[WWdevel] CGI weirdness under Apache 1

[Sam H. <sh...@ma...>]

Hi Mike,

In doing some testing, I've discovered that CGI.pm doesn't behave the  
way we thought it did under Apache 1. For some reason, the default  
CGI object ($CGI::Q) doesn't seem to be getting parameters from  
POSTDATA.

I've added a Test.pm content generator (/webwork2/coursename/test/)  
which demonstrates this behavior. Click "Refresh" and note that  
CGI::param('pwd') returns an empty value under Apache 1, even though  
there is a "pwd" field in the request. Also note that the $CGI::Q  
object dumped at the top of the page is essentially empty.

If you change the POST to a GET, the parameters show up in the CGI  
object, and the new "pwd" value from $self->{pwd} isn't used in the  
hidden field.

We actually rely on this lack of existing values. For example,  
FileManager relies on the value of $self->{pwd} actually being  
written out in the line:

	print CGI::hidden({name=>'pwd',value=>$self->{pwd}});

In order for this to happen, CGI has to think that there is no  
existing "pwd" parameter.

In Apache 2, CGI.pm *is* able to get parameters from POSTDATA. This  
is the REAL CAUSE of the original parameter problem that we've been  
working on. CGI.pm failing to get parameter data is not the problem  
-- it's actually when it succeeds that things break.

So this changes the contours of the problem a bit.

Only two forms in WeBWorK use GET requests. They are the database  
export form in CourseAdmin.pm and the main form in Instructor/ 
Index.pm. Sticky values *could* be a problem in these forms, but as  
it turns out, they aren't. The rest of WeBWorK's forms use POST, and  
many form fields have been written with the assumption that the "- 
value" or "-default" will always be used.

So you'd think that the solution would be to simply add the "- 
nosticky" pragma, like we originally tried. However, from looking at  
the CGI.pm code, I think -nosticky doesn't do what we think it does.  
What it appears to do is suppress the output of hidden ".cgifields"  
fields naming each of the radio buttons, checkboxes, and scrolling  
lists in the form. (And also give the default name ".submit" to  
unnamed submit buttons.) THAT'S ALL.

  As far as i can tell, all that ".cgifields" does is ensures that  
the parameter *names* for checkboxes, radio buttons, and scrolling  
lists are still known to CGI.pm even if none of them are selected  
(and thus don't appear in the request). This has very little to do  
with form field "stickiness", despite statements to the contrary in  
the docs. (The only connection is that it prevents checkboxes, radio  
buttons, and scrolling lists from being reset to their defaults if  
none of their items are selected.) It looks to me like the only way  
to turn off form field stickiness is to specify "-override=>1" in  
each field.

This seems really weird to me, since it implies that the CGI module  
documentation is just plain wrong. Could you do me a favor and look  
at $NOSTICKY in the CGI.pm source and tell me if I'm missing something?
-sam