#!/usr/bin/perl # # Octave-cgi main file... written by mai@ms.uky.edu. # The code is under GPL 2.0 copyright. # For security reason, Octave's file/directory commands are disabled. my($temp); my $myrndnumber = int(rand(9999)+1); my $octavefile="octave$myrndnumber"; my $pngfilename="octave$myrndnumber.png"; $temp = "/tmp"; $allowedhost = 'per.ibu.edu.tr'; #use strict; use CGI; my($results, $in); my($q)= new CGI; # Reconstruct any inputs #if ($results=$q->param('CALLER')) { # $results=''; # } #@input = $q->param('INPUT'); $in=join("\n",$q->param('INPUT')); # Print input form #print $q->header, print 'Content-type: text/html
Lütfen aşağıdaki kutucuğa octave programını giriniz.
'; # Basic security checks if (($q->referer()) && ($q->referer() !~ /$allowedhost\//)) { print 'Sorry, the website which sent you here is not allowed to run scripts here. Email the author of the previous page and ask them to look into it.'; exit; } if ($in) { # Give our input (if any) to a file , filter out some commands. chdir($temp); open(R, ">$temp/$octavefile.in"); print R "gset term png\n"; print R "gset output \"$pngfilename\"\n"; $in =~ s/\r//g; $in =~ s/(dir|shell|system|rmdir|ls|mkdir|rename|unlink)[^\n]*//g; $in =~ s/(umask|mkfifo|readdir|popen|fork|cd|chdir|getpw)[^\n]*//g; # I think they're the only really nasty things to trap... print R $in."\n"; # End it politely (not an EOF at the end of a command) print R "quit\n"; close R; my $x = system(`octave --traditional -x -H -f <$temp/$octavefile.in >$temp/$octavefile.out`); #my $x = system(`chmod 644 $pngfilename`); # Read the output open(IN, "$temp/$octavefile.out"); # Tidy it up for HTML $results = join(" ",
*** Octave-cgi reference '.$$.':' .`date +%Y%m%d%H%M%S`."\n".$results .''; # Have we got a call-back name? # if ($in=$q->param('CALLER')) { # print '