The following reply was made to PR mod_cgi/609; it has been noted by GNATS.
From: David TILLOY <[EMAIL PROTECTED]>
To: Marc Slemko <[EMAIL PROTECTED]>
Subject: Re: mod_cgi/609: User Authentification in CGI environment
Date: Fri, 23 May 1997 09:15:52 +0200 (MET DST)
Ok... Sorry for my english, but i'm going to try to be more sharp
in this mail...
I have'nt Limit GET in my config file, to reply to your first
message.
I have just an html document (toto.html) wich the access is
protected by a '.htaccess' and '.htpasswd' file. This page call a cgi, and
the access to the CGI is protected too. The html document send arguments
with POST method. In theory, the Web Server must set a variable
REMOTE_USER that contain the name of user (after .htaccess
authentification), so I haven't this variable...
But when i call directly the CGI, without arguments, and without
the HTML page, the REMOTE_USER variable is correctly set...
So, I think the POST method not allow the CGI to set this
variable (REMOTE_USER).
You can try on my site... I have a page to test who call a cgi...
http://lab.neuronnexion.fr/sec-lab/w3user/
The login is "dav", and the passwd is "dav" too.
This is the source of my cgi :
;---cut---
#!/usr/bin/perl
$ru=$ENV{"REMOTE_USER"};
$ra=$ENV{"REMOTE_ADDR"};
print "Content Type: Text/Html\n\n";
print "Remote User : ",$ru ;
print "\nRemote Address : ",$ra,"\n"
;---end---
P.S : If you don't understand what I want to do, shall I write in French
to you ?
Thanks, dav.
David TILLOY - Neuronnexion - Specialistes Reseaux
12, rue Amiral Courbet - 80000 Amiens - FRANCE
Voice (+33 3).22.71.61.90 - Fax (+33 3).22.72.05.93
mailto:[EMAIL PROTECTED]
On Thu, 22 May 1997, Marc Slemko wrote:
:On Thu, 22 May 1997, David TILLOY wrote:
:
:> I have an HTML document in a directory (/lab/toto.html) who call a cgi in
:> /cgi-bin/lab/my-cgi. To access to the toto.html file, I have a .htaccess
and
:> .htpasswd file. You enter your name & passwd, but I have too a .htaccess in
cgi,
:> and this second .htaccess acceed to passwd in the same .htpasswd than
toto.html.
:> The problem is this : After the call of cgi (in POST method), I haven't the
:> REMOTE_USER define, but if I launch the CGI alone, without the toto.html
file,
:> the REMOTE_USER var is correctly set. I don't understand why...
:
:I am not exactly clear on what you are doing. The minimal possible config
:which exhibits the problem would help.
:
:Be sure you aren't using a "Limit GET" when you restrict access to the
:CGI. That will only restrict GETs, not POSTs.
:
