[26973] in Perl-Users-Digest
Perl-Users Digest, Issue: 8923 Volume: 10
daemon@ATHENA.MIT.EDU (Perl-Users Digest)
Sun Feb 5 21:05:36 2006
Date: Sun, 5 Feb 2006 18:05:05 -0800 (PST)
From: Perl-Users Digest <Perl-Users-Request@ruby.OCE.ORST.EDU>
To: Perl-Users@ruby.OCE.ORST.EDU (Perl-Users Digest)
Perl-Users Digest Sun, 5 Feb 2006 Volume: 10 Number: 8923
Today's topics:
Re: I just can't get this global/local/my stuff <joe@inwap.com>
Re: Morse code audio playout? <gan@starling.us>
Re: Morse code audio playout? <gan@starling.us>
Re: Question about abuse of a CGI script <news@chaos-net.de>
Re: Question about abuse of a CGI script <1usa@llenroc.ude.invalid>
Re: Question about abuse of a CGI script <news@chaos-net.de>
Re: Question about abuse of a CGI script <noreply@gunnar.cc>
Re: Question about abuse of a CGI script <1usa@llenroc.ude.invalid>
Re: Question about abuse of a CGI script <news@chaos-net.de>
Re: Question about abuse of a CGI script <news@chaos-net.de>
Re: Why does renaming a file not work when cron'd <tintin@invalid.invalid>
Digest Administrivia (Last modified: 6 Apr 01) (Perl-Users-Digest Admin)
----------------------------------------------------------------------
Date: Sun, 05 Feb 2006 17:18:05 -0800
From: Joe Smith <joe@inwap.com>
Subject: Re: I just can't get this global/local/my stuff
Message-Id: <n-adnXwsuelOPnvenZ2dnUVZ_tadnZ2d@comcast.com>
Wes Groleau wrote:
> dbmopen (%DataBase, $GEDCOM . ".DB", 0644)
> %Params = &read_params;
Have you considered converting to perl5 syntax?
------------------------------
Date: Sun, 05 Feb 2006 17:22:20 -0600
From: "Gan Uesli Starling" <gan@starling.us>
Subject: Re: Morse code audio playout?
Message-Id: <1139181740_3377@sp6iad.superfeed.net>
Thank you for your examples! I shall study them presently in hope of improving what I managed to cobble together in the mean time. Checking out the Audio::* family of modules I found Audio::Wav which, at least for now, does the trick...albeit slowly. See attached example.
begin 666 gus_morse.txt
M(R$O=7-R+W!K9R]B:6XO<&5R; HC(%9E<G-I;VX@,C P-BTP,BTP-0HC($-O
M<'ER:6=H="!B>2!'86X@565S;&D@4W1A<FQI;F<L($M9.$0*"B,@5&AI<R!E
M87)L>2!V97)S:6]N('=O<FMS(&%S(&ES+"!B=70@<W1I;&P@;F5E9',@<&]L
M:7-H.B!C;&D@9FQA9W,L(&UA>6)E(&$@1U5)+@H*(R!4;RUD;SH@36%K92!W
M;W)K(&9O<B!%<W!E<F%N=&\@86YD(&]T:&5R(&QA;F=U86=E<R!B97-I9&5S
M($5N9VQI<V@N"@IU<V4@=V%R;FEN9W,["G5S92!!=61I;SHZ5V%V.PH*(R!'
M970@9G)O;2!C;VUM86YD(&QI;F4L(&QI:V4@<V\Z(&=U<U]M;W)S92YP;" O
M<F%M+W1H95]R879E;BYT>'0@=V%V"B,@3W(@;6%Y8F4@;&EK92!S;SH@9W5S
M7VUO<G-E+G!L("]R86TO<F%N9&]M7V-H87)S+G1X="!O9V<*;7D@*"1T>'1?
M<&%T:"P@)&9O<FUA="D@/2! 05)'5CL@"@HC(%-E="!A<'!R;WAI;6%T92!C
M:&%R86-T97(@<W!E960@*&1I="!L96YG=&@I+@IM>2 D=W!M(#T@,34[( H*
M(R!#:&]O<V4@9&EF9FEC=6QT>2!L979E;"X@270@:7,@8F5S="!F;W(@8F5G
M:6YN97)S('1O(&AA=F4@=&AE"B,@8VAA<F%C=&5R('-P965D('-E="!T;R!A
M(&9A<W0@5U!-(&)U="!H879E('1H92!I;G1E<BUC:&%R86-T97(*(R!S<&5E
M9"!S970@<VQO=V5R+B!3;R!A(&YO=FEC92!S:&]U;&0@:&5A<B Q-2!74$T@
M8VAA<F%C=&5R<R!S<&%C960*(R!A<&%R="!B>2 U(%=032!G87!S(&9O<B!M
M;W-T(&5F9FEC:65N="!L96%R;FEN9R!C=7)V92X*(R Q," ]($YO<FUA;"!G
M87!S(&)E='=E96X@8VAA<F%C=&5R<RX*(R @-2 ]($1O=6)L92UW:61T:"!G
M87!S"B,@(#$@/2!5;'1R82UL;VYG(&=A<',*(R @," ]($-R87-H('!R;V=R
M86T@=VET:"!Z97)O+61I=FED92!E<G)O<BX*;7D@)&1I9F9I8W5L='D@/2 U
M.PH*(R!3970@875D:6\@<')E9F5R96YC97,N+BXN( IM>2 D:'H@/2 W-3 [
M(",@4V5T('1O;F4N( IM>2 D<V%M<&QE7W)A=&4@/2 Q,3 R-3L@(R!-86ME
M('1H:7,@.# P,"!I9B!Y;W4@=V%N="X*"B,@2&]W('1O("AR92TI8V]M<&]S
M92!E86-H(&QI;F4@;V8@=&5X="XN+@HC(#$@/2!0;&%I;B!T97AT(&9I<G-T
M+"!T:&5N(')E=F5R<V5D('=O<F1S+"!T:&5N(&)A8VMW87)D<PHC(# @/2!0
M;&%I;B!T97AT(&]N;'DN"FUY("1S8W)A;6)L92 ](# [( H*;7D@)'=A=B ]
M(&YE=R!!=61I;SHZ5V%V.PIM>2 D8FET<U]S86UP;&4@/2 Q-CL*;7D@)&1I
M=%]L96YG=&@@/2 V," O(#8@+R X("\@)'=P;2 J("1S86UP;&5?<F%T93L@
M(R Q(&UI;B O(#4@8VAA<G,@)B Q('-P86-E("\@9&DM9&%S("\@=W!M"FUY
M("1P:2 ]("@@,C(@+R W("D@*B R.PIM>2 D;6%X7VYO(#T@("@@,B J*B D
M8FET<U]S86UP;&4@*2 O(#(["@IM>2 D9&5T86EL<R ]('L*(" G8FET<U]S
M86UP;&4G(" @/3X@)&)I='-?<V%M<&QE+ H@("=S86UP;&5?<F%T92<@(" ]
M/B D<V%M<&QE7W)A=&4L"B @)V-H86YN96QS)R @(" @(#T^(#$L"GT["@IM
M>2 D=V%V7W!A=&@@/2 D='AT7W!A=&@["B1W879?<&%T:" ]?B!S+W1X="0O
M=V%V+SL*;7D@)'=R:71E(#T@)'=A=BT^=W)I=&4H("(D=V%V7W!A=&@B+" D
M9&5T86EL<R I.PH*(R!-;W)S92!C;V1E(&AA<V@N"FUY("5M;W)S92 ]("@@
M"B<N)R ]/B!S=6(@>V1I*"D[9&$H*3MD:2@I.V1A*"D[9&DH*3MD82@I.W-T
M<"@I.WTL"B<L)R ]/B!S=6(@>V1A*"D[9&$H*3MD:2@I.V1I*"D[9&$H*3MD
M82@I.W-T<"@I.WTL"B<Z)R ]/B!S=6(@>V1A*"D[9&$H*3MD82@I.V1I*"D[
M9&DH*3MD:2@I.W-T<"@I.WTL"B<_)R ]/B!S=6(@>V1I*"D[9&DH*3MD82@I
M.V1A*"D[9&DH*3MD:2@I.W-T<"@I.WTL"B(G(B ]/B!S=6(@>V1I*"D[9&$H
M*3MD82@I.V1A*"D[9&$H*3MD:2@I.W-T<"@I.WTL"B<M)R ]/B!S=6(@>V1A
M*"D[9&DH*3MD:2@I.V1I*"D[9&DH*3MD82@I.W-T<"@I.WTL"B<[)R ]/B!S
M=6(@>V1A*"D[9&DH*3MD82@I.V1I*"D[9&$H*3MS=' H*3M]+ HG+R<@/3X@
M<W5B('MD82@I.V1I*"D[9&DH*3MD82@I.V1I*"D[<W1P*"D[?2P*"B<H)R ]
M/B!S=6(@>V1A*"D[9&DH*3MD82@I.V1A*"D[9&DH*3MD82@I.W-T<"@I.WTL
M"B<I)R ]/B!S=6(@>V1A*"D[9&DH*3MD82@I.V1A*"D[9&DH*3MD82@I.W-T
M<"@I.WTL"@HG(B<@/3X@<W5B('MD:2@I.V1A*"D[9&DH*3MD:2@I.V1A*"D[
M9&DH*3MS=' H*3M]+ HG7R<@/3X@<W5B('MD:2@I.V1I*"D[9&$H*3MD82@I
M.V1I*"D[9&$H*3MS=' H*3M]+ HG/2<@/3X@<W5B('MD82@I.V1I*"D[9&DH
M*3MD:2@I.V1A*"D[<W1P*"D[?2P*)RLG(#T^('-U8B![9&DH*3MD82@I.V1I
M*"D[9&$H*3MD:2@I.W-T<"@I.WTL"@HG(2<@/3X@<W5B('MD82@I.V1I*"D[
M9&$H*3MD:2@I.V1A*"D[9&$H*3MS=' H*3M]+ HG)B<@/3X@<W5B('MD:2@I
M.W-T<"@I.V1I*"D[9&DH*3MD:2@I.W-T<"@I.WTL"B<D)R ]/B!S=6(@>V1I
M*"D[9&DH*3MD:2@I.V1A*"D[9&DH*3MD:2@I.V1A*"D[<W1P*"D[?2P*)T G
M(#T^('-U8B![9&DH*3MD82@I.V1A*"D[9&DH*3MD82@I.V1I*"D[<W1P*"D[
M?2P*"B=!)R ]/B!S=6(@>V1I*"D[9&$H*3MS=' H*3M]+ HG0B<@/3X@<W5B
M('MD82@I.V1I*"D[9&DH*3MD:2@I.W-T<"@I.WTL"B=#)R ]/B!S=6(@>V1A
M*"D[9&DH*3MD82@I.V1I*"D[<W1P*"D[?2P*)T0G(#T^('-U8B![9&$H*3MD
M:2@I.V1I*"D[<W1P*"D[?2P*)T4G(#T^('-U8B![9&DH*3MS=' H*3M]+ HG
M1B<@/3X@<W5B('MD:2@I.V1I*"D[9&$H*3MD:2@I.W-T<"@I.WTL"B=')R ]
M/B!S=6(@>V1A*"D[9&$H*3MD:2@I.W-T<"@I.WTL"B=()R ]/B!S=6(@>V1I
M*"D[9&DH*3MD:2@I.V1I*"D[<W1P*"D[?2P*)TDG(#T^('-U8B![9&DH*3MD
M:2@I.W-T<"@I.WTL"B=*)R ]/B!S=6(@>V1I*"D[9&$H*3MD82@I.V1A*"D[
M<W1P*"D[?2P*)TLG(#T^('-U8B![9&$H*3MD:2@I.V1A*"D[<W1P*"D[?2P*
M)TPG(#T^('-U8B![9&DH*3MD82@I.V1I*"D[9&DH*3MS=' H*3M]+ HG32<@
M/3X@<W5B('MD82@I.V1A*"D[<W1P*"D[?2P*)TXG(#T^('-U8B![9&$H*3MD
M:2@I.W-T<"@I.WTL"B=/)R ]/B!S=6(@>V1A*"D[9&$H*3MD82@I.W-T<"@I
M.WTL"B=0)R ]/B!S=6(@>V1I*"D[9&$H*3MD82@I.V1I*"D[<W1P*"D[?2P*
M)U$G(#T^('-U8B![9&$H*3MD82@I.V1I*"D[9&$H*3MS=' H*3M]+ HG4B<@
M/3X@<W5B('MD:2@I.V1A*"D[9&DH*3MS=' H*3M]+ HG4R<@/3X@<W5B('MD
M:2@I.V1I*"D[9&DH*3MS=' H*3M]+ HG5"<@/3X@<W5B('MD82@I.W-T<"@I
M.WTL"B=5)R ]/B!S=6(@>V1I*"D[9&DH*3MD82@I.W-T<"@I.WTL"B=6)R ]
M/B!S=6(@>V1I*"D[9&DH*3MD:2@I.V1A*"D[<W1P*"D[?2P*)U<G(#T^('-U
M8B![9&DH*3MD82@I.V1A*"D[<W1P*"D[?2P*)U@G(#T^('-U8B![9&$H*3MD
M:2@I.V1I*"D[9&$H*3MS=' H*3M]+ HG62<@/3X@<W5B('MD82@I.V1I*"D[
M9&$H*3MD82@I.W-T<"@I.WTL"B=:)R ]/B!S=6(@>V1A*"D[9&$H*3MD:2@I
M.V1I*"D[<W1P*"D[?2P*)S G(#T^('-U8B![9&$H*3MD82@I.V1A*"D[9&$H
M*3MD82@I.W-T<"@I.WTL"B<Q)R ]/B!S=6(@>V1I*"D[9&$H*3MD82@I.V1A
M*"D[9&$H*3MS=' H*3M]+ HG,B<@/3X@<W5B('MD:2@I.V1I*"D[9&$H*3MD
M82@I.V1A*"D[<W1P*"D[?2P*)S,G(#T^('-U8B![9&DH*3MD:2@I.V1I*"D[
M9&$H*3MD82@I.W-T<"@I.WTL"B<T)R ]/B!S=6(@>V1I*"D[9&DH*3MD:2@I
M.V1I*"D[9&$H*3MS=' H*3M]+ HG-2<@/3X@<W5B('MD:2@I.V1I*"D[9&DH
M*3MD:2@I.V1I*"D[<W1P*"D[?2P*)S8G(#T^('-U8B![9&$H*3MD:2@I.V1I
M*"D[9&DH*3MD:2@I.W-T<"@I.WTL"B<W)R ]/B!S=6(@>V1A*"D[9&$H*3MD
M:2@I.V1I*"D[9&DH*3MS=' H*3M]+ HG."<@/3X@<W5B('MD82@I.V1A*"D[
M9&$H*3MD:2@I.V1I*"D[<W1P*"D[?2P*)SDG(#T^('-U8B![9&$H*3MD82@I
M.V1A*"D[9&$H*3MD:2@I.W-T<"@I.WTL"@HG05(G(#T^('-U8B![9&DH*3MD
M82@I.V1I*"D[9&$H*3MD:2@I.W-T<"@I.WTL"B=+3B<@/3X@<W5B('MD82@I
M.V1I*"D[9&$H*3MD82@I.V1I*"D[<W1P*"D[?2P*)U-+)R ]/B!S=6(@>V1I
M*"D[9&DH*3MD:2@I.V1A*"D[9&DH*3MD82@I.W-T<"@I.WTL"@HG3V]P<R<@
M/3X@<W5B('MD:2@I.V1I*"D[9&DH*3MD:2@I.V1I*"D[9&DH*3MD:2@I.V1I
M*"D[<W1P*"D[?2P*"B=#>"<@/3X@<W5B('MD82@I.V1I*"D[9&$H*3MD:2@I
M.V1I*"D[<W1P*"D[?2P*)T=X)R ]/B!S=6(@>V1A*"D[9&$H*3MD:2@I.V1A
M*"D[9&DH*3MS=' H*3M]+ HG2'@G(#T^('-U8B![9&$H*3MD82@I.V1A*"D[
M9&$H*3MS=' H*3M]+ HG2G@G(#T^('-U8B![9&DH*3MD82@I.V1A*"D[9&$H
M*3MS=' H*3M]+ HG4W@G(#T^('-U8B![9&DH*3MD:2@I.V1I*"D[9&$H*3MD
M:2@I.W-T<"@I.WTL"B=5>"<@/3X@<W5B('MD:2@I.V1I*"D[9&$H*3MD82@I
M.W-T<"@I.WTL"@HI.PH*<W5B(&1I('L*("!C=R@D9&ET7VQE;F=T:"D["B @
M9V%P*"D["GT*"G-U8B!D82![( H@(&-W*"1D:71?;&5N9W1H("H@,RD["B @
M9V%P*"D["GT*"G-U8B!C=R![( H@(&9O<B!M>2 D<&]S("@P("XN("1?6S!=
M*2!["B @(" D=&EM92 ]("1P;W,@+R D<V%M<&QE7W)A=&4["B @(" D=&EM
M92 J/2 D:'H["B @("!M>2 D=F%L(#T@<VEN("1P:2 J("1T:6UE.PH@(" @
M;7D@)'-A;7 @/2 D=F%L("H@)&UA>%]N;SL*(" @("1W<FET92T^=W)I=&4H
M)'-A;7 I.PH@('T*?0H*<W5B(&=A<"!["B @9F]R(&UY("1P;W,@*# @+BX@
M)&1I=%]L96YG=&@I('L*(" @("1W<FET92T^=W)I=&4H,"D["B @?0I]"@IS
M=6(@<W1P('L*("!M>2 D<W1P7VQE;F=T:" ](&EN="@@)&1I=%]L96YG=&@@
M*B S("H@,3 @+R D9&EF9FEC=6QT>2D["B @9F]R(&UY("1P;W,@*# @+BX@
M)'-T<%]L96YG=&@I('L*(" @("1W<FET92T^=W)I=&4H,"D["B @?0I]"@IS
M=6(@;6]R<VEF>2!["B!F;W)E86-H("A 7RD@>R *(" @;F5X="!U;FQE<W,@
M9&5F:6YE9"@@)&UO<G-E>R(D7R)]("D["B @("9[("1M;W)S97LB)%\B?2!]
M.PH@?0I]"@II9B H(&]P96X@24Y&24Q%+" B/"1T>'1?<&%T:"(@*2!["B @
M=VAI;&4@*#Q)3D9)3$4^*2!["B @(" D7R ]?B!S+UQS+R O9SL@(R!3=V%P
M('=H:71E<W!A8V4N"B @(" D7R ]('5C*"1?*3L*(" @(&UO<G-I9GDH<W!L
M:70@+R\L("1?*3L*(" @(&EF("@D<V-R86UB;&4I('L*(" @(" @)%\@/2!R
M979E<G-E("1?.PH@(" @("!M;W)S:69Y*'-P;&ET("\O+" D7RD[('-T<"@I
M.PH@(" @(" D7R ](&IO:6XH("(@(BP@<F5V97)S92!S<&QI="@@(B B+" D
M7RD@*3L*(" @(" @;6]R<VEF>2AS<&QI=" O+RP@)%\I.R!S=' H*3L*(" @
M('T*("!]"B @)GL@)&UO<G-E>R)!4B)]('T[(",@16YD(&]F(&UE<W-A9V4@
M<VEG;F%L+@I]"F5L<V4@>R!P<FEN=" B3V]P<R$@0V%N;F]T(&]P96X@:6YF
M:6QE.B D(2!<;B(@?0H*)'=R:71E+3YF:6YI<V@H*3L*"B,@5&AI<R!I<R!T
M:&4@;VYL>2!P87)T('1H870@=VEL;"!C<F%S:"!O;B!7:6XS,BX@4V\@:68@
M>6]U"B,@87)E('-T=6-K('=I=&@@5VEN9&]Z92!T:&5N(&=I=F4@)W=A=B<L
M(&YO=" G;V=G)R!A<R!Y;W5R(&9O<FUA="X*(R!(97)E($D@9VEV92!5;FEX
M(&-O;6UA;F0@;&EN92!T;R!C;VYV97)T('1O($]G9R!6;W)B:7,N"B,@22!M
M87D@9FEX(&ET(&9O<B!C<F]S<RUP;&%T9F]R;2!U8FEU:71Y(&EN(&QA=&5R
M('9E<G-I;VYS+@II9B H("1F;W)M870@/7X@+V]G9R]I("D@>PH@(&!N:6-E
M(&]G9V5N8R M<2 R("1W879?<&%T:& [(",@16YC;V1E(&%S("HN;V=G"B @
D8')M("1W879?<&%T:& [(",@3&]S92!T:&4@*BYW878N"GT*
end
Posted Via Usenet.com Premium Usenet Newsgroup Services
----------------------------------------------------------
** SPEED ** RETENTION ** COMPLETION ** ANONYMITY **
----------------------------------------------------------
http://www.usenet.com
------------------------------
Date: Sun, 05 Feb 2006 17:27:36 -0600
From: "Gan Uesli Starling" <gan@starling.us>
Subject: Re: Morse code audio playout?
Message-Id: <1139182056_3381@sp6iad.superfeed.net>
My attachment did not attach. Or at least I did not see it when I
checked my post. Sorry, too, about the non-wrap. Anyway, rather
than attach my code. If you like, it is on-line here:
http://starling.ws/morse
Thanks,
PS - If I can't figure out how to delete the usenet.com advert at
the bottom of my posts I'm going to get me a new provider. I won't
willing pay for the privilege of advertising for them. Grrrrrr!
Posted Via Usenet.com Premium Usenet Newsgroup Services
----------------------------------------------------------
** SPEED ** RETENTION ** COMPLETION ** ANONYMITY **
----------------------------------------------------------
http://www.usenet.com
------------------------------
Date: Mon, 6 Feb 2006 01:19:48 +0100
From: Martin Kissner <news@chaos-net.de>
Subject: Re: Question about abuse of a CGI script
Message-Id: <slrndud5h4.s8a.news@maki.homeunix.net>
A. Sinan Unur wrote :
> Martin Kissner <news@chaos-net.de> wrote in
> news:slrnducuop.s8a.news@maki.homeunix.net:
>
>> Gunnar Hjalmarsson wrote :
>>> Martin Kissner wrote:
>>>> What I want is to execute a script which enables me to analyse the
>>>> method the spammer uses in order to learn how this works - not
>>>> because I want to redo it, but I am interested.
>>>
>>> If you post the (relevant part of the) script here, somebody will
>>> probably be able to tell you what the problem is.
>>
>> Yes, absolutely.
>> I did not do so in the first place for two reasons.
>>
>> 1. I am not really sure which part is relevant.
>> 2. It took me some time to simplify the script and remove several
>> conditions etc.
>
> Have you seen the posting guidelines? Especially the part about posting
> code?
Yes, I guess you are talking about the part which suggests to post a
small but working script which can be copied and pasted and which
demonstrates the problem.
Sorry, but I was not able to provide such a script because the relevant
code is included in a selfmade module which I have admittedly designed
not optimally. It was my first somewhat larger module to write.
>> I hoped someone might be able to point me to the right direction
>> without seeing code.
>
> How? Are we mindreaders?
No, but I thought if I'd admit that I processed uncheckt userinput from
the form maybe someone could point out some examples how this input can
make my script do bad things (like execute external code).
> use strict;
> use warnings;
>
> missing (oh, and don't tell me you did not include those because someone
> told you they would slow your script down).
No, I won't
Actuallly I use these two always. I forgot to mention this. Sorry.
In fact I have learned this from this group and have read you pointing
it out many many times.
>> my %userinput;
>> sub process {
>> %userinput = parse_input($_[1]);
>> generate_output() if send_mail();
>> }
>>
>> sub send_mail {
>> use Mail::Mailer;
>> my $mailer = Mail::Mailer->new;
>> $mailer->open ({
>> To => 'mail@thedomain.tld',
>> # The spammers script still worked after I had replaced the variables
>> # with fixed values
>> From => "$userinput{name} <$userinput{from}>",
>
> So, what happens if $userinput{name} contains:
>
> aaa@example.com,\naab@example.com,\naac@example.com ...
Then the mail which is sent to the reciever of the email contains some
additional sendere:
aaa@example.com, naab@example.com and naac@example.com
It is a little weired to recieve one _single_ email from _four_ senders
but this is not critical yet (it's not good either, of course).
I tried adding mail@example.com,\nBcc:secret@mailaddress.com to see if
I could use this to send myself a Bcc but it just added another sender.
I also tried putting in some code with different modifications but none
of them worked (Something like ">\n; [some perl code here]").
>
>> 'Content-Type' => 'text/html',
>> Subject => "My Subject",
>> });
>> print $mailer <<"END"
>> <html>...
>> <br>$userinput{name}
>> <br>$userinput{otherfield}
>> ...</html>
>
> I thought you used templates and such.
Yes, is this relevant?
I didn't think so but I might be wrong.
>> END
>> $mailer->close;
>> }
>>
>> sub parse_input {
>> # I hope I did not mess this up when I simplified it
>> my $input = shift;
>> my %cgihash;
>>
>> my @pairs =split(/&/,$input);
>> foreach my $data (@pairs) {
>> $data =~ s/\+/ /go;
>
> Why the 'o' switch?
I have taken this from a book. The book says it saves cpu time because
the pattern is only compiled once. It suggests to always use it in loops
unless the pattern changes.
>> ($key, $value) = split(/=/,$data);
>> $key =~ s/\%(..)/pack("c",hex($1))/ge;
>> $value =~ s/\%(..)/pack("c",hex($1))/ge;
>> $cgihash{$key} = $value;
>> }
>> return %cgihash;
>
> No comment.
Hm, - okay (wondering silently).
I have realized that the userinput can change the desired result but I
have not yet found out, how it can change the recipient or add
additional code to the script.
Any additional help will be gladly appreciated
Best regards
Martin
--
perl -e '$S=[[73,116,114,115,31,96],[108,109,114,102,99,112],
[29,77,98,111,105,29],[100,93,95,103,97,110]];
for(0..3){for$s(0..5){print(chr($S->[$_]->[$s]+$_+1))}}'
------------------------------
Date: Mon, 06 Feb 2006 00:38:08 GMT
From: "A. Sinan Unur" <1usa@llenroc.ude.invalid>
Subject: Re: Question about abuse of a CGI script
Message-Id: <Xns9761C7D41C5B0asu1cornelledu@127.0.0.1>
Martin Kissner <news@chaos-net.de> wrote in
news:slrndud5h4.s8a.news@maki.homeunix.net:
> A. Sinan Unur wrote :
>> Martin Kissner <news@chaos-net.de> wrote in
>> news:slrnducuop.s8a.news@maki.homeunix.net:
>>
>>> Gunnar Hjalmarsson wrote :
>>>> Martin Kissner wrote:
>>>>> What I want is to execute a script which enables me to analyse the
>>>>> method the spammer uses in order to learn how this works - not
>>>>> because I want to redo it, but I am interested.
>>>>
>>>> If you post the (relevant part of the) script here, somebody will
>>>> probably be able to tell you what the problem is.
>>>
>>> Yes, absolutely.
>>> I did not do so in the first place for two reasons.
>>>
>>> 1. I am not really sure which part is relevant.
>>> 2. It took me some time to simplify the script and remove several
>>> conditions etc.
>>
>> Have you seen the posting guidelines? Especially the part about
>> posting code?
>
> Yes, I guess you are talking about the part which suggests to post a
> small but working script which can be copied and pasted and which
> demonstrates the problem.
Yes.
...
>> aaa@example.com,\naab@example.com,\naac@example.com ...
>
> Then the mail which is sent to the reciever of the email contains some
> additional sendere:
> aaa@example.com, naab@example.com and naac@example.com
Are you purposefully being dense here? \n is a newline. OK, I forgot to
type the Bcc: before the second address but still, the point I was
trying to make should have been obvious. See:
D:\Home\asu1\UseNet\clpmisc\mail> cat m.pl
#!/usr/bin/perl
use strict;
use warnings;
use Mail::Mailer;
my $from = <<'FROM';
aaa@example.com
Bcc: bbb@example.com, ccc@example.com, ddd@example.com
FROM
my $mailer = Mail::Mailer->new('testfile');
$mailer->open({
To => 'you@example.com',
From => $from,
Subject => 'Test',
});
$mailer->close;
D:\Home\asu1\UseNet\clpmisc\mail> cat mailer.testfile
===
test 1 Sun Feb 5 19:33:35 2006
to: you@example.com
Subject: Test
To: you@example.com
From: aaa@example.com
Bcc: bbb@example.com, ccc@example.com, ddd@example.com
>>> print $mailer <<"END"
>>> <html>...
>>> <br>$userinput{name}
>>> <br>$userinput{otherfield}
>>> ...</html>
>>
>> I thought you used templates and such.
>
> Yes, is this relevant?
> I didn't think so but I might be wrong.
It is, because that was your excuse for not using CGI.pm
Sinan
--
A. Sinan Unur <1usa@llenroc.ude.invalid>
(reverse each component and remove .invalid for email address)
comp.lang.perl.misc guidelines on the WWW:
http://mail.augustmail.com/~tadmc/clpmisc/clpmisc_guidelines.html
------------------------------
Date: Mon, 6 Feb 2006 01:54:39 +0100
From: Martin Kissner <news@chaos-net.de>
Subject: Re: Question about abuse of a CGI script
Message-Id: <slrndud7if.s8a.news@maki.homeunix.net>
Gunnar Hjalmarsson wrote :
> Martin Kissner wrote:
>>
>> $mailer->open ({
>> To => 'mail@thedomain.tld',
>> # The spammers script still worked after I had replaced the variables
>> # with fixed values
>> From => "$userinput{name} <$userinput{from}>",
>
> What would happen if $userinput{name} consists of the string that this
> expression results in:
>
> qq|faked\@example.com\nCc: victim1\@example.com, victim2\@example.com,|
Then some more people will get mail than intented.
My question is: How did they do it?
I tryed on my local webserver evereything I can think of, but the only
result I get is a few additional senders.
Best regards
Martin
--
perl -e '$S=[[73,116,114,115,31,96],[108,109,114,102,99,112],
[29,77,98,111,105,29],[100,93,95,103,97,110]];
for(0..3){for$s(0..5){print(chr($S->[$_]->[$s]+$_+1))}}'
------------------------------
Date: Mon, 06 Feb 2006 02:03:46 +0100
From: Gunnar Hjalmarsson <noreply@gunnar.cc>
Subject: Re: Question about abuse of a CGI script
Message-Id: <44nlgcF32q8cU1@individual.net>
Martin Kissner wrote:
> Gunnar Hjalmarsson wrote :
>>What would happen if $userinput{name} consists of the string that this
>>expression results in:
>>
>>qq|faked\@example.com\nCc: victim1\@example.com, victim2\@example.com,|
>
> Then some more people will get mail than intented.
> My question is: How did they do it?
Either they used an own, modified form, or - more likely - a script that
emulates a form submission. With Perl you can write such a script using
e.g. the LWP family of modules.
--
Gunnar Hjalmarsson
Email: http://www.gunnar.cc/cgi-bin/contact.pl
------------------------------
Date: Mon, 06 Feb 2006 01:04:01 GMT
From: "A. Sinan Unur" <1usa@llenroc.ude.invalid>
Subject: Re: Question about abuse of a CGI script
Message-Id: <Xns9761CC3748E14asu1cornelledu@127.0.0.1>
Martin Kissner <news@chaos-net.de> wrote in
news:slrndud7if.s8a.news@maki.homeunix.net:
> Gunnar Hjalmarsson wrote :
>> Martin Kissner wrote:
>>>
>>> $mailer->open ({
>>> To => 'mail@thedomain.tld',
>>> # The spammers script still worked after I had replaced the
>>> variables # with fixed values
>>> From => "$userinput{name} <$userinput{from}>",
>>
>> What would happen if $userinput{name} consists of the string that
>> this expression results in:
>>
>> qq|faked\@example.com\nCc: victim1\@example.com,
>> victim2\@example.com,|
>
> Then some more people will get mail than intented.
You are missing the point. The spammer does not type these things in by
hand.
> My question is: How did they do it?
> I tryed on my local webserver evereything I can think of, but the only
> result I get is a few additional senders.
Submit the form using WWW::Mechanize.
At this point, I would recommend that you give up. Don't put a mail form
on the web. Just put your mom's email address there, and tell your mom
to use a spam filter[1].
You do not realize the harm you are doing to hundreds of thousands of
people being targetted by the spammer. In fact, I sense from you an
attitude of "who cares" regarding the victims.
[1] Yes, I am dead serious. Maybe after a few months of spam, you
realize the harm you are doing.
Sinan
--
A. Sinan Unur <1usa@llenroc.ude.invalid>
(reverse each component and remove .invalid for email address)
comp.lang.perl.misc guidelines on the WWW:
http://mail.augustmail.com/~tadmc/clpmisc/clpmisc_guidelines.html
------------------------------
Date: Mon, 6 Feb 2006 02:47:28 +0100
From: Martin Kissner <news@chaos-net.de>
Subject: Re: Question about abuse of a CGI script
Message-Id: <slrndudalg.s8a.news@maki.homeunix.net>
A. Sinan Unur wrote :
> Martin Kissner <news@chaos-net.de> wrote in
> news:slrndud5h4.s8a.news@maki.homeunix.net:
>
>> A. Sinan Unur wrote :
>>> Martin Kissner <news@chaos-net.de> wrote in
>>> news:slrnducuop.s8a.news@maki.homeunix.net:
>>> aaa@example.com,\naab@example.com,\naac@example.com ...
>>
>> Then the mail which is sent to the reciever of the email contains some
>> additional sendere:
>> aaa@example.com, naab@example.com and naac@example.com
>
> Are you purposefully being dense here? \n is a newline. OK, I forgot to
> type the Bcc: before the second address but still, the point I was
> trying to make should have been obvious.
To me it is obvious *what* can be done but not *how* it is done.
Of course I tried
myoneaddress@example.com,\nBcc:myotheraddress@example.com
but I didn't recieve a Bcc mail to myotheraddress.
I recieved mail to the address coded in the script with some "weired"
looking senders.
I also trid the code you posted below. Here is my result:
|
| ===
| test 1 Mon Feb 6 02:30:09 2006
| to: you@example.com
|
| Subject: Test
| To: you@example.com
| From: aaa@example.com Bcc: bbb@example.com, ccc@example.com,
| ddd@example.com
|
The Bcc does not skip to the next line. (???)
I have no idea why but I will test this on a different computer with
FreeBSD on it.
This is Mac OS X / Darwin.
[...]
>>> I thought you used templates and such.
>>
>> Yes, is this relevant?
>> I didn't think so but I might be wrong.
>
> It is, because that was your excuse for not using CGI.pm
I didn't feel like I have to excuse myself, I was just explaning my
reasons for my decison.
Actually the website on which the script runs contains about 300 pages
generated by my cgi skript. The HTML email was not the reason to use
HTML::Template and also it was not the reason for not using CGI.pm
Also it doesn't even make sense to generate the mail with
HTML::Template. I was just curious if I could combine Mail::Mailer and
HTML::Template. This also shows that the overhead of CGI.pm is not the
reason for not using it ;-)
If I had known that this is important I had explained this mor
thouroughly.
Best regards
Martin
--
perl -e '$S=[[73,116,114,115,31,96],[108,109,114,102,99,112],
[29,77,98,111,105,29],[100,93,95,103,97,110]];
for(0..3){for$s(0..5){print(chr($S->[$_]->[$s]+$_+1))}}'
------------------------------
Date: Mon, 6 Feb 2006 02:55:40 +0100
From: Martin Kissner <news@chaos-net.de>
Subject: Re: Question about abuse of a CGI script
Message-Id: <slrndudb4s.s8a.news@maki.homeunix.net>
Gunnar Hjalmarsson wrote :
> Martin Kissner wrote:
>> Gunnar Hjalmarsson wrote :
>>>What would happen if $userinput{name} consists of the string that this
>>>expression results in:
>>>
>>>qq|faked\@example.com\nCc: victim1\@example.com, victim2\@example.com,|
>>
>> Then some more people will get mail than intented.
>> My question is: How did they do it?
>
> Either they used an own, modified form, or - more likely - a script that
> emulates a form submission. With Perl you can write such a script using
> e.g. the LWP family of modules.
Okay.
Am I right if I suppose that such a script contacts the form on my
website, fills in some values into my fields and then submits the form?
--
perl -e '$S=[[73,116,114,115,31,96],[108,109,114,102,99,112],
[29,77,98,111,105,29],[100,93,95,103,97,110]];
for(0..3){for$s(0..5){print(chr($S->[$_]->[$s]+$_+1))}}'
------------------------------
Date: Mon, 6 Feb 2006 13:42:38 +1300
From: "Tintin" <tintin@invalid.invalid>
Subject: Re: Why does renaming a file not work when cron'd
Message-Id: <IXwFf.133480$vH5.1106290@news.xtra.co.nz>
"gd" <slamsworld@shaw.ca> wrote in message
news:YuoFf.559763$ki.521139@pd7tw2no...
> Hello all
>
> I have created a small script to go to the internet and get some data I am
> interested in and save it to a linux machine
>
> Can anyone tell me why the script will rename and save the file properly
> when I run it from the command line but when I cron it it does not
>
> the line of code to rename the file is
>
> rename("wind.png","$data.png");
You are making the *very* common mistake of thinking that cronjobs run with
the exact same permissions and environment as your command line. Never,
never blindly assume that certain environment variables exist or that you
are running in a particular directory.
In fact, it makes good sense to assume these things even if you don't run it
as a cronjob, as it will make your script more robust and should enable to
to think more about data verification and error handling.
For the Perl side of things, *always* ensure you check for failures, ie:
rename "wind.png", "$data.png" or die "Can not rename wind.png to $data.png
because $!\n";
------------------------------
Date: 6 Apr 2001 21:33:47 GMT (Last modified)
From: Perl-Users-Request@ruby.oce.orst.edu (Perl-Users-Digest Admin)
Subject: Digest Administrivia (Last modified: 6 Apr 01)
Message-Id: <null>
Administrivia:
#The Perl-Users Digest is a retransmission of the USENET newsgroup
#comp.lang.perl.misc. For subscription or unsubscription requests, send
#the single line:
#
# subscribe perl-users
#or:
# unsubscribe perl-users
#
#to almanac@ruby.oce.orst.edu.
NOTE: due to the current flood of worm email banging on ruby, the smtp
server on ruby has been shut off until further notice.
To submit articles to comp.lang.perl.announce, send your article to
clpa@perl.com.
#To request back copies (available for a week or so), send your request
#to almanac@ruby.oce.orst.edu with the command "send perl-users x.y",
#where x is the volume number and y is the issue number.
#For other requests pertaining to the digest, send mail to
#perl-users-request@ruby.oce.orst.edu. Do not waste your time or mine
#sending perl questions to the -request address, I don't have time to
#answer them even if I did know the answer.
------------------------------
End of Perl-Users Digest V10 Issue 8923
***************************************
