Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: Interchange: users

Parsing of CGI GET/POST/PUT input

 

 

Interchange users RSS feed   Index | Next | Previous | View Threaded


racke at linuxia

Nov 12, 2009, 12:04 PM

Post #1 of 2 (694 views)
Permalink
Parsing of CGI GET/POST/PUT input

Hello, Interchange developers!

We found on the IRC meeting on Tuesday:

--snip--
The character set conversion for file uploads happens in
Vend::Server::parse_multipart before we know which catalog the file upload
belongs to. David and Racke agreed that we store the character set for
each uploaded file in $CGI::file_encoding first and do the conversion in
Vend::Dispatch::open_cat just before the call to open_database().
Functions which write the data in $CGI::file to the file system need
to pass the corresponding value in $CGI::file_encoding to
Vend::File::writefile.
--snap--

Further investigation yielded that every CGI post parameter is subject
to this character set conversion _and_ that we don't know the character
set for the catalog.

I looked into the source code and found no reason to parse CGI
input ahead of calling Vend::Dispatch::open_cat. The only thing which
is used from CGI is $CGI::script_name.

My proposal is to postpone parsing of CGI parameters and run it
from inside open_cat.

Please comment.

Regards
Racke

--
LinuXia Systems => http://www.linuxia.de/
Expert Interchange Consulting and System Administration
ICDEVGROUP => http://www.icdevgroup.org/
Interchange Development Team


_______________________________________________
interchange-users mailing list
interchange-users [at] icdevgroup
http://www.icdevgroup.org/mailman/listinfo/interchange-users


racke at linuxia

Nov 14, 2009, 2:07 AM

Post #2 of 2 (623 views)
Permalink
Re: Parsing of CGI GET/POST/PUT input [In reply to]

Stefan Hornburg (Racke) wrote:
> Hello, Interchange developers!
>
> We found on the IRC meeting on Tuesday:
>
> --snip--
> The character set conversion for file uploads happens in
> Vend::Server::parse_multipart before we know which catalog the file upload
> belongs to. David and Racke agreed that we store the character set for
> each uploaded file in $CGI::file_encoding first and do the conversion in
> Vend::Dispatch::open_cat just before the call to open_database().
> Functions which write the data in $CGI::file to the file system need
> to pass the corresponding value in $CGI::file_encoding to
> Vend::File::writefile.
> --snap--
>
> Further investigation yielded that every CGI post parameter is subject
> to this character set conversion _and_ that we don't know the character
> set for the catalog.
>
> I looked into the source code and found no reason to parse CGI
> input ahead of calling Vend::Dispatch::open_cat. The only thing which
> is used from CGI is $CGI::script_name.
>
> My proposal is to postpone parsing of CGI parameters and run it
> from inside open_cat.
>

Please see attached patch. It needs more testing and maybe some
polishing, but in general it should work fine :-). I didn't try
if it makes problems with mod_perl mode.

Regards
Racke



--
LinuXia Systems => http://www.linuxia.de/
Expert Interchange Consulting and System Administration
ICDEVGROUP => http://www.icdevgroup.org/
Interchange Development Team
Attachments: enc.patch (5.12 KB)

Interchange users RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.