tag 367711 patch
forwarded 367711 http://rt.cpan.org/Public/Bug/Display.html?id=62762
reassign 367711 libcgi-pm-perl 3.49-1
thanks
On Wed, May 17, 2006 at 09:57:37PM +0200, Peter Gervai wrote:
> Package: perl-modules
> Version: 5.8.8-4
> Severity: normal
Thanks for the report and sorry about the lack of action on this bug.
> CGI.pm uses a temp dir for uploads. It does not make it possible to force it
> (apart from changing the source), or set it explicitely, but uses a heuristics
> to walk several hardwired dirs and use the first which is writable.
>
> This actually breaks programs which preload CGI when apache2 starts (runs at
> uid 0 because
> there is no user [suexec] at that time, so everything is writable), and later
> find
> out that suexec'ed uid cannot write the dir, an CGI.pm fails with a cryptic
> error msg.
>
> Heuristics is a good thing, but there should be a way to override it without
> changing the source, like other options allow.
As far as I can see, $ENV{TMPDIR} was and still is documented to override
the hardwired dirs (except ~/tmp, which isn't really used and seems to
be a documentation bug.)
There's also code that checks for writability at run time and tries to
recalculate the temp dir if necessary. Unfortunately that seems to have
been broken since 3.12 (Perl 5.8.8 had 3.15), which added undocumented
support for setting $CGITempFile::TMPDIRECTORY before loading the module.
I agree the error message could be better.
I've reported this upstream with the attached suggested patch, see
http://rt.cpan.org/Public/Bug/Display.html?id=62762
I'm reassigning this against the separate libcgi-pm-perl package, which
contains a newer version of CGI.pm as the one shipped with Perl. This
way you'll get notified as soon as the fix gets in Debian. Unfortunately
I doubt this will happen for the next release (Squeeze), as we are
very close to a release now and these kind of changes aren't allowed
in anymore.
(@pkg-perl: I suggest avoiding non-upstreamed fixes with dual lived
modules even more than usual, as there's the danger of the core version
and the separate package getting out of sync.)
--
Niko Tyni [email protected]
>From a13487721a3a6eec8ad43d9ee5da4854db2a184b Mon Sep 17 00:00:00 2001
From: Niko Tyni <[email protected]>
Date: Fri, 5 Nov 2010 21:40:13 +0200
Subject: [PATCH] TMPDIRECTORY fixes and tests
The code for choosing the temporary directory for uploaded files has
several glitches:
- support for user temporary directories ($HOME/tmp) was commented out
in 2.61 but the documentation wasn't updated
- setting $CGITempFile::TMPDIRECTORY before loading CGI.pm has been
working but undocumented since 3.12 (which listed it in Changes as
$CGI::TMPDIRECTORY)
- unfortunately the previous change broke the runtime check for looking
for a new temporary directory if the current one suddenly became
unwritable (as commonly happens with mod_perl and the like)
- when creating a temporary file in the directory fails, the error message
could indicate the root of the problem better
Originally reported by Peter Gervai in <http://bugs.debian.org/367711>.
---
lib/CGI.pm | 10 ++++++----
t/tmpfile.t | 35 +++++++++++++++++++++++++++++++++++
2 files changed, 41 insertions(+), 4 deletions(-)
create mode 100644 t/tmpfile.t
diff --git a/lib/CGI.pm b/lib/CGI.pm
index 355b8d1..a05b9f6 100644
--- a/lib/CGI.pm
+++ b/lib/CGI.pm
@@ -3622,7 +3622,7 @@ sub read_multipart {
last if defined($filehandle = Fh->new($filename,$tmp,$PRIVATE_TEMPFILES));
$seqno += int rand(100);
}
- die "CGI open of tmpfile: $!\n" unless defined $filehandle;
+ die "CGI.pm open of tmpfile $tmp/$filename failed: $!\n" unless defined $filehandle;
$CGI::DefaultClass->binmode($filehandle) if $CGI::needs_binmode
&& defined fileno($filehandle);
@@ -4257,7 +4257,10 @@ $AUTOLOADED_ROUTINES=<<'END_OF_AUTOLOAD';
sub new {
my($package,$sequence) = @_;
my $filename;
- find_tempdir() unless -w $TMPDIRECTORY;
+ unless (-w $TMPDIRECTORY) {
+ $TMPDIRECTORY = undef;
+ find_tempdir();
+ }
for (my $i = 0; $i < $MAXTRIES; $i++) {
last if ! -f ($filename = sprintf("\%s${SL}CGItemp%d", $TMPDIRECTORY, $sequence++));
}
@@ -5114,8 +5117,7 @@ file is created with mode 0600 (neither world nor group readable).
The temporary directory is selected using the following algorithm:
- 1. if the current user (e.g. "nobody") has a directory named
- "tmp" in its home directory, use that (Unix systems only).
+ 1. if $CGITempFile::TMPDIRECTORY is already set, use that
2. if the environment variable TMPDIR exists, use the location
indicated.
diff --git a/t/tmpfile.t b/t/tmpfile.t
new file mode 100644
index 0000000..c9d2041
--- /dev/null
+++ b/t/tmpfile.t
@@ -0,0 +1,35 @@
+#!perl
+use Test::More tests => 5;
+use strict;
+
+my ($testdir, $testdir2);
+
+BEGIN {
+ $testdir = "CGItest";
+ $testdir2 = "CGItest2";
+ for ($testdir, $testdir2) {
+ ( -d ) || mkdir;
+ ( ! -w ) || chmod 0700, $_;
+ }
+ $CGITempFile::TMPDIRECTORY = $testdir;
+ $ENV{TMPDIR} = $testdir2;
+}
+
+use CGI;
+is($CGITempFile::TMPDIRECTORY, $testdir, "can pre-set \$CGITempFile::TMPDIRECTORY");
+CGITempFile->new;
+is($CGITempFile::TMPDIRECTORY, $testdir, "\$CGITempFile::TMPDIRECTORY unchanged");
+
+chmod 0500, $testdir;
+CGITempFile->new;
+is($CGITempFile::TMPDIRECTORY, $testdir2,
+ "unwritable \$CGITempFile::TMPDIRECTORY overridden");
+
+chmod 0500, $testdir2;
+CGITempFile->new;
+isnt($CGITempFile::TMPDIRECTORY, $testdir2,
+ "unwritable \$ENV{TMPDIR} overridden");
+isnt($CGITempFile::TMPDIRECTORY, $testdir,
+ "unwritable \$ENV{TMPDIR} not overridden with an unwritable \$CGITempFile::TMPDIRECTORY");
+
+END { rmdir for ($testdir, $testdir2) }
--
1.7.2.3
