Forum Moderators: phranque

Message Too Old, No Replies

Executing only extensionless files in cgi-bin

cgi-bin execute

         

kishoremax

1:24 pm on Nov 1, 2008 (gmt 0)

10+ Year Member



Hi,

I came across one of the articles written by JdMorgan replies regarding running only extensionless scripts in cgi leaving aside other files like jpg, gif, html.

Actually I'm stuck with this problem where images are not getting displayed instead cgi-bin is trying to execute them. I read that ScriptAliasMatch would do the job but I'm not very comfortable with regular expressions.

Here is my folder structure

ScriptAlias /cgi-bin/ "/var/www/mercury/cgi-bin/"

I have a folder called "scripts" in this /var/www/mercury/cgi-bin folder and I want all scripts in the "/var/www/mercury/cgi-bin/scripts" folder to execute but not the normal files in /var/www/mercury/cgi-bin/

Please let me know how to get this done.

Thanks,
Kishore

jdMorgan

1:57 pm on Nov 1, 2008 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I'd suggest some code using ScriptAliasMatch, but the problem is that it might not work as expected. That's because a "bullet-proof" definition of your terms "all scripts" and "normal files" is needed before proceeding to the coding step.

How, exactly, by looking only at the requested URL-path, is the server to determine whether a file is a script or a normal file? We will need a complete and correct "list" of all possible "script-URL identifiers" in order to do this.

The most likely answer will be to list the extensions on the script files, such as, "All scripts will end with '.cgi' or '.pl' or '.php' or '.asp', and everything else is not to be treated as a script."

If such an answer cannot be constructed, then the best approach would be to move all files which are not scripts out of the cgi-bin directory structure (in a "pure" or "strict" server set-up, they really should not be there in the first place).

[added] There is no such thing as an "extensionless file." There are extensionless URLs, but servers require that the files to which URLs resolve have an extension, in order to determine the correct handling and MIME-type (HTTP Content-Type) for those files.

Don't confuse URLs with filepaths -- These are two entirely-different "addressing systems" used in two entirely-different scopes; URLs are used on the Web, and filepaths are used inside the server's operating system. The two systems are "associated," but not equivalent. Mixing them up only leads to confusion and errors. [/added]

Jim

[edited by: jdMorgan at 2:12 pm (utc) on Nov. 1, 2008]

kishoremax

3:11 pm on Nov 1, 2008 (gmt 0)

10+ Year Member



Hi Jim,

Thanks for quick reply.

I have set of executables created by c programs. Actually I'm working on a C cgi application. These executables don't have any extension( as there shouldn't be any for my application). I do understand that ideally the image files should be htdocs but this application doesn't let me do that unfortunately.

I have set of executables like hgTracks, hgGateway, ... and other normal files (jpg, gif, and html) in the same cgi-bin folder. I just the server to execute only extensionless files leaving aside normal files.

Thanks,
Kishore

jdMorgan

4:12 pm on Nov 1, 2008 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Something like:

# Alias extensionless cgi-bin URL-path requests to script directory, and mark for execution
ScriptAliasMatch ^/cgi-bin/(([^/.]+/)*[^/.]+)$ /var/www/mercury/cgi-bin/$1
#
# Alias cgi-bin URL-paths with extensions to script directory, but do not mark for execution
AliasMatch ^/cgi-bin/(([^/.]+/)*[^/.]+\.[0-9a-zA-Z]+)$ /var/www/mercury/cgi-bin/$1

ScriptAliasMatch directive: "On a match for '/cgi-bin/' followed by any number of subdirectory URL-path-parts, followed by a path-part which does not include a period or a slash, internally rewrite to script subdirectory plus all matched URL-path-parts, and mark as executable."

AliasMatch directive: "On a match for '/cgi-bin/' followed by any number of subdirectory URL-path-parts, followed by a path-part which does not include a period or slash, followed by a period, followed by letters or numbers, internally rewrite to script subdirectory plus all matched URL-path-parts, and do not mark as executable."

Because we have now excluded URL-paths ending with a filetype from the ScriptAliasMatch, it is necessary to add the AliasMatch directive to avoid 'breaking' the Alias function for those URLs which *do* end with a filetype.

In other words, we have now changed the two functions of the original ScriptAlias, which were 1) Aliasing all /cgi-bin URLs to the script directory and 2) marking all /cgi-bin files as executable, into conditionally Aliasing extensionless cgi-bin URLs and marking the files as executable, and Aliasing /cgi-bin URLs with extensions but not marking the files as executable.

There is one unresolved case: What do you want to do with a directory index request -- That is, a requested URL ending with a slash, with no filename at all? Should it be Aliased? Should it be executable? The code above does neither, because requirements were not specified.

Jim

kishoremax

6:22 pm on Nov 1, 2008 (gmt 0)

10+ Year Member



Hi Jim,

You are a Genius !

The images appear now in the browser. You got me out of this huge mess Jim, Thanks very much to you. Now I can proceed with my work.

I really don't have any clue for your last question about "requested url ending with a slash" right now I get "404 Not Found Error". Let me know what should appear ideally? possibly with solution.

Thanks very much.

I'm very thankful to you :-)

regards,
Kishore

kishoremax

6:46 pm on Nov 1, 2008 (gmt 0)

10+ Year Member



Jim,

Is it possible to execute .pl, .cgi, .php and .asp files along with files with no extensions?

Thanks,
Kishore

jdMorgan

7:09 pm on Nov 1, 2008 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Assuming that no other "complications" exist, then adding this code *ahead* of the previously-posted AliasMatch should take care of that:

# Alias cgi-bin URL-path requests ending in .pl, .cgi, .php, .php4-9, or .asp to script directory, & mark for execution
ScriptAliasMatch ^/cgi-bin/(([^/.]+/)*[^/.]+\.(pl¦cgi¦php[4-9]?¦asp))$ /var/www/mercury/cgi-bin/$1

For efficiency, you should place the two ScriptAliasMatch directives in order of most-likely-URL-path-to-be-requested first.

Similarly, the filetypes in this new directive should be ordered as most-likely-to-be-requested first.

Important: Change the broken pipe "¦" characters in this regex pattern to solid pipe characters before use; Posting on this forum modifies the pipe characters.

Jim