Menu
▾
▴
nms-cgi-devel — Developers discussion for NMS CGI programs
You can subscribe to this list here.
| 2001 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
(90) |
Dec
(25) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2002 |
Jan
(183) |
Feb
(124) |
Mar
(123) |
Apr
(75) |
May
(49) |
Jun
(60) |
Jul
(58) |
Aug
(41) |
Sep
(27) |
Oct
(30) |
Nov
(13) |
Dec
(19) |
| 2003 |
Jan
(119) |
Feb
(70) |
Mar
(5) |
Apr
(16) |
May
(3) |
Jun
(1) |
Jul
|
Aug
|
Sep
(1) |
Oct
(3) |
Nov
(4) |
Dec
(7) |
| 2004 |
Jan
(9) |
Feb
|
Mar
(1) |
Apr
(7) |
May
(12) |
Jun
(4) |
Jul
(11) |
Aug
(17) |
Sep
(3) |
Oct
(15) |
Nov
(7) |
Dec
(2) |
| 2005 |
Jan
(4) |
Feb
(7) |
Mar
(2) |
Apr
(2) |
May
|
Jun
(1) |
Jul
(3) |
Aug
(1) |
Sep
(9) |
Oct
(4) |
Nov
(1) |
Dec
|
| 2006 |
Jan
(5) |
Feb
(7) |
Mar
(19) |
Apr
(8) |
May
(6) |
Jun
(2) |
Jul
(1) |
Aug
|
Sep
(1) |
Oct
(1) |
Nov
(1) |
Dec
(1) |
| 2007 |
Jan
(1) |
Feb
|
Mar
(4) |
Apr
(2) |
May
(2) |
Jun
(1) |
Jul
(1) |
Aug
(1) |
Sep
|
Oct
|
Nov
|
Dec
(1) |
| 2008 |
Jan
|
Feb
(3) |
Mar
|
Apr
(1) |
May
|
Jun
(2) |
Jul
|
Aug
|
Sep
|
Oct
(4) |
Nov
|
Dec
|
| 2009 |
Jan
(2) |
Feb
(2) |
Mar
|
Apr
|
May
(1) |
Jun
|
Jul
|
Aug
(1) |
Sep
|
Oct
|
Nov
|
Dec
|
| 2010 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
(1) |
Nov
|
Dec
|
| 2012 |
Jan
(2) |
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
|
From: Nick C. <ni...@cl...> - 2001-11-27 09:05:39
|
On Mon, Nov 26, 2001 at 09:04:08PM +0000, Jonathan Stowe wrote:
> > metacharacters not interpreted: \Q$foo\E
> >
>
> Yep, but if the contents of $foo are themselves constructing a regex
> from some other construct then it should be taken back a step earlier:
>
> my $pattern = join '|', map { quotemeta($_) } keys(%unescape_html_map);
Yup.
The case /[$foo]/ will be another exception, since I don't think
/[(?:$foo)]/ will work.
--
Nick
|
|
From: Jonathan S. <gel...@ge...> - 2001-11-26 22:44:18
|
FormMail.pl and wwwboard.pl are the real bogies as they are :
A) used more than most of the other programs
B) apparently more often attacked by crackers and spammers
I address FormMail.pl here as the other one makes me brane hert ..
A lot of stuff can come from user supplied input via the form:
my @fields = qw(
recipient
subject
email
realname
redirect
bgcolor
background
link_color
vlink_color
text_color
alink_color
title
sort
print_config
required
env_report
return_link_title
return_link_url
print_blank_fields
missing_fields_redirect
);
Yes, most of this is escaped and so forth but I dunno I get a worry that
maybe this is still a large bunch of stuff to be sure that it is checked
..
Firstly I am going to provide a means for the end user to override the use
of these in the code (in a backward compatible way), secondly are any of
the coverage guys on this list (Pony Man, Robin, Anyone ?) - it might be
useful to be able to track the use of variables with a separate tool that
can tell if (E.G.) escape_html() has been called on a variable before it
is interpolated into a string that is going to printed ? Yeah sure I
could reconstruct it from the proposed magic for non-Y2K compliant uses of
(localtime)[5] but I can't be arsed ... it gives me the CvGv's ;-}
On the whole though guys it's looking great ...
/J\
--
Jonathan Stowe |
<http://www.gellyfish.com> | This space for rent
|
|
|
From: Jonathan S. <gel...@ge...> - 2001-11-26 21:03:59
|
On Mon, 26 Nov 2001, Nick Cleaton wrote:
> On Mon, Nov 26, 2001 at 05:40:05AM -0800, Nick Cleaton wrote:
> >
> > Modified Files:
> > guestbook.pl
> > Log Message:
> > Added \Q \E around variables in regexps where metacharacters in the
> > variables shouldn't be interpreted by the regex engine.
>
> I propose this convention for interpolating variables into regular
> expressions:
>
> metacharacters interpreted: (?:$foo) or ($foo)
>
Was the first available in 5.00404 ? If so that should be the one of
choice :)
> metacharacters not interpreted: \Q$foo\E
>
Yep, but if the the contents of $foo are themselves constructing a regex
from some other construct then it should be taken back a step earlier:
my $pattern = join '|', map { quotemeta($_) } keys(%unescape_html_map);
As in recent wwwboard.pl ....
/J\
--
Jonathan Stowe |
<http://www.gellyfish.com> | This space for rent
|
|
|
From: Nick C. <ni...@cl...> - 2001-11-26 13:58:18
|
On Mon, Nov 26, 2001 at 05:40:05AM -0800, Nick Cleaton wrote: > > Modified Files: > guestbook.pl > Log Message: > Added \Q \E around variables in regexps where metacharacters in the > variables shouldn't be interpreted by the regex engine. I propose this convention for interpolating variables into regular expressions: metacharacters interpreted: (?:$foo) or ($foo) metacharacters not interpreted: \Q$foo\E Thoughts ? -- Nick |
|
From: Nick C. <ni...@cl...> - 2001-11-26 13:48:40
|
On Sat, Nov 24, 2001 at 08:25:53PM +0000, Jonathan Stowe wrote: > My giant goose says that I should go on and factor all the common stuff > out into a seperate module and then develop some method for deploying the > sucker - but but but the big fish say's I should ask first .... > > I'm going to be putting too much identical code into the programs. > > Tell me what you think ... For maximum backward compatibility, I think we should have a module for common code, but structure it so that it's easy to automatically generate stand-alone versions of all the scripts at release time. -- Nick |
|
From: Jonathan S. <gel...@ge...> - 2001-11-25 20:37:21
|
On Sun, 25 Nov 2001, Dave Cross wrote: > On Sun, Nov 25, 2001 at 11:53:51AM +0000, Jonathan Stowe (gel...@ge...) wrote: > > On Sun, 25 Nov 2001, Dave Cross wrote: > > > > > On Sun, Nov 25, 2001 at 09:50:19AM +0000, Jonathan Stowe (gel...@ge...) wrote: > > > > I have added docs/FAQ.pod - currently there are only a few questions and > > > > no answers. Feel free to add answers and new questions. > > > > > > This doesn't seem to be in CVS yet. > > > > > > > Hmm it should be :( I don't know where it went - anyhow its there now. It > > will probably turn up somewhere totally unrelated. I would recommend > > deleting the working directories you have now and checking out the NMS > > module so you get everything all at once. > > I've had a first go at filling in the answers to the questions. Please feel > free to change stuff. > > And I've done a quick pod2html and put a link up on the main > nms-cgi.sourceforge.net web page. > Dave, that's great - just in the spirit the questions were supposed to elicit ;-} Lurv ya /J\ -- Jonathan Stowe | <http://www.gellyfish.com> | This space for rent | |
|
From: Dave C. <da...@da...> - 2001-11-25 16:11:11
|
On Sun, Nov 25, 2001 at 11:53:51AM +0000, Jonathan Stowe (gel...@ge...) wrote: > On Sun, 25 Nov 2001, Dave Cross wrote: > > > On Sun, Nov 25, 2001 at 09:50:19AM +0000, Jonathan Stowe (gel...@ge...) wrote: > > > I have added docs/FAQ.pod - currently there are only a few questions and > > > no answers. Feel free to add answers and new questions. > > > > This doesn't seem to be in CVS yet. > > > > Hmm it should be :( I don't know where it went - anyhow its there now. It > will probably turn up somewhere totally unrelated. I would recommend > deleting the working directories you have now and checking out the NMS > module so you get everything all at once. I've had a first go at filling in the answers to the questions. Please feel free to change stuff. And I've done a quick pod2html and put a link up on the main nms-cgi.sourceforge.net web page. Dave... -- Drugs are just bad m'kay |
|
From: Jonathan S. <gel...@ge...> - 2001-11-25 11:54:06
|
On Sun, 25 Nov 2001, Dave Cross wrote: > On Sun, Nov 25, 2001 at 09:50:19AM +0000, Jonathan Stowe (gel...@ge...) wrote: > > I have added docs/FAQ.pod - currently there are only a few questions and > > no answers. Feel free to add answers and new questions. > > This doesn't seem to be in CVS yet. > Hmm it should be :( I don't know where it went - anyhow its there now. It will probably turn up somewhere totally unrelated. I would recommend deleting the working directories you have now and checking out the NMS module so you get everything all at once. > And why do we have both a /doc and a /docs directory? > The doc directory was an earlier cock up (see messages passim) if you use the -P flag to checkout or update it will go away ( you can never get rid of directories in the repository without actually going into $CVSROOT and actually deleting them - and of course we can't do that ) If you check out the NMS module you will get everything without the doc directory :) /J\ -- Jonathan Stowe | <http://www.gellyfish.com> | This space for rent | |
|
From: Dave C. <da...@da...> - 2001-11-25 10:34:30
|
On Sun, Nov 25, 2001 at 09:50:19AM +0000, Jonathan Stowe (gel...@ge...) wrote: > I have added docs/FAQ.pod - currently there are only a few questions and > no answers. Feel free to add answers and new questions. This doesn't seem to be in CVS yet. And why do we have both a /doc and a /docs directory? Dave... -- Don't dream it... be it |
|
From: Dave C. <da...@da...> - 2001-11-25 10:28:55
|
On Sun, Nov 25, 2001 at 09:50:42AM +0000, Dave Cross (da...@da...) wrote: > I seem have broken my connection to the SourceForge CVS server. I thought > it might be that the server was down, but I see that other are checkig stuff > in without problems. When I try to run a CVS update, I get the following > errors: > > [dave@tma1 nms-cgi]$ cvs update > usw-pr-cvs.sourceforge.net: Connection refused > cvs [update aborted]: end of file from server (consult above messages if any) > > Any suggestions would be appreciated. I'm not at home with CVS and am a bit > lost. I'm painfully aware that the releases on the nms website are out of > date and I'd like to correct that as soon as possible. Of course, it all works much better if you have CVS_RSH set to the appropriate value :-/ Dave... [going back to bed] -- .sig missing... |
|
From: Dave C. <da...@da...> - 2001-11-25 09:51:45
|
I seem have broken my connection to the SourceForge CVS server. I thought it might be that the server was down, but I see that other are checkig stuff in without problems. When I try to run a CVS update, I get the following errors: [dave@tma1 nms-cgi]$ cvs update usw-pr-cvs.sourceforge.net: Connection refused cvs [update aborted]: end of file from server (consult above messages if any) Any suggestions would be appreciated. I'm not at home with CVS and am a bit lost. I'm painfully aware that the releases on the nms website are out of date and I'd like to correct that as soon as possible. Cheers, Dave... -- .sig missing... |
|
From: Jonathan S. <gel...@ge...> - 2001-11-25 09:50:31
|
I have added docs/FAQ.pod - currently there are only a few questions and no answers. Feel free to add answers and new questions. /J\ -- Jonathan Stowe | <http://www.gellyfish.com> | This space for rent | |
|
From: Jonathan S. <gel...@ge...> - 2001-11-24 20:31:39
|
My giant goose says that I should go on and factor all the common stuff out into a seperate module and then develop some method for deploying the sucker - but but but the big fish say's I should ask first .... I'm going to be putting too much identical code into the programs. Tell me what you think ... /J\ -- Jonathan Stowe | <http://www.gellyfish.com> | This space for rent | |
|
From: Jonathan S. <gel...@ge...> - 2001-11-23 16:30:13
|
On Fri, 23 Nov 2001, struan wrote: > > Having watched someone tinker briefly with formail the one thing I'd say > that needs to be done is either stress in the README that the field name > recipient _must_ be in lower case or make use of lc in the appropriate > places. > or case smash the incoming parameter names .... I'll have a look at that :) /J\ -- Jonathan Stowe | <http://www.gellyfish.com> | This space for rent | |
|
From: struan <nm...@ex...> - 2001-11-23 15:47:43
|
Hi, Having watched someone tinker briefly with formail the one thing I'd say that needs to be done is either stress in the README that the field name recipient _must_ be in lower case or make use of lc in the appropriate places. And of course this probably should be propogated to the other scripts. It's not a big issue but it might help to cut down the number of puzzled users. Struan |
|
From: Jonathan S. <gel...@ge...> - 2001-11-21 10:03:30
|
On Tue, 20 Nov 2001, Nick Cleaton wrote:
> On Tue, Nov 20, 2001 at 10:38:04AM -0500, Joseph F. Ryan wrote:
>
> > >The line
> > > > foreach (reverse 0 .. $#from_date)
> > >allows an attacker to choose the number of goes around this loop.
> > >No obvious impact.
> >
> > 2.) I'm not sure what you mean here :)
>
> That loop is over several arrays of 6 elements: @now, @skip, @diff
> and @from_date.
>
> Since @from_date is the only one that's controlled by CGI inputs
> (and so may contain more or less than 6 elements) it seems to me
> that "$#from_date" is a foolish encoding of "5". "$#now" or
> "$#diff" would be nicer.
>
> It's a very minor point really.
>
Not necessarily. With pre 5.005 perl ( and bear in mind that we are
targetting 5.00404 ) the list over which for() iterates is actually built
internally before the iteration starts, so if an attacker could somehow
get @from_date to have $some_very_large number of elements it could cause
the allocation of large amounts of memory. <checks>
[gellyfish@orpheus test]$ cat test.c
#include "EXTERN.h"
#include "perl.h"
main()
{
printf("%d\n",sizeof(SV));
}
[gellyfish@orpheus test]$ cc -I /usr/lib/perl5/5.6.1/i686-linux/CORE
test.c
[gellyfish@orpheus test]$ ./a.out
12
bearing in mind none of the memory used by those SVs is reclaimed by the
OS, on some OS this could DoS the box quite effectively.
Mind the one you really want to look out for is:
for ( a .. ZZZZZZZ )
{
...
}
I don't recommend trying it on a Linux machine you can't afford to reboot
;-}
/J\
--
Jonathan Stowe |
<http://www.gellyfish.com> | This space for rent
|
|
|
From: Nick C. <ni...@cl...> - 2001-11-20 17:35:37
|
On Tue, Nov 20, 2001 at 10:38:04AM -0500, Joseph F. Ryan wrote: > Regarding search.pl: > >* Arbitrary command execution in search.pl if filenames > > ending in "|" can be created. > > 1.) I will add something to the wanted function to parse out filenames > ending in |. Good. I've put a "<" on the open. > >The line > > > foreach (reverse 0 .. $#from_date) > >allows an attacker to choose the number of goes around this loop. > >No obvious impact. > > 2.) I'm not sure what you mean here :) That loop is over several arrays of 6 elements: @now, @skip, @diff and @from_date. Since @from_date is the only one that's controlled by CGI inputs (and so may contain more or less than 6 elements) it seems to me that "$#from_date" is a foolish encoding of "5". "$#now" or "$#diff" would be nicer. It's a very minor point really. -- Nick |
|
From: Joseph F. R. <rya...@os...> - 2001-11-20 15:40:22
|
Regarding search.pl: >* Arbitrary command execution in search.pl if filenames > ending in "|" can be created. 1.) I will add something to the wanted function to parse out filenames ending in |. [SNIP] >search >====== > >Interpolates user input into pattern matches without \Q \E, >leading to a CPU-bound DoS. 2.) I haven't gotten to this part of the script yet (been busy with midterms), but thanks for pointing it out. >Shell metacharacters in filenames could lead to arbitrary >command execution while FILE is opened. 3.) See 1. >Interpolates user input into output HTML with no checking. 4.) I'm going to fix that up completely, but you have an valid point [SNIP] Regarding countdown.pl: >countdown >========= > >User input passed unchecked to strftime. I was able to segfault >perl 5.00503 in libc under linux by passing negative numbers to >strftime, so some sort of sanity check is probably in order. 1.) Woopsy. Will do. Thanks. >The line > > foreach (reverse 0 .. $#from_date) >allows an attacker to choose the number of goes around this loop. >No obvious impact. 2.) I'm not sure what you mean here :) |
|
From: Nick C. <ni...@cl...> - 2001-11-20 08:38:22
|
On Fri, Nov 16, 2001 at 09:36:19PM +0000, Jonathan Stowe wrote:
>
> Nick, how do you feel about sizing up the holes (and incompliancies) in
> all the scripts and documenting them - bearing in mind that we are going
> to have to support by default the existing behaviour (that is to say we
> can't lose the GET thing right now.) Once documented we can find willing
> slaves to implement the changes if necessary :)
>
> I would also like you to examine the 'spam pawn' potential in the
> FormMail.pl if you are up for the gig ...
Here are the problems I can see. This is all from reading
the code, so some of these may be in error.
Highlights:
* I've changed my mind: guestbook and formmail are both
very handy if you're a spammer.
* Arbitrary command execution in search.pl if filenames
ending in "|" can be created.
* Loads of ways to display arbitrary HTML. This opens a
cross site scripting hole which makes it possible to
subvert other applications hosted on the same domain
as one of these scripts.
countdown
=========
User input passed unchecked to strftime. I was able to segfault
perl 5.00503 in libc under linux by passing negative numbers to
strftime, so some sort of sanity check is probably in order.
The line
> foreach (reverse 0 .. $#from_date)
allows an attacker to choose the number of goes around this loop.
No obvious impact.
ffa
===
locks the temporary file when adding a link, so different copies
of the script using different temporary file names will clash.
fails to seek to the end after flocking on update.
interpolates unchecked user input into output HTML.
interpolates unchecked user input into stored HTML.
formmail
========
Missing \Q \E around variables interpolated into patterns in
a couple of places.
A missing leading ^ renders the referer check ineffective.
check_required() accepts any recipient containing a substring
in @referers, so "localhost <vi...@vi...>" gets through,
allowing arbitrary spamming.
send_email() interpolates $Config{email} and $Config{realname}
into the header without checking for multiple lines, allowing
arbitrary To/Cc/Bcc headers and hence arbitrary spamming.
This could be quite attractive to spammers since many recipients
and other headers can be specified, and it's probably possible to
hide all the content that FormMail adds in the MIME preamble, so
the spammer gets full control of the content.
error() interpolates $Config{recipient} into the HTML, allowing
the display of arbitrary HTML.
guestbook
=========
Interpolates unchecked user input into displayed HTML in various
places.
Interpolates unchecked user input into stored HTML in various
places.
$allow_html fails to fully strip all HTML constructs
from the comments, e.g. "<img src='javascript:alert(1)' >"
With $allow_html turned on, we deliberately allow arbitrary
HTML, opening a cross site scripting hole. Need to have a
whitelist of harmless tags.
If $remote_mail is set, $username is interpolated into the input
of sendmail -t at the top of the message without sanity checking,
so the message structure and recipient list is under attacker
control. Nice for spamming.
imagecounter
============
The locking gets a bit funny if two copies of script are in
create() on the same counter at the same time.
rand_image
==========
Fails to seek to the end after flock when updating the
log file.
rand_link
=========
Missing leading "<" when opening $linkfile for read. No actual
problem since it's statically configured, but bad security style.
Doesn't seek to the end after flocking on log write, and opens
and closes the log file an extra time for no apparent reason.
rand_text
=========
Missing leading "<" when opening $randomfile for read. No actual
problem since it's statically configured, but bad security style.
search
======
Interpolates user input into pattern matches without \Q \E,
leading to a CPU-bound DoS.
Shell metacharacters in filenames could lead to arbitrary
command execution while FILE is opened.
Interpolates user input into output HTML with no checking.
ssi_rand_image
==============
Doesn't seek to the end after flock when updating the log.
textclock
=========
This script appears devoid of security issues. I feel strangely
cheated.
textcounter
===========
The locking gets a bit funny if two copies of script are in
create() on the same counter at the same time.
wwwboard
========
$allow_html fails to fully strip all HTML constructs
from the comments, e.g. "<img src='javascript:alert(1)' >"
With $allow_html turned on, we deliberately allow arbitrary
HTML, opening a cross site scripting hole. Need to have a
whitelist of harmless tags.
Interpolates unchecked user input into displayed HTML in various
places.
Interpolates unchecked user input into stored HTML in various
places.
Missing leading "<" on file opens.
passwd.txt can be fetched directly via HTTP for offline cracking
if stored within the doc root.
|
|
From: Nick C. <ni...@cl...> - 2001-11-19 13:43:47
|
On Fri, Nov 16, 2001 at 09:36:19PM +0000, Jonathan Stowe wrote: [SNIP] > > > 2) Makes changes in response to a GET request. > > > > Is that really a problem? > > > > Examine rfc2616 with reference to the term 'idempotent' ;-} > > I'll get the world famed HTTP pendant Alan Flavell in here to explain this > if we have difficulty. > > I have a feeling that most of the scripts suffer from this problem > unfortunately we do have to consider the compatibility with the legacy of > the Existing Body Of Matts Scripts .... There are security issues with allowing GET requests to do things rather than just display things, for example an attacker can use an IMG tag to cause a victim to submit an abusive guest book entry. A referer check helps here. How about allowing GET requests only in compatibility mode ? > Nick, how do you feel about sizing up the holes (and incompliancies) in > all the scripts and documenting them - bearing in mind that we are going > to have to support by default the existing behaviour (that is to say we > can't lose the GET thing right now.) Once documented we can find willing > slaves to implement the changes if necessary :) Yes, I'd like to have a go at that. > I would also like you to examine the 'spam pawn' potential in the > FormMail.pl if you are up for the gig ... Done, I think it's about as good as it's going to get given that we have to send the confirmation mail to a user supplied address. The only change that I would make is to include the HTTP client IP address in the mail somewhere, and maybe think about some rate limiting. -- Nick |
|
From: Jonathan S. <gel...@ge...> - 2001-11-18 18:34:29
|
On Sun, 18 Nov 2001, iain truskett wrote:
> * Jonathan Stowe (gel...@ge...) [16 Nov 2001 21:45]:
>
> > I have a feeling that most of the scripts suffer from this problem
> > unfortunately we do have to consider the compatibility with the legacy
> > of the Existing Body Of Matts Scripts ....
>
> Given the ease with which CGI.pm allows people to just access param()
> without worrying whether it's POSTed or GETed (maybe 'GOT') it's
> possible that quite a few scripts in the world have this problem.
>
Absolutely - I am probably as guilty of this as anyone but it is something
that should be considered - bear in mind that most of the work that we are
reviewing goes straight to $ENV{QUERY_STRING} without considering the
request method :)
> [snip about 'mv and rename' method of changing guestbook.html]
> > I have a version of guestbook.pl that does this but is so vastly different
> > from the version in CVS that I am holding off on it.
>
> Yes, well, mine uses Mason and a postgresql backend, so is very
> inappropriate.
>
Er, we'll save that for a later upgrade :)
> Does Apache pay any attention to any form of file locking? (Probably
> safe to say that even if IIS does, it would be a bugger locking the
> file.)
No. That is why the write to temporary file and mv is the only solution -
the web server doesnt respect a flock() on the requested files ...
/J\
--
Jonathan Stowe |
<http://www.gellyfish.com> | This space for rent
|
|
|
From: Joseph F. R. <rya...@os...> - 2001-11-18 07:26:47
|
At 10:36 AM 11/17/2001 +0000, Jonathan Stowe wrote:
>On Sat, 17 Nov 2001, Joseph F. Ryan wrote:
> >
> > $typelist =
> >
> ((@filetypes>0)?'(\.'.join(')|(\.',@filetypes).')':'').((@wildcards>0)?((@filetypes>0)?'|':'').join('|',map{s#\*(\.)#'.*?'.($1?'\.':'')#ge;$_='('.$_.')'}@wildcards):'');
> >
>
>Gah! This is cute but probably a little JAPH like and opaque for some code
>that is going to reach the eyes of people learning programming - this is
>the kind of thing that is either going to cause people to think "I'm never
>going to be able to learn that stuff" or confirm what people say about
>Perl being a "Write Only Language".
>
>Mind you I am having difficulty expressing this as a bunch of discreet
>statements ;-}
Hehe, sometimes I can't help myself. I am not sure how well yours works,
but the above will translate into below. Try this:
-----------------------
$typelist = '(\.';
$typelist .= join(')|(\.',@filetypes) if (@filetypes>0);
$typelist .= ')';
$typelist .= '|' if (@wildcards>0 && @filetypes>0);
foreach my $wildcard (@wildcards)
{
$wildcard =~ s/\*(\.)/'.*?'/g;
$wildcard .= '\.' if ($1);
$wildcard = '(' . $_ . ')';
}
$typelist .= join('|',@wildcards);
-------------------------
On a future not: I humbly apologize for making you sort through that; I was
just trying to be consise; figuring that the users wouldn't have to sort
through the black magic. I forgot that we were to also teach them. I
happen to write something insane like that again, you don't have to waste
time rewriting my code; just slap me in the face and make me sort through
my nonsense ;)
Joe Ryan
|
|
From: iain t. <ic...@eh...> - 2001-11-18 05:59:56
|
* Jonathan Stowe (gel...@ge...) [16 Nov 2001 21:45]: > On Sat, 17 Nov 2001, iain truskett wrote: > > * Nick Cleaton (ni...@cl...) [16 Nov 2001 17:56]: [...] > > > 2) Makes changes in response to a GET request. > > > > Is that really a problem? > > Examine rfc2616 with reference to the term 'idempotent' ;-} Ah. Cool. Never knew about that. [...] > I have a feeling that most of the scripts suffer from this problem > unfortunately we do have to consider the compatibility with the legacy > of the Existing Body Of Matts Scripts .... Given the ease with which CGI.pm allows people to just access param() without worrying whether it's POSTed or GETed (maybe 'GOT') it's possible that quite a few scripts in the world have this problem. [snip about 'mv and rename' method of changing guestbook.html] > I have a version of guestbook.pl that does this but is so vastly different > from the version in CVS that I am holding off on it. Yes, well, mine uses Mason and a postgresql backend, so is very inappropriate. Does Apache pay any attention to any form of file locking? (Probably safe to say that even if IIS does, it would be a bugger locking the file.) cheers, -- iain. <http://eh.org/~koschei/> |
|
From: Jonathan S. <gel...@ge...> - 2001-11-17 10:36:09
|
On Sat, 17 Nov 2001, Joseph F. Ryan wrote:
>
> $typelist =
> ((@filetypes>0)?'(\.'.join(')|(\.',@filetypes).')':'').((@wildcards>0)?((@filetypes>0)?'|':'').join('|',map{s#\*(\.)#'.*?'.($1?'\.':'')#ge;$_='('.$_.')'}@wildcards):'');
>
Gah! This is cute but probably a little JAPH like and opaque for some code
that is going to reach the eyes of people learning programming - this is
the kind of thing that is either going to cause people to think "I'm never
going to be able to learn that stuff" or confirm what people say about
Perl being a "Write Only Language".
Mind you I am having difficulty expressing this as a bunch of discreet
statements ;-}
Something like this perhaps :
my @files = ('robot*' ,'pod','ftp*.html','txt','jpg');
foreach my $file (@files)
{
$file =~ s/\./\\./g;
if ( $file !~ /[^a-z]/i )
{
$file = "(\\.$file)";
}
else
{
$file =~ s/\*/.*%/g;
$file =~ s/\?/.?/g;
$file =~ s/%/?/g;
$file = "($file)";
}
push @file_patterns, $file;
}
$typelist = join '|', @file_patterns;
print $typelist;
This should probably be tucked away in a subroutine somewhere.
/J\
--
Jonathan Stowe |
<http://www.gellyfish.com> | This space for rent
|
|
|
From: Jonathan S. <gel...@ge...> - 2001-11-17 09:52:23
|
On Sat, 17 Nov 2001, Dave Cross wrote: > On Fri, Nov 16, 2001 at 12:45:46AM -0500, Joseph F. Ryan (rya...@os...) wrote: > > > > On an unrelated note, I am still having problems with CVS. I downloaded > > WinCVS and installed it successfully, but I couldn't figure out how to use > > it. CVS's super-massive manual wasn't much help either. I guess I'll just > > keep posting to my perlmonk site until I can figure this monster out... > > Sorry, but I don't develop under Windows so I can't be any help. Does > anyone else have experience of WinCVS? Would be much appreciated if you > could help Joe out so that he could commit files. > The page http://www.wincvs.org/ssh.html describes how to set up WinCVS with both the commercial SSH and Cygwin OpenSSH - I'll try it out on monday (you don't think I have windows at home do you :), the programs need testing with IIS anyhow. /J\ -- Jonathan Stowe | <http://www.gellyfish.com> | This space for rent | |
14 messages has been excluded from this view by a project administrator.