running a shell script via cgi web interface in All Things Unix http://www.dslreports.com/forum/r22479675 en Tue, 01 Dec 2009 11:57:56 EDT Tue, 01 Dec 2009 11:57:56 EDT Re: running a shell script via cgi web interface http://www.dslreports.com/forum/remark,22489842 Dennis :
said by nwrickert See Profile :

The above however did not work...
You should be using
echo "$input" > /tmp/router.txt
The quoting prevents reparsing of "$input".

If you just want to write all of stdin to a file, then
cat - > /tmp/router.txt
should accomplish that.
Sure why not...when in doubt quotes won't hurt eh? :)

oh and btw a much better way of doing what I did above is this:

My Blog. Because I desperately need the acknowledgement of others.

Visit the Judd Family website to see my kids!]]> http://www.dslreports.com/forum/remark,22489842 Wed, 03 Jun 2009 14:07:54 EDT Re: running a shell script via cgi web interface http://www.dslreports.com/forum/remark,22485295 nwrickert :
The above however did not work...
You should be using
echo "$input" > /tmp/router.txt
The quoting prevents reparsing of "$input".

If you just want to write all of stdin to a file, then
cat - > /tmp/router.txt
should accomplish that.
--
AT&T dsl; Westell 327w modem/router; openSuSE 11.0; firefox 3.0.10]]> http://www.dslreports.com/forum/remark,22485295 Tue, 02 Jun 2009 18:58:32 EDT Re: running a shell script via cgi web interface http://www.dslreports.com/forum/remark,22485152 Dennis : woo hoo....successs. I was able to import a text file as a variable in a test script (not at my work computer right now)


--
My Blog. Because I desperately need the acknowledgement of others.

Visit the Judd Family website to see my kids!]]> http://www.dslreports.com/forum/remark,22485152 Tue, 02 Jun 2009 18:30:11 EDT Re: running a shell script via cgi web interface http://www.dslreports.com/forum/remark,22485014 Dennis : If only there was some way for me to read that text file back into a variable....


The above however did not work....:(

--
My Blog. Because I desperately need the acknowledgement of others.

Visit the Judd Family website to see my kids!]]> http://www.dslreports.com/forum/remark,22485014 Tue, 02 Jun 2009 18:07:15 EDT Re: running a shell script via cgi web interface http://www.dslreports.com/forum/remark,22484709 Dennis : well I tried changing the variables, but got these errors

/usr/local/apache/dennis.sh: -n: is not an identifier
[Tue Jun 2 16:07:20 2009] [error] [client xxx.xxx.xxx.xxx] Premature end of script headers: /usr/local/apache/dennis.sh

tried to echo it out into a test file but no joy so the syntax must be off


update:
I did just get this to work....


--
My Blog. Because I desperately need the acknowledgement of others.

Visit the Judd Family website to see my kids!]]> http://www.dslreports.com/forum/remark,22484709 Tue, 02 Jun 2009 17:09:00 EDT Re: running a shell script via cgi web interface http://www.dslreports.com/forum/remark,22483545 anon : You also want to make sure you do input validation on user-supplied data. Something like:

die unless ($input =~ m/[a-z0-9/i);

The above is PERL that only allows alpha-numeric characters. Nothing like OS command injection to get your web server 0wned.]]> http://www.dslreports.com/forum/remark,22483545 Tue, 02 Jun 2009 14:01:46 EDT Re: running a shell script via cgi web interface http://www.dslreports.com/forum/remark,22483323 pablo2525 : Howdy,

Ugh, my writing wasn't especially clear. I'm sorry. Let me try again.

In /etc/apache2/vhosts.d, my `conf' file has the above entry. :) In my case, I created a random file named `hostname`.conf baseed on `vhost.template'

My distribution is openSUSE but I figure the above is true in most (all?) apache installations. Of course the root pathing may be different.

I hope the above helps.

Cheers,
--
pablo
openSUSE 11.0;KDE
ISP: TekSavvy DSL; backhauled via a 6KM wireless link]]> http://www.dslreports.com/forum/remark,22483323 Tue, 02 Jun 2009 13:27:01 EDT Re: running a shell script via cgi web interface http://www.dslreports.com/forum/remark,22482492 anon : s/and it's delimited with a QUERY_STRING/and it's not delimited with a QUERY_STRING/g]]> http://www.dslreports.com/forum/remark,22482492 Tue, 02 Jun 2009 11:08:48 EDT Re: running a shell script via cgi web interface http://www.dslreports.com/forum/remark,22482489 anon : Dennis - Glad to help, please post a picture (kidding) ;)

I've not done CGI in a VERY long time, so you might want to do some testing to ensure that $HTTP_POST only contains the content of the POST itself and it's delimited with a QUERY_STRING style syntax. Ideally, your new code would be similar to below, assuming additional parsing of $HTTP_POST isn't necessary:

]]> http://www.dslreports.com/forum/remark,22482489 Tue, 02 Jun 2009 11:07:37 EDT Re: running a shell script via cgi web interface http://www.dslreports.com/forum/remark,22482467 Dennis :
said by Sir Meowmix III :

$HTTP_POST is arbitrary, it was a declared variable from the 'read' statement I posted earlier. If you're going to use $HTTP_POST be sure to use the 'read' statement as well.
Ok, you mean to make sure I use it in the shell script...right?

I should have mentioned that I know nothing earlier :) I'm trying to learn but really I'm trying to learn to run before walking....
--
My Blog. Because I desperately need the acknowledgement of others.

Visit the Judd Family website to see my kids!]]> http://www.dslreports.com/forum/remark,22482467 Tue, 02 Jun 2009 11:02:35 EDT Re: running a shell script via cgi web interface http://www.dslreports.com/forum/remark,22482413 anon : $HTTP_POST is arbitrary, it was a declared variable from the 'read' statement I posted earlier. If you're going to use $HTTP_POST be sure to use the 'read' statement as well.]]> http://www.dslreports.com/forum/remark,22482413 Tue, 02 Jun 2009 10:52:38 EDT Re: running a shell script via cgi web interface http://www.dslreports.com/forum/remark,22482325 Dennis :
said by nwrickert See Profile :

Those touches in the beginning....never happen.
That's probably because "$1" is undefined.
....ok well so if that's the case then if the touches are indeed happening, there must be frament files in the /tmp directory...


so yeah, ok.....the variable must not be passing. So $1 is just a cli variable, and $HTTP_POST would be necessary in its stead.

I'll try that and see what happens.

--
My Blog. Because I desperately need the acknowledgement of others.

Visit the Judd Family website to see my kids!]]> http://www.dslreports.com/forum/remark,22482325 Tue, 02 Jun 2009 10:31:03 EDT Re: running a shell script via cgi web interface http://www.dslreports.com/forum/remark,22482175 nwrickert :
Those touches in the beginning....never happen.
That's probably because "$1" is undefined.
--
AT&T dsl; Westell 327w modem/router; openSuSE 11.0; firefox 3.0.10]]> http://www.dslreports.com/forum/remark,22482175 Tue, 02 Jun 2009 10:02:38 EDT Re: running a shell script via cgi web interface http://www.dslreports.com/forum/remark,22482168 anon : Something like:


Where $HTTP_POST needs to be used instead of $1 in your code.
]]> http://www.dslreports.com/forum/remark,22482168 Tue, 02 Jun 2009 10:00:56 EDT Re: running a shell script via cgi web interface http://www.dslreports.com/forum/remark,22482149 anon : I think the issue is that the value you're passing via HTTP post is not inserted into $1, like it would be if it were called from the CLI.

You need to accept the HTTP POST in a different way.

quote:
For forms that use METHOD="POST", CGI specifications say that the data is passed to the script or program in the standard input stream (stdin), and the length (in bytes, i.e. characters) of the data is passed in an environment variable called CONTENT_LENGTH.


So you need to read from STDIN, assign it to a variable, and use it instead of $1. See »www.tcl.tk/man/aolserver3.0/cgi-ch4.htm]]> http://www.dslreports.com/forum/remark,22482149 Tue, 02 Jun 2009 09:55:51 EDT Re: running a shell script via cgi web interface http://www.dslreports.com/forum/remark,22482112 Dennis :
said by pablo2525 See Profile :

I made the following modification to my `vhosts.d' `conf' file:
I don't have a "vhosts.d" file...only a httpd.conf one which seems to have something similar

--
My Blog. Because I desperately need the acknowledgement of others.

Visit the Judd Family website to see my kids!]]> http://www.dslreports.com/forum/remark,22482112 Tue, 02 Jun 2009 09:46:01 EDT Re: running a shell script via cgi web interface http://www.dslreports.com/forum/remark,22481990 Dennis : well, here is the jist of the code...at least the part I am having problems with. I have to remove some bits of it since it's for work and all...

here's teh cgi:

and here is the shell script called dennis.sh


Those touches in the beginning....never happen. I works just fine when I do it from the cli of course...but not via apache. I originally added them in order try and fix this problem but tit seems they don't. And of course the $1 is the variable I'm passing.

When I have it use a pre-existing file (which won't work for me, was only for testing) then this is the ownership I get.

--
My Blog. Because I desperately need the acknowledgement of others.

Visit the Judd Family website to see my kids!]]> http://www.dslreports.com/forum/remark,22481990 Tue, 02 Jun 2009 09:18:39 EDT Re: running a shell script via cgi web interface http://www.dslreports.com/forum/remark,22480536 pablo2525 : I'm running `sh' scripts as CGI's without any issue.

I made the following modification to my `vhosts.d' `conf' file:

apache code:
        ...
          AddHandler cgi-script sh
         </Directory>

and my shell scripts have to end with `.sh' To get around having to parse input, I symlink to the actual script as follows: base name + _ + switch

The shell script itself tears $0 apart to find out the switch to use.

Cheers,

--
pablo
openSUSE 11.0;KDE
ISP: TekSavvy DSL; backhauled via a 6KM wireless link]]> http://www.dslreports.com/forum/remark,22480536 Mon, 01 Jun 2009 22:34:07 EDT Re: running a shell script via cgi web interface http://www.dslreports.com/forum/remark,22480064 anon : I believe that 'nobody' should be able to write to /tmp without issue, would you mind sharing the code here? I'm assuming it's written in Bash?

How are you handling, in the code, the HTTP POST/GET? How are you sure it's working correctly, are you able to echo it back and see it? Are you correctly reading the CGI input from stdin?]]> http://www.dslreports.com/forum/remark,22480064 Mon, 01 Jun 2009 21:16:03 EDT Re: running a shell script via cgi web interface http://www.dslreports.com/forum/remark,22479864 nwrickert : I am not aware of any problem with that. I'm pretty sure I am using some shell scripts for cgi, though I don't recall whether they write to files.

Do your web server logs provide any useful information?
--
AT&T dsl; Westell 327w modem/router; openSuSE 11.0; firefox 3.0.10]]> http://www.dslreports.com/forum/remark,22479864 Mon, 01 Jun 2009 20:33:20 EDT Re: running a shell script via cgi web interface http://www.dslreports.com/forum/remark,22479785 Dennis : well i was doing the output to the /tmp/ directory which is not the CWD...but I do think that the file ownership is "nobody". If that's the case and "nobody" can never create a file even with a shell script then am I pretty much SOL?
--
My Blog. Because I desperately need the acknowledgement of others.

Visit the Judd Family website to see my kids!]]> http://www.dslreports.com/forum/remark,22479785 Mon, 01 Jun 2009 20:18:12 EDT Re: running a shell script via cgi web interface http://www.dslreports.com/forum/remark,22479727 anon : Could it be that the CWD is not what you expect it to be, essentially, the CGI code should be running under the Apache users (often it's either http or nobody) and Apache does not have permissions to write in the CWD (current working directory).]]> http://www.dslreports.com/forum/remark,22479727 Mon, 01 Jun 2009 20:09:56 EDT running a shell script via cgi web interface http://www.dslreports.com/forum/remark,22479675 Dennis : Does anyone know of any pitfalls that could be biting me in the rear in a scenario like this?

I know running a shell script via cgi is frowned upon, but the server in question is a work based one behind multiple firewalls and also requiring a login. My real problem seems to be getting it to execute a shell script where creation of a local file is required.

I'm passing a variable, let's use "router1.clli" as an example, via the cgi script and it seems to work fine. If i was at the cli I'd type "sh script.sh router1.clli" but then it gets to the part of the script like "echo router config >> /tmp/router_command.txt" it just never does it.

Is there a native security feature that apache has configured to prevent it from working? I've even tried putting a "touch router_command.txt" and a "chmod 777 router_command.txt" in the script. I'm just not sure if apache by default can create any type of file even if it's via shell script.
--
My Blog. Because I desperately need the acknowledgement of others.

Visit the Judd Family website to see my kids!]]> http://www.dslreports.com/forum/remark,22479675 Mon, 01 Jun 2009 20:02:04 EDT