You are viewing a plain text version of this content. The canonical link for it is here.
Posted to embperl@perl.apache.org by martin langhoff <ma...@scim.net> on 2000/11/13 15:08:23 UTC
Should <$fdat{file}> work?
hi,
I'm using mod_perl 1.24 and Embperl 1.2.1 and I'd like to know if
using construct like
{
local $/ = undef;
$filecontents = <$fdat{file}>;
}
is supported/supposed to work. Reading the man pages, it seems that the
'official' way is to take the "binary clean" path and use read(). But
I'm lazy, and old vices are hard to give up. I'm used to the <> readline
shortcut for text files, and I'd still like to use it.
martin
Re: Should <$fdat{file}> work?
Posted by Gerald Richter <ri...@ecos.de>.
hi,
>
> I'm using mod_perl 1.24 and Embperl 1.2.1 and I'd like to know if
> using construct like
>
> {
> local $/ = undef;
> $filecontents = <$fdat{file}>;
> }
>
> is supported/supposed to work. Reading the man pages, it seems that the
> 'official' way is to take the "binary clean" path and use read(). But
> I'm lazy, and old vices are hard to give up. I'm used to the <> readline
> shortcut for text files, and I'd still like to use it.
>
I didn't have tested it, but it should work. (You have to set optRawInput,
as always when you use the <> operator, or write < > instead).
The reason why the docs use the read function is, that you may run into
memory problems when you often upload big files, because everything is
loaded into memory, while the example in the docs, only read 32K at a time.
Gerald
-------------------------------------------------------------
Gerald Richter ecos electronic communication services gmbh
Internetconnect * Webserver/-design/-datenbanken * Consulting
Post: Tulpenstrasse 5 D-55276 Dienheim b. Mainz
E-Mail: richter@ecos.de Voice: +49 6133 925151
WWW: http://www.ecos.de Fax: +49 6133 925152
-------------------------------------------------------------
Re: Should <$fdat{file}> work?
Posted by Kee Hinckley <na...@somewhere.com>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
At 1:51 PM -0300 11/13/00, martin langhoff wrote:
> Why would you want to validate the filename of the file you are getting
>via upload? Or am I missing something?
Sorry, I missed that it was an upload parameter. I thought you were
getting the name of a file on the machine.
- --
Kee Hinckley - Somewhere.Com, LLC - Cyberspace Architects
Now Playing - Folk, Rock, and odd stuff - http://www.somewhere.com/radio.pls
I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 6.5.2 for non-commercial use <http://www.pgp.com>
iQA/AwUBOhCLACZsPfdw+r2CEQKZPQCeL54xpe8mhrYK4dEaMOSiXQI9EiIAoIi5
sYUPu3vAmjvqrLmdnEX0hlvX
=XzLB
-----END PGP SIGNATURE-----
Re: Should <$fdat{file}> work?
Posted by martin langhoff <ma...@scim.net>.
Kee Hinckley wrote:
> So long as you don't mind someone doing http://xxx/foo.epl?file=/etc/passwd
> I'd do a little checking on the contents of $fdat{file} first.
Kee,
using CGI.pm's magic to treat a reference as a filehandle is regarded
as a safe practice, and is part of what I understand the Perl community
does everyday. It's even recommended if you read `man CGI` and also in
my Perl Cookbook.
The trick is that the reference is 'magic' in the sense that if you
read it as a scalar, you get a string that reflects the filename of the
file on the clients hard drive. If you treat is as a filehandle,
read()ing it, for instance, it'll behave as an *already open*
filehandle. As you can read in my post, I was never issuing an open on
the *string*. As a matter of fact, it wouldn't work!
Why would you want to validate the filename of the file you are getting
via upload? Or am I missing something?
martin
Re: Should <$fdat{file}> work?
Posted by Kee Hinckley <na...@somewhere.com>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
At 11:08 AM -0300 11/13/00, martin langhoff wrote:
>hi,
>
> I'm using mod_perl 1.24 and Embperl 1.2.1 and I'd like to know if
>using construct like
>
>{
> local $/ = undef;
> $filecontents = <$fdat{file}>;
>}
So long as you don't mind someone doing http://xxx/foo.epl?file=/etc/passwd
I'd do a little checking on the contents of $fdat{file} first.
- --
Kee Hinckley - Somewhere.Com, LLC - Cyberspace Architects
Now Playing - Folk, Rock, and odd stuff - http://www.somewhere.com/radio.pls
I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 6.5.2 for non-commercial use <http://www.pgp.com>
iQA/AwUBOhAT6iZsPfdw+r2CEQKReACfYLwk3yZ6D/r3Q/go/Ro6J6/F7HIAoPZo
srdBmp6rm/QaC8BxwBuEMe0N
=TrLe
-----END PGP SIGNATURE-----