CGI脚本不执行的bash命令，如“CP” [英] CGI script not executing bash commands such as 'CP'
问题描述
我有一个Web服务器（apache2的）成立了一个名为.cgi文件扩展名执行文件。这适用于某些命令。但是，我需要它的文件/var/www/on.html复制到/var/www/a1.html的位置。
我使用Debian Linux操作系统。该脚本如下：
＃！/斌/庆典
回声内容类型：text / html的
回声＆LT; HTML和GT;＆LT; HEAD＆GT;＆LT;标题＆GT;光的
回声＆LT; /标题＆gt;中
回声＆LT; META HTTP-当量=刷新内容='1; URL = HTTP：//86.11.221.243/＆gt;中
回声＆LT; /头＆GT;＆LT;身体GT;
回声$（GPIO模式8出来）＃此开灯
回声$（CP /var/www/on.html /var/www/a1.html）
回声＆LT; /身体GT;＆LT; / HTML＆gt;中
我用cp到一个HTML网页复制与绿色背景，以取代它有一个黑色背景的文件。这是用来指示LED a1的状态（列的行1）。
回声$（CP /var/www/on.html /var/www/a1.html）
的
$（...）运行括号中的命令是由输出的（到的标准输出的）该命令的。一个成功的 CP没有任何输出。一个失败的CP是给错误消息的标准错误的，不是的标准输出的。在两种情况下，效果是的回声，（输出一个空行，即，单一的新行），也许复制文件的附加副作用。而该副本运行作为www数据用户（一个运行Web服务器）......所以会失败，如果/无功/网络/不是由它写（我的系统上/无功/网络/是归根：根，而不是可写，所以www数据可以在里面不写）。所以，没有必要有
回声在那个特定的CP行。你可以用CP /var/www/on.html /var/www/a1.html取代它;记录CP得到$？（但使用CP不是很好，见下文）顺便说一句，在
CP不是一个原子操作。如果两个这样的CGI进程正在运行，同时没有精确定义会发生什么。也许你想强迫与LN -f硬链接（即是的一个原子操作），而不是CP您可以让
/无功/网络/按www数据，或世界可写拥有。在这两种情况下，这是一个安全漏洞（你可能买得起一个专门的内部的web服务器，才能访问您的家庭网络）。如果你能负担得起替换/var/www/on.html和/var/www/a1.html按/var/www/mydir/on.html和/var/www/mydir/a1.html（所以改变HTML code指的是他们），你可以简单地通过www数据拥有的/无功/网络/ MYDIR /目录和/或可写您可以在的setuid 可执行文件（例如codeA小C包装你的shell脚本计划，该计划的execve（2）你的脚本）和
CHMOD U + SRX编译后的可执行文件。您可能会增加（至少缓解调试）一些记录器（1 ）命令脚本（和/或一些的syslog（3 ）到C程序包装它），然后寻找到的消息在
/无功/日志/顺便说一句，在树莓派，你可以用专用的C程序更换您的Apache Web服务器（使用一些HTTP服务器库一样的 libonion ）
考虑或许也是 AJAX技术（也许的的WebSockets ）。
I have a web server (apache2) set up to execute files with a .cgi file extension. This works for some commands. However, I need it to copy the file /var/www/on.html to the location of /var/www/a1.html.
I am using Debian Linux. The script is as follows:
#!/bin/bash echo "Content-type: text/html" echo "<html><head><title>Light on" echo "</title>" echo "<meta http-equiv='refresh' content='1; url=http://86.11.221.243' />" echo "</head><body>" echo "$(gpio mode 8 out) #this turns the light on" echo "$(cp /var/www/on.html /var/www/a1.html)" echo "</body></html>"I am using cp to copy a html webpage with a green background to replace a file which has a black background. This is used to indicate the status of the LED a1 (column a row 1).
解决方案echo "$(cp /var/www/on.html /var/www/a1.html)"
The
$(...)is running the command inside the parenthesis and is replaced by the output (to stdout) of that command. A successfulcpdoes not have any output. A failingcpis giving an error message to stderr, not stdout. In both cases the effect is that ofecho ""(outputs an empty line, i.e. a single newline), with perhaps an additional side effect of copying the file. And that copy is run as thewww-datauser (the one running your web server) .... so would fail if/var/www/is not writable by it (on my system/var/www/is owned byroot:rootand is not world writable, sowww-datacannot write in it).So, no need to have
echoon that particularcpline. You could replace it withcp /var/www/on.html /var/www/a1.html ; logger cp got $?(but usingcpis not very good, see below)BTW, the
cpis not an atomic operation. What would happen if two such CGI processes are running concurrently is not exactly defined. Perhaps you want to force a hard link withln -f(that is an atomic operation) instead ofcpYou could make
/var/www/owned bywww-data, or world-writable. In both cases, that is a security hole (which you might afford on a dedicated internal webserver, accessible only from your home network). If you can afford replacing/var/www/on.htmland/var/www/a1.htmlby/var/www/mydir/on.htmland/var/www/mydir/a1.html(so change the HTML code refering to them) you could simply have a/var/www/mydir/directory owned and/or writable bywww-dataYou could wrap your shell script in a setuid executable (e.g. code a small C program which would execve(2) your script) and
chmod u+srxthe compiled executable.You might add (at least to ease debug) some logger(1) command to your script (and/or some syslog(3) to your C program wrapping it), then look into messages under
/var/log/BTW, on a Rasberry Pi, you might replace your apache web server with a dedicated C program (e.g. using some HTTP server library like libonion)
Consider perhaps also AJAX techniques (perhaps combined with websockets) on the browser side.
这篇关于CGI脚本不执行的bash命令，如“CP”的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
