
>
>If you enable taint checking, any data coming into your program from outside of the 
>program is
>considered "tainted".  Perl tries to ensure that tainted data is not used to affect 
>anything
>outside of the program and will kill the program rather than allow Bad Things to 
>happen.  This
>script will die if you try to run it:
>
>#!/usr/bin/perl -wT
>use strict;
>
>my $file = ;
>chomp $file;
>
>open "> $file" or die "Can't open $file for writing: $!";
>
>Note that the "or die" is not what's killing the script.  Trying to use a tainted 
>variable ($file)
>to open a file for writing is what kills the script, assuming taint mode is enabled.  
>Trying to
>read from the file is considered safe, however:
>
>open "< $file" or die "Can't open $file for writing: $!";
>
>Unfortunately, this causes problems in many programs where someone enters something 
>like
>"/etc/passwd" in a CGI script and potentially gains access to info that they 
>shouldn't (of course,
>that ignores that the system should be using shadow passwords, but this is just an 
>example).  On
>Unix-like systems, you can also append a pipe to the filename and that will cause an 
>attempt to
>execute the file instead of opening it.  That's why we have taint checking:  it 
>forces us to
>examine these variables and make sure that the data is safe.
>
>To learn more about taint checking and how to "untaint" a variable, open a command 
>prompt and type
>"perldoc perlsec".  This will also explain exactly what Perl considers tainted.
>
>You can also read Lesson Three of my online CGI course and gain a *basic* 
>understanding of CGI
>security:
>
>http://www.easystreet.com/~ovid/cgi_course/lesson_three/lesson_three.html
>
>Cheers,
>Curtis Poe
>
>=
>Senior Programmer
>Onsite! Technology (http://www.onsitetech.com/)
>"Ovid" on http://www.perlmonks.org/
>
>__
>Do You Yahoo!?
>Make international calls for as low as $.04/minute with Yahoo! Messenger
>http://phonecard.yahoo.com/
>
>-- 
>To unsubscribe, e-mail: [EMAIL PROTECTED]
>For additional commands, e-mail: [EMAIL PROTECTED]
>

/~_. _ | _ _  _  _ 
\_/|(_||| | |(_)| |
 _|
___
GO.com Mail
Get Your Free, Private E-mail at http://mail.go.com



-- 
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: Re: CGI on IIS <- bad idea?

[Curtis Poe]

--- Mark Bergeron <[EMAIL PROTECTED]> wrote:
> Taint won't run on Win32 anyway.

Mark,

This is actually a common misconception.  Taint checking works just fine on Win32 using
ActiveState Perl.  Try the following from the command line:

perl -Te "$x=shift;open TEST, qq/>$x/" test.txt

You will get the following error message:

Insecure dependency in open while running with -T switch at -e line 1.

Taint checking is problematic on Win32 systems *usually* because of the way the 
programs are run. 
If you type "perl somescript.pl" and you have the -T switch on the shebang line, you 
will get the
"Too late for "-T" option at somescript.pl line 1." error.  The easiest way to get 
around this is
to explicitly pass the -T switch to the perl interpreter:

perl -T somescript.pl

If this doesn't work for you, what version of Perl are you using?

Cheers,
Curtis Poe

=
Senior Programmer
Onsite! Technology (http://www.onsitetech.com/)
"Ovid" on http://www.perlmonks.org/

__
Do You Yahoo!?
Make international calls for as low as $.04/minute with Yahoo! Messenger
http://phonecard.yahoo.com/

-- 
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: Re: CGI on IIS <- bad idea?

[Eric Wang]

So I can actually use a CGI to carry out the perl script in the front end
and put the -T inside the cgi right? and the users cannot see which perl
script was executed because it's on the server site.
Is that right?

eric

On Wed, 15 Aug 2001, Curtis Poe wrote:

> --- Mark Bergeron <[EMAIL PROTECTED]> wrote:
> > Taint won't run on Win32 anyway.
>
> Mark,
>
> This is actually a common misconception.  Taint checking works just fine on Win32 
>using
> ActiveState Perl.  Try the following from the command line:
>
> perl -Te "$x=shift;open TEST, qq/>$x/" test.txt
>
> You will get the following error message:
>
> Insecure dependency in open while running with -T switch at -e line 1.
>
> Taint checking is problematic on Win32 systems *usually* because of the way the 
>programs are run.
> If you type "perl somescript.pl" and you have the -T switch on the shebang line, you 
>will get the
> "Too late for "-T" option at somescript.pl line 1." error.  The easiest way to get 
>around this is
> to explicitly pass the -T switch to the perl interpreter:
>
> perl -T somescript.pl
>
> If this doesn't work for you, what version of Perl are you using?
>
> Cheers,
> Curtis Poe
>
> =
> Senior Programmer
> Onsite! Technology (http://www.onsitetech.com/)
> "Ovid" on http://www.perlmonks.org/
>
> __
> Do You Yahoo!?
> Make international calls for as low as $.04/minute with Yahoo! Messenger
> http://phonecard.yahoo.com/
>
> --
> To unsubscribe, e-mail: [EMAIL PROTECTED]
> For additional commands, e-mail: [EMAIL PROTECTED]
>


-- 
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: Re: CGI on IIS <- bad idea?

[Curtis Poe]

--- Eric Wang <[EMAIL PROTECTED]> wrote:
> 
> So I can actually use a CGI to carry out the perl script in the front end
> and put the -T inside the cgi right? and the users cannot see which perl
> script was executed because it's on the server site.
> Is that right?
> 
> eric

Eric,

You'll have to go into IIS and see what cgi script extension is associated with (i.e., 
what opens
it).  If it's associated with PerlIS.dll, you will have faster performance, but cannot 
use taint
checking.  

Generally, taint checking on Windows with IIS is difficult with CGI scripts because 
IIS does not
recognize the shebang line (except for the switches).  It relies on the program 
associated with a
particular extension.  Since this program is executed *before* the script is read in, 
you get a
"Too late for -T" error if you try to use taint checking.

If you can live with slightly slower performance on IIS (kind of a given, huh? :), you 
can do the
following on IIS 5.  Open up the Internet Information Services console and right-click 
on the Web
site you want to adjust and select "properties".  On the properties window, click on 
Home
Directory and if Execute Permissions has 'scripts' in the drop down, click the 
"Configuration". 
On the configuration window, select the extension that you want to change and click 
"Edit".  In
the following window, in the "Executable" window, enter "D:\Perl\bin\Perl.exe -T %s 
%s" (without
the quotes and make sure that you have the correct path to Perl.exe).

Please note that *all* of your CGI programs with the chosen extension will then have 
taint
checking enabled.  This is not a backwards-compatible fix.  You may need to add a new 
extension
and migrate your scripts over.

Depending upon how your system is set up, those instructions may change slightly.  
You'll need to
talk to your boxes administrator to get things to work.

Since going with straight CGI instead of ISAPI is a performance killer and my personal 
research
has revealed NO suitable alternatives when using IIS, you may wish to consider 
mod_perl with
Apache for Win32.  You can find more information about mod_perl with ActivePerl at
http://www.mail-archive.com/modperl%40apache.org/msg11515.html.  However, I think this 
may still
be a beta product at best.  If you need performance *and* security, Windows is not 
your best
option (though that's what we use where I work).

Good luck!
Curtis Poe

=
Senior Programmer
Onsite! Technology (http://www.onsitetech.com/)
"Ovid" on http://www.perlmonks.org/

__
Do You Yahoo!?
Make international calls for as low as $.04/minute with Yahoo! Messenger
http://phonecard.yahoo.com/

-- 
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: Re: CGI on IIS <- bad idea?

[Mark Bergeron]

This could be. When running under

#!/usr/bin/perl -wT

Too late for -T

I'm running 626 on Win2K Pro IIS

-Original Message-
From: "Curtis Poe"<[EMAIL PROTECTED]>
To: "CGI Beginners"<[EMAIL PROTECTED]>
Date: Wed Aug 15 09:50:54 PDT 2001
Subject: Re: CGI on IIS <- bad idea?

>--- Mark Bergeron <[EMAIL PROTECTED]> wrote:
>> Taint won't run on Win32 anyway.
>
>Mark,
>
>This is actually a common misconception.  Taint checking works just fine on Win32 
>using
>ActiveState Perl.  Try the following from the command line:
>
>perl -Te "$x=shift;open TEST, qq/>$x/" test.txt
>
>You will get the following error message:
>
>Insecure dependency in open while running with -T switch at -e line 1.
>
>Taint checking is problematic on Win32 systems *usually* because of the way the 
>programs are run. 
>If you type "perl somescript.pl" and you have the -T switch on the shebang line, you 
>will get the
>"Too late for "-T" option at somescript.pl line 1." error.  The easiest way to get 
>around this is
>to explicitly pass the -T switch to the perl interpreter:
>
>perl -T somescript.pl
>
>If this doesn't work for you, what version of Perl are you using?
>
>Cheers,
>Curtis Poe
>
>=
>Senior Programmer
>Onsite! Technology (http://www.onsitetech.com/)
>"Ovid" on http://www.perlmonks.org/
>
>__
>Do You Yahoo!?
>Make international calls for as low as $.04/minute with Yahoo! Messenger
>http://phonecard.yahoo.com/
>
>-- 
>To unsubscribe, e-mail: [EMAIL PROTECTED]
>For additional commands, e-mail: [EMAIL PROTECTED]
>

/~_. _ | _ _  _  _ 
\_/|(_||| | |(_)| |
 _|
___
GO.com Mail
Get Your Free, Private E-mail at http://mail.go.com



-- 
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: Re: CGI on IIS <- bad idea?

[Curtis Poe]

--- Mark Bergeron <[EMAIL PROTECTED]> wrote:
> This could be. When running under
> 
> #!/usr/bin/perl -wT
> 
> Too late for -T
> 
> I'm running 626 on Win2K Pro IIS

Mark,

If you see my reply to Eric Wang in this thread, I describe how to get around this 
problem. 
Basically, what's going on is that IIS does not recognize the shebang line (except for 
the
switches).  Instead of launching the program there (which it wouldn't find anyway 
unless you
somehow have a /usr/bin/perl on a Win2K box), it checks the Perl programs extension 
and launches
the program associated with it and *then* feeds the program with the switches.  Perl 
needs to be
started with the -T switch passed directly.  I explain how to do that in my previous 
post, though
it will kill your performance.

As a side note, I contacted ActiveState about their ISAPI dll and they informed me 
that they were
considering supporting taint checking in future versions.  Given what I consider a lax 
attention
to security in the past, I am not hopeful that this will actually come to pass.

Cheers,
Curtis Poe

=
Senior Programmer
Onsite! Technology (http://www.onsitetech.com/)
"Ovid" on http://www.perlmonks.org/

__
Do You Yahoo!?
Make international calls for as low as $.04/minute with Yahoo! Messenger
http://phonecard.yahoo.com/

-- 
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]