Apache: can cgi output be parsed for Server-side includes?
Dan Brickley
Hi. I hope someone can help here - I've run out of ideas...
I'm trying to get Apache to parse the output of CGI scripts for
server side includes. I've got a website that has a lot of header and
footer banners, and - having moved over from Cern to Apache - these have
been converted to server side includes. This works fine. We've also got
quite a few scripts which generate HTML on the fly. At the moment, these
either have the HTML embedded in the Perl or else they read in a template
file. I want to get things set up so that the output from these scripts
contains our server-side-include HTML snippets. I had planned to just read
them into the Perl by hand. unfortunately I've got a two-layered server
side include structure: a variety of 'top.ssi' files are included in the
html pages, and these in turn include a site-standard 'top-bar.ssi'. This
makes reading the ssi material into the cgi script rather fiddly.
So... How to get Apache to parse the output of scripts for SSIs??
I've tried making sure the filename of the script is defined in
mime.types as 'text/x-server-parsed-html', and made sure the HTTP header
output by the script was
Content type: text/x-server-parsed-html
Apache takes no notice of this, and serves the output unparsed.
Can anyone suggest another method? Am I trying to do something undoable?
thanks,
Dan Brickley.
Rob Hartill
> Hi. I hope someone can help here - I've run out of ideas...
>
> I'm trying to get Apache to parse the output of CGI scripts for
> server side includes.
that's a security hole. Too many scripts will not check what info
they echo back to the user, so it'd be too easy for someone to
send SSI knowing that it would then be echoed back by the script.
You can always send the output to a file and then redirect to the
file - IF you're confident that file cannot contain user provided
SSI.
--
Rob Hartill (ro...@imdb.com)
The Internet Movie Database (IMDb) http://www.imdb.com/
...more movie info than you can poke a stick at.
Jim Sloan
>
>Hi. I hope someone can help here - I've run out of ideas...
>
>
>So... How to get Apache to parse the output of scripts for SSIs??
>I've tried making sure the filename of the script is defined in
>mime.types as 'text/x-server-parsed-html', and made sure the HTTP header
>output by the script was
>Content type: text/x-server-parsed-html
>
>Apache takes no notice of this, and serves the output unparsed.
>
>Can anyone suggest another method? Am I trying to do something undoable?
>
>thanks,
>
>Dan Brickley.
>
you are doing something undoable. the server reads the html file and parses
the input before sending it out. the cgi is after the server has read the
input, therefor it is now just output to stdout, which is out of control of
the server at this point.
If your cgi is reading in a template file and parsing it before transmitting
it, you could duplicate the server function and recognize cgi's and run them
yourself.
------------------------------------------------------------------------
Jim Sloan jsl...@livnet.com
Vice President
LiveNet, Inc.
413 Davis St. Suite 106 Full Service Internet Provider
Virginia Beach VA 23462 Dialup and dedicated connections
Ph: 804-499-9328 Virtual Web, Email, and FTP hosting
http://www.livnet.com in...@livnet.com webm...@livnet.com
------------------------------------------------------------------------