Proxy example from guide doesn't work, security problem
In the guide there's a cookie cutter example on setting up a proxy in front of the perl server. In it there's a critical rule that blocks incoming proxy requests so the only use of the proxy should be the intended use from rewrite rules. That rule is absolutely critical, otherwise your server can be used as an anonymous redirector for hacking attacks, and it can often be exploited to bypass your firewall. I don't think the rule in the example works. At least on one server if i telnet to its external interface and give a proxy request it tries to contact the external site (and times out because of the firewall). There are lots of errors in the error_log from people trying to use this server as a proxy server. This is very frightening. Have other people actually tested this rule and know it works in some circumstances? The rule in question is: RewriteRule ^(http|ftp)://.* - [F] I had it in a virtual server definition which strikes me as odd, but even when i duplicate it outside the virtual server it still doesn't have any effect. Curiously, most of these attempts come from caches like skycache etc. Either there's a particular manner in which these caches operate that make them try this, or hackers are trying to build multiple levels of indirection for attacks. -- greg
Re: Can't get a requested page
Sorry I answer so late, I was out of connection a few days :-(
> I won't look at this to closely, the first glance raises enough questions.
> So, a few points, do you really intend an exit with every file served?
> Do you really want your handler to fetch a URL, as a proxy, or should you
> instead redirect to the URL with the query string attached?
The problem is not redirection. The thing is that I want to show an
upper frame in a page requested. The handler prints a frameset and this
frameset requests the page, so the handler is triggered again and I need
to determine whether I just need to print the page and exit or show the
frameset. The deal is that the second time the handler is called, to print
the requested page, it's not doing anything.
> 3) instead of just printing "No good" how about "No good: $requestpage"
> or something else informative about the failure
Yeah, I should. Anyway it's requesting the right page...
Hope you can help me or point me the right way.
> >
> > Hi, I need a script that gets a url, and if it doesn't have a
> > query_string, adds one to the url and requests it again. Then, when it
> > comes with a query, reads the file, print it and exit.
> >
> > The matter is that the script enters a loop as it is requesting pages
> > that trigger the script again. But i've been doing tests with this code
> > and the second time is called, it doesn't print anything and I dunno why.
> > Here's the code:
> >
> > sub handler {
> >
> > my $r = shift;
> > my $uri = $r->parsed_uri;
> > my $query = $uri->query;
> > my $path = $uri->path;
> > my $root = 'http://undertow';
> > # Add a query to the page to request
> > my $requestpage = $root . $path . "?hello";
> > my @pathinfo = split ('/', $path);
> > my $page = $pathinfo[$#pathinfo];
> >
> > if (defined $query) {
> > #r->print("there's a query: $query");
> > # Open the file to send
> > open (FILE, '/var/www/$path');
> > my @data = ;
> > close(FILE);
> > # Print it and exit
> > $r->print(@data);
> > exit;
> > } else { # The first request enters here
> > my $request = HTTP::Request->new ("GET" => $requestpage);
> > my $response = $ua->request($request);
> > $r->content_type("text/html");
> > $r->send_http_header;
> > if ($response->is_success) {
> > $r->print($response->content);
> > } else {
> > $r->print("No good");
> > }
> >
> > }
> > }
> > 1;
> >
> > If we first request index.html, it goes into else stuff and requests the
> > page as index.html?hello, so it goes through the handler again and should
> > enter the 'if (defined $query)' stuff. Well it actually does but it
> > doesn't return anything: just "No good". ( I've tried printing
> > $r->print("Works\n") instead of $r->print(@data) but it doesn't work
> > neither ). I don't know what's going wrong here and so I'm asking you.
> >
> > TIA for all. Bye!
> >
> >
> >
> >
> >
> >
>
> --
> Salon Internethttp://www.salon.com/
> HTTP mechanic, Perl diver, Mebwaster, Some of the above
> Ian Kallen <[EMAIL PROTECTED]> / AIM: iankallen / Fax: (561) 619-0995
>
>
Take my words about performance Apache::ASP back
Hello!
At first, great thanks to Gerald Richter and Joshua Chamas for helping to
configure Apache with HTML::Embperl & Apache::ASP.
As I wrote before Embperl 1.1.1 works faster than Apache::ASP 0.16, although
Apache::ASP wasn't configured for best performance. When I upgraded Embperl
to 1.2b9 situation is changed.
Apache::ASP - 19 req/sec, Embperl - 15 req/sec.
--- httpd.conf -
PerlPostReadRequestHandler My::ProxyRemoteAddr
ServerAdmin [EMAIL PROTECTED]
DocumentRoot /usr/local/httpdata/www.samara.ru/data
ServerName www.samara.ru
ErrorLog "|/usr/sbin/cronolog
/usr/local/httpdata/www.samara.ru/logs/ep%d%m%
SetHandler perl-script
PerlHandler HTML::Embperl
Options ExecCGI
SetHandler perl-script
PerlHandler Apache::ASP
PerlSetVar Debug 0
PerlSetVar Global /usr/local/httpdata/www.samara.ru/global
PerlSetVar NoState 1
PerlSetVar DynamicIncludes 1
SetHandler perl-script
PerlHandler Apache::Registry
Options ExecCGI
PerlSendHeader On
--- httpd.conf -
--- index1.asp -
<%
use strict;
use DBI;
my ($dbh,$sth,$login,$fio);
$dbh = DBI->connect("DBI:Oracle:SSUMain","test","test");
$sth = $dbh->prepare_cached("select login,fio from test where login like
?");
$sth->bind_param(1,"Be%");
$sth->execute;
$sth->bind_columns(\$login,\$fio);
local $^W=0;
while ($sth->fetchrow_arrayref)
{
$Response->Write ("$login - $fio\n");
}
%>
--- index1.asp -
apache:/usr/local/apache/power/bin# ./ab -n 1000 -c 10 http://apache/index1.asp
This is ApacheBench, Version 1.3a
Copyright (c) 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/
Copyright (c) 1998-1999 The Apache Group, http://www.apache.org/
Server Software:Apache/1.3.9
Server Hostname:apache
Server Port:80
Document Path: /index1.asp
Document Length:303 bytes
Concurrency Level: 10
Time taken for tests: 51.815 seconds
Complete requests: 1000
Failed requests:0
Total transferred: 586000 bytes
HTML transferred: 303000 bytes
Requests per second:19.30
Transfer rate: 11.31 kb/s received
Connnection Times (ms)
min avg max
Connect:0 5 534
Processing:61 509 3852
Total: 61 514 4386
--- test.epl -
DBTest
[-
use DBI;
$dbh = DBI->connect("DBI:Oracle:SSUMain","test","test");
$sth = $dbh->prepare_cached("select login,fio from test where login like
?");
$sth->bind_param(1,"Be%");
$sth->execute;
$sth->bind_columns(\$login,\$fio);
local $^W=0;
$escmode =0;
-]
[$ while ($sth->fetchrow_arrayref) $]
[+ $login +] - [+ $fio +]
[$ endwhile $]
--- test.epl -
apache:/usr/local/apache/power/bin# ./ab -n 1000 -c 10
http://apache/test.epl
This is ApacheBench, Version 1.3a
Copyright (c) 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/
Copyright (c) 1998-1999 The Apache Group, http://www.apache.org/
Server Software:Apache/1.3.9
Server Hostname:apache
Server Port:80
Document Path: /test.epl
Document Length:355 bytes
Concurrency Level: 10
Time taken for tests: 64.745 seconds
Complete requests: 1000
Failed requests:0
Total transferred: 614000 bytes
HTML transferred: 355000 bytes
Requests per second:15.45
Transfer rate: 9.48 kb/s received
Connnection Times (ms)
min avg max
Connect:0 4 430
Processing:71 638 11717
Total: 71 642 12147
---
Apache::Session and Mason and win32
I'm trying to install Apache::Session in a win32 box and make it work
from Mason Components.
I installed Apache-Session-0.17.1 but it doesn't open the stored
session.
Doing:
$session=Apache::Session::Win32->open($cookie)
always returns undef
Here is the handler.pl session stuff:
my $cookie = $r->header_in('Cookie');
$cookie =~ s/SESSION_ID=(\w*)/$1/;
my $session;
if (defined $cookie) {
$session=Apache::Session::Win32->open($cookie)
or $r->warn("Can't find $cookie in Session");
};
if (!defined $session) {
$session=Apache::Session::Win32->new();
$r->header_out("Set-Cookie"
=> "SESSION_ID=".$session->{_ID});
}
local *HTML::Mason::Commands::session=\$session;
$ah->handle_request($r);
$session->store();
Can you give me a hint about how to handle sessions in win32
with Mason ?
--
^-^,-. mailto:[EMAIL PROTECTED]
o o )http://www.etsetb.upc.es/~frankie
Y (_ (___(
Re: Take my words about performance Apache::ASP back
> while ($sth->fetchrow_arrayref)
>
> $Response->Write ("$login - $fio\n");
> }
does ist change anything, if you change the Embperl code to be more similar
to Apache::ASP?
[-
while ($sth->fetchrow_arrayref)
print OUT "$login - $fio\n";
}
-]
Do you generate any DEBUG output in the logfile? Writing to the logfile
slows down Embperl. Try setting EMBPERL_DEBUG to zero.
How many rows are displayed as result?
Embperl 1.2 is slightly slower then 1.1 due to the more of functionalty, but
from the tests I have made, I can't see such a huge difference. So I would
be interested to see, what's the reason for that difference.
I don't have compared Apache::ASP and Embperl, but I wonder why Embperl 1.2
should be so much slower then 1.1.
Gerald
Re: Take my words about performance Apache::ASP back
> > while ($sth->fetchrow_arrayref)
> >
>
> > $Response->Write ("$login - $fio\n");
> > }
>
> does ist change anything, if you change the Embperl code to be more
similar
> to Apache::ASP?
>
> [-
> while ($sth->fetchrow_arrayref)
>
>
> print OUT "$login - $fio\n";
> }
> -]
>
Ok, I changed to this variant - results leaves the same.
> Do you generate any DEBUG output in the logfile? Writing to the logfile
> slows down Embperl. Try setting EMBPERL_DEBUG to zero.
No, no Debug in ASP and Embperl
>
> How many rows are displayed as result?
13
>
> Embperl 1.2 is slightly slower then 1.1 due to the more of functionalty,
but
> from the tests I have made, I can't see such a huge difference. So I would
> be interested to see, what's the reason for that difference.
Your still have permissons to logon on machine.
>
> I don't have compared Apache::ASP and Embperl, but I wonder why Embperl
1.2
> should be so much slower then 1.1.
When I told that ASP slower than Embperl - Joshua Chamas said that he know
it, but was surprised by huge difference, he tuned the ASP, I upgraded
Embperl to 1.2b9 and results interchanges.
--
Sergey Polyakov (BeerBong)
Chief of Web Lab (http://www.mustdie.ru/~beerbong)
Re: Apache::Filter: Can't locate object method "TIEHANDLE"
Yes, that's what it looks like to me too. STDOUT is supposed to be tied to the
Apache package, and for some reason it's not. I'm not sure why that would be -
can anyone on the list shed some light?
Perhaps it got untied in some previous run of the server. As a simple test,
you might try restarting the server and testing whether it also happens on the
first request, possibly even running in -X mode.
[EMAIL PROTECTED] (Roland Alder) wrote:
>Dear Ken.
>
>Thank you for your assistance.
>
>> warn "tied(*STDOUT) is " . tied(*STDOUT) . ", " . *STDOUT if $debug;
>> $info->{'old_stdout'} = ref tied(*STDOUT);
>> untie *STDOUT;
>
>I did the change and got the following output:
>
>***info for /var/galaxyweb/htdocs/index.html is at
>/var/galaxyweb/perl/Apache/Filter.pm line 32.
>/var/galaxyweb/htdocs/index.html: This is the first filter at
>/var/galaxyweb/perl/Apache/Filter.pm line 61.
>Untie()ing STDOUT at /var/galaxyweb/perl/Apache/Filter.pm line 71.
>tied(*STDOUT) is , *main::STDOUT at /var/galaxyweb/perl/Apache/Filter.
>pm line 72.
>Tie()ing STDOUT to Apache::Filter at /var/galaxyweb/perl/Apache/Filter
>..pm line 91.
>END info is old_stdout count 1 fh_in GLOB(0x8630dac) at
>/var/galaxyweb/perl/Apache/Filter.pm line 95.
>***info for /var/galaxyweb/htdocs/index.html is old_stdout count
>1 fh_in GLOB(0x8630dac) at /var/galaxyweb/perl/Apache/Filter.pm line
>32, chunk 179.
>Turning STDOUT (Apache::Filter) into filter_fh_in at
>/var/galaxyweb/perl/Apache/Filter.pm line 55.
>Tie()ing STDOUT to '' for finish at /var/galaxyweb/perl/Apache/Filter.
>pm line 84.
>[Fri Oct 15 09:03:11 1999] [error] Can't locate object method
>"TIEHANDLE" via package "" at /var/galaxyweb/perl/Apache/Filter.pm
>line 86.
>
>It seems to me (i don't know much about tieing) as STDOUT isn't tied.
>Do you have an idea? What should tied(*STDOUT) return?
>I will try it today on another plattform (Solaris instead of Linux) and look
what's
>happening there.
>
>Thank you again,
>
>Roli
>
>
>--
>Roland Alder, Doerfli 3 / Schmidweg, CH-8634 Hombrechtikon
>e-mail: [EMAIL PROTECTED], WWW: http://galaxy.ch/roli/
>
>
------
Ken Williams Last Bastion of Euclidity
[EMAIL PROTECTED]The Math Forum
RE: Logging Session IDs from environment variables
don't worry about it - I ask silly questions all the time ;)
just in case you are interested... for my logging I set up several log
handlers: one main handler that pushes other log handlers on to the
PerlLogHander stack using push_handlers(). This way I can use the main
handler to do some pattern matching and stuff on the URI and use different
logging routines for different types of pages - for instance, I skip logging
all requests for images and the redirects resulting from a 404.
anyway, just thought I'd mention it.
glad you got your problem figured out.
--Geoff
> -Original Message-
> From: [EMAIL PROTECTED] [SMTP:[EMAIL PROTECTED]]
> Sent: Friday, October 15, 1999 8:00 AM
> To: 'Young, Geoffrey S.'; Clinton Gormley; [EMAIL PROTECTED]
> Subject: RE: Logging Session IDs from environment variables
>
> Many thanks Geoff
>
> I feel rather embarassed to admit my stupidity here. Most pages didn't
> include the ID from notes because (DOH!) they were images and the browser
> was not required to prove its identity.
>
> When I scanned up the page a bit... indeed there they were
>
> My apologies, and again thanks
>
> Clint
>
>
> > -Original Message-
> > From: Young, Geoffrey S. [mailto:[EMAIL PROTECTED]]
> > Sent: 13 October 1999 13:15
> > To: '[EMAIL PROTECTED]'; [EMAIL PROTECTED]
> > Subject: RE: Logging Session IDs from environment variables
> >
> >
> > well...
> >
> > variables set by the notes and subprocess_env methods should
> > be available
> > for the entire length of the request, no matter what phase
> > they are set.
> >
> > I just set up a test handler that used both notes and
> > subprocess_env to set
> > up variables in a PerlInitHandler and was able to capture
> > them by adding
> > them to the LogFormat directive. Make sure the directive
> > quotes the quotes
> > (that is, \"{NOTES_VAR}n\" for example). That you are using
> > PerlAuthenHandler should not make a difference.
> >
> > I'm not sure if mod_perl implements a way to get pnotes stuff
> > into your
> > logs, which is a pretty cool function. Anyone?
> >
> > hope this helps - if not, try posting the relevant bits...
> >
> > --Geoff
> >
> >
> >
> > > -Original Message-
> > > From: [EMAIL PROTECTED]
> > [SMTP:[EMAIL PROTECTED]]
> > > Sent: Monday, October 11, 1999 10:34 AM
> > > To: [EMAIL PROTECTED]
> > > Subject: Logging Session IDs from environment variables
> > >
> > > Hi all
> > >
> > > I have asked this before, but I still haven't managed to
> > shed any light on
> > > it, so I was hoping that somebody might be able to shed
> > some more light.
> > >
> > > (While you're about it, have a look at the site we have
> > just launched :
> > > http://www.orgasmicwines.com - mod_perl & mysql based site.)
> > >
> > > If I store my sessionID in an environment variable (or in
> > $r->notes), I
> > > can
> > > see it in other Apache:: modules, but when I try to log it
> > using the the
> > > CustomLog directive in httpd.conf, the environment variable
> > (or $r->notes)
> > > is blank.
> > >
> > > Does this have anything to do with the fact that I'm setting the ENV
> > > variable in a PerlAuthenHandler, before %ENV is set up? And that
> > > shouldn't
> > > affect $r->notes, should it?
> > >
> > > Any help greatly appreciated
> > >
> > > Many thanks
> > >
> > > Clint
> >
Installing handler. Anonymous subs vs code returning ref
Hi! Quick question. It's mentioned in the book that I may provide anonymous subroutine as a handler. Does it have to be sub declaration or any arbitrary perl code that return reference to sub would do? Andrei --
OT: Is there a general question apache mailing list?
Hello list, I have apache 1.3.6 with mod_perl 1.21 installed. I've been using it without any problems for a long time, and I've now reach a point where I'd like to use server side includes like Normally, on other web sites this is a painless procedure. The httpd.conf is pretty much unmodified as it came with the distribution, except I uncommented these lines: AddType text/html shtml AddHandler server-parsed shtml And for htdocs AllowOverride is set to All I've also tried adding these lines, and many variations to the .htaccess. When I view a page, the SSI code is still in the document, as if the server didn't process it at all. I'm at a loss for what might be wrong - the "Apache: The Definitive Guide" book I have makes it sound like there are no build-time configuration options that need to be selected- it seems like this is default behavior to expect. As an update, I've downloaded Apache 1.3.9 and rebuilt my entire server, and the new server has the exact same problem.. My server-info says mod_include.c is installed and handling content for text/x-server-parsed-html , text/x-server-parsed-html3 , server-parsed , text/html.. But SSI statements aren't being processed - they are still in the HTML code that is delivered to the browser. I'm at wits' end. I would like to post this question on a Apache mailing list because I can seem to find the answer on the apache web site, this apache book, or by searching the web. Does anyone know of any Apache mailing lists? Thanks for listening...
Re: Installing handler. Anonymous subs vs code returning ref
> > Quick question. It's mentioned in the book that I may provide > anonymous subroutine as a handler. Does it have to be sub declaration > or any arbitrary perl code that return reference to sub would do? > Any reference to a sub (coderef) should do Gerald
Re: [SITE] the great redesign of 1999
Stas Bekman <[EMAIL PROTECTED]> writes: > My personal comment on both of your previews, is that they are very cool! > But while being flattered with having a Guide as part of the main menu, > this is unfair to other folks who wrote an invaluable documentation > (Vivek, Frank and other). For my part, I leave that decision entirly up to the designers. If it fits in there, fine. If it doesn't, that's fine too. -- Frank Cringle, [EMAIL PROTECTED] voice: (+49 2304) 467101; fax: 943357
[andrei@securities.com: Installing handler. Anonymous subs vs code returning ref]
Sorry. Contrary to the replies I couldn't install handler as arbitrary
perl code that returns reference to code. Only "sub {your code here}"
actually works. Everything else logs error when attempting to fetch
the URL.
Andrei
- Forwarded message from "Andrei A. Voropaev" <[EMAIL PROTECTED]> -
Date: Fri, 15 Oct 1999 08:53:25 -0400
From: "Andrei A. Voropaev" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: Installing handler. Anonymous subs vs code returning ref
Mail-Followup-To: [EMAIL PROTECTED]
X-Mailer: Mutt 0.95.4i
Hi!
Quick question. It's mentioned in the book that I may provide
anonymous subroutine as a handler. Does it have to be sub declaration
or any arbitrary perl code that return reference to sub would do?
Andrei
--
- End forwarded message -
--
[Fwd: Embperl system interpolation]
Gary,
These are two command that we've tested in perl script and it printed out
hello as it is supposed to(the second example).
${system(echo hello)}
${system('echo hello')}
We tried to put this into a form on the web and see what Embperl would do
with this. And we got nothing. It inputted both of these statements into
the database as a string. Is there anything in embperl that prevents from
this call going to the system? This code produced errors on a different
page that we use to authenticate passwords where this code was looked at
by DBI and tried to create an SQL call (following is the err msg)
[17074]ERR: 32: Line 14: Warning in Perl code: DBD::mysql::st execute
failed: You have an error in your SQL syntax near 'echo hello')}')' at
line 1 at /usr/lib/perl5/SQLHANDLE.pm line 118.
So, both of these pages are embperl pages,but why the error in one place
and not in the other?
-Akshay
RE: mod_perl rpm ready for testing
Miguel A.L. Paraz wrote: > On Wed, Oct 13, 1999 at 04:24:55PM -0400, David Harris wrote: > Thanks a lot for solving my long-standing problem of building a static > mod_perl system that allows loading of modules and is compatible with the > Red Hat RPM. I initially didn't bump into problems when doing simple > stuff and HTML::EmbPerl but when I started working with the WING web e-mail > system I had all sorts of problems. Does this mean that you've gotten my RPM to work for you in places where the Red Hat mod_perl RPM did not? If so, good, and I'll continue with releasing this stuff up on the web. Expect it to be done sometime later today. > Sometime in the future I would need Apache-SSL with mod_perl, so I guess > I could use your work as a starting point. I'm probably going to make a version for myself that has EAPI integrated, so that it will mesh properly with my apache-mod_perl RPM that I've got. I doubt that I'll end up distributing that version because of crypto hook export problems. - David Harris Principal Engineer, DRH Internet Services
ANNOUNCE: HTML::Mason 0.72
The URL http://www.masonhq.com/download/HTML-Mason-0.72.tar.gz has entered CPAN as file: $CPAN/authors/id/J/JS/JSWARTZ/HTML-Mason-0.72.tar.gz size: 217526 bytes md5: cdfa8719773da3fcced56c6bd580e3d2 Mason is a component-based web site development system with caching, debugging, and previewing facilities. Check out http://www.masonhq.com for more information. Changes in 0.72: - Eliminated long-standing infinite-block bug when POSTing to a non-existent URL - Fixed "keys" cache action which never worked as documented (submitted by Scott Straley) - Fixed source references on Win32 platforms by using text mode when reading object file (submitted by Michael Shulman) - Fixed various methods in FakeApache - Remove final slash from system paths (component root, etc.) and check that those paths are absolute - Fixed all-text subcomponents, by bypassing the pure-text optimization - Quoted all hash strings in object file to reduce "Ambiguous use of ..." warnings (suggested by Paul Schilling) - Replaced */* with default-handler as recommended way to bypass Mason (suggested by Dirk Koopman) - Removed defunct pure text section in Administrators Guide (reported by Michael Shulman)
Rewrite to handler
What is the most straightforward way to make a RewriteRule map an arbitrary URL directly to a handler? I can do it by setting a handler for a directory, putting the file there and rewriting to that location, or by setting a handler for a mime-type and specifying -T for that type in the rewriterule. Have I missed a more direct way? (I want to mix-n-match PerlRun, Registry, and CGI for some old programs without changing the visible URL's.) Les Mikesell [EMAIL PROTECTED]
Re: OT: Is there a general question apache mailing list?
I've found SSI to be often problematic since when it doesn't work, it does so silently like you are saying. Your syntax below looks fine, so I'm no help there, but if you want other options, the modperl modules Apache::SSI, and Apache::ASP will also handle the include file SSI directive. These modules are nice too because they allow you to sprinkle perl code in your pages as well. --Joshua _ Joshua Chamas Chamas Enterprises Inc. NODEWORKS >> free web link monitoring Huntington Beach, CA USA http://www.nodeworks.com1-714-625-4051 "Olsen, James" wrote: > > Hello list, > > I have apache 1.3.6 with mod_perl 1.21 installed. I've been using it > without any problems for a long time, and I've now reach a point where I'd > like to use server side includes like > > Normally, on other web sites this is a painless procedure. The httpd.conf > is pretty much unmodified as it came with the distribution, except I > uncommented these lines: > > AddType text/html shtml > AddHandler server-parsed shtml > > And for htdocs AllowOverride is set to All > > I've also tried adding these lines, and many variations to the .htaccess. > When I view a page, the SSI code is still in the document, as if the server > didn't process it at all. > > I'm at a loss for what might be wrong - the "Apache: The Definitive Guide" > book I have makes it sound like there are no build-time configuration > options that need to be selected- it seems like this is default behavior to > expect. > > As an update, I've downloaded Apache 1.3.9 and rebuilt my entire server, > and the new server has the exact same problem.. My server-info says > mod_include.c is installed and handling content for > text/x-server-parsed-html , text/x-server-parsed-html3 , server-parsed , > text/html.. But SSI statements aren't being processed - they are still in > the HTML code that is delivered to the browser. I'm at wits' end. > > I would like to post this question on a Apache mailing list because I can > seem to find the answer on the apache web site, this apache book, or by > searching the web. > > Does anyone know of any Apache mailing lists? > > Thanks for listening...
Re: OT: Is there a general question apache mailing list?
I had a similar problem. in order to get includes to work, you need to set 'Options Includes' in a Location/Directory directive. > _ > Joshua Chamas Chamas Enterprises Inc. > NODEWORKS >> free web link monitoring Huntington Beach, CA USA > http://www.nodeworks.com1-714-625-4051 > > "Olsen, James" wrote: > > > > Hello list, > > > > I have apache 1.3.6 with mod_perl 1.21 installed. I've been using it > > without any problems for a long time, and I've now reach a point where I'd > > like to use server side includes like > > > > Normally, on other web sites this is a painless procedure. The httpd.conf > > is pretty much unmodified as it came with the distribution, except I > > uncommented these lines: > > > > AddType text/html shtml > > AddHandler server-parsed shtml > > > > And for htdocs AllowOverride is set to All > > > > I've also tried adding these lines, and many variations to the .htaccess. > > When I view a page, the SSI code is still in the document, as if the server > > didn't process it at all. > > > > I'm at a loss for what might be wrong - the "Apache: The Definitive Guide" > > book I have makes it sound like there are no build-time configuration > > options that need to be selected- it seems like this is default behavior to > > expect. > > > > As an update, I've downloaded Apache 1.3.9 and rebuilt my entire server, > > and the new server has the exact same problem.. My server-info says > > mod_include.c is installed and handling content for > > text/x-server-parsed-html , text/x-server-parsed-html3 , server-parsed , > > text/html.. But SSI statements aren't being processed - they are still in > > the HTML code that is delivered to the browser. I'm at wits' end. > > > > I would like to post this question on a Apache mailing list because I can > > seem to find the answer on the apache web site, this apache book, or by > > searching the web. > > > > Does anyone know of any Apache mailing lists? > > > > Thanks for listening... >
status()
I'm writing a Apache::Registry script and would like to use the following
syntax to return server status:
my $r = $apache->request;
$r->content_type('text/html');
unless (some_test) {
$r->log_error("FOO");
$r->status(FORBIDDEN);
return;
}
My problem is that the resulting error message is a bit funky.
I get the typical : Forbidden You don't have permission to access /foo on
this server
But then I *ALSO* get : Additionally, a 403 Forbidden error was encountered
while trying to use an ErrorDocument to handle the request
When I return a 403, it says "Additionally a 403.." when it's a 404, it says
"Additionally a 404...".
What's the proper way to do this so I don't end up with "double errors" ???
FYI: I've not configured any kind of ErrorDocument
Ian
Embperl configurability
We're attempting to implement Embperl on an already-existing, relatively large website whose HTML writers/users number well over 400. We're finding that a large minority of documents already have the left square bracket followed by one of the special characters (+-*#$!) within them, obviously not intended to be interpreted as perl code. I'd like to suggest that Embperl be configurable (at worst during compile time, at best in apache run-time configuration files) with respect to what characters are used to mark the beginning and end of Embperl. For instance, I'd like to be able to use HTML comments instead of square brackets: I do see in the documentation that "Embperl does not use SGML comments (i.e., or similar things) because some HTML editors can't create them, or it's much more complicated. Since every HTML editor takes (or should take) `[' and `]' as normal text, there should be no problem." I suppose there are multiple sides to every problem, which speaks more to the idea that the code wrapper text should be configurable. Better still, would be the ability to configure from a single +, which is very common in existing HTML documents, to another character set: perhaps double-plus, perhaps EVAL-OUT. Finally, what is the value with having the closing bracket be preceded by one of the special characters? Why not just have the opening character(s)? Is that not enough to determine how to deal with the ensuing perl code? Regards, Christian - Christian Gilmore Senior Technical Staff Member AT&T Labs IP Technology, Florham Park [EMAIL PROTECTED] http://www.research.att.com/info/cgilmore
ANNOUNCE: mod_perl Guide ver 1.17
I'm glad to announce a ver. 1.17 of the mod_perl Guide
You can find the Guide at http://perl.apache.org/guide
There have been many heavy additions in this release, please help to
review those. You will find them all in the CHANGES below, but I'll
list the most important ones here:
* a big new section "using RPM, DEB and other packages to
install mod_perl" (by Young, Geoffrey S and David Harris)
* a big new section "One Light and One Heavy Servers
where ALL htmls are Perl-Generated" (by Wesley Darlington)
* added a converted to pod "Jeff's guide to mod_perl
database performance" (by Jeffrey W. Baker)
* new chapter: "Correct Headers" contributed by Andreas Koenig.
* I wrote lots of new material (see the CHANGES)
The CHANGES file:
10.16.99 ver 1.17
* intro: CREDITS section was updated the long list of contributors!!!
Thank you all!!! If I've missed your name, please let me know!!!
* control: added "Safe Code Updates on a Live Production Server"
* control: added "An Intentional Disabling of Live Scripts"
* scenario: added a big new section "One Light and One Heavy Servers
where ALL htmls are Perl-Generated" (Wesley Darlington)
* dbm: David Harris has detected a corruption with the suggested
locking methods in the Camel book and DB_File man page (at least
before the version 1.72). They are flawed and if you use them in the
environment where more than one process modify the dbm file, it can
get corrupted!!! I've modified the DB_File::Lock module to fix the
problem by integrating the previously written DB_File::Wrap and the
module David wrote (David Harris)
* snippets: added "Sending multiply cookies with Perl API" (Rick
Myers)
* install: added a big section "using RPM, DEB and other packages to
install mod_perl" (Young, Geoffrey S , David Harris)
* install: added "Automating installation" - James G Smith's Apache
Builder script
* install: added a new section "using CPAN to install mod_perl"
* performance: extended the "Forking or Executing subprocesses from
mod_perl" with information and code to avoid zombies.
* performance: added a converted to pod "Jeff's guide to mod_perl
database performance" (Jeffrey W. Baker)
* new chapter: "Correct Headers" contributed by Andreas Koenig!!!
* help: updated the link to DBI homepage (hermetica has gone)
* performance: added sizing benchmarks of CGI.pm's imported
symbols. (CGI.pm's object methods calls vs. function calls)
* porting: fixed a typo with local() and Special variables (Andrei
A. Voropaev)
* snippets: fixed a taint problem in the sample error_log display
script.(John Walker)
* install: added "Should I Build mod_perl with gcc or cc" (Tom Hughes)
* warnings: added to the troubleshotting section "Missing right
bracket at line " with a link to the item explaining that in
porting.pod ("__END__ and __DATA__ tokens") (Eric Strovink)
* install: added a tip of saving config.status files for each module
build (php. mod_perl, ssl) for a later easier reuse. (Dave
Hodgkinson)
* performance: added clarification to "PerlSetupEnv Off" item (Doug)
* snippets: added "Passing environment variables between handlers"
(Doug)
* warnings: added "Can't locate loadable object for module XXX" (Doug)
* config: corrected the section dump typo (Gerald Richter)
* scenario: corrected the snippet to extract the client IP from the
X-Forwarded-For header to use headers_in instead of the obsolete
header_in (Oleg Bartunov)
* scenario: added a note about "Ben Laurie's Apache-SSL setting
REMOTE_ADDER instead of X-Forwarded-For header (Jie Gao)
* performance: started "Analysis of SW and HW Requirements" (Jeffrey
W. Baker)
* warnings: clarification of "rwrite returned -1" (Eric Cholet)
* warnings: added "Invalid command 'PerlHandler" (Doug)
* debug: started "Apache::Debug" and Carp::confess("init") (Doug)
* install: "undefined reference to 'Perl_newAV'" documented (Doug)
* modules: added a clarification about Apache::PerlVINC (Doug)
* warnings: updated the "Callback Called Exit & -D
PERL_EMERGENCY_SBRK" (Doug)
* databases: added $Apache::DBI::DEBUG = 2 (instead of '1') for ver
0.84+ (Edmund Mergl)
* performance: added "Caching prepare() statements" + rolling your own
Apache::DBO code (Jeffrey Baker)
* porting: replaced "Apache::Registry::handler" with
"Apache::Registry". It caused problems to some of the users (Daniel
W. Burke)
* performance: added "Increasing the shared memory with mergemem" (no
real info but a link to the util's site. Please take a look and
submit your opinions) (Doug Bagley)
* snippets: added "Redirect a POST request, forwarding the content"
(Eric Cholet, Doug)
* performance extended the "Using $|=1 under mod_perl and better
print() techniques" with notes about rflush()
* shuffled many items around to help more intuitive search of the them
* performance: added "Cached stat() calls"
You can find the Guide at http://perl.apache.org/guide
Enjoy!
___
BUG?? Weird server startup prob w/ Apache::DBI
Hi all, I've searched the list for this, but to no avail. I'm using 1.3.9 / 1.21 / latest Apache::DBI, Embperl 1.2b7, Perl 5.00503 Anywho, this the problem: When I enable Apache::DBI in httpd.conf, the server simply won't start. No error log messages, no nothing. It claims to have started ( output from apachectl ) but, hasn't. Odd thing is through sheer persistence I got it to start earlier today, and everything worked peachy, but I made some changes to mods ( I just checked, and they all compile fine ), stopped the server, and now it won't restart. The server starts fine if I comment out PerlModule Apache::DBI. This is rather a show stopper. Has anyone else seen anything like this. If so, please tell me how you fixed it!!! Thanks, Tom -- =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Tom Lancaster iQualify, inc.. [EMAIL PROTECTED] Walnut Creek, CA 1-925-906-5881 MIME spoken herehttp://www.iqualify.com/
Apache::ASP
Can this perlMod be used as a IIS replacement under winnt 4.0 server? -- /* tALSit de CoD || Catalyst of Design * * * *David Allan Morris Oliveros* * * * http://resgine.deusto.es/talsit * * [EMAIL PROTECTED] * * +34 619709997 ICQ:47124624 */
Re: [SITE] the great redesign of 1999
At 01:06 15/10/1999 +0200, Stas Bekman wrote: >The list already exist - [EMAIL PROTECTED] or this one >[EMAIL PROTECTED] (it's an alias right? was it also >[EMAIL PROTECTED] ?) Oh, that's good to know :-) Is it any/all of the above ? And if so, is it running Majordomo or ezmlm (so that I can figure how to subscribe) ? >BTW, if you remember that I've tried to create a new site about half a >year ago (the first snapshot is still there at stason.org/stas/modperl) >I've never made the second version :( It all went into >modperl.sourcegarden.org's design... Yes I remember, I would have helped back then (April) but I was way too busy crossing the Atlantic and the amount of unconstructive criticism unusual on this list probably didn't help get me more involved. Digging up in the archives, I have found the link to the Site::Builder source (http://www.singlesheaven.com/stas/modperl/src/builder.tar.gz , is it the right one ?) which I am now downloading. As for the site, well it has a few flaws but nothing worth flaming for and no project-killer. There are a few things which I quite like, I think we'll list those when time comes to actually design something. Also, your input on what could be reused from your code would certainly be helpful. One funny thing, back then people referred to the Guide as the "miniguide" :-) >Anyway, I've got about 40 emails with responds from people regarding the >above first release. just a part of them in he archive, I can send the >emails to you -- there are many good comments in there. If you have anything that's not in the archives then I think those could help, any good comments help. >But while being flattered with having a Guide as part of the main menu, >this is unfair to other folks who wrote an invaluable documentation >(Vivek, Frank and other). While the Guide has integrated almost all of >them inside itself, I vote for having a 'Documentation' entry in the >main menu, with a sub menu, enlisting all the available documentation >there. YMMV... Thanks! Yes I totally agree. I had actually thought of that but I was just offering a design idea and no real categorisation so I stopped before I started looking for all available documentation. I meant neither offense nor praise (though I think there is much praise to be said about the mod_perl documentation as a whole, and making the "Books" entry plural was intentional). .Robin You can tune a piano, but you can't tuna fish.
RE: Logging Session IDs from environment variables
Many thanks Geoff
I feel rather embarassed to admit my stupidity here. Most pages didn't
include the ID from notes because (DOH!) they were images and the browser
was not required to prove its identity.
When I scanned up the page a bit... indeed there they were
My apologies, and again thanks
Clint
> -Original Message-
> From: Young, Geoffrey S. [mailto:[EMAIL PROTECTED]]
> Sent: 13 October 1999 13:15
> To: '[EMAIL PROTECTED]'; [EMAIL PROTECTED]
> Subject: RE: Logging Session IDs from environment variables
>
>
> well...
>
> variables set by the notes and subprocess_env methods should
> be available
> for the entire length of the request, no matter what phase
> they are set.
>
> I just set up a test handler that used both notes and
> subprocess_env to set
> up variables in a PerlInitHandler and was able to capture
> them by adding
> them to the LogFormat directive. Make sure the directive
> quotes the quotes
> (that is, \"{NOTES_VAR}n\" for example). That you are using
> PerlAuthenHandler should not make a difference.
>
> I'm not sure if mod_perl implements a way to get pnotes stuff
> into your
> logs, which is a pretty cool function. Anyone?
>
> hope this helps - if not, try posting the relevant bits...
>
> --Geoff
>
>
>
> > -Original Message-
> > From: [EMAIL PROTECTED]
> [SMTP:[EMAIL PROTECTED]]
> > Sent: Monday, October 11, 1999 10:34 AM
> > To: [EMAIL PROTECTED]
> > Subject:Logging Session IDs from environment variables
> >
> > Hi all
> >
> > I have asked this before, but I still haven't managed to
> shed any light on
> > it, so I was hoping that somebody might be able to shed
> some more light.
> >
> > (While you're about it, have a look at the site we have
> just launched :
> > http://www.orgasmicwines.com - mod_perl & mysql based site.)
> >
> > If I store my sessionID in an environment variable (or in
> $r->notes), I
> > can
> > see it in other Apache:: modules, but when I try to log it
> using the the
> > CustomLog directive in httpd.conf, the environment variable
> (or $r->notes)
> > is blank.
> >
> > Does this have anything to do with the fact that I'm setting the ENV
> > variable in a PerlAuthenHandler, before %ENV is set up? And that
> > shouldn't
> > affect $r->notes, should it?
> >
> > Any help greatly appreciated
> >
> > Many thanks
> >
> > Clint
>
Multiple PerlHandler in Apache
I need to have 2 PerlHandler 's in the httpd.conf file, but when I put them both in...the html page from that location gets interpreted 2 times. here is the Location code SetHandler perl-script PerlHandler Apache::BASEREF PerlHandler HTML::Embperl Options ExecCGI How can you have Apache use both these modules and have one proper output? thanks, Akshay
Errors while running under Apache::Registry (modperl 1.21)
Hello all, Let me start out by saying that I am extremely new to mod-perl, but have been writing cgi scripts for four years. I am having some difficulties in running a few script under mod-perl. My server is apache 1.3.9 with mod-perl 1.21. The script I am trying to use is Web-search ver 1.12 , by Darryl Burgdorf. Here are the error_log entries thrown by the server: Use of uninitialized value at /home/httpd/cgi-bin/web-search.cgi line 45. Use of uninitialized value at /home/httpd/cgi-bin/web-search.cgi line 46. Use of uninitialized value at /home/httpd/cgi-bin/web-search.cgi line 47. Use of uninitialized value at /home/httpd/cgi-bin/web-search.cgi line 48. Use of uninitialized value at /home/httpd/cgi-bin/web-search.cgi line 52. Argument "136227836case=insensitive&hits=10&boolean=any+terms&term..." isn't numeric in entersub at /usr/lib/perl5/site_perl/Apache/Registry.pm line 136. Useless use of a variable in void context at /home/httpd/cgi-bin/web-search.cgi line 59. I noticed that all the FORM VARIABLES are not showing up... ie, when I type in the search term in the form, The script runs as if nothing was entered, and just displays the list of files to be searched. The script is extremely long, so I do not want to post it here. It is available for downloading/viewing at my personal server (http://cpelkey.dyn.ns1.net/downloads/) Thanks in advance for any and all help in this matter. Charles E. Pelkey C.P. Designs [EMAIL PROTECTED] [EMAIL PROTECTED] ICQ: 8294384 http://www.geocities.com/TimesSquare/Alley/2920/designs.html http://cpelkey.dyn.ns1.net/ <- Personal server, 2130-0600 U.S. Eastern Time
Re: OT: Is there a general question apache mailing list?
Do you have Includes enabled in the Options for the directory that has your .shtml files? (http://www.apache.org/docs/mod/mod_include.html) "Olsen, James" wrote: > > Hello list, > > I have apache 1.3.6 with mod_perl 1.21 installed. I've been using it > without any problems for a long time, and I've now reach a point where I'd > like to use server side includes like > > Normally, on other web sites this is a painless procedure. The httpd.conf > is pretty much unmodified as it came with the distribution, except I > uncommented these lines: > > AddType text/html shtml > AddHandler server-parsed shtml > > And for htdocs AllowOverride is set to All > > I've also tried adding these lines, and many variations to the .htaccess. > When I view a page, the SSI code is still in the document, as if the server > didn't process it at all. > > I'm at a loss for what might be wrong - the "Apache: The Definitive Guide" > book I have makes it sound like there are no build-time configuration > options that need to be selected- it seems like this is default behavior to > expect. > > As an update, I've downloaded Apache 1.3.9 and rebuilt my entire server, > and the new server has the exact same problem.. My server-info says > mod_include.c is installed and handling content for > text/x-server-parsed-html , text/x-server-parsed-html3 , server-parsed , > text/html.. But SSI statements aren't being processed - they are still in > the HTML code that is delivered to the browser. I'm at wits' end. > > I would like to post this question on a Apache mailing list because I can > seem to find the answer on the apache web site, this apache book, or by > searching the web. > > Does anyone know of any Apache mailing lists? > > Thanks for listening... -- Eugene
Re: BUG?? Weird server startup prob w/ Apache::DBI
Tom Lancaster wrote: > > Hi all, > I've searched the list for this, but to no avail. > I'm using 1.3.9 / 1.21 / latest Apache::DBI, Embperl 1.2b7, Perl 5.00503 > > Anywho, this the problem: > When I enable Apache::DBI in httpd.conf, the server simply won't start. > No error log messages, no nothing. It claims to have started ( output > from apachectl ) but, hasn't. > > Odd thing is through sheer persistence I got it to start earlier today, > and everything worked peachy, but I made some changes to mods ( I just > checked, and they all compile fine ), stopped the server, and now it > won't restart. > > The server starts fine if I comment out PerlModule Apache::DBI. > > This is rather a show stopper. Has anyone else seen anything like this. > If so, please tell me how you fixed it!!! > > Thanks, > > Tom > -- > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > Tom Lancaster iQualify, inc.. > [EMAIL PROTECTED] Walnut Creek, CA 1-925-906-5881 > MIME spoken herehttp://www.iqualify.com/ this has been reported several times. If you have a pre-configured database conection and the connect does not succeeed, your server won't start until the connect times out (database dependent) ! Edmund -- Edmund Mergl mailto:[EMAIL PROTECTED] http://www.bawue.de/~mergl
RE: More on web application performance with DBI
When you refer to bound parameters, do you refer only to the use of $sth->bind_param, or would calling $sth->execute($foo,$bar) also qualify. Is there any difference between using these methods other than clarity of code? Thanks Clint > -Original Message- > From: Jeffrey W. Baker [mailto:[EMAIL PROTECTED]] > Sent: 15 October 1999 03:50 > To: [EMAIL PROTECTED]; [EMAIL PROTECTED] > Cc: [EMAIL PROTECTED] > Subject: Re: More on web application performance with DBI > > > "Jeffrey W. Baker" wrote: > > > > Perrin Harkins wrote: > > > > > > On Thu, 14 Oct 1999, Jeffrey Baker wrote: > > > > Zero optimization: 41.67 requests/second > > > > Stage 1 (persistent connections): 140.17 requests/second > > > > Stage 2 (bound parameters): 139.20 requests/second > > > > Stage 3 (persistent statement handles): 251.13 requests/second > > > > > > I know you said you don't like it because it has extra > overhead, but would > > > you mind trying stage 3 with prepare_cached rather than > your custom > > > solution with globals? For some applications with lots > of SQL statements, > > > the prepare_cached appraoch is just much more manageable. > > > > Okay. I'll try it out tomorrow and post the results. However, my > > application uses this approach and I'd say it's in the 99th > percentile > > with respect to number of different statements =:-) > > I just performed this benchmark. The Stage 3 optimization using > prepare_cached gets 152.72 requests/sec. The end result is this: > > Zero optimization: 41.67 requests/second > Stage 1 (persistent connections): 140.17 requests/second > Stage 2 (bound parameters): 139.20 requests/second > Stage 3 (prepare_cached): 152.72 requests/second > Stage 3 (global references): 251.13 requests/second > > You can see that prepare_cached isn't much of an improvement over > prepare. I've profiled this stuff in the past, and the prepare method > really is quite expensive. A nice project for someone with sufficient > spare time would be to optimize that code path. > > -jwb >
Re: More on web application performance with DBI
On Fri, 15 Oct 1999, Perrin Harkins wrote: > On Thu, 14 Oct 1999, Jeffrey Baker wrote: > > Zero optimization: 41.67 requests/second > > Stage 1 (persistent connections): 140.17 requests/second > > Stage 2 (bound parameters): 139.20 requests/second > > Stage 3 (persistent statement handles): 251.13 requests/second > > I know you said you don't like it because it has extra overhead, but would > you mind trying stage 3 with prepare_cached rather than your custom > solution with globals? For some applications with lots of SQL statements, > the prepare_cached appraoch is just much more manageable. Sadly prepare_cached doesn't always work very well - at least not with Sybase (and I assume MSSQL). Just a warning. -- Details: FastNet Software Ltd - XML, Perl, Databases. Tagline: High Performance Web Solutions Web Sites: http://come.to/fastnet http://sergeant.org Available for Consultancy, Contracts and Training.
Re: More on web application performance with DBI
Oleg Bartunov writes: > On Thu, 14 Oct 1999, Perrin Harkins wrote: > > > Date: Thu, 14 Oct 1999 17:53:15 -0700 (PDT) > > From: Perrin Harkins <[EMAIL PROTECTED]> > > To: Jeffrey Baker <[EMAIL PROTECTED]> > > Cc: [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED] > > Subject: Re: More on web application performance with DBI > > > > On Thu, 14 Oct 1999, Jeffrey Baker wrote: > > > Zero optimization: 41.67 requests/second > > > Stage 1 (persistent connections): 140.17 requests/second > > > Stage 2 (bound parameters): 139.20 requests/second > > > Stage 3 (persistent statement handles): 251.13 requests/second > > > > I know you said you don't like it because it has extra overhead, but would > > you mind trying stage 3 with prepare_cached rather than your custom > > solution with globals? For some applications with lots of SQL statements, > > the prepare_cached appraoch is just much more manageable. > > Some databases doesn't support caches of prepared plans. > PostgreSQL for example. Or Sybase. Though with Sybase you could open multiple connections to achieve the same result (at the risk of getting deadlocks depending on what you are trying to do!) Michael -- Michael Peppler -||- Data Migrations Inc. [EMAIL PROTECTED]-||- http://www.mbay.net/~mpeppler Int. Sybase User Group -||- http://www.isug.com Sybase on Linux mailing list: [EMAIL PROTECTED]
