head	1.3;
access;
symbols
	dlr:1.1.1;
locks; strict;
comment	@# @;


1.3
date	2000.07.13.08.08.57;	author ed;	state dead;
branches;
next	1.2;

1.2
date	2000.06.01.00.57.32;	author ed;	state Exp;
branches;
next	1.1;

1.1
date	2000.05.31.23.34.35;	author ed;	state Exp;
branches
	1.1.1.1;
next	;

1.1.1.1
date	2001.02.21.00.35.48;	author dlr;	state Exp;
branches;
next	;


desc
@@


1.3
log
@maillist.cgi needs __SANDBOX__ to be cooked in.
@
text
@#!/usr/bin/perl
# (c) 2000 Collab, Inc.

# CGI that allows list scripts to be executed via apache, rather
# than having java do an exec, which causes performance problems.

use CGI;

my $sandbox = '/usr/tigris';

my $cgi = new CGI;
my $script = $cgi->param('script');
my $params = $cgi->param('params');
my $mailhost = $cgi->param('mailhost');
my $mailuser = $cgi->param('mailuser');

my $scriptdir = "$sandbox/helm/perl/scripts";

# Send back the header.
print $cgi->header("text/plain");

if ($script !~ m/^list\-/) {
	print "not allowed: $script\n";
	exit(1);
};

# do some *simple* validation of the input
if ($params =~ m/[;`\|]/) {
    print "invalid character(s) in input\n";
    exit();
}

# split the params ourselves so we don't pass potentially unclean
# data to the shell.
$params =~ s/^\s+//;
my @@command = split /\s+/, $params;
if ($mailhost && $mailuser) {
    unshift @@command, 'ssh', '-l', $mailuser, $mailhost, $script;
} else {
    unshift @@command, "$sandbox/helm/perl/scripts/$script";
}

open (IN, "-|") || exec @@command;
while (<IN>) {
    $result .= $_;
}
print "$result";

@


1.2
log
@avoid shell expansion of the arguments provided.
@
text
@@


1.1
log
@this script is used by the new servlet which manages subscriptions
to ezmlm lists.
@
text
@d33 4
a36 2
# allow the script to be run either remotely or locally
my $command;
d38 1
a38 1
    $command = "ssh -l $mailuser $mailhost $script $params";
d40 1
a40 1
    $command = "$sandbox/helm/perl/scripts/$script $params";
d43 4
a46 1
$result = `$command`;
@


1.1.1.1
log
@Replacing the HEAD with the HELM_PEER_PORT_BRANCH.
@
text
@d9 1
a9 1
my $sandbox = '/home/dlr/sandbox';
d33 2
a34 8
# handle ~tigrisq -- since we don't do a shell call (security reasons)
# we need to substitute ~tigrisq ourselves.  bleah.
$params =~ s@@\~tigrisq@@/home/dlr/sandbox/data/helm/qmail@@;

# split the params ourselves so we don't pass potentially unclean
# data to the shell.
$params =~ s/^\s+//;
my @@command = split /\s+/, $params;
d36 1
a36 1
    unshift @@command, 'ssh', '-l', $mailuser, $mailhost, $script;
d38 1
a38 1
    unshift @@command, "$scriptdir/$script";
d41 1
a41 4
open (IN, "-|") || exec @@command;
while (<IN>) {
    $result .= $_;
}
@


