man, ls, and cat are in the path given to CGI programs by your HTTP server.
man. Tools->Object Editor).
File->New to create a new object.
EXEC from the Object Type combo box.
man in the Selection text field. Click Ok.
man in the Executable Name text field. This is the command that you want the CGI to execute and process.
#name,type,remove_previous#
WRAP or NO_WRAP. WRAP tells the Data Object to wrap the argument value with quotes and NO_WRAP tells it not to wrap the value with quotes.
True means to remove the prefix of this argument if the value returned for the argument is NULL or empty. False means do not remove the prefix.
man. That argument will be named title, and you do not want to wrap quotes around the argument. An argument not wrapped with quotes will be interpreted by the shell before the command is executed. This allows the user to use wild cards for filenames and other shell expansions. It can also open security holes (as we shall see later in this chapter).#title,no_wrap# in the Command-Line text field.
man is executed at the command line it returns one string that is not formatted into multiple rows and columns. You need to tell Sapphire/Web about this, so that it does not try to parse the output.
The following steps specify that the page will display one column, with column entries delimited by the End Of File character ^D (on most machines). You will specify ^D because this character cannot be in the middle of the output string.
Delimited toggle button is pressed in.
Column Delim and select ^D.
output in the Name text field.
Add >> button. You have named your output string output.
File->Save, then select File->Close.
ManPage Anchor in the index.html document. When this Anchor is clicked, the project CGI will play the manform.html template. There is no dynamic data on this page, so you will use a NULL data object.
Object Bind Editor (New Activator) icon.
Document list select index.html.
Anchor list select HREF=ManPage. Click Ok.
Object Type combo box select NULL. Click Ok.
Results<=>Template, select manform.html. Click Ok.
Submit button in the manform.html document. When this Submit button is clicked your project will take the string entered by the user and pass it (as the argument Title) to the man Executable Data Object. The results of man will be placed into the manres.html template.Object Bind Editor (New Activator) icon.
Document list select manform.html.
Forms list select ACTION=FormAction. Click Ok.
Object Type combo box, select EXEC.
Executable Objects list, select man. Click Ok.
Arguments<=>Activator, bind the Title form element to the Title Argument.
Results<=>Template, click the down arrow and select manres.html.
Results site to the Output result. Click Ok.
Save and Test the project.
Man Page anchor. If you get "error URL not found," your Browser most likely has an older version of index.html in its cache. To correct the problem click the Back button (in your browser) to return to index.html and then click the Reload button to load the latest copy of index.html.
ls (or any other UNIX command) and click the Submit button.
man command now shows up in your browser. If the page does not display a description of your command, skip down to "Troubleshooting."Back to the man page form.
ls; cat /etc/passwd in the text field and click the Submit button.
man ls results, you should see the contents of your password file! Your project CGI will accept any UNIX command and pass it along to be executed. This is a considerable security hole. You should now complete tutorial 5 to learn how to fix the project.If the password file does not appear at the bottom of your page, then your server is probably configured to catch and stop attempts to damage the system via CGIs. You may still wish to complete tutorial 5 so that your server applications will run smoothly on insecure systems.
man, ls, and cat are in the path given to CGI programs by your HTTP server.
If the UNIX commands man, ls, and cat are not in the path given to CGI programs by your HTTP server, then they cannot be run by user nobody. This is a common situation. In order for your project to execute these commands, you must enter the full path of the commands when you define your data objects.
For example, to implement the man command:
Open your Data Object man.
Executable Name should be man.
which man. The full path of man will be returned to you. For example, it may be /usr/ucb/man.
man as the Executable Name. Close the Data Object Editor. Save and Test your project.