CGI.pm has poor list of temp directories on Windows #7395

p5pRT · 2004-06-29T07:27:11Z

Migrated from rt.perl.org#30524 (status was 'resolved')

Searchable as RT30524$

p5pRT · 2004-06-29T07:27:12Z

From perl@glob.com.au

Created by perl@glob.com.au

On Windows, CGI.pm uses the following paths to locate the Temp directory location:

$ENV{TMPDIR}
\usr\tmp
\var\tmp
C:\temp
\tmp
\temp
\Temporary Items
\WWW_ROOT
\SYS$SCRATCH
C:\system\temp
.

This isn't a very good list from a Windows point of view. My temp directory is set
to D:\Temp, so it isn't used for scripts that run on my wwwroot (which is located on
drive E).

This results in the "CGI open of tmpfile" error message.

Ideally CGI.pm should use the Windows GetTempPath API.

Perl envrionment information is wrong as perlbug wants sendmail :(

Perl Info


Flags:
    category=core
    severity=medium

Site configuration information for perl v5.8.0:

Configured by root at Tue Jul  1 09:25:35 WST 2003.

Summary of my perl5 (revision 5.0 version 8 subversion 0) configuration:
  Platform:
    osname=linux, osvers=2.2.16, archname=i686-linux
    uname='linux darling 2.2.16 #5 smp thu apr 4 16:57:41 wst 2002 i686 unknown '
    config_args=''
    hint=recommended, useposix=true, d_sigaction=define
    usethreads=undef use5005threads=undef useithreads=undef usemultiplicity=undef
    useperlio=define d_sfio=undef uselargefiles=define usesocks=undef
    use64bitint=undef use64bitall=undef uselongdouble=undef
    usemymalloc=n, bincompat5005=undef
  Compiler:
    cc='cc', ccflags ='-fno-strict-aliasing -I/usr/local/include -DDEBUGGING -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm',
    optimize='-O2',
    cppflags='-fno-strict-aliasing -I/usr/local/include -DDEBUGGING -I/usr/include/gdbm'
    ccversion='', gccversion='egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)', gccosandvers=''
    intsize=4, longsize=4, ptrsize=4, doublesize=8, byteorder=1234
    d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=12
    ivtype='long', ivsize=4, nvtype='double', nvsize=8, Off_t='off_t', lseeksize=8
    alignbytes=4, prototype=define
  Linker and Libraries:
    ld='cc', ldflags =' -L/usr/local/lib'
    libpth=/usr/local/lib /lib /usr/lib
    libs=-lnsl -lndbm -lgdbm -ldb -ldl -lm -lc -lposix -lcrypt -lutil
    perllibs=-lnsl -ldl -lm -lc -lposix -lcrypt -lutil
    libc=/lib/libc-2.1.3.so, so=so, useshrplib=false, libperl=libperl.a
    gnulibc_version='2.1.3'
  Dynamic Linking:
    dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-rdynamic'
    cccdlflags='-fpic', lddlflags='-shared -L/usr/local/lib'

Locally applied patches:
    


@INC for perl v5.8.0:
    /usr/lib/perl5/5.8.0/i686-linux
    /usr/lib/perl5/5.8.0
    /usr/lib/perl5/site_perl/5.8.0/i686-linux
    /usr/lib/perl5/site_perl/5.8.0
    /usr/lib/perl5/site_perl/5.6.1
    /usr/lib/perl5/site_perl/5.005
    /usr/lib/perl5/site_perl
    .


Environment for perl v5.8.0:
    HOME=/root
    LANG=en_US
    LANGUAGE (unset)
    LD_LIBRARY_PATH (unset)
    LOGDIR (unset)
    PATH=/usr/bin:/bin:/usr/local/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/sbin:/usr/local/bin:/usr/local/jdk118/bin:/root/bin
    PERL_BADLANG (unset)
    SHELL=/bin/bash

p5pRT · 2004-07-08T18:52:39Z

From @schwern

On Tue, Jun 29, 2004 at 07:27:13AM -0000, perl @ glob. com. au wrote:

On Windows, CGI.pm uses the following paths to locate the Temp directory location:

$ENV{TMPDIR}
\usr\tmp
\var\tmp
C:\temp
\tmp
\temp
\Temporary Items
\WWW_ROOT
\SYS$SCRATCH
C:\system\temp
.

This isn't a very good list from a Windows point of view. My temp directory is set
to D:\Temp, so it isn't used for scripts that run on my wwwroot (which is located on
drive E).

There's only so far CGI.pm can bend trying to guess the location of a
temp directory. Rather than growing an already long list, you could
just set the TMPDIR environment variable. The helpful side effect of
this is lots of other programs and modules use that.

Ideally CGI.pm should use the Windows GetTempPath API.

Instead of CGI.pm having to hard code any platform specific temp dir code,
it should probably just use File::Spec->tmpdir.

On a side note, File::Spec::Win32::tmpdir() is not using the Win32 API to
find the temp directory.

--
Michael G Schwern schwern@pobox.com http://www.pobox.com/~schwern/
Commence simultaneous panic on my mark.

p5pRT · 2004-07-08T18:52:41Z

The RT System itself - Status changed from 'new' to 'open'

p5pRT · 2004-07-08T19:05:54Z

From @demerphq

Schwern wrote...

There's only so far CGI.pm can bend trying to guess the location of a
temp directory. Rather than growing an already long list, you could
just set the TMPDIR environment variable. The helpful side effect of
this is lots of other programs and modules use that.

Ideally CGI.pm should use the Windows GetTempPath API.

Well, a simpler approach is to use $ENV{TEMP} or $ENV{TMP} isnt it? Both of
these vars should be set on a Windows system afaik. Of course using the
Windows API is better, but IMO its pretty much of a muchness. (Especially as
I don't see GetTempPath() exposed through the normal Win32 modules, and thus
using it would require use of Win32::API which is probably undesirable for
File::Spec)

Instead of CGI.pm having to hard code any platform specific
temp dir code,
it should probably just use File::Spec->tmpdir.

On a side note, File::Spec::Win32::tmpdir() is not using the
Win32 API to find the temp directory.

A quick check shows it uses the correct ENV vars though. But it will ignore
them under tainting. Something that I think is probably wrong. It should
probably detaint and verify the directory exists and then be happy.

Yves

p5pRT · 2004-07-09T01:20:48Z

From perl@glob.com.au

Well, a simpler approach is to use $ENV{TEMP} or $ENV{TMP} isnt it? Both of
these vars should be set on a Windows system afaik. Of course using the
Windows API is better, but IMO its pretty much of a muchness. (Especially as
I don't see GetTempPath() exposed through the normal Win32 modules, and thus
using it would require use of Win32::API which is probably undesirable for
File::Spec)

i had to work around this issue for bugzilla, see

http://bugzilla.mozilla.org/show_bug.cgi?id=248988

IIS exposes $ENV{TEMP} and $ENV{TMP} to cgi, however apache does not, so under
apache we're back to square one.

i ended up doing this:

$ENV{'TMPDIR'} = $ENV{'TEMP'} || $ENV{'TMP'} || "$ENV{'WINDIR'}\\TEMP";

i think that the simplest fix for this bug would be to add these paths to the
list that CGI.pm checks.

begin-base64 644 signature.gif
R0lGODlhbQAHAIAAAABPo////ywAAAAAbQAHAAACfAxuGAnch+Bibkn7FL1p
XgVl4Ig1jjlZRoqybgun2Cur5uOunq7u/Ipq7WIyIc7XG9JquEgumPzdlhTf
h0O83kDJaXEm8mRHwXKJy5sac7qYOpT+gtv0n+0ujQOfdqh16caWt0foBViH
N1PRMXimiLUGt3ElVimlgbllWAAAOw==

p5pRT · 2008-08-20T08:40:32Z

From renee.baecker@smart-websolutions.de

This patch adds some more possible temp-directories to the @TEMP array
on Windows...

Cheers,
Renee

p5pRT · 2008-08-20T09:17:04Z

From @Tux

On Wed, 20 Aug 2008 10:39:53 +0200 (CEST),
renee.baecker@smart-websolutions.de wrote:

This patch adds some more possible temp-directories to the @TEMP array
on Windows...

Can we see the patch?
Or does RT not include the patches to the ML?

--
H.Merijn Brand Amsterdam Perl Mongers http://amsterdam.pm.org/
using & porting perl 5.6.2, 5.8.x, 5.10.x, 5.11.x on HP-UX 10.20, 11.00,
11.11, 11.23, and 11.31, SuSE 10.1, 10.2, and 10.3, AIX 5.2, and Cygwin.
http://mirrors.develooper.com/hpux/ http://www.test-smoke.org/
http://qa.perl.org http://www.goldmark.org/jeff/stupid-disclaimers/

p5pRT · 2008-08-20T09:26:28Z

From renee.baecker@smart-websolutions.de

Uups, sorry...

Am 20.08.2008 um 11:16 Uhr haben Sie geschrieben:

On Wed, 20 Aug 2008 10:39:53 +0200 (CEST),
renee.baecker@smart-websolutions.de wrote:

This patch adds some more possible temp-directories to the @TEMP
array
on Windows...

Can we see the patch?
Or does RT not include the patches to the ML?

renee.baecker@smart-websolutions.de

Smart-Websolutions André Windolph und Renée Bäcker GbR
Maria-Montessori-Str. 13
64584 Biebesheim

USt.-ID: DE 228 935 695

Telefon: 01803 - 278 25 51 98 (9 cent/Minute)
E-Mail: info@smart-websolutions.de

Perl-Magazin: http://foo-magazin.de
Perl-Nachrichten: http://perl-nachrichten.de

p5pRT · 2008-08-20T09:26:28Z

From renee.baecker@smart-websolutions.de

CGI.pm.patch

--- CGI.pm.3.40	2008-08-20 09:24:55.000000000 +0200
+++ CGI.pm.3.40.patched	2008-08-20 09:28:38.000000000 +0200
@@ -4050,6 +4050,14 @@
 	   "${vol}${SL}Temporary Items",
            "${SL}WWW_ROOT", "${SL}SYS\$SCRATCH",
 	   "C:${SL}system${SL}temp");
+    
+    if( $CGI::OS eq 'WINDOWS' ){
+       unshift @TEMP,
+           $ENV{TEMP},
+           $ENV{TMP},
+           $ENV{WINDIR} . $SL . 'TEMP';
+    }
+
     unshift(@TEMP,$ENV{'TMPDIR'}) if defined $ENV{'TMPDIR'};
 
     # this feature was supposed to provide per-user tmpfiles, but

p5pRT · 2008-08-20T10:55:07Z

From @Tux

On Wed, 20 Aug 2008 11:26:02 +0200 (CEST),
renee.baecker@smart-websolutions.de wrote:

Uups, sorry...

Am 20.08.2008 um 11:16 Uhr haben Sie geschrieben:

On Wed, 20 Aug 2008 10:39:53 +0200 (CEST),
renee.baecker@smart-websolutions.de wrote:

This patch adds some more possible temp-directories to the @TEMP
array on Windows...

I don't know CGI/Windows enough to tell if those folders should exist,
but wouldn't it be safer to check that? Somewhat like

$CGI::OS eq "WINDOWS" and
unshift @TEMP, grep { -d }
(map { exists $ENV{$_} ? ($ENV{$_}) : () }
qw( TEMP TMP )),
$ENV{WINDIR}.$SL."TEMP");

Can we see the patch?
Or does RT not include the patches to the ML?

--
H.Merijn Brand Amsterdam Perl Mongers http://amsterdam.pm.org/
using & porting perl 5.6.2, 5.8.x, 5.10.x, 5.11.x on HP-UX 10.20, 11.00,
11.11, 11.23, and 11.31, SuSE 10.1, 10.2, and 10.3, AIX 5.2, and Cygwin.
http://mirrors.develooper.com/hpux/ http://www.test-smoke.org/
http://qa.perl.org http://www.goldmark.org/jeff/stupid-disclaimers/

p5pRT · 2008-08-20T11:26:25Z

From renee.baecker@smart-websolutions.de

Am 20.08.2008 um 12:54 Uhr haben Sie geschrieben:

I don't know CGI/Windows enough to tell if those folders should exist,
but wouldn't it be safer to check that? Somewhat like

$CGI::OS eq "WINDOWS" and
unshift @TEMP, grep { -d }
(map { exists $ENV{$_} ? ($ENV{$_}) : () }
qw( TEMP TMP )),
$ENV{WINDIR}.$SL."TEMP");

No, this is not necessary. A few lines later in CGI.pm:

foreach (@TEMP) {
do {$TMPDIRECTORY = $_; last} if -d $_ && -w _;
}

There are already entries in @TEMP that unlikely exist.

Cheers,
Renee

p5pRT · 2008-08-20T12:28:51Z

From @Tux

On Wed, 20 Aug 2008 13:25:58 +0200 (CEST),
renee.baecker@smart-websolutions.de wrote:

Am 20.08.2008 um 12:54 Uhr haben Sie geschrieben:

I don't know CGI/Windows enough to tell if those folders should exist,
but wouldn't it be safer to check that? Somewhat like

$CGI::OS eq "WINDOWS" and
unshift @TEMP, grep { -d }
(map { exists $ENV{$_} ? ($ENV{$_}) : () }
qw( TEMP TMP )),
$ENV{WINDIR}.$SL."TEMP");

No, this is not necessary. A few lines later in CGI.pm:
foreach $@&#8203;TEMP$ \{
  do \{$TMPDIRECTORY = $\_; last\} if \-d $\_ && \-w \_;
\}
There are already entries in @TEMP that unlikely exist.

OK, and $ENV{TEMP} and $ENV{TMP} *always* exist in Win-land?

--
H.Merijn Brand Amsterdam Perl Mongers http://amsterdam.pm.org/
using & porting perl 5.6.2, 5.8.x, 5.10.x, 5.11.x on HP-UX 10.20, 11.00,
11.11, 11.23, and 11.31, SuSE 10.1, 10.2, and 10.3, AIX 5.2, and Cygwin.
http://mirrors.develooper.com/hpux/ http://www.test-smoke.org/
http://qa.perl.org http://www.goldmark.org/jeff/stupid-disclaimers/

p5pRT · 2008-08-20T13:57:20Z

From @Tux

On Wed, 20 Aug 2008 09:42:06 -0400, "Lincoln Stein" <lstein@cshl.edu>
wrote:

Thanks, I'll use your patch in the next release.

Now also in CORE with change #34208
I upped the version to

$CGI::VERSION='3.40_01';

On Wed, Aug 20, 2008 at 5:26 AM, <renee.baecker@smart-websolutions.de>wrote:

Uups, sorry...

Am 20.08.2008 um 11:16 Uhr haben Sie geschrieben:

On Wed, 20 Aug 2008 10:39:53 +0200 (CEST),
renee.baecker@smart-websolutions.de wrote:

This patch adds some more possible temp-directories to the @TEMP
array
on Windows...

Can we see the patch?
Or does RT not include the patches to the ML?

--
H.Merijn Brand Amsterdam Perl Mongers http://amsterdam.pm.org/
using & porting perl 5.6.2, 5.8.x, 5.10.x, 5.11.x on HP-UX 10.20, 11.00,
11.11, 11.23, and 11.31, SuSE 10.1, 10.2, and 10.3, AIX 5.2, and Cygwin.
http://mirrors.develooper.com/hpux/ http://www.test-smoke.org/
http://qa.perl.org http://www.goldmark.org/jeff/stupid-disclaimers/

p5pRT · 2008-08-20T16:48:32Z

p5p@spam.wizbit.be - Status changed from 'open' to 'resolved'

p5pRT · 2008-08-21T08:31:25Z

From lstein@cshl.edu

Thanks, I'll use your patch in the next release.

Lincoln

On Wed, Aug 20, 2008 at 5:26 AM, <renee.baecker@smart-websolutions.de>wrote:

Uups, sorry...

Am 20.08.2008 um 11:16 Uhr haben Sie geschrieben:

On Wed, 20 Aug 2008 10:39:53 +0200 (CEST),
renee.baecker@smart-websolutions.de wrote:

This patch adds some more possible temp-directories to the @TEMP
array
on Windows...

Can we see the patch?
Or does RT not include the patches to the ML?

---

renee.baecker@smart-websolutions.de

Smart-Websolutions André Windolph und Renée Bäcker GbR
Maria-Montessori-Str. 13
64584 Biebesheim

USt.-ID: DE 228 935 695

Telefon: 01803 - 278 25 51 98 (9 cent/Minute)
E-Mail: info@smart-websolutions.de

Perl-Magazin: http://foo-magazin.de
Perl-Nachrichten: http://perl-nachrichten.de

--
Lincoln D. Stein

Ontario Institute for Cancer Research
101 College St., Suite 800
Toronto, ON, Canada M5G0A3
416 673-8514
Assistant: Stacey Quinn <Stacey.Quinn@oicr.on.ca>

Cold Spring Harbor Laboratory
1 Bungtown Road
Cold Spring Harbor, NY 11724 USA
(516) 367-8380
Assistant: Sandra Michelsen <michelse@cshl.edu>

p5pRT closed this as completed Aug 20, 2008

p5pRT added Severity Medium distro-Linux type-core labels Oct 18, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CGI.pm has poor list of temp directories on Windows #7395

CGI.pm has poor list of temp directories on Windows #7395

p5pRT commented Jun 29, 2004

p5pRT commented Jun 29, 2004

p5pRT commented Jul 8, 2004

p5pRT commented Jul 8, 2004

p5pRT commented Jul 8, 2004

p5pRT commented Jul 9, 2004

p5pRT commented Aug 20, 2008

p5pRT commented Aug 20, 2008

p5pRT commented Aug 20, 2008

p5pRT commented Aug 20, 2008

p5pRT commented Aug 20, 2008

p5pRT commented Aug 20, 2008

p5pRT commented Aug 20, 2008

p5pRT commented Aug 20, 2008

p5pRT commented Aug 20, 2008

p5pRT commented Aug 21, 2008

CGI.pm has poor list of temp directories on Windows #7395

CGI.pm has poor list of temp directories on Windows #7395

Comments

p5pRT commented Jun 29, 2004

p5pRT commented Jun 29, 2004

From perl@glob.com.au

Created by perl@glob.com.au

p5pRT commented Jul 8, 2004

From @schwern

p5pRT commented Jul 8, 2004

p5pRT commented Jul 8, 2004

From @demerphq

p5pRT commented Jul 9, 2004

From perl@glob.com.au

begin-base64 644 signature.gif R0lGODlhbQAHAIAAAABPo////ywAAAAAbQAHAAACfAxuGAnch+Bibkn7FL1p XgVl4Ig1jjlZRoqybgun2Cur5uOunq7u/Ipq7WIyIc7XG9JquEgumPzdlhTf h0O83kDJaXEm8mRHwXKJy5sac7qYOpT+gtv0n+0ujQOfdqh16caWt0foBViH N1PRMXimiLUGt3ElVimlgbllWAAAOw==

p5pRT commented Aug 20, 2008

From renee.baecker@smart-websolutions.de

p5pRT commented Aug 20, 2008

From @Tux

p5pRT commented Aug 20, 2008

From renee.baecker@smart-websolutions.de

p5pRT commented Aug 20, 2008

From renee.baecker@smart-websolutions.de

p5pRT commented Aug 20, 2008

From @Tux

p5pRT commented Aug 20, 2008

From renee.baecker@smart-websolutions.de

p5pRT commented Aug 20, 2008

From @Tux

p5pRT commented Aug 20, 2008

From @Tux

p5pRT commented Aug 20, 2008

p5pRT commented Aug 21, 2008

From lstein@cshl.edu

begin-base64 644 signature.gif
R0lGODlhbQAHAIAAAABPo////ywAAAAAbQAHAAACfAxuGAnch+Bibkn7FL1p
XgVl4Ig1jjlZRoqybgun2Cur5uOunq7u/Ipq7WIyIc7XG9JquEgumPzdlhTf
h0O83kDJaXEm8mRHwXKJy5sac7qYOpT+gtv0n+0ujQOfdqh16caWt0foBViH
N1PRMXimiLUGt3ElVimlgbllWAAAOw==