TCL as CGI.. or PHP and no CGI? The choice is yours

Phil Powell wrote:
> I am having to use CGI script to view files in a particular directory
> (directory has permissions of 755 and has the same ownership as everywhere
> else). I am able to upload the file using PHP, however, I am unable to view
> or list the files because of permission errors.
> [cut]

That's actually a bit of a tough one. This is a very common permission
problem, since your scripts run as www, and not as phil. If you really
want to store the files as phil (which I'm not sure is a good idea), you
can:

1/ run your Tcl CGI scripts via suid tcl interpreter; for example get a
tclkit, make it chmod 6755 - but then, you'll have a security problem,
since anyone clever enough will be able to run your tclkit with his/her
script (and therefore work as phil) - not a good option, IMHO

2/ use a suid starpack, better than 1/, since the script will be
embedded in the interpreter, so noone will run it except you.

3/ write a simple Tcl app that does Tcl_CreateInterp(), Tcl_Init(),
Tcl_FindExecutable() and Tcl_EvalFile(); make it suid

4/ run tclhttpd (on another port) as phil and have tclhttpd serve as
your webserver - I'm not sure if it handles uploads though. Try googling
on that.

5/ ask your system administrator to run PHP scripts as their owner -
this is possible, AFAIR, however I do not use PHP, so cannot help here



--
WK

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Wojciech Kocjan whispered unto us in comp.lang.php:

[...]

> 5/ ask your system administrator to run PHP scripts as their owner -
> this is possible, AFAIR, however I do not use PHP, so cannot help here

Fortunately, yes, this is possible... just put PHP into 'safe mode' and
it will run as user who owns the files. Sorry, I don't know for Tcl
CGI, suexec will probably do that, but there are years since my using
it, so my memory may be a bit rusty...


- Vid `RTFM` Strpic.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)

iD8DBQE/QK0oq1AzG0/iPGMRAiKCAJ9sfEYbgWa9ssvdz0q26y5b8g6kAACglAEo
R49ic4vCRWQnoTJxOPy5PgA=
=cagC
-----END PGP SIGNATURE-----

--
vms@bofhlet.net, IRC:*@Martin, /bin/zsh. C|N>K
Linux moria 2.4.21 #1 Sat Jul 5 16:11:20 CEST 2003 i686
12:38:58 up 28 days, 21:23, 5 users, load average: 0.07, 0.04, 0.14