Matthew Dalton wrote:
> I have two questions (below)...
> > system("graph -L 'Mono-molecular Reaction' -X Time -Y
> > 'Concentration' /tmp/data >| /tmp/temp.meta");
> > system("plot -T gif /tmp/temp.meta >| /tmp/order1.gif");
>
> Is there a security risk with a call such as this?
> You're not supposed to put system calls in cgi for security reasons, but
> does that rule include situations such as this where the command is
> constant?
Um. I don't know. The application is for students at the UTS
here next semester. I have Apache setup so that the HTML app
is only accessable from two named machines internal to the
UTS. I would not open it up to the outside as I don't know
if someone could feed some funny data to plot and graph via
the form.
Good point though and I'd like to know what security
implications it may have.
> I've been playing around with perl/cgi a little on my mini network at
> home. I have a cgi form that remembers the state that it is in. I want
> it to reload automatically when it is accessed, not just fetched from
> the browser's cache, so that it can reflect the state properly.
I am presuming that my gif is retrieved from a cache. There
is some info being sent back with the new form as well as
the gif so I can tell if the form is updated, they are the
values used in the calculation. They show correctly the data
values used for the current gif so my generated form is the
latest - just the gif is old.
Mike
--------------------------------------------------------------------
Michael Lake
University of Technology, Sydney
Email: mailto:[EMAIL PROTECTED] Ph: 02 9514 1724 Fx: 02
9514 1628
URL: http://www.science.uts.edu.au/~mikel
Linux enthusiast, active caver and interested in anything
technical.
--------------------------------------------------------------------
--
SLUG - Sydney Linux Users Group Mailing List - http://www.slug.org.au
To unsubscribe send email to [EMAIL PROTECTED] with
unsubscribe in the text
