/* Licensed to the Apache Software Foundation (ASF) under one or more * contributor license agreements. See the NOTICE file distributed with * this work for additional information regarding copyright ownership. * The ASF licenses this file to You under the Apache License, Version 2.0 * (the "License"); you may not use this file except in compliance with * the License. You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License.
*/
/* * http_script: keeps all script-related ramblings together. * * Compliant to CGI/1.1 spec * * Adapted by rst from original NCSA code by Rob McCool * * This modules uses a httpd core function (ap_add_common_vars) to add some new env vars, * like REDIRECT_URL and REDIRECT_QUERY_STRING for custom error responses and DOCUMENT_ROOT. * It also adds SERVER_ADMIN - useful for scripts to know who to mail when they fail. *
*/
/* Read and discard the data in the brigade produced by a CGI script */ staticvoid discard_script_output(apr_bucket_brigade *bb);
/* KLUDGE --- for back-combatibility, we don't have to check ExecCGI * in ScriptAliased directories, which means we need to know if this * request came through ScriptAlias or not... so the Alias module * leaves a note for us.
*/
if (ap_timeout_parameter_parse(arg, &dc->timeout, "s") != APR_SUCCESS) { return"CGIScriptTimeout has wrong format";
}
return NULL;
}
staticconst command_rec cgi_cmds[] =
{
AP_INIT_TAKE1("ScriptLog", set_scriptlog, NULL, RSRC_CONF, "the name of a log for script debugging info"),
AP_INIT_TAKE1("ScriptLogLength", set_scriptlog_length, NULL, RSRC_CONF, "the maximum length (in bytes) of the script debug log"),
AP_INIT_TAKE1("ScriptLogBuffer", set_scriptlog_buffer, NULL, RSRC_CONF, "the maximum size (in bytes) to record of a POST request"),
AP_INIT_TAKE1("CGIScriptTimeout", set_script_timeout, NULL, RSRC_CONF | ACCESS_CONF, "The amount of time to wait between successful reads from " "the CGI script, in seconds."),
{NULL}
};
/* This is the special environment used for running the "exec cmd=" * variety of SSI directives.
*/ staticvoid add_ssi_vars(request_rec *r)
{
apr_table_t *e = r->subprocess_env;
if (r->path_info && r->path_info[0] != '\0') {
request_rec *pa_req;
apr_file_open_stderr(&stderr_log, pool); /* Escape the logged string because it may be something that * came in over the network.
*/
apr_file_printf(stderr_log, "(%d)%pm: %s\n",
err,
&err, #ifndef AP_UNSAFE_ERROR_LOG_UNESCAPED
ap_escape_logitem(pool, #endif
description #ifndef AP_UNSAFE_ERROR_LOG_UNESCAPED
) #endif
);
}
if (e_info->process_cgi) {
*cmd = r->filename; /* Do not process r->args if they contain an '=' assignment
*/ if (r->args && r->args[0] && !ap_strchr_c(r->args, '=')) {
args = r->args;
}
}
if (!args) {
numwords = 1;
} else { /* count the number of keywords */ for (x = 0, numwords = 2; args[x]; x++) { if (args[x] == '+') {
++numwords;
}
}
} /* Everything is - 1 to account for the first parameter * which is the program name.
*/ if (numwords > APACHE_ARG_MAX - 1) {
numwords = APACHE_ARG_MAX - 1; /* Truncate args to prevent overrun */
}
*argv = apr_palloc(p, (numwords + 2) * sizeof(char *));
(*argv)[0] = *cmd; for (x = 1, idx = 1; x < numwords; x++) {
w = ap_getword_nulls(p, &args, '+');
ap_unescape_url(w);
(*argv)[idx++] = ap_escape_shell_cmd(p, w);
}
(*argv)[idx] = NULL;
if (!(ap_allow_options(r) & OPT_EXECCGI) && !is_scriptaliased(r)) return log_scripterror(r, conf, HTTP_FORBIDDEN, 0, APLOGNO(02809), "Options ExecCGI is off in this directory"); if (nph && is_included) return log_scripterror(r, conf, HTTP_FORBIDDEN, 0, APLOGNO(02810), "attempt to include NPH CGI script");
if (r->finfo.filetype == APR_NOFILE) return log_scripterror(r, conf, HTTP_NOT_FOUND, 0, APLOGNO(02811), "script not found or unable to stat"); if (r->finfo.filetype == APR_DIR) return log_scripterror(r, conf, HTTP_FORBIDDEN, 0, APLOGNO(02812), "attempt to invoke directory as script");
if ((r->used_path_info == AP_REQ_REJECT_PATH_INFO) &&
r->path_info && *r->path_info)
{ /* default to accept */ return log_scripterror(r, conf, HTTP_NOT_FOUND, 0, APLOGNO(02813), "AcceptPathInfo off disallows user's path");
} /* if (!ap_suexec_enabled) { if (!ap_can_exec(&r->finfo)) return log_scripterror(r, conf, HTTP_FORBIDDEN, 0, APLOGNO(03194) "file permissions deny server execution"); }
/*============================================================================ *============================================================================ * This is the beginning of the cgi filter code moved from mod_include. This * is the code required to handle the "exec" SSI directive. *============================================================================
*============================================================================*/ static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f,
apr_bucket_brigade *bb, char *s)
{
request_rec *r = f->r;
request_rec *rr = ap_sub_req_lookup_uri(s, r, f->next); int rr_status;
if (rr->status != HTTP_OK) {
ap_destroy_sub_req(rr); return APR_EGENERAL;
}
/* No hardwired path info or query allowed */ if ((rr->path_info && rr->path_info[0]) || rr->args) {
ap_destroy_sub_req(rr); return APR_EGENERAL;
} if (rr->finfo.filetype != APR_REG) {
ap_destroy_sub_req(rr); return APR_EGENERAL;
}
/* Script gets parameters of the *document*, for back compatibility */
rr->path_info = r->path_info; /* hard to get right; see mod_cgi.c */
rr->args = r->args;
/* Force sub_req to be treated as a CGI request, even if ordinary * typing rules would have called it something else.
*/
ap_set_content_type_ex(rr, CGI_MAGIC_TYPE, 1);
/* Run it. */
rr_status = ap_run_sub_req(rr); if (ap_is_HTTP_REDIRECT(rr_status)) { constchar *location = apr_table_get(rr->headers_out, "Location");
/* We can't close the pipe here, because we may return before the * full CGI has been sent to the network. That's okay though, * because we can rely on the pool to close the pipe for us.
*/ return APR_SUCCESS;
}
staticint cgi_post_config(apr_pool_t *p, apr_pool_t *plog,
apr_pool_t *ptemp, server_rec *s)
{ /* This is the means by which unusual (non-unix) os's may find alternate * means to run a given command (e.g. shebang/registry parsing on Win32)
*/
cgi_build_command = APR_RETRIEVE_OPTIONAL_FN(ap_cgi_build_command); if (!cgi_build_command) {
cgi_build_command = default_build_command;
} return OK;
}
Die Informationen auf dieser Webseite wurden
nach bestem Wissen sorgfältig zusammengestellt. Es wird jedoch weder Vollständigkeit, noch Richtigkeit,
noch Qualität der bereit gestellten Informationen zugesichert.
Bemerkung:
Die farbliche Syntaxdarstellung ist noch experimentell.