Thread View: best.www
8 messages
8 total messages
Started by Andrew Maisel
Tue, 10 Nov 1998 00:00
[INCLUDE:Url '%s' not found or insecure]
Author: Andrew Maisel
Date: Tue, 10 Nov 1998 00:00
Date: Tue, 10 Nov 1998 00:00
31 lines
1426 bytes
1426 bytes
Arrggghh. I'm stumped on paths and/or permissions... Part 1 works: I've got a form that writes data to a file - call it Data.htm Data.htm has permissions 660 and is in directory Writable The data is successfully written to Data.htm Part 2 doesn't work: Now I'd like to use an SSI to incorporate the contents of Data.htm in another page in another directory, call this Page.sht, using: <!--#include file="writable/data.htm" --> Here is the directory structure: /public_html/forms/writable/data.htm # data file /public_html/forms/page.sht # SSI page When I go to page.sht, I get the page, but with the warning/error message: [INCLUDE:Url '%s' not found or insecure] If I try to use an absolute path, like: /home/login/public_html/forms/writable/data.htm I avoid the error message - but I get no content... It's as if the data.htm file is empty. Thoughts? TIA, Andrew Maisel
Re: [INCLUDE:Url '%s' not found or insecure]
Author: Harold Sasaki
Date: Tue, 10 Nov 1998 00:00
Date: Tue, 10 Nov 1998 00:00
15 lines
1049 bytes
1049 bytes
Andrew Maisel <andrew@superkids.com> wrote: => Part 2 doesn't work: => Now I'd like to use an SSI to incorporate the contents of Data.htm in => another page in another directory, call this Page.sht, using: => <!--#include file="writable/data.htm" --> => Here is the directory structure: => /public_html/forms/writable/data.htm # data file What permissions/ownership do you have on the 'writable' directory? -- ----- Harold Sasaki http://www.harold.com/
Re: [INCLUDE:Url '%s' not found or insecure]
Author: Andrew Maisel
Date: Tue, 10 Nov 1998 00:00
Date: Tue, 10 Nov 1998 00:00
25 lines
1371 bytes
1371 bytes
Harold Sasaki wrote: > Directory 'writable' has permissions set at 730 File 'data.htm' within that directory is set at 660 The form does successfully write to 'data.htm' but the include statement on Page.sht can't read it... (: > Andrew Maisel <andrew@superkids.com> wrote: > > => Part 2 doesn't work: > => Now I'd like to use an SSI to incorporate the contents of Data.htm in > => another page in another directory, call this Page.sht, using: > => <!--#include file="writable/data.htm" --> > => Here is the directory structure: > => /public_html/forms/writable/data.htm # data file > > What permissions/ownership do you have on the 'writable' directory? > > -- > ----- > Harold Sasaki > http://www.harold.com/
Re: [INCLUDE:Url '%s' not found or insecure]
Author: Todd Michel McComb
Date: Tue, 10 Nov 1998 00:00
Date: Tue, 10 Nov 1998 00:00
16 lines
1086 bytes
1086 bytes
In article <3648042F.565B@superkids.com>, Andrew Maisel <andrew@superkids.com> wrote: > <!--#include file="writable/data.htm" --> I don't think you can even #include from writeable directories... your results would appear to confirm that. > /home/login/public_html/forms/writable/data.htm Likely one of these directories is opaque to the server (i.e. no 'x' permission). Try using the "real" path of /webadmin/pub/login/public_html/blah Note that I would not expect this to solve your problem, but I would expect it to duplicate the other behavior.
Re: [INCLUDE:Url '%s' not found or insecure]
Author: Smith and O'Halloran
Date: Tue, 10 Nov 1998 00:00
Date: Tue, 10 Nov 1998 00:00
17 lines
1306 bytes
1306 bytes
In article <3648042F.565B@superkids.com>, Andrew Maisel <andrew@superkids.com> wrote: >Now I'd like to use an SSI to incorporate the contents of Data.htm in >another page in another directory, call this Page.sht, using: > <!--#include file="writable/data.htm" --> > >Here is the directory structure: > public_html/forms/writable/data.htm # data file > public_html/forms/page.sht # SSI page Have you verified these three things: public_html/forms/page.sht must not be writable by group or other. public_html/forms must not be writable by group or other. public_html/. must not be writable by group or other. -- INWAP.COM is Joe and Sally Smith, John and Chris O'Halloran and our cats See http://www.inwap.com/ for PDP-10, "ReBoot", "Shadow Raiders"/"War Planets"
Re: [INCLUDE:Url '%s' not found or insecure]
Author: Andrew Maisel
Date: Tue, 10 Nov 1998 00:00
Date: Tue, 10 Nov 1998 00:00
37 lines
1902 bytes
1902 bytes
Smith and O'Halloran wrote: > Have you verified these three things: > public_html/forms/page.sht must not be writable by group or other. > public_html/forms must not be writable by group or other. > public_html/. must not be writable by group or other. Hmmm. I think so. This is what I have: public_html/forms/writable/data.htm = 660 public_html/forms/writable = 730 public_html/forms/page.sht = 644 public_html/forms = 755 public_html = 777 I thought I was trying to do something really simple -- use a form to allow a non-web-literate teacher to update one of her class web pages. (1) The form would write to data.htm (2) The cgi for the form would print the contents to the teacher's browser, allowing verification (3) And page.sht would incorporate the text contents of data.htm using the <!--#include file="data.htm" --> command. If, as Todd suspects, its not possible to use an include with a file in a writable directory, what's the solution? I suppose I could skip step 3 and just have the form cgi generate a formatted data.htm page -- but I wasn't sure about having the world visible page in a writable directory. Having just written this down, I'm not sure that's a problem... Thoughts? TIA Andrew Maisel SuperKids http://www.superkids.com
Re: [INCLUDE:Url '%s' not found or insecure]
Author: Larry Sherman
Date: Wed, 11 Nov 1998 00:00
Date: Wed, 11 Nov 1998 00:00
24 lines
1560 bytes
1560 bytes
Andrew Maisel <andrew@superkids.com> wrote: > Hmmm. I think so. This is what I have: > > public_html/forms/writable/data.htm = 660 > public_html/forms/writable = 730 > public_html/forms/page.sht = 644 > public_html/forms = 755 > public_html = 777 [...] > If, as Todd suspects, its not possible to use an include with a file in > a writable directory, what's the solution? I suppose I could skip step > 3 and just have the form cgi generate a formatted data.htm page -- but I > wasn't sure about having the world visible page in a writable > directory. Having just written this down, I'm not sure that's a > problem... Thoughts? You should _never_ perm public_html so wide open. Change it's perms to 710 (or 750). In order to #include data.htm, you need to clear the group 'w' bit on the 'writable' dir. Just chmod 'writable' to 710. The server doesn't need write access to it anyway. Larry
Re: [INCLUDE:Url '%s' not found or insecure]
Author: Smith and O'Halloran
Date: Fri, 13 Nov 1998 00:00
Date: Fri, 13 Nov 1998 00:00
44 lines
2310 bytes
2310 bytes
In article <36492146.3590@superkids.com>, Andrew Maisel <andrew@superkids.com> wrote: >Smith and O'Halloran wrote: >> public_html/. must not be writable by group or other. > >Hmmm. I think so. This is what I have: > >public_html = 777 If the permissions are "lrwxrwxrwx", then it's not 777. inwap@shell3% ls -ld public_html public_html/. lrwxrwxrwx 36 Apr 20 1998 public_html@ -> /webadmin/home/pub/inwap/public_html drwx--x--- 1024 Nov 12 14:04 public_html/./ The first letter is "l" which indicates a symlink. Permissions on a symlink are irrelevant, what counts is the permissions on the directory that the symlink points to. You will need to use "ls -ld public_html/." or "ls -ld ftp/public_html" to see the true permissions. In the example above, the permissions on my public_html are 710. >(3) And page.sht would incorporate the text contents of data.htm using >the <!--#include file="data.htm" --> command. I tried adding this to an index.shtml file: <p>include: <!--#include file="foo/test.txt"--> :include <br> exec: <!--#exec cmd="cat foo/test.txt"--> :exec It produced the following: include: [INCLUDE:Url '%s' not found or insecure] :include exec: Contents of test.txt are here. :exec The use of 'cat' bypassed the server's security checking. You should not do that unless you are absolutely sure that the included file does not have any bad things in it. For instance, the CGI that wrote the file needs to be sure that JavaScript and things like <SCRIPT SRC="http://badguy/killer.js"> are filtered out. -Joe -- INWAP.COM is Joe and Sally Smith, John and Chris O'Halloran and our cats See http://www.inwap.com/ for PDP-10, "ReBoot", "Shadow Raiders"/"War Planets"
Thread Navigation
This is a paginated view of messages in the thread with full content displayed inline.
Messages are displayed in chronological order, with the original post highlighted in green.
Use pagination controls to navigate through all messages in large threads.
Back to All Threads