| Subject: | Crash with & in filename |
File not found error when filename contains "&". (Users do the
darndest things!)
Seems to me that the filename isn't being properly quoted, so the
&secondpartoffilename is being parsed as a query string parameter.
Diagnosis:
So, filename a&b.jpg gets linked as ?mode=view&photo=a%26b.jpg
But it gets processed as though it were ?mode=view&photo=a&b.jpg
A couple of lines of debug in show_image prove this to be the case:
my $foof = $query->param('b.jpg');
$foof = "UnDeFiNeD" if( !defined $foof );
die "DEBUG: |$foof|";
will report the empty string (not undefined). So CGI.pm isn't decoding
the parameter string intended.
Real example:
-rw-r--r-- 1 gallery gallery 1986166 Oct 28
12:38 /home/gallery/webspace/Anthony GH 2007/Emma&Seal.jpg
Produces this crash:
[Sat Mar 08 05:31:35 2008] [error] [client 192.168.148.108] Error
executing run mode 'full': ERROR: Cannot
open /home/gallery/webspace/Anthony GH 2007/Emma: No such file or
directory
at /usr/lib/perl5/site_perl/5.8.8/CGI/Application/PhotoGallery.pm line
437., referer: https://gallery.litts.net/gallery.cgi?mode=view&photo=%
2FAnthony%20GH%202007%2FEmma%26Seal.jpg
[Sat Mar 08 05:31:35 2008] [error] [client 192.168.148.108]
at /home/gallery/cgi-bin/gallery.cgi line 17, referer:
https://gallery.litts.net/gallery.cgi?mode=view&photo=%2FAnthony%20GH%
202007%2FEmma%26Seal.jpg
[Sat Mar 08 05:31:35 2008] [error] [client 192.168.148.108] Premature
end of script headers: gallery.cgi, referer:
https://gallery.litts.net/gallery.cgi?mode=view&photo=%2FAnthony%20GH%
202007%2FEmma%26Seal.jpg
But
mv Emma\&Seal.jpg EmmaAndSeal.jpg
resolves it.
However, since users will assign arbitrary names to files, gallery
needs to handle them.
Also, you might want to consider sending errors to the browser -
use CGI::Carp qw(fatalsToBrowser); is a minimalist way to get this,
though it would be better to generate a more application-specific page
for the obvious cases - like file not found on open.