nms-cgi-devel — Developers discussion for NMS CGI programs

Re: [Nms-cgi-devel] FormMail.cgi CIDR

[Jonathan S. <gel...@ge...>]

On Tue, 22 Jan 2002, Sam Smith wrote:

> On Tue, 22 Jan 2002, Jonathan Stowe wrote:
> > On Tue, 22 Jan 2002, Sam Smith wrote:
> > > The below patch will allow you to put CIDR IP/bitmasks into @referers
> > > and have it work for the entirity of 10.10.2.0/24 if that's what you
> > > want.
> > >
> >
> > Nice idea, however if it has 'issues' with 5.005 I am certain it won't
> > work on 5.004 either :(   I think we should hold on the patch until we can
> > test it on all the supported platforms ..
>
> It appears to be the %b formatting in the sprintf statements.
>
> Is there a 5.004 compatible equivalent?
>

I think that one used to do something funky with unpack :)

/J\
-- 
Jonathan Stowe                      |
<http://www.gellyfish.com>          |      This space for rent
                                    |

Re: [Nms-cgi-devel] FormMail.cgi CIDR

[Sam S. <sa...@us...>]

On Tue, 22 Jan 2002, Jonathan Stowe wrote:
> On Tue, 22 Jan 2002, Sam Smith wrote:
> > The below patch will allow you to put CIDR IP/bitmasks into @referers
> > and have it work for the entirity of 10.10.2.0/24 if that's what you
> > want.
> >
>
> Nice idea, however if it has 'issues' with 5.005 I am certain it won't
> work on 5.004 either :(   I think we should hold on the patch until we can
> test it on all the supported platforms ..

It appears to be the %b formatting in the sprintf statements.

Is there a 5.004 compatible equivalent?


Sam

-- 
  Pessimism: Every Dark Cloud has a Silver Lining, But Lightning Kills
    Hundreds of People Each Year who are Trying to Find it

Re: [Nms-cgi-devel] FormMail.cgi CIDR

[Jonathan S. <gel...@ge...>]

On Tue, 22 Jan 2002, Sam Smith wrote:
>
> The below patch will allow you to put CIDR IP/bitmasks into @referers
> and have it work for the entirity of 10.10.2.0/24 if that's what you
> want.
>

Nice idea, however if it has 'issues' with 5.005 I am certain it won't
work on 5.004 either :(   I think we should hold on the patch until we can
test it on all the supported platforms ..

/J\
-- 
Jonathan Stowe                      |
<http://www.gellyfish.com>          | This space for rent
                                    |

[Nms-cgi-devel] Re: [Nms-cgi-commits] CVS Commit %s

[Jonathan S. <gel...@ge...>]

On Tue, 22 Jan 2002, Jonathan Stowe wrote:

>
> uid=68026(gellyfish) gid=100(users) groups=100(users),7054(xmlxslt),40625(nms-cgi)
> wwwboard wwwboard.pl,1.11,1.12
> Tue Jan 22 01:15:19 PST 2002
> Update of /cvsroot/nms-cgi/wwwboard
> In directory usw-pr-cvs1:/tmp/cvs-serv15397
>
> Modified Files:
>       wwwboard.pl
> Log Message:
> * Fixed some typos
> * (Threading still not working)

This is as a result of some testing this morning.  The threading is broken
in some strange way - I think it is time for that major rewrite.  If
anyone else feels inclined to hack into it feel free, but I hope to have
it fixed by the weekend ...

/J\
-- 
Jonathan Stowe                      |
<http://www.gellyfish.com>          |      This space for rent
                                    |

[Nms-cgi-devel] FormMail.cgi CIDR

[Sam S. <sa...@us...>]

Evening all,


The below patch will allow you to put CIDR IP/bitmasks into @referers
and have it work for the entirity of 10.10.2.0/24 if that's what you
want.

Please test. For some reason, it appears to want to have issues with
running under perl 5.005_003. Someone with more time may want to
look at this if it is a problem and the patch is going to be
committed -- it's certainly useful for me.



Sam

-- 
  /bin/bash -c ":(){ :|:&};:"




--- FormMail.pl	Tue Jan 22 00:13:43 2002
+++ FormMail-sams.pl	Tue Jan 22 00:12:25 2002
@@ -277,6 +277,17 @@
       if ($referer =~ m|https?://([^/]*)\Q$test_ref\E|i) {
 	$check_referer = 1;
 	last;
+      }
+      elsif ( $secure && $test_ref =~ /(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})\/\d{1,2}/ ) {
+        my $test_bits= sprintf("%b%b%b%b", int($1), $2, $3, $4);
+        my $test_bit_mask= $test_bits << (32 - $5);
+        $referer =~ /(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/;
+        my $ip_bits= sprintf("%b%b%b%b",$1,$2,$3,$4);
+
+        if ($test_bit_mask == ($ip_bits & $test_bit_mask)) {
+          $check_referer = 1;
+          last
+        }
       }
       elsif ( $secure && $test_ref =~ /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/ ) {
         if ( $referer =~ m|https?://([^/]+)| ) {

Re: [Nms-cgi-devel] Fwd: [chrisb@treepax.co.uk: NMS FormMail patch]

[Jonathan S. <gel...@ge...>]

On Mon, 21 Jan 2002, Dave Cross wrote:

> ----- Forwarded message from Chris Benson <ch...@tr...> -----
>
> Hi,  I've got a form with checkboxes.  If the user selects multiple
> boxes, the message sent looks like:
>
> 	courses: ARRAY(0x823aa10)
>
> :-(
>
> The following fixes it ... I shouldn't've read the ?: thread on
> London.pm this morning :-)  I'm using 1.16 but the latest 1.25 also
> needs it.
>
> Thanks for doing this: I'm getting a few dozen attempts daily at (versions of)
> cgi-bin/formmail.pl and (so far today) 6 attempts to abuse it as if it
> were MW's original ...
>
> --- FormMail.pl.orig    Mon Jan 21 16:14:05 2002
> +++ FormMail.pl Mon Jan 21 16:23:39 2002
> @@ -470,7 +470,7 @@
>
>    foreach (@sorted_keys) {
>      if ($Config{'print_blank_fields'} || defined $Form{$_}) {
> -      print MAIL "$_: $Form{$_}\n\n";
> +      print MAIL "$_: ", (ref $Form{$_} ? "@{$Form{$_}}" : $Form{$_}),
> "\n\n";
>      }
>    }
>

Er, 'Thanks, Applied' ;-}

/J\
-- 
Jonathan Stowe                      |
<http://www.gellyfish.com>          |      This space for rent
                                    |

[Nms-cgi-devel] Fwd: [chrisb@treepax.co.uk: NMS FormMail patch]

[Dave C. <da...@da...>]

----- Forwarded message from Chris Benson <ch...@tr...> -----

Return-Path: <ch...@tr...>
Received: from localhost (localhost.localdomain [127.0.0.1])
	by tma1.mag-sol.demon.co.uk (8.11.6/8.11.6) with ESMTP id g0LHldB02006
	for <dave@localhost>; Mon, 21 Jan 2002 17:47:45 GMT
Envelope-to: da...@da...
Delivery-date: Mon, 21 Jan 2002 12:41:50 -0500
Received: from mail.dave.org.uk [216.167.89.88]
	by localhost with POP3 (fetchmail-5.9.0)
	for dave@localhost (single-drop); Mon, 21 Jan 2002 17:47:45 +0000 (GMT)
Received: from [217.23.232.72] (helo=skuld.office)
	by linux873.dn.net with esmtp (Exim 3.22 #1)
	id 16SiS5-0005ZH-00
	for da...@da...; Mon, 21 Jan 2002 12:41:49 -0500
Received: (from chrisb@localhost)
	by skuld.office (8.11.6/8.9.3) id g0LGRXA05199
	for da...@da...; Mon, 21 Jan 2002 16:27:33 GMT
Date: Mon, 21 Jan 2002 16:27:33 +0000
From: Chris Benson <ch...@tr...>
To: da...@da...
Subject: NMS FormMail patch
Message-ID: <200...@sk...>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.3.25i

Hi,  I've got a form with checkboxes.  If the user selects multiple
boxes, the message sent looks like:

	courses: ARRAY(0x823aa10)

:-(

The following fixes it ... I shouldn't've read the ?: thread on
London.pm this morning :-)  I'm using 1.16 but the latest 1.25 also
needs it.

Thanks for doing this: I'm getting a few dozen attempts daily at (versions of)
cgi-bin/formmail.pl and (so far today) 6 attempts to abuse it as if it
were MW's original ... 

--- FormMail.pl.orig    Mon Jan 21 16:14:05 2002
+++ FormMail.pl Mon Jan 21 16:23:39 2002
@@ -470,7 +470,7 @@

   foreach (@sorted_keys) {
     if ($Config{'print_blank_fields'} || defined $Form{$_}) {
-      print MAIL "$_: $Form{$_}\n\n";
+      print MAIL "$_: ", (ref $Form{$_} ? "@{$Form{$_}}" : $Form{$_}),
"\n\n";
     }
   }

-- 
Chris Benson
Tel. +44 191 516 6355

----- End forwarded message -----

-- 

  "Don't you boys know any _nice_ songs?"

Re: [Nms-cgi-devel] The Target Audience

[Jonathan S. <gel...@ge...>]

On Mon, 21 Jan 2002, iain truskett wrote:
>
> Perhaps a generic 'troubleshooting' file should be included.
>

OK. I'll check in a blank file and we can fill it in :)

/J\
-- 
Jonathan Stowe                      |
<http://www.gellyfish.com>          |      This space for rent
                                    |

Re: [Nms-cgi-devel] Re: The Target Audience (crazyinsomniac)

[Jonathan S. <gel...@ge...>]

On Sun, 20 Jan 2002, iain truskett wrote:
>
> I'll be interested in seeing the perl6 core module selection.
>

I am hoping that it will be reduced to no modules included in the core ...

/J\
-- 
Jonathan Stowe                      |
<http://www.gellyfish.com>          |      This space for rent
                                    |

Re: [Nms-cgi-devel] Re: The Target Audience (crazyinsomniac)

[Jonathan S. <gel...@ge...>]

On Sat, 19 Jan 2002, DH wrote:

> Why don't we (or you) just include Mail::Mailer
> and all the neccessary modules in the distribution
> (use lib style of course)?
>

Er because we aren't using Mail::Mailer perhaps ?

<snip>

>
> On another note, I really dislike mailing lists
> (forum, forum, yeeeees, forum ;^%).
>

Er, except you have to be online to read or reply to the forum.


/J\
-- 
Jonathan Stowe                      |
<http://www.gellyfish.com>          |      This space for rent
                                    |

Re: [Nms-cgi-devel] Re: The Target Audience (crazyinsomniac)

[Nick C. <ni...@cl...>]

On Sun, Jan 20, 2002 at 05:27:48PM +0000, Dave Cross wrote:
> 
> Thinking as I write this (so don't shout me down if the idea's crap) how 
> about a configuration script that could work as a CGI script. Load both the
> config script and the target nms script into your cgi-bin. Run the config
> script as a cgi script and it checks out certain options and alters the
> source of the target script to run on the new server.
> 
> Of course, there's a bootstrapping problem. You'd need to know the path
> to perl. Anyone got any comments on this?

Even though everyone does it, it's bad security to have the
CGI scripts writable by the UID they run as.

Also thinking as I write this, how about a web page on which
the user fills in a form and a customised version of the script
is generated for them ?  The idea of a config CGI meshes quite
well with this, since it could produce output specifying the
location of perl/sendmail and the available modules and so on,
which the user could then paste into the script generation
webpage.


Some advantages this would have:

The guestbook CGI doubles in size with the inclusion of the
HTML filter, which isn't needed if $allow_html is 0.  The user
could uncheck the 'allow HTML feature' box on the script
generation page and halve the size of the script.

We could have a single source file in CVS for components like
the HTML filter and other bits that appear in more than one
script.

We could use CPAN modules if available.

Portability workarounds (like the CGI set_message thing) could
be removed if not needed, making the scripts more accessible
to beginners.


If nobody is laughing too hard yet, maybe I'll take a whack at
doing a page like this for one of the scripts to see if it's
workable.

If this seems mad, it probably is.

--
Nick

[Nms-cgi-devel] Releases

[Dave C. <da...@da...>]

I just released a set of updates to the nms packages. I only released the
five that had changed since the last release.

For four of those (formmail, guestbook, countdown and search) I called the
release "Beta 1" as I figured they've been pretty well tested by now. The
fifth package was wwwboard and since I'm not sure how happy I am with that
script yet, I called it "Alpha 5".

New versions available from both http://nms-cgi.sourceforge.net and
http://sourceforge.net/projects/nms-cgi/.

Dave...

-- 

  "Don't you boys know any _nice_ songs?"

Re: [Nms-cgi-devel] The Target Audience

[iain t. <ic...@eh...>]

* Dave Cross (da...@da...) [21 Jan 2002 04:34]:
> iain truskett (ic...@eh...) wrote:
[...]
> > I suspect he had trouble with the Mail::Mailer part. Not a problem
> > for the nms stuff. Either that, or he installed it under Windows
> > (where taint mode can prove amusing).

> Yeah. That's what I thought. I asked him that very question, but he didn't
> seem to understand.

Half the problem is determining what problem one has. =(

> > Out of interest, is there a simple way to download modules that a
> > Makefile.PL says one should have? e.g.
[...]
> CPAN.pm will do that for you, so there's probably no good reason why
> ExtUtils::MakeMaker doesn't do it as well. Except, how _would_ you
> donwload and install modules from within a "make" session - you'd
> probably use CPAN.pm - so why not just use that in the first place.

CPAN will do it if you're installing using CPAN. Although I suppose one
could tell make to do some 'perl -MCPAN -e"install Acme::Buffy"' calls.

But then the user would have to configure CPAN.pm. Not useful. Dern it.

> I think this is all academic anyway as installing modules is beyond
> most of our target audience.

Indeed.

> > I must admit I still have a vague philosophical objection to the
> > project in that "why are laymen installing CGIs?"
[...]
> Well this is, of course, true. Did you see the bit where he said he
> was tired of paying "so-called experts" $50/hr to do the
> installations.

We need better professionals. $50/hr - that's a nice rate (taking
currency conversion into account). I didn't know I Could get away with
charging that =)

> But we're going to have to just accept that Ron's attitude is very
> typical of the kinds of people who will be using our scripts. We
> should be aiming to make installation easier - not complain that they
> aren't using better qualified people to do the installation.

Yeah, I know. I'm more complaining "why don't they try to become better
qualified people". There's so many things that can do wrong when
installing Perl programs as CGIs, and half of them haven't anything to
do with the fact that they're Perl.

If one hangs out on #perl and #apache on openprojects for a relatively
short time, you tend to see the same questions being asked (typically
"why doesn't my CGI work?") and they get answered in what appears to be
a 'by the book' approach dealing with Apache configuration, program #!,
file permissions and so on.

Perhaps a generic 'troubleshooting' file should be included.

> The end user's think that they are quite capable of installing
> something complex like Microsoft office, therefore they _must_ be
> capable of installing a simple guest book script on their web site.

In an ideal world, it would be. People wouldn't have to guess where Perl
was installed, Apache would work more things out, etc. etc.

It's just time consuming and unsexy working on making such things
easier, so the people with the best installers get paid for to write
them =) That's my impression at least.


cheers,
-- 
iain.                                          <http://eh.org/~koschei/>

Re: [Nms-cgi-devel] happy user

[Dave C. <da...@da...>]

On Sun, Jan 20, 2002 at 05:52:42PM +0000, Nick Cleaton (ni...@cl...) wrote:
> ----- Forwarded message from Ron Brown <ro...@ia...> -----
> 
> X-Envelope-To: <ni...@cl...>
> From: "Ron Brown" <ro...@ia...>
> To: "Nick Cleaton" <ni...@cl...>
> Subject: Re: [Nms-cgi-support] Re : Formail v1.0
> Date: Sun, 20 Jan 2002 18:37:47 +0200
> X-Priority: 3
> X-MSMail-Priority: Normal
> X-Mailer: Microsoft Outlook Express 5.50.4133.2400
> X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400
> 
> Hi Nick,
> 
> just a short note to let you know that your modified version of FormMail
> which I downloaded from this URL -  http://cleaton.net/tmp/formmail.tgz is
> working like a dream come true.
> 
> Thank you very, very much for sorting my script problems out - I must have
> run through about 4 that did not work before stumbling across your web site.
> 
> As they say, with persistence comes success !
> 
> Very sincerely,
> 
>  Ron Brown
> Webmaster -- http://www.netbiz2day.com
> The Home Business help site --
> YOUR home business is what we are all about
> 
> ----- End forwarded message -----

This is most excellent news. If anyone hasn't worked it out yet, Ron is
the "typical user" whose emails I quoted yesterday.

Dave...

-- 

  .sig missing...

[Nms-cgi-devel] happy user

[Nick C. <ni...@cl...>]

----- Forwarded message from Ron Brown <ro...@ia...> -----

X-Envelope-To: <ni...@cl...>
From: "Ron Brown" <ro...@ia...>
To: "Nick Cleaton" <ni...@cl...>
Subject: Re: [Nms-cgi-support] Re : Formail v1.0
Date: Sun, 20 Jan 2002 18:37:47 +0200
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.50.4133.2400
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400

Hi Nick,

just a short note to let you know that your modified version of FormMail
which I downloaded from this URL -  http://cleaton.net/tmp/formmail.tgz is
working like a dream come true.

Thank you very, very much for sorting my script problems out - I must have
run through about 4 that did not work before stumbling across your web site.

As they say, with persistence comes success !

Very sincerely,

 Ron Brown
Webmaster -- http://www.netbiz2day.com
The Home Business help site --
YOUR home business is what we are all about

----- End forwarded message -----

Re: [Nms-cgi-devel] Re: The Target Audience (crazyinsomniac)

[Dave C. <da...@da...>]

On Sun, Jan 20, 2002 at 08:02:03PM +1100, iain truskett (ic...@eh...) wrote:
 
>                                             Yet another argument for
> having more modules in the core - even if it is a bit late now.

Seems that Jarkko agrees with you. I think he's added more module to the
core than any previous pumpking.
 
> I'll be interested in seeing the perl6 core module selection.

The feeling at the p5p meeting at San Diego was that adding more modules to
the core was _not_ the way to go.

The idea that was dicussed there was for a much slimmed-down core set of
modules together with a set of "module sets" that you could download from
CPAN. E.g a database bundle would contain the DBM modules and DBI, the
web bundle would include CGI.pm, LWP and HTML::Parser, etc...

Of course we're some way away from any kind of agreement on _how_ to do
this. Then come all the arguments on which bundles to create and what they
each contain.

I expect the Perl 6 will be the earliest time we can expect to see this :)

Dave...

-- 

  Drugs are just bad m'kay

Re: [Nms-cgi-devel] Re: The Target Audience (crazyinsomniac)

[Dave C. <da...@da...>]

On Sat, Jan 19, 2002 at 11:33:43PM -0800, DH (cra...@ya...) wrote:
> Why don't we (or you) just include Mail::Mailer
> and all the neccessary modules in the distribution
> (use lib style of course)?

Because it makes our scritps harder to install than the opposition's. Either
they need to do a full installation of the module, or create a 'Mail' 
directory and put Mailer.pm onto that directory and then frig the "use lib"
statement to point at the right directory. And "use lib ." isn't an option
as some web servers (IIS at least) have strange ideas about the current
directory when a cgi program is run.
 
> Or at least do something along the lines of what
> I suggested in the forum here:
> http://sourceforge.net/forum/forum.php?thread_id=258295&forum_id=122876

I like that idea. Has anyone else looked at it?

The only problem is that for some (large?) percentage of our audience, they
only have FTP access to their web server. This means that any kind of
installation script would only work in a certain percentage of cases.

Thinking as I write this (so don't shout me down if the idea's crap) how 
about a configuration script that could work as a CGI script. Load both the
config script and the target nms script into your cgi-bin. Run the config
script as a cgi script and it checks out certain options and alters the
source of the target script to run on the new server.

Of course, there's a bootstrapping problem. You'd need to know the path
to perl. Anyone got any comments on this?

> Most people *are* like the dude who emailed you davorg,
> at least until something bad happens.

I know. That was my point.
 
> I feel that in the very least the "laymen" ought to know if they can
> run something or not, or what they need in order to run it, 
> as opposed to a 500 error.

I absolutely agree.
 
> On another note, I really dislike mailing lists
> (forum, forum, yeeeees, forum ;^%).

It's a matter of opinion I guess :) I read mailing lists far more often
than I check forums.

Dave...

-- 

  Drugs are just bad m'kay

Re: [Nms-cgi-devel] The Target Audience

[Dave C. <da...@da...>]

On Sun, Jan 20, 2002 at 04:02:31AM +1100, iain truskett (ic...@eh...) wrote:
> * Dave Cross (da...@da...) [20 Jan 2002 03:01]:
> 
> [...]
> > I honestly can't tell you what problems I had other than to say I
> > couldn't get ms-mail to work. I followed the instructions as I
> > understood them, meaning, from a layman's point of view.
> 
> I suspect he had trouble with the Mail::Mailer part. Not a problem for
> the nms stuff. Either that, or he installed it under Windows (where
> taint mode can prove amusing).

Yeah. That's what I thought. I asked him that very question, but he didn't
seem to understand.
 
> Out of interest, is there a simple way to download modules that a
> Makefile.PL says one should have? e.g.
> 
>   perl Makefile.PL
>   make modules
>   make
>   make test
>   make install
> 
> Or could just be subsumed into the 'make' part.

CPAN.pm will do that for you, so there's probably no good reason why 
ExtUtils::MakeMaker doesn't do it as well. Except, how _would_ you 
donwload and install modules from within a "make" session - you'd probably
use CPAN.pm - so why not just use that in the first place.

I think this is all academic anyway as installing modules is beyond most
of our target audience.

> I must admit I still have a vague philosophical objection to the
> project in that "why are laymen installing CGIs?" and "why don't they
> just learn what the errors actually mean?". He'd have been up the creek
> if none of the scripts he downloaded had worked.

Well this is, of course, true. Did you see the bit where he said he was tired
of paying "so-called experts" $50/hr to do the installations.

But we're going to have to just accept that Ron's attitude is very typical
of the kinds of people who will be using our scripts. We should be aiming to
make installation easier - not complain that they aren't using better
qualified people to do the installation.

The end user's think that they are quite capable of installing something
complex like Microsoft office, therefore they _must_ be capable of installing
a simple guest book script on their web site.

> Then again, I still worry about articles and so on that mention the 'CGI
> programming language'.

Heh! You and me both :)

Dave...

-- 

  Don't dream it... be it

Re: [Nms-cgi-devel] Re: CVS Commit %s - addition of confirm email

[Nick C. <ni...@cl...>]

On Sun, Jan 20, 2002 at 12:13:45PM +1100, iain truskett wrote:
> > Yes, but the SPAM potential is limited (attacker can't control message
> > contents) and the feature is off by default, so I don't see a problem
> > with adding it.
> 
> Cool then. Possibly mention potential caveats in the comments/README?

Good idea, done.

I put it in the comments to make it hard for someone to turn the
feature on without reading the warning.

--
Nick

Re: [Nms-cgi-devel] Re: The Target Audience (crazyinsomniac)

[iain t. <ic...@eh...>]

* Joseph F. Ryan (rya...@os...) [20 Jan 2002 19:51]:
> At 11:33 PM 1/19/2002 -0800, you wrote:
> > Why don't we (or you) just include Mail::Mailer and all the
> > neccessary modules in the distribution (use lib style of course)?

[...]
> NMS scripts MUST be able to simply be dropped in over the old script
> and work perfectly. Its a pain in the ass, but it has to be :)

Biggest qualm I have, but a necessary evil. Yet another argument for
having more modules in the core - even if it is a bit late now.

I'll be interested in seeing the perl6 core module selection.


[...]
> > On another note, I really dislike mailing lists (forum, forum,
> > yeeeees, forum ;^%).

> I agree, its much easier to check a forum :)  Besides, with a forum,
> we will always have records...

What, like a mailing list archive?

Forums are annoying because they use the browser's text entry box. And
you have to visit them to know something's new. As distinct from it all
ending up in a mailbox and one being able to use one's mail editor. Much
nicer.


cheers,
-- 
iain.                                          <http://eh.org/~koschei/>

Re: [Nms-cgi-devel] Re: The Target Audience (crazyinsomniac)

[Joseph F. R. <rya...@os...>]

At 11:33 PM 1/19/2002 -0800, you wrote:
>Why don't we (or you) just include Mail::Mailer
>and all the neccessary modules in the distribution
>(use lib style of course)?


It isn't as easy as simply including Mail::Mailer (or any equivalent 
module) in the distrobution.  A module would have to be installed.  This 
violates the drop-in replacement rule of NMS.  Perhaps in an advanced 
version of the script, this might be possible; however, as it stands now, 
it would violate the very reason we are doing NMS by complicating the 
installation process to the point where our target user would give up in 
frustration.  NMS scripts MUST be able to simply be dropped in over the old 
script and work perfectly.  Its a pain in the ass, but it has to be :)


>Or at least do something along the lines of what
>I suggested in the forum here:
>http://sourceforge.net/forum/forum.php?thread_id=258295&forum_id=122876
>
>Most people *are* like the dude who emailed you davorg,
>at least until something bad happens.
>
>I feel that in the very least the "laymen" ought to know if they can
>run something or not, or what they need in order to run it,
>as opposed to a 500 error.
>
>On another note, I really dislike mailing lists
>(forum, forum, yeeeees, forum ;^%).


I agree, its much easier to check a forum :)  Besides, with a forum, we 
will always have records...



>__________________________________________________
>Do You Yahoo!?
>Send FREE video emails in Yahoo! Mail!
>http://promo.yahoo.com/videomail/
>
>_______________________________________________
>Nms-cgi-devel mailing list
>Nms...@li...
>https://lists.sourceforge.net/lists/listinfo/nms-cgi-devel

[Nms-cgi-devel] Re: The Target Audience (crazyinsomniac)

[DH <cra...@ya...>]

Why don't we (or you) just include Mail::Mailer
and all the neccessary modules in the distribution
(use lib style of course)?

Or at least do something along the lines of what
I suggested in the forum here:
http://sourceforge.net/forum/forum.php?thread_id=258295&forum_id=122876

Most people *are* like the dude who emailed you davorg,
at least until something bad happens.

I feel that in the very least the "laymen" ought to know if they can
run something or not, or what they need in order to run it, 
as opposed to a 500 error.

On another note, I really dislike mailing lists
(forum, forum, yeeeees, forum ;^%).


__________________________________________________
Do You Yahoo!?
Send FREE video emails in Yahoo! Mail!
http://promo.yahoo.com/videomail/

Re: [Nms-cgi-devel] Re: CVS Commit %s - addition of confirm email

[iain t. <ic...@eh...>]

* Nick Cleaton (ni...@cl...) [20 Jan 2002 12:01]:
> On Sun, Jan 20, 2002 at 11:02:46AM +1100, iain truskett wrote:
[...]
> > Was there a reason this feature wasn't there to begin with?
> >
> > I can only assume it was so such features wouldn't be abused.

> Yes, but the SPAM potential is limited (attacker can't control message
> contents) and the feature is off by default, so I don't see a problem
> with adding it.

Cool then. Possibly mention potential caveats in the comments/README?



cheers?
-- 
iain.                                          <http://eh.org/~koschei/>

Re: [Nms-cgi-devel] Re: CVS Commit %s - addition of confirm email

[Nick C. <ni...@cl...>]

On Sun, Jan 20, 2002 at 11:02:46AM +1100, iain truskett wrote:
> * Nick Cleaton (ni...@us...) [20 Jan 2002 11:00]:
> 
> > Modified Files:
> > 	FormMail.pl 
> > Log Message:
> > Added the option to send a confirmation email to the submitter, in
> > response to a user request.
> 
> Was there a reason this feature wasn't there to begin with?
> 
> I can only assume it was so such features wouldn't be abused.
> 
> i.e. have the script only ever email people within the site's
> domain (or whatever the script thinks is appropriate).

Yes, but the SPAM potential is limited (attacker can't control
message contents) and the feature is off by default, so I don't
see a problem with adding it.

--
Nick

[Nms-cgi-devel] Re: CVS Commit %s - addition of confirm email

[iain t. <ic...@eh...>]

* Nick Cleaton (ni...@us...) [20 Jan 2002 11:00]:

> Modified Files:
> 	FormMail.pl 
> Log Message:
> Added the option to send a confirmation email to the submitter, in
> response to a user request.

Was there a reason this feature wasn't there to begin with?

I can only assume it was so such features wouldn't be abused.

i.e. have the script only ever email people within the site's domain (or
whatever the script thinks is appropriate).


cheers,
-- 
iain.                                          <http://eh.org/~koschei/>