nixCraft

mariolima · #1 (**permalink**) 07-10-2007, 06:57 PM

Hi:

I have a very old and simple form Script written in Perl (see it below), which has no kind of security and probably can easily be hacked. The problem is that I have several domains / sites using it and I don't have enough time now to move to another Script.

So, all I need is to implement some level of security on it, by adding a control to avoid that forms hosted elsewhere could use it. So, just Domains hosted at my Server could use it.

I have seen controls like this in some Scripts, by using an array, like for instance @referrers, where I would be adding the Domains names that would be authorized. But considering that there are more than 200 Domains using it, I would like to have something smarter, like controlling through IP address.

Another control would be not to permit passing HTML tags or creating CC or BCC fields.

Please, looking forward to a help. Thanks a lot in advance.

Mario./
__________________________________________________ _______________________________

#!/usr/local/bin/perl
$mailprog = '/usr/lib/sendmail';
print "Content-type: text/html\n\n";
if ($ENV{'REQUEST_METHOD'} eq "get") { $buffer = $ENV{'QUERY_STRING'}; }
else { read(STDIN, $buffer, $ENV{'CONTENT_LENGTH'}); }
@nvpairs = split(/&/, $buffer);
foreach $pair (@nvpair

{
($name, $value) = split(/=/, $pair);

$value =~ tr/+/ /;
$value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg;

$FORM{$name} = $value;
}
print <<MESSAGES;
<HTML>
<HEAD>
<TITLE>$FORM{'HEADER'}</TITLE>
<STYLE TYPE="text/css"> A:link, A:vlink { text-decoration: none; } </STYLE>
<link rel="stylesheet" href="http://www.multisites.com.br/estilos/padrao.css" type="text/css">
</HEAD>
<BODY BGCOLOR=ffffff text=000000 background="">
<TABLE width=610 cellpadding=0 cellspacing=0 border=0>
<TR>
<TD valign=top>
<center><font class=texto12><b>$FORM{'HEADER'}</b></font></center>
<FONT class=texto11>
<blockquote>
<HR>
Hi <B>$FORM{'NOME'}</B>, thank you for contacting us. We will be getting in touch.<BR>
<BR>
<CENTER><a href="javascript:history.go(-1)"><font class=texto10><b>BACK</b></font></a></CENTER>
<BR>
</blockquote>
<BR>
</FONT>
</TD></TABLE>
</BODY></HTML>
MESSAGES
$recipient = $FORM{'DESTINO'};
open (MAIL, "|$mailprog $recipient") || die "$mailprog not available.\n";
print MAIL "From: $FORM{'EMAIL'} ($FORM{'NOME'})\n";
print MAIL "Subject: $FORM{'ASSUNTO'} \n\n";
print MAIL "_________________________________________________ __________\n\n";
foreach $pair (@nvpair

{
($name, $value) = split(/=/, $pair);
$value =~ tr/+/ /;
$value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg;
$name =~ tr/+/ /;
$name =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg;
if (($value ne "") &&
($name ne "DESTINO") &&
($name ne "HEADER"))
{
print MAIL "$name: ";
print MAIL "$value\n\n";
}
}
print MAIL "\n";
close (MAIL);

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Change root password using perl script?	Raj1	Solaris/OpenSolaris	8	06-13-2008 11:01 PM
Simple ipcalc perl script	unixfoo	Shell scripting	0	01-24-2008 06:59 PM
avoid displaying errors while executing a script	vikas027	Shell scripting	4	10-31-2007 11:57 AM
let users change password using perl script?	james bond	Getting started tutorials	9	05-24-2007 10:32 PM
few quick perl questions	raj	All about FreeBSD/OpenBSD/NetBSD	1	06-30-2005 12:27 AM

nixCraft

Quick improvements to avoid hacking to a Perl form Script

Quick improvements to avoid hacking to a Perl form Script

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)

Similar Threads