From: Anders Borch <spam@...>
Date: 2003-06-24T00:58:33+09:00
Subject: Re: File upload and mod-ruby

Sacha Schlegel wrote:

> On Mon, 2003-06-23 at 19:36, George Moschovitis wrote:
> 
>>Hello everybody,
>>
>>I am wondering if anyone can help me with implementing a file-upload
>>script using Apache2.0 and modruby1.1.1
>>
>>lets say I have a form like this
>>
>><form name='fileupload' action='upload.rb' method='post'>
>><input type='file' name='myfile'/><br/>
>><input type='submit'/>
>></form>
>>
>>what code should i use in upload.rb to grabe the filedata + filename
>>from the apache/modruby request. I want to save the file in a custom
>>directory.
>>
> 
> 
> This is for apache 1.3.x not sure about 2 though:
> 
> ----------------------------------------
> require 'cgi'
> cgi = CGI.new()  # New CGI object
> 
> myfile = cgi.params['myfile'].first.path
> 
> ----------------------------------------
> 
> myfile is the file name which you can sue for File.new(myfile)
> 
> you might have to look at the http.conf 
> 
> <IfModule mod_ruby.c>
>   ...
>   RubySafeLevel 0
>   ...
> </IfModule>
> 
> in particular RubySafeLevel if you run into permission
> errors/exceptions.
> 

You should consider not lowering your safe level as there could be lots 
of exploits in any file handling code if you are not very careful. I 
recommend at least safe level 1 and 2 wouldn't hurt either if you have 
world writable locations...

See http://rubycentral.com/book/taint.html for information on taint levels.

/Anders

-- 
dc -e 
4dd*od3*dddn1-89danrn10-dan3+ann6*dan*2*an13dn1+dn2-dn3+5*ddan2/9+an13nap