[rrd-users] Re: rrdcgi input checks

[Erik de Mare]

you could use <form> and the the <OPTION value=day>day <OPTION
value=week>week, so that the visitor only can pick 1. and the value is
unchangeable so that it is always in the right format.

Koos van den Hout wrote:
> I am playing with some rrd generated graphs, and I'd like to give the
> period (day, week, month, year) as a parameter to the cgi. I'd also like to
> give targets as parameter, but that is secondary.
>
> But, I never trust input from the web to be what I want, or to be safe. So,
> I want to check whether it's day/week/month/year and if it isn't, not even
> try to start rrdgraph.
>
> So, is there a way to check input values in rrdcgi? Or do I need to fall
> back to a perl wrapper?
>
> Koos van den Hout
>

--
Unsubscribe mailto:rrd-user...@list.ee.ethz.ch?subject=unsubscribe
Help mailto:rrd-user...@list.ee.ethz.ch?subject=help
Archive http://www.ee.ethz.ch/~slist/rrd-users
WebAdmin http://www.ee.ethz.ch/~slist/lsg2.cgi

[Hugo van der Kooij]

Koos van den Hout zei:

>
> I am playing with some rrd generated graphs, and I'd like to give the
> period (day, week, month, year) as a parameter to the cgi. I'd also like
> to
> give targets as parameter, but that is secondary.
>
> But, I never trust input from the web to be what I want, or to be safe.
> So,
> I want to check whether it's day/week/month/year and if it isn't, not even
> try to start rrdgraph.
>
> So, is there a way to check input values in rrdcgi? Or do I need to fall
> back to a perl wrapper?

You could peek on how it is done with tools like MRTS
(http://apt-get.dk/mrts/) or MailGraph
(http://people.ee.ethz.ch/~dws/software/mailgraph/)

Hugo.

--
All email sent to me is bound to the rules described on my homepage.
hvdk...@vanderkooij.org http://hvdkooij.xs4all.nl/
Don't meddle in the affairs of sysadmins,
for they are subtle and quick to anger.

[Ed Schmollinger]

On Fri, Mar 26, 2004 at 07:54:01AM +0100, Erik de Mare wrote:
> you could use <form> and the the <OPTION value=day>day <OPTION
> value=week>week, so that the visitor only can pick 1. and the value is
> unchangeable so that it is always in the right format.

That only helps you if you can somehow guarantee that nobody will ever
send you an HTTP request that originates from something other than your
form. This is not generally possible without closed networks and
trusted hardware. Anybody can, for example, telnet to port 80 and type
"GET http://whatever/cgi-bin/whatever.cgi?BADSTUFF". That's why, if you
care about security at all, you'll always check your inputs for crazy
values.

> Koos van den Hout wrote:

> > I am playing with some rrd generated graphs, and I'd like to give the
> > period (day, week, month, year) as a parameter to the cgi. I'd also like to
> > give targets as parameter, but that is secondary.
> >
> > But, I never trust input from the web to be what I want, or to be safe. So,
> > I want to check whether it's day/week/month/year and if it isn't, not even
> > try to start rrdgraph.
> >
> > So, is there a way to check input values in rrdcgi? Or do I need to fall
> > back to a perl wrapper?
> >

> > Koos van den Hout

--
Ed Schmollinger - schm...@frozencrow.org

-- Binary/unsupported file stripped by Ecartis --
-- Err : No filename to use for decode, file stripped.
-- Type: application/pgp-signature