Top Document: FAQ: Frequently Asked Questions about CGI Programming Previous Document: 3.19 How can I avoid users hitting "submit" twice? Next Document: 3.21 How can I prevent my CGI results being cached by the browser? See reader questions & answers on this topic! - Help others by sharing your knowledge CGI scripts are run by the HTTPD, and therefore by the UID of the HTTPD process, which is (by convention) usually a special user "nobody". There are two basic ways to run a script under your own userid: (1) The direct approach: use a setuid program. (2) The double-server approach: have your CGI script communicate with a second process (e.g. a daemon) running under your userid, which is responsible for the actual file management. The direct approach is usually faster, but the client-server architecture may help with other problems, such as maintaining integrity of a database. When running a compiled CGI program (e.g. C, C++), you can make it setuid by simply setting the setuid bit: e.g. "chmod 4755 myprog.cgi" For security reasons, this is not possible with scripting languages (eg Perl, Tcl, shell). A workaround is to run them from a setuid program, such as cgiwrap. In most cases where you'd want to use the client-server approach, the server is a finished product (such as an SQL server) with its own CGI interface. A lightweight alternative to this is Don Libes' "expect" package. Note that any program running under your userid has access to all your files, and could do serious damage if hacked. Take care! User Contributions:Top Document: FAQ: Frequently Asked Questions about CGI Programming Previous Document: 3.19 How can I avoid users hitting "submit" twice? Next Document: 3.21 How can I prevent my CGI results being cached by the browser? Single Page [ Usenet FAQs | Web FAQs | Documents | RFC Index ] Send corrections/additions to the FAQ Maintainer: Nick Kew <nick@webthing.com>
Last Update March 27 2014 @ 02:12 PM
|
Comment about this article, ask questions, or add new information about this topic: