need to pass on a file from a form to cgi script to perl program

kavi98 · Jan 2, 2001

the html form is to take the file name upload it to the cgi script and then the file is to be passed on to a perl program to be used in execution there.

the form
<!Form to upload a text file to generate a script .>
<HTML>
<HEAD>
<TITLE>Uploading File</TITLE>
</HEAD>
<BODY>
<FONT size=6 type="ariel" color = #0000FF align ="center">Please click browse to Upload the File</FONT>
<TABLE width="510" border="0" cellpadding="0" cellspacing="0" bgcolor="#FFFFFF">
<tr><td align="left" valign="top" height="20">
<FORM METHOD = POST ACTION ="

http://sandbox.storyserver.zdnet.com/karora/cgi-bin/test.cgi"

ENCTYPE="multipart/form-data">

Local File: <INPUT TYPE ="file" value= "UPLOAD" ACCEPT="text/plain,image/gif">
</td></tr><br>

<tr><td align="left" valign="top" height="20"><br>
&#032;&#032;<INPUT TYPE = "submit" value ="Transfer File">
<INPUT TYPE = "reset" value= "Reset ">
</td></tr>
</FORM>
</TABLE>
</BODY></HTML>

the cgi script which i am still trying to understand and write.So it still has a lot of loose ends.

#!/usr/local/bin/perl

print "Content-type:text/html\n\n";

read(STDIN, $buffer, $ENV{'CONTENT_LENGTH'});
@pairs = split(/&/, $buffer);
foreach $pair (@pairs) {
($name, $value) = split(/=/, $pair);
$value =~ tr/+/ /;
$FORM{$name} = $value;
}
print "$value \n";
print "<html><head><title>Form Output</title></head><body>";
print "<h2>Results from FORM post</h2>\n";

foreach $key (keys(%FORM)) {
print "$key = $FORM{$key}<br>";
}

print "</body></html>";

~
from this script i want to pass the file to the perl program and use the data in the text file passed

thanks for the help

tanderso · Jan 7, 2001

Well, my first observation is that you need to use a valid system path, not a URL. In other words, if "

http://sandbox.storyserver.zdnet.com/karora/cgi-bin/filename.txt"

is the url to your file, then you have to reference it like "/home/users/karora/cgi-bin/filename.txt" assuming that is your file structure. You'll have to ask your sysadmin the full path to your account. Also, you should never put data files in your cgi-bin. Instead you should put it somewhere like "/home/users/karora/datadir/filename.txt". But that is just a security precaution... your system should let you write your file to your cgi-bin if you want to as long as it is owned by the webserver user and is chmod 777.

The second suggestion would be to try commenting out the flock code. Some systems to not provide flock compatibility. So, try commenting it out and see if that changes anything.

Does it run correctly from the command line?
Sincerely,

Tom Anderson
CEO, Order amid Chaos, Inc.

http://www.oac-design.com

luciddream · Jan 7, 2001

owned by the webserver user and is chmod 777

i would definately not do this. firstly you should probably never have a data file in your cgi directory chmoded 777. i would make it 666, meaning read and write privledges for everyone. if you have it 777 you are, which is read/write/execute for everyone, you are just asking for problems. secondly, i would also not have any of my files owned by the webservers user account. that means someone else hosted on the system can arbitrarily change the permissions on your file, or do much worse, just by running a cgi program of their own. or, someone else could have it change things by writing to your chmod 777 file then running it.

if you have to make a file publicly writiable, dont give it execute permissions, and if you have to make a file publicly executable, dont give it write permission. adam@aauser.com

tanderso · Jan 7, 2001

I meant owned by the webserver user or chmod 777. Otherwise you won't have permission to write the file from your perl script (unless you are using some sort of cgi-wrapper which changes the owner in some way). This is also why I suggested NOT putting data files in your cgi-bin, but in a non-web-accessible directory.
Sincerely,

Tom Anderson
CEO, Order amid Chaos, Inc.

http://www.oac-design.com

luciddream · Jan 7, 2001

chmod 777 is still not a good idea for data files. even if its in a non web accessible directory. adam@aauser.com

tanderso · Jan 8, 2001

Well, if the webserver user does not have permission to write to that directory otherwise, you have no choice but to chmod 777. In most cases, you'd be better off chowning that directory to the webserver user, though. Sorry if I wasn't specific in my recommendation.
Sincerely,

Tom Anderson
CEO, Order amid Chaos, Inc.

http://www.oac-design.com

luciddream · Jan 8, 2001

no. why do you need 777? if you want to give it execute 755 is fine. if you want to give it write 666 is fine. you dont need to give the webserver write privledges to a file its going to execute. adam@aauser.com

tanderso · Jan 8, 2001

We're talking about writing a file. The script needs to write a new datafile to the target directory. So, it either needs to own that directory or have write permission. You're right in that 666 would be sufficient for writing data files, but adding execution priviledges to non-executable files doesn't add any security risk as far as I know.
Sincerely,

Tom Anderson
CEO, Order amid Chaos, Inc.

http://www.oac-design.com

kavi98 · Jan 8, 2001

Hi ,Thanks for all the help ,When i run the code on the command line it asks for the input and i set the variable $upload to the path of the file name and then it hangs up ,i think it does not assign the file contents to the variable $upload so it never enters the loop.

Please see the code below ,when i try to print the contents of the form it gives me the file name ,how can i find out if the contents are being uploaded.

#!/opt/ZDperl/bin/perl -w
> # CGI routines
> use CGI_Lite;
> #use Fcntl qw

flock);
> my $cgi = new CGI_Lite;
> my %in = $cgi->parse_form_data;
>
> # get the file from the input stream
> my $upload = $in{"UPLOAD"};
>
> my $filename = "home/karora/textDir/filename.txt";
> # print your html header
> print "Content-type: text/html\n\n";
>
> # check if it's there, and write it to disk
> if ($upload)
> {
> open(TEXT, ">$filename&quot

|| CgiDie("Cannot open $filename for
> writing&quot

;
> #unless (flock (TEXT, LOCK_EX)) {CgiDie("Cannot lock $filename: $!&quot

;}
> print TEXT $upload;
> close(TEXT);
> }
> else {CgiDie("Error: file did not upload.&quot

;}
>
> # print the page
> print "<html><head><title>Form Output</title></head>";
> print "<body>";
> print "<h2>Results from FORM post:</h2><br>";
> #print "$upload";
> $view=$cgi->print_form_data;
> print $view;
> print "</body></html>";
>
> sub CgiDie
> {
> my ($message) = @_;
> print $message;
> #die ("$message&quot

;
> }

Thanks again for all the help.

tanderso · Jan 8, 2001

To test your CGI script on the command line, you have to pass it your parameters in the same fashion that they would appear through CGI. In your case, do something like this:

perl your_script.pl "UPLOAD='this is the contents of the file'"

Your script should then parse that into the %in array just as it would a file if you were uploading a text file with that line in it.
Sincerely,

Tom Anderson
CEO, Order amid Chaos, Inc.

http://www.oac-design.com

luciddream · Jan 8, 2001

if the file has a write privledge for everyone, there is a risk. adam@aauser.com

tanderso · Jan 8, 2001

Of course there is a risk in having anything world-writable. But that is the only way that your script can write the file unless it owns the directory. It is not too much of a risk if nobody but you has an account on your server, which ought to be the case if you are dealing with any sensitive data. Or, if you have to share the system, then put your data in an RDMS protected by a password -- but that is still not too secure since the password must be contained in your necessarily readable script. The point is, that in order for kavi98 to be able to write his uploaded file to his server's filesystem, then the directory he is writing to must be owned by the webserver user or world-writable. Agreed?
Sincerely,

Tom Anderson
CEO, Order amid Chaos, Inc.

http://www.oac-design.com

kavi98 · Jan 8, 2001

perl load1.cgi
[ Reading query from standard input. Press ^D to stop! ]
UPLOAD = this has to be uploaded and the contents should alsio be a part of it
Content-type: text/html

Error: file did not upload.<html><head><title>Form Output</title></head><body><h
2>Results from FORM post:</h2><br>UPLOAD = this has to be uploaded and the con
tents should alsio be a part of it
</body></html>>

This is the error generated,it still does not enter th loop,

luciddream · Jan 8, 2001

yes, i agrred on that, but there is no reason to make a world-writeable file world executeable. adam@aauser.com

tanderso · Jan 8, 2001

That makes absolutely no sense whatsoever. First, it outputs the error message which would only occur if $upload did not contain any data. At that point, it should have died. But, it continued running anyway despite the explicit die command. And then, in the output, it printed the contents of $upload as what you typed in! So, like I said, this makes no sense to me. It should work just fine. If $upload contains data, as it apparently does since it printed it out, then it shouldn't return an error.

Try putting the parameter on the command line like I showed you in my last post rather than allowing it to read from STDIN. Also, is it still giving you an error if you do it from the web page form?
Sincerely,

Tom Anderson
CEO, Order amid Chaos, Inc.

http://www.oac-design.com

kavi98 · Jan 8, 2001

Thanks for all the help,the script works fine.

tanderso · Jan 8, 2001

Does it really, or are you just tired of trying ;-)
Sincerely,

Tom Anderson
CEO, Order amid Chaos, Inc.

http://www.oac-design.com

kavi98 · Jan 8, 2001

No it actually does on the command line it transfers perfectly but then when i use it from the browser it just does not load.
Any reasons you can think why it does that.

tanderso · Jan 8, 2001

What does not load?

Did you look at your error log?
Sincerely,

Tom Anderson
CEO, Order amid Chaos, Inc.

http://www.oac-design.com

goBoating · Jan 8, 2001

Gotta' be getting close....;^)

Exactly what do you mean 'it does not load'? Step by Step..... you bring up an HTML input page, identify a file to upload and click a submit button.... and so on........where exactly in the string of events does it 'not load'. And what, in descriptive language, does it do or not do.

keep the rudder amid ship and beware the odd typo

kavi98 · Jan 8, 2001

If i type in the contents of the file on the command line it transfers then to the file given in the path,but when i try to run the same script as above i get a file not loaded error which is in the code,it does not get the contents of the file which i am trying to upload.

it is just not getting any contents from the web page.
this does not work .

my %in = $cgi->parse_form_data;

Thanks

Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

need to pass on a file from a form to cgi script to perl program

Programmer

IS-IT--Management

Programmer

IS-IT--Management

Programmer

IS-IT--Management

Programmer

IS-IT--Management

Programmer

IS-IT--Management

Programmer

IS-IT--Management

Programmer

Programmer

IS-IT--Management

Programmer

IS-IT--Management

Programmer

IS-IT--Management

Programmer

Programmer

Similar threads

Log in

Part and Inventory Search

Sponsor