Best practice for executing a CGI in iwhome/httpd?

OctavianMH

Greetings all, and thanks in advance!

I was hoping for some best practice suggestions...here's the scenario.

Company A was contracted by us to create a Teamsite driven subsection of our website which was originally created by Company B. Company A decided to implement this process via a CGI script that lives in iwhome/httpd/iw-bin/bin. Which is then executed by a ui extension from within ContentCenter Pro. Company A ran into a few permissions problems when installing the module, most of which came down to the fact that the CGI script was being run by the 'iwui' user, whose privileges, in the end, had to be increased to root level (or nearly).

Company B is now beginning a development job on our website, and part of that project is upgrading to TS 6.5, we're running 6.1 at the moment. Their teamsite architect, after hearing about Company A's work, was a little exasperated at the security hole Company A created by increasing iwui's privs, and suggested that those changes were unnecessary, mentioning something about a CGI wrapper that Company A's script could've been run by, this taking iwui out of the picture .. somehow.

Now, I would love to go back to Company A and say "we're upgrading to 6.5 and are worried your module might break, since some permissions things change, etc.. maybe you should've architected it this other way...?" But I don't know enough about this subsystem to talk about it intelligently.

If this made ANY sense, can someone suggest how Company A should've executed the CGI script (this rumored wrapper..) to avoid having to elevate iwui's privs, thus opening a security hole. And is this hole a big deal, in the end, or not so much?

Thanks!!!

LooseCannon

Company B's architect is correct. The CGI should be run as the user not iwui. You do this by calling the CGI with the wrapper :

http://myDomain.com/iw-bin/iw_cgi_wrapper.cgi/myCustom.cgi