Re: Implementing security in CGI

2000-04-20 Thread Differentiated Software Solutions Pvt. Ltd.
Hi, Persitent cookies was the dilemna I was in. I also found that there are persistent and non-persistent cookies. I wrote some test Javascript programs and found out that we can have cookies which die after the browser exits. Would this be a good option. Another nagging doubt. Is this the way

Re: [RFC] Do Not Run Everything on One mod_perl Server

2000-04-20 Thread shane
Actually in my experience the sharing of memory doesn't work as well as one would hope. While compiling perl allocates memory for code and data (variables) from the same memory pools, so code and variables are interlaced. Over the lifetime of a apache/mod_perl child a lot of

Re: Implementing security in CGI

2000-04-20 Thread Manfred Dehnkamp
Hy, why do you use cookie's ??? A lot of people hate them. I think a much better Idea is to put your sessionID in the PathInfo of every requested URI. So after the login your CGI generates a SessionID. Lets say your CGI has the URI http://domain/mycgi. After the login the cgi's output is just a

Re: Implementing security in CGI

2000-04-20 Thread Gunther Birznieks
Yeah it works on all the clients, but it's a pain in the ass to do relative URLs when manipulating PATH_INFO. So it's not necessarily trivial to program and maintain unless you pass everything through a monolithic CGI. Of course, on Apache it may be easier by using mod_rewrite to manipulate

Re: Implementing security in CGI

2000-04-20 Thread Gunther Birznieks
At 09:53 AM 4/20/00 +0530, Differentiated Software Solutions Pvt. Ltd. wrote: Hi, Persitent cookies was the dilemna I was in. I also found that there are persistent and non-persistent cookies. I wrote some test Javascript programs and found out that we can have cookies which die after the

Re: crypt() under windows

2000-04-20 Thread Matt Sergeant
On Thu, 20 Apr 2000, Gunther Birznieks wrote: At 09:00 PM 4/19/00 +0100, Matt Sergeant wrote: On Wed, 19 Apr 2000, Tim Bishop wrote: Hi- We used Martin Vorlaender's Crypt::UnixCrypt module for the same reason you need it - no crypt() on Windows. Nonesense. Read README.win32

mod_perl for BeOS ??

2000-04-20 Thread raptor
hi, someone to know is there a binary package of mod_perl for BeOS

Re: crypt() under windows

2000-04-20 Thread Randy Kobes
On Thu, 20 Apr 2000, Matt Sergeant wrote: On Thu, 20 Apr 2000, Gunther Birznieks wrote: At 09:00 PM 4/19/00 +0100, Matt Sergeant wrote: On Wed, 19 Apr 2000, Tim Bishop wrote: Hi- We used Martin Vorlaender's Crypt::UnixCrypt module for the same reason you need it -

Re: Implementing security in CGI

2000-04-20 Thread Jeff Beard
At 05:36 PM 4/20/00, Differentiated Software Solutions Pvt. Ltd. wrote: a) [...] then do we have a security hole? Is not the user assuming that by killing the browser we are exiting the system !! Yes there is a security risk. HTTP is an insecure protocol. You can use the ideas that have been

mod_perl: rwrite returned -1

2000-04-20 Thread scotta
I've been working on a site using Apache::Registry and although it works, an occasional request will just get into some loop or ? and eat up much of the availble processor power. When I check the logs, i find the error : [Thu Apr 20 08:32:44 2000] mod_perl: rwrite returned -1 [Thu Apr 20

Re: Perl Section...

2000-04-20 Thread w trillich
while($domain = $sth-fetchrow_array) { $PerlConfig .= "CONFIG"; VirtualHost $ipAddr ServerName www.$domain ServerAdmin webmaster@$domain ServerAlias $domain DocumentRoot $baseDir/www.$domain/htdocs/ /VirtualHost CONFIG } doesn't $sth-fetchrow_array() return a

Re: mod_perl: rwrite returned -1

2000-04-20 Thread Matt Sergeant
On Thu, 20 Apr 2000 [EMAIL PROTECTED] wrote: I've been working on a site using Apache::Registry and although it works, an occasional request will just get into some loop or ? and eat up much of the availble processor power. When I check the logs, i find the error : [Thu Apr 20 08:32:44

Re: mod_perl: rwrite returned -1

2000-04-20 Thread scotta
Thanks. I looked into the wrong archive. When i checked the one on swarthmore.edu, it was second down. Scott. Matt Sergeant wrote: On Thu, 20 Apr 2000 [EMAIL PROTECTED] wrote: I've been working on a site using Apache::Registry and although it works, an occasional request will just

problem with POST data and returning NOT_FOUND

2000-04-20 Thread Roger Espel Llima
I'm porting a site from Apache::Registry to mod_perl handlers, using Apache 1.3.12 and mod_perl 1.21. I've noticed a problem with POST requests: if a ContentHandler reads the POST body with $r-content and subsequently returns NOT_FOUND, Apache will hang trying to read the content again. The

Trouble with DSO/APXS.

2000-04-20 Thread Robert B. Easter
Will mod_perl work as a DSO using USE_APXS=1? I've tried it very simply as: perl Makefile.PL USE_APXS=1 make make install It compiles ok and Apache 1.3.12 will startup identifying itself as mod_perl/1.22_01-dev mod_ssl 2.6.2 openSSL 0.9.5a (sometimes I Load php4 too but

Re: Implementing security in CGI

2000-04-20 Thread DeWitt Clinton
Hi, Interesting thread and interesting question. It makes sense to start with the requirements for what it means to implement those secure features. My requirements have an obvious e-commerce bias, and should probably be heavily reviewed by anyone thinking of using this design for

Re: Trouble with DSO/APXS.

2000-04-20 Thread Daniel Jacobowitz
On Thu, Apr 20, 2000 at 11:56:00AM -0400, Robert B. Easter wrote: Will mod_perl work as a DSO using USE_APXS=1? I've tried it very simply as: perl Makefile.PL USE_APXS=1 make make install It compiles ok and Apache 1.3.12 will startup identifying itself as

Re: Perl Section...

2000-04-20 Thread darren chamberlain
w trillich ([EMAIL PROTECTED]) said something to this effect: while($domain = $sth-fetchrow_array) { $PerlConfig .= "CONFIG"; VirtualHost $ipAddr ServerName www.$domain ServerAdmin webmaster@$domain ServerAlias $domain DocumentRoot

[summary] holding a mod_perl conference

2000-04-20 Thread Stas Bekman
Ok, It's been a while since I've started this thread and there is no more comments on this topic, so I'll summarize. It's clear that we want a dedicated track for mod_perl only. There is demand and there are many bright people at least on this list who will want to share their knowledge, so

Re: [summary] holding a mod_perl conference

2000-04-20 Thread Nathan Torkington
Stas Bekman writes: Therefore a possible solution, as offered by both conference organizers, is to have a dedicated mod_perl track this summer in Monterey and in Close, but not quite. It's too late to adjust the July 2000 conference (layout was finalized around March 1), but we are all

Re: Implementing security in CGI

2000-04-20 Thread Matt Carothers
On Thu, 20 Apr 2000, DeWitt Clinton wrote: 5) The secure token is associated on the server side (preferably on another tier, such as a database) with the user identification token. Additionally, to support secure session timeouts, the current time must be recorded. An easy way to

Re: Problem with Apache::SIG

2000-04-20 Thread Doug MacEachern
On Wed, 12 Apr 2000 [EMAIL PROTECTED] wrote: Hi All, Recently I installed Apache-1.3.12 with mod_perl-1.22. Standard installation. Everything seemed to work great. I'm using the directive PerlFixupHandler Apache::SIG because you have some 'alive' scripts that need to be killed if

Re: detecting fd leaks (was Re: Apache::Request)

2000-04-20 Thread Doug MacEachern
On Thu, 13 Apr 2000, Stas Bekman wrote: I have no real conclusion to reach, except that it seems to be leaking files. Well, I wanted to write Apache::FileLeak or an extension to Apache::VMonitor to show the opened file descriptors, the files and the processes that have opened them, but

Re: Avoiding redefining constant subs

2000-04-20 Thread Doug MacEachern
Sorry--you're quite right... it's not a mandatory warning at all any more. I run all my scripts when developing under -w, so I still get the warning. I think it would be useful to specifically check that the sub is not already defined in the caller's namespace: if (!(defined

Re: apache_1.3.12 / mod_perl-1.22 ... install crash !

2000-04-20 Thread Doug MacEachern
On Fri, 14 Apr 2000, Frédéric Schwien wrote: Hi, I'm using apache_1.3.12 / mod_perl-1.22 , on Suse 6.1 . when I try to install modperl, when perl Makefile.PL, I get the result before. After that, I can't make make test make install : make test crashes at listening to the port 8529.

Re: detecting fd leaks (was Re: Apache::Request)

2000-04-20 Thread Stas Bekman
On Thu, 20 Apr 2000, Doug MacEachern wrote: On Thu, 13 Apr 2000, Stas Bekman wrote: I have no real conclusion to reach, except that it seems to be leaking files. Well, I wanted to write Apache::FileLeak or an extension to Apache::VMonitor to show the opened file descriptors, the

Re: modperl and MIME::Parser?

2000-04-20 Thread Doug MacEachern
On Sat, 15 Apr 2000, John S. Evans wrote: So digging a little deeper (and through the magic of trial and error), the offending module seems to be Mail::Field. It has a bunch of code to dynamically load perl classes for various types of fields (AddrList, Date, Content-Type, etc), and this

Re: [RFC] Transitioning from Apache::Registry to Apache handlers

2000-04-20 Thread Stas Bekman
On Thu, 20 Apr 2000, Doug MacEachern wrote: On Fri, 14 Apr 2000, Stas Bekman wrote: use vars qw($q $switch $status $sessionID); why all the globals?? symbol table lookups are much slower than lexicals. please don't promote globals, pass lexicals to the subroutines. Yeah, I'll fix

Re: Segfault on DBI-Connect

2000-04-20 Thread Doug MacEachern
On Sun, 16 Apr 2000, Jochen Wiedmann wrote: Btw, Doug, as I see the sigpipe thing: What do you recommend for the DBD::mysql driver? (Remember the "MySQL morning bug"?) Should we enable or disable SIGPIPE? apache no longer catches SIGPIPE as of 1.3.6, so it may not be an issue anymore if

Re: [Slightly OT] IPC::Open3 broken in mod_perl/perl 5.6.0?

2000-04-20 Thread Doug MacEachern
On Mon, 17 Apr 2000, Richard Titmuss wrote: Hi, I have also had this problem. I checked the modperl-cvs archive and this problem has been fixed in the development release. yes, the cvs version implements Apache::OPEN I still have an problem using IPC::Open2. This can be demonstrated by:

Re: XML::Parser causing SEGFAULT in Apache under mod_perl

2000-04-20 Thread Doug MacEachern
On Tue, 18 Apr 2000, DeWitt Clinton wrote: On Tue, Apr 18, 2000 at 12:43:57PM -0400, Delaporta, Michael wrote: I'm currently using XML::Parser (2.28) under Apache (1.3.11) and mod_perl (1.21) and have noticed a fairly large number of segfaults in the Apache error_log. I noticed a

Re: Passing POST Data to a SubRequest

2000-04-20 Thread Doug MacEachern
On Tue, 18 Apr 2000, Chris D'Annunzio wrote: Is there a way to pass data into a SubRequest using the post method? no, you'll need to use GET and $r-args which can be made transparent with the module below, provided your code can deal with post POST and GET requests. package Apache::POST2GET;

Re: Core dump

2000-04-20 Thread Doug MacEachern
On Tue, 18 Apr 2000, Robert Jenks wrote: Got a different code dump. I'm not sure if this one is mod_perl related though... My httpd.conf and startup.pl are the same as my 4/9/2000 post. #0 0x4089fbb6 in kputac () (gdb) where #0 0x4089fbb6 in kputac () #1 0x408bf8b6 in OCISessionEnd

Re: Perl Sections and Virtual Host

2000-04-20 Thread Doug MacEachern
i've only skimmed this thread, but haven't seen any mention of chapter 8 online at http://modperl.com/ which covers Perl sections in detail.

Re: unsatisfied symbol - mod_perl 1.21/Apache 1.3.12

2000-04-20 Thread Doug MacEachern
On Tue, 18 Apr 2000, Hugh Williams wrote: I've seen several make problems posted, so maybe someone has the answer to this one. mod_perl fails during the 'make' with an unsatisfied symbol; first a little background. I'm building on an HP J2240 running HP-UX 10.20. In the commands below:

Re: shrinking memory (was Re: Modperl/Apache deficiencies... Memory usage.)

2000-04-20 Thread Stas Bekman
On Tue, 18 Apr 2000, Stas Bekman wrote: What do you say? 1003520 bytes are returned to OS when @x goes out of scope. Note that this doesn't happen if you use a global @x instead. because under linux Perl defaults to system malloc: % perl -V:usemymalloc usemymalloc='n'; if

Re: ANNOUNCE: Apache-TicketAccess 0.10

2000-04-20 Thread Doug MacEachern
On Tue, 18 Apr 2000, Michael J Schout wrote: Apache-TicketAccess-0.10.tar.gz cool, but, there's already a module named Apache::TicketAccess, listed in the apache-modlist.html: TicketAccessbdpOTicket based access/authentication MPB if it's something different than the example

Re: perl in configs /perl

2000-04-20 Thread Doug MacEachern
but localhost/server-info shows no such directive having taken effect... mod_info does it's own parsing of httpd.conf, it does not understand Perl sections.

Re: perl use of malloc()

2000-04-20 Thread David McCabe
From: Doug MacEachern [EMAIL PROTECTED] Date: Thu, 20 Apr 2000 14:04:09 -0700 (PDT) Subject: Re: shrinking memory (was Re: Modperl/Apache deficiencies... Memory usage.) On Tue, 18 Apr 2000, Stas Bekman wrote: What do you say? 1003520 bytes are returned to OS when @x goes out of

Re: mod_perl DSO coexisting with mod_php DSO ?

2000-04-20 Thread Doug MacEachern
On Wed, 19 Apr 2000, James Graham wrote: Now when I startup the httpd with both modules (php and perl) Load and Add Module'd in httpd.conf the parent starts but seems to hang; no children are spawned and nothing is logged under error_log either. If I comment out the Load/Add Module for

Re: modperl interfering with php

2000-04-20 Thread Doug MacEachern
...so if I want to protect a directory with a custom Authen/Authz or Access handler, php won't parse! is this familiar territory for anyone? just remove 'SetHandler perl-script', you don't need that to run Authen/Authz handlers.

modperl-unsubscribe@apache.org not working

2000-04-20 Thread Mark Wagner
I'm trying to unsubscribe. I've sent mail to [EMAIL PROTECTED] but it keeps coming. I used every combination of unsubscribe unsubscribe modperl unsubscribe modperl [EMAIL PROTECTED] in both subject and body to no avail. I sent mail to [EMAIL PROTECTED] but I received nothing in reply. Can the

Re: Trouble with DSO/APXS.

2000-04-20 Thread Doug MacEachern
On Thu, 20 Apr 2000, Robert B. Easter wrote: Will mod_perl work as a DSO using USE_APXS=1? with 1.22 it should work fine. child pid x exit signal Segmentation fault (11) any chance you're using XML::Parser? if so, configure apache with --disable-rule=EXPAT otherwise, we'll

Re: perl use of malloc()

2000-04-20 Thread Doug MacEachern
This implies that on another OS, the system malloc() might be different? Right?? right. Now, does this mean that if usemyalloc='y', memory is not returned to the OS, no matter what the OS is yes.

Re: Memory usage on reload and graceful -- still broken?

2000-04-20 Thread G.W. Haywood
Hi all, On Thu, 20 Apr 2000, Doug MacEachern wrote: I have a static Solaris compilation, and have the same problems where the parent seems to grow by 1M each HUP. that's strange, do you have PerlFreshRestart On or some Perl sections? otherwise, kill -HUP with a static modperl is a

Re: Passing POST Data to a SubRequest

2000-04-20 Thread Chris D'Annunzio
Is there a way to pass data into a SubRequest using the post method? no, you'll need to use GET and $r-args which can be made transparent with the module below, provided your code can deal with post POST and GET requests. That works great if the Content-Type of the POST is

Re: vanilla install failure 1.3.12/1.22/5.6.0

2000-04-20 Thread Doug MacEachern
On Thu, 20 Apr 2000 [EMAIL PROTECTED] wrote: Hi, After much fast progress buiding a new machine, I'm stuck. This is a vanilla RH6.2 box with almost nothing on it.. no residue from RPM perl or httpd (deselected at machine blast time). I've built perl 5.6.0 (all tested out ok), also built

cvs commit: modperl Changes Makefile.PL

2000-04-20 Thread dougm
dougm 00/04/20 22:56:20 Modified:.Changes Makefile.PL Log: --disable-rule=EXPAT is passed to Apache's configure to avoid XML::Parser conflicts Revision ChangesPath 1.470 +3 -0 modperl/Changes Index: Changes