From 4e7c58a85289fd84aef1aebf1c8afb58b4322dd6 Mon Sep 17 00:00:00 2001 From: florian Date: Mon, 17 Mar 2014 13:39:29 +0000 Subject: jturner pointed out that if one wants to run cgi scripts outside /cgi-bin SCRIPT_NAME doesn't cut it. The spec says: "The SCRIPT_NAME variable MUST be set to a URL path". Use SCRIPT_FILENAME which can be an absolute filesystem path for these cases and fall back to using SCRIPT_NAME if SCRIPT_FILENAME is not present. Details how to handle this worked out by jturner and sthen. Based on an erlier diff by jturner. Tested by jturner OK jturner, sthen --- slowcgi.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/slowcgi.c b/slowcgi.c index af07bd8..7c914f6 100644 --- a/slowcgi.c +++ b/slowcgi.c @@ -1,4 +1,4 @@ -/* $OpenBSD: slowcgi.c,v 1.27 2014/01/19 00:01:05 djm Exp $ */ +/* $OpenBSD: slowcgi.c,v 1.28 2014/03/17 13:39:29 florian Exp $ */ /* * Copyright (c) 2013 David Gwynne * Copyright (c) 2013 Florian Obser @@ -741,7 +741,11 @@ parse_params(uint8_t *buf, uint16_t n, struct request *c, uint16_t id) env_entry->val[name_len] = '\0'; if (val_len < MAXPATHLEN && strcmp(env_entry->val, - "SCRIPT_NAME") == 0) { + "SCRIPT_NAME") == 0 && c->script_name[0] == '\0') { + bcopy(buf, c->script_name, val_len); + c->script_name[val_len] = '\0'; + } else if (val_len < MAXPATHLEN && strcmp(env_entry->val, + "SCRIPT_FILENAME") == 0) { bcopy(buf, c->script_name, val_len); c->script_name[val_len] = '\0'; } -- cgit v1.2.3-2-gb3c3