DBIx::Recordset/Embperl security question

2003-01-14 Thread Kee Hinckley
One of the great features of of the Embperl/DBIx::Recordset combination is the ability to pass %fdat directly to a database update or insert call. Recordset takes the parameters that exist in the record and ignores the rest. You can easily update your database and your web forms without havin

Re: Feedback (was: Security question)

2000-11-27 Thread Gerald Richter
> p.s. I don't want to bog down people's emailboxes with "useless" > messages like this. And yet, I feel compelled to thank people when they > have taken the time and trouble to help. Etiquette - do I reply to the > list to make the thanks "public", or just to the person concerned? > Thoughts? TIA

Re: Security question

2000-11-27 Thread Neil Gunton
Gerald Richter wrote: > I think including/"executing" plain html files, without interpreting them, > in the way you describe it, is really usefull and I already have planed to > implement it, but not in 1.3. It's on my roadmap for 2.0b2. Embperl 2.0 will > be much more flexible, by the possibility

Re: Security question

2000-11-27 Thread Gerald Richter
> > As I said before, I can see EmbperlObject being useful in a dual sense - > both as an interpreter of embedded Perl code, and as a "construction > engine" for OO websites through the EMBPERL_OBJECT_BASE functionality. > > JMHO, I'd be interested to see what Gerald thinks of all this (more > wor

Re: Security question

2000-11-26 Thread Neil Gunton
Angus Lees wrote: > > On Sun, Nov 26, 2000 at 03:31:52PM -0500, Neil Gunton wrote: > > > > Perhaps a directive which allows certain file extensions to be processed > > by EmbperlObject::Execute(*), but not parsed and interpreted internally. > > > > option 1: > > use the "Safe" module and allow

Re: Security question

2000-11-26 Thread Angus Lees
On Sun, Nov 26, 2000 at 03:31:52PM -0500, Neil Gunton wrote: > > Perhaps a directive which allows certain file extensions to be processed > by EmbperlObject::Execute(*), but not parsed and interpreted internally. > option 1: use the "Safe" module and allow user's web pages to include code, but

Re: Security question

2000-11-26 Thread Neil Gunton
> Perhaps a directive which allows certain file extensions to be processed > by EmbperlObject::Execute(*), but not parsed and interpreted internally. Further to my earlier email, it occurs to me that I am being too restrictive here. In fact, ANY file which is included by base.html (or whatever EM

Re: Security question

2000-11-26 Thread Neil Gunton
[EMAIL PROTECTED] wrote: > > why don't you place your embedded perl that you need in a directory where > the users on your website can not write and alias those scripts to appear > as if they were in the webtree .. eg inside your apache conf somewhere you > would have .. > > AliasMatch ^/(.*\.e

Re: Security question

2000-11-25 Thread Michael.Dean
why don't you place your embedded perl that you need in a directory where the users on your website can not write and alias those scripts to appear as if they were in the webtree .. eg inside your apache conf somewhere you would have .. AliasMatch ^/(.*\.epl) "/web/embperl/$1" SetHandler

Security question

2000-11-25 Thread Neil Gunton
I am going to be allowing users on my website to upload and edit their own HTML files. I want the location of these files to be in the directory tree which is handled by Embperl (because I want EmbperlObject to be doing some work). Obviously it would be undesirable to let arbitrary Perl code be