You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by gs...@apache.org on 2012/09/20 13:48:31 UTC
svn commit: r1387984 - /httpd/httpd/trunk/Makefile.win
Author: gsmith
Date: Thu Sep 20 11:48:30 2012
New Revision: 1387984
URL: http://svn.apache.org/viewvc?rev=1387984&view=rev
Log:
Install the new printenv.vbs file in cgi-bin on Windows
Modified:
httpd/httpd/trunk/Makefile.win
Modified: httpd/httpd/trunk/Makefile.win
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/Makefile.win?rev=1387984&r1=1387983&r2=1387984&view=diff
==============================================================================
--- httpd/httpd/trunk/Makefile.win (original)
+++ httpd/httpd/trunk/Makefile.win Thu Sep 20 11:48:30 2012
@@ -1040,6 +1040,7 @@ BEGIN {
INSTALL_DIR="$(INSTDIR)\bin\iconv"
cd ..\..
!ENDIF
+ copy docs\cgi-examples\printenv.vbs "$(INSTDIR)\cgi-bin\printenv.vbs" <.y
copy docs\cgi-examples\printenv "$(INSTDIR)\cgi-bin\printenv.pl" <.y
-awk -f <<script.awk "docs/cgi-examples/printenv" > "$(INSTDIR)\cgi-bin\printenv.pl"
BEGIN {
Re: svn commit: r1387984 - /httpd/httpd/trunk/Makefile.win
Posted by Graham Leggett <mi...@sharp.fm>.
On 21 Sep 2012, at 1:35 PM, Jeff Trawick <tr...@gmail.com> wrote:
> A script that leaks information should not be enabled unless the
> administrator takes an action specific to that script.
>
> If the default configuration has cgi-bin disabled and the
> administrator then drops an application there and enables cgi-bin,
> they should not have to also disable printenv.
>
> Perhaps at one point printenv was helpful to show somebody how easy it
> is to write a CGI script. Those days are over for anyone that knows
> how to do a web search for "CGI <purpose>". It could be helpful to
> debug some aspects of configuration, though that is an infrequent use.
+1.
Regards,
Graham
--
Re: svn commit: r1387984 - /httpd/httpd/trunk/Makefile.win
Posted by Jeff Trawick <tr...@gmail.com>.
On Thu, Sep 20, 2012 at 8:13 PM, Gregg Smith <gl...@gknw.net> wrote:
> On 9/20/2012 4:36 PM, Guenter Knauf wrote:
>>
>> Am 20.09.2012 16:56, schrieb Guenter Knauf:
>>>
>>> Am 20.09.2012 16:16, schrieb Guenter Knauf:
>>>>
>>>> Am 20.09.2012 16:02, schrieb Jeff Trawick:
>>>>>
>>>>> We shouldn't have scripts which, out of the box, leak information
>>>>> about the system or configuration.
>>>>
>>>> ok, I change the script in a way as printenv has (make shebang
>>>> in-active);
>>>
>>> done:
>>> http://svn.apache.org/viewvc?rev=1388054&view=rev
>>
>> from trunk/Makefile.win line 1043ff:
>> copy docs\cgi-examples\printenv "$(INSTDIR)\cgi-bin\printenv.pl" <.y
>> -awk -f <<script.awk "docs/cgi-examples/printenv" >
>> "$(INSTDIR)\cgi-bin\printenv.pl"
>> BEGIN {
>> if ( "perl -e \"print $$^X;\"" | getline perlroot ) {
>> gsub( /\\/, "/", perlroot );
>> print "#!" perlroot;
>> }
>> }
>> {
>> if ( $$0 !~ /^#!/ ) {
>> print $$0;
>> }
>> }
>> <<
>>
>> so this is the place where the shebang gets fixed for printenv.pl thus
>> making it executable unless perl is not in search path ...
>> shouldnt we then remove this part and only copy it unchanged?
>
>
> These are samples, I think they should be executable. I personally do not
> like the fact that ScriptAlias is enabled by default. I think that is as
> much a concern.
>
> Regards,
> Gregg
A script that leaks information should not be enabled unless the
administrator takes an action specific to that script.
If the default configuration has cgi-bin disabled and the
administrator then drops an application there and enables cgi-bin,
they should not have to also disable printenv.
Perhaps at one point printenv was helpful to show somebody how easy it
is to write a CGI script. Those days are over for anyone that knows
how to do a web search for "CGI <purpose>". It could be helpful to
debug some aspects of configuration, though that is an infrequent use.
--
Born in Roswell... married an alien...
http://emptyhammock.com/
Re: svn commit: r1387984 - /httpd/httpd/trunk/Makefile.win
Posted by Michael Felt <ma...@gmail.com>.
ScriptAlias enabled by default... maybe, this is "yes, but"
In 2.4.X - as in my packaging I have
#LoadModule cgid_module libexec/mod_cgid.so
by default in httpd.conf.
I was getting appropriate errors when I tried to access cgi scripts.
Also, all
"AddHandler" directives (there is one) are commented out.
Unsure of what my 2.2.X package has.
On Fri, Sep 21, 2012 at 2:13 AM, Gregg Smith <gl...@gknw.net> wrote:
> On 9/20/2012 4:36 PM, Guenter Knauf wrote:
>
>> Am 20.09.2012 16:56, schrieb Guenter Knauf:
>>
>>> Am 20.09.2012 16:16, schrieb Guenter Knauf:
>>>
>>>> Am 20.09.2012 16:02, schrieb Jeff Trawick:
>>>>
>>>>> We shouldn't have scripts which, out of the box, leak information
>>>>> about the system or configuration.
>>>>>
>>>> ok, I change the script in a way as printenv has (make shebang
>>>> in-active);
>>>>
>>> done:
>>> http://svn.apache.org/viewvc?**rev=1388054&view=rev<http://svn.apache.org/viewvc?rev=1388054&view=rev>
>>>
>> from trunk/Makefile.win line 1043ff:
>> copy docs\cgi-examples\printenv "$(INSTDIR)\cgi-bin\printenv.**pl<http://printenv.pl>"
>> <.y
>> -awk -f <<script.awk "docs/cgi-examples/printenv" >
>> "$(INSTDIR)\cgi-bin\printenv.**pl <http://printenv.pl>"
>> BEGIN {
>> if ( "perl -e \"print $$^X;\"" | getline perlroot ) {
>> gsub( /\\/, "/", perlroot );
>> print "#!" perlroot;
>> }
>> }
>> {
>> if ( $$0 !~ /^#!/ ) {
>> print $$0;
>> }
>> }
>> <<
>>
>> so this is the place where the shebang gets fixed for printenv.pl thus
>> making it executable unless perl is not in search path ...
>> shouldnt we then remove this part and only copy it unchanged?
>>
>
> These are samples, I think they should be executable. I personally do not
> like the fact that ScriptAlias is enabled by default. I think that is as
> much a concern.
>
> Regards,
> Gregg
>
Re: svn commit: r1387984 - /httpd/httpd/trunk/Makefile.win
Posted by Gregg Smith <gl...@gknw.net>.
On 9/20/2012 4:36 PM, Guenter Knauf wrote:
> Am 20.09.2012 16:56, schrieb Guenter Knauf:
>> Am 20.09.2012 16:16, schrieb Guenter Knauf:
>>> Am 20.09.2012 16:02, schrieb Jeff Trawick:
>>>> We shouldn't have scripts which, out of the box, leak information
>>>> about the system or configuration.
>>> ok, I change the script in a way as printenv has (make shebang
>>> in-active);
>> done:
>> http://svn.apache.org/viewvc?rev=1388054&view=rev
> from trunk/Makefile.win line 1043ff:
> copy docs\cgi-examples\printenv "$(INSTDIR)\cgi-bin\printenv.pl" <.y
> -awk -f <<script.awk "docs/cgi-examples/printenv" >
> "$(INSTDIR)\cgi-bin\printenv.pl"
> BEGIN {
> if ( "perl -e \"print $$^X;\"" | getline perlroot ) {
> gsub( /\\/, "/", perlroot );
> print "#!" perlroot;
> }
> }
> {
> if ( $$0 !~ /^#!/ ) {
> print $$0;
> }
> }
> <<
>
> so this is the place where the shebang gets fixed for printenv.pl thus
> making it executable unless perl is not in search path ...
> shouldnt we then remove this part and only copy it unchanged?
These are samples, I think they should be executable. I personally do
not like the fact that ScriptAlias is enabled by default. I think that
is as much a concern.
Regards,
Gregg
Re: svn commit: r1387984 - /httpd/httpd/trunk/Makefile.win
Posted by Guenter Knauf <fu...@apache.org>.
Am 20.09.2012 16:56, schrieb Guenter Knauf:
> Am 20.09.2012 16:16, schrieb Guenter Knauf:
>> Am 20.09.2012 16:02, schrieb Jeff Trawick:
>>> We shouldn't have scripts which, out of the box, leak information
>>> about the system or configuration.
>> ok, I change the script in a way as printenv has (make shebang
>> in-active);
> done:
> http://svn.apache.org/viewvc?rev=1388054&view=rev
from trunk/Makefile.win line 1043ff:
copy docs\cgi-examples\printenv "$(INSTDIR)\cgi-bin\printenv.pl" <.y
-awk -f <<script.awk "docs/cgi-examples/printenv" >
"$(INSTDIR)\cgi-bin\printenv.pl"
BEGIN {
if ( "perl -e \"print $$^X;\"" | getline perlroot ) {
gsub( /\\/, "/", perlroot );
print "#!" perlroot;
}
}
{
if ( $$0 !~ /^#!/ ) {
print $$0;
}
}
<<
so this is the place where the shebang gets fixed for printenv.pl thus
making it executable unless perl is not in search path ...
shouldnt we then remove this part and only copy it unchanged?
Gün.
Re: svn commit: r1387984 - /httpd/httpd/trunk/Makefile.win
Posted by Guenter Knauf <fu...@apache.org>.
Am 20.09.2012 16:16, schrieb Guenter Knauf:
> Am 20.09.2012 16:02, schrieb Jeff Trawick:
>> We shouldn't have scripts which, out of the box, leak information
>> about the system or configuration.
> ok, I change the script in a way as printenv has (make shebang
> in-active);
done:
http://svn.apache.org/viewvc?rev=1388054&view=rev
Gün.
Re: svn commit: r1387984 - /httpd/httpd/trunk/Makefile.win
Posted by Guenter Knauf <fu...@apache.org>.
Am 20.09.2012 16:02, schrieb Jeff Trawick:
> printenv and test-cgi are not executable in Unix installs.
oh; I thought usual distros had these executable, but I admit I didnt
check into recent Linux versions ...
> We shouldn't have scripts which, out of the box, leak information
> about the system or configuration.
ok, I change the script in a way as printenv has (make shebang
in-active); but then we should probably also ommit the shebang fix which
is done for printenv.pl; even if #!C:/usr/bin/perl.exe is not the
default installation for Activeperl, there might be other perl
installations using this place, and making the script then executable by
default ...
Gün.
Re: svn commit: r1387984 - /httpd/httpd/trunk/Makefile.win
Posted by Jeff Trawick <tr...@gmail.com>.
On Thu, Sep 20, 2012 at 9:59 AM, Guenter Knauf <fu...@apache.org> wrote:
> Hi Jeff,
> Am 20.09.2012 15:52, schrieb Jeff Trawick:
>
>> On Thu, Sep 20, 2012 at 7:48 AM,<gs...@apache.org> wrote:
>>>
>>> Author: gsmith
>>> Date: Thu Sep 20 11:48:30 2012
>>> New Revision: 1387984
>>>
>>> URL: http://svn.apache.org/viewvc?rev=1387984&view=rev
>>> Log:
>>> Install the new printenv.vbs file in cgi-bin on Windows
>>
>>
>> Is this non-executable (and I don't mean the Unix permission bits) by
>> default?
>
> it is executable by default - just same as printenv[.pl] is executable by
> default (on Windows as well as it is on Linux); so is this a problem? The
> output is exactly same as what printenv.pl gives ...
printenv and test-cgi are not executable in Unix installs.
We shouldn't have scripts which, out of the box, leak information
about the system or configuration.
>
> Gün.
>
>
>
--
Born in Roswell... married an alien...
http://emptyhammock.com/
Re: svn commit: r1387984 - /httpd/httpd/trunk/Makefile.win
Posted by Guenter Knauf <fu...@apache.org>.
Hi Jeff,
Am 20.09.2012 15:52, schrieb Jeff Trawick:
> On Thu, Sep 20, 2012 at 7:48 AM,<gs...@apache.org> wrote:
>> Author: gsmith
>> Date: Thu Sep 20 11:48:30 2012
>> New Revision: 1387984
>>
>> URL: http://svn.apache.org/viewvc?rev=1387984&view=rev
>> Log:
>> Install the new printenv.vbs file in cgi-bin on Windows
>
> Is this non-executable (and I don't mean the Unix permission bits) by default?
it is executable by default - just same as printenv[.pl] is executable
by default (on Windows as well as it is on Linux); so is this a problem?
The output is exactly same as what printenv.pl gives ...
Gün.
Re: svn commit: r1387984 - /httpd/httpd/trunk/Makefile.win
Posted by Jeff Trawick <tr...@gmail.com>.
On Thu, Sep 20, 2012 at 7:48 AM, <gs...@apache.org> wrote:
> Author: gsmith
> Date: Thu Sep 20 11:48:30 2012
> New Revision: 1387984
>
> URL: http://svn.apache.org/viewvc?rev=1387984&view=rev
> Log:
> Install the new printenv.vbs file in cgi-bin on Windows
Is this non-executable (and I don't mean the Unix permission bits) by default?
>
> Modified:
> httpd/httpd/trunk/Makefile.win
>
> Modified: httpd/httpd/trunk/Makefile.win
> URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/Makefile.win?rev=1387984&r1=1387983&r2=1387984&view=diff
> ==============================================================================
> --- httpd/httpd/trunk/Makefile.win (original)
> +++ httpd/httpd/trunk/Makefile.win Thu Sep 20 11:48:30 2012
> @@ -1040,6 +1040,7 @@ BEGIN {
> INSTALL_DIR="$(INSTDIR)\bin\iconv"
> cd ..\..
> !ENDIF
> + copy docs\cgi-examples\printenv.vbs "$(INSTDIR)\cgi-bin\printenv.vbs" <.y
> copy docs\cgi-examples\printenv "$(INSTDIR)\cgi-bin\printenv.pl" <.y
> -awk -f <<script.awk "docs/cgi-examples/printenv" > "$(INSTDIR)\cgi-bin\printenv.pl"
> BEGIN {
>
>
--
Born in Roswell... married an alien...
http://emptyhammock.com/