iw_cgi_wrapper.cgi issue

Guys,

Does anyone know how to convert perl code to cgi. I don't mean perl with cgi.

If you look at show_env.cgi file it has some different characters than when you have a regular perl/cgi file. Interwoven engineers said my custom_import.cgi needs to be in the same format so that impersonation can work with iw_cgi_wrapper.cgi.

Modified by says "SYSTEM" and I need it to be actual user who uploaded file. Any ideas/suggestions. Thanks.

Find more posts tagged with

Comments

ISCBorisB

Guys,

Does anyone know how to convert perl code to cgi. I don't mean perl with cgi.

If you look at show_env.cgi file it has some different characters than when you have a regular perl/cgi file. Interwoven engineers said my custom_import.cgi needs to be in the same format so that impersonation can work with iw_cgi_wrapper.cgi.

Modified by says "SYSTEM" and I need it to be actual user who uploaded file. Any ideas/suggestions. Thanks.

- show_env.cgi is a binary "platform native" executable compiled from some proprietary TS C++ Code.
Unless you do the same ie, re-write your module in some compiled language (not necessarily C++) and
compile it into executable that will run on your platform, there is no way on Earth that you can make
it "to be in the same format".

- That said, I've successfully used "iw_cgi_wrapper" to impersonate (set Effective UID of) logged user
for variety of pure Perl/Shell Custom menu items, CGI Scripts, callServer invocations and so on. In other
words, your Script does not have to be binary for impersonation to work.

However, the Wrapper is not perfect. I had my fare share of troubles with it. I was able to resolve some of
them and gave up on others. For example, Wrapper may have issues in SSL mode, it does not seem to like Form's
input type "file" etc...

Without looking at your custom Import Menu configuration and code I can not make any non-trivial suggestions.
I'm just trying to explain what you are facing, perhaps it may help a little...

becool321

Thanks Boris for your reply, here is my custom code.

The code works perfectly outside the wrapper with exception of SYSTEM id issue.

becool321

Previous attachment file had a bug, file contents not uploaded 0 bytes.

Here is corrected file which now includes read and buffer to get all file contents, correct size.

ISCBorisB

Previous attachment file had a bug, file contents not uploaded 0 bytes.

Here is corrected file which now includes read and buffer to get all file contents, correct size.

One questionable command in the enclosed code is
my @ts_dir = $ENV{QUERY_STRING};

That implies Menu's Form "Get" Method. Double check that you are really getting anything there
if this goes through the Wrapper. I might be wrong but I *believe* that the Wrapper actually
uses "Post" rather than "Get" to (re)Post Menu's Form Data.

If that's indeed the case, QUERY_STRING may be empty and you'll generate something like
"...url=http://YourDomain/iw-cc/import?vpath=&done_page=..." in your cgi output.
Since vpath evaluates to literally nothing that obviously can not work, etc...

becool321

Boris vpath actually has the valid path below:

//testserver/default/main/TestOnline/WORKAREA/design/sites

I get all necessary values which makes upload working correctly. The only issue is the SYSTEM user id when run as /iw-bin/custom_import.cgi via ui_custom.xml.

I want to replace SYSTEM user id with the actual user id who performed the upload.

To my understanding the only way to achieve this is through the /iw-bin/iw_cgi_wrapper.cgi/custom_import.ipl command via ui_custom.xml which doesn't work for me, I get internal server error.

If I try /iw-bin/iw_cgi_wrapper.cgi/custom_import.cgi command via ui_custom.xml I get the below popup error:

Teamsite : Wrapper
Error trying to open a pipe to: I:\Interwoven\TeamSite\httpd\iw-bin\custom_import.cgi(1)

Adam Stoller

Boris vpath actually has the valid path below:

//testserver/default/main/TestOnline/WORKAREA/design/sites

I get all necessary values which makes upload working correctly. The only issue is the SYSTEM user id when run as /iw-bin/custom_import.cgi via ui_custom.xml.

I want to replace SYSTEM user id with the actual user id who performed the upload.

To my understanding the only way to achieve this is through the /iw-bin/iw_cgi_wrapper.cgi/custom_import.ipl command via ui_custom.xml which doesn't work for me, I get internal server error.

If I try /iw-bin/iw_cgi_wrapper.cgi/custom_import.cgi command via ui_custom.xml I get the below popup error:

Teamsite : Wrapper
Error trying to open a pipe to: I:\Interwoven\TeamSite\httpd\iw-bin\custom_import.cgi(1)

You wrote that using a command of:

/iw-bin/custom_import.cgi

works but the files are owned by SYSTEM
and that:

/iw-bin/iw_cgi_wrapper.cgi/custom_import.ipl

gives you an internal server error
and that:

/iw-bin/iw_cgi_wrapper.cgi/custom_import.cgi

gives you a pipe error

Is the script "custom_import.ipl" or "custom_import.cgi"?
Are you sure the script does not have any syntactic errors or warnings?
(i.e.: did you run:

iwperl -w -c iwhome\httpd\iw-bin\custom_import.ipl

)

Without seeing the actual code, it is difficult to debug why you are getting the behavior you're seeing - but my guess is that there is a bug in your code and you'll have to debug it yourself to get it to function with iw_cgi_wrapper.cgi -- however, that's only the first part of the issue. If the logged in TS user does not have logon locally privileges on the server, there's a very good chance that iw_cgi_wrapper.cgi won't make any difference to the end-result ownership of the uploaded file.

becool321

Ghoti the script is actually custom_import.cgi. I just made a copy custom.ipl to try resolution. Syntax check shows output below.

1st check shows when Im using the taint switch "#!I:\Interwoven\TeamSite\iw-perl\bin\iwperl -Tw" and 2nd check when I remove it "#!I:\Interwoven\TeamSite\iw-perl\bin\iwperl -w". But I think I should leave taint switch in to make script more secure.

I:\Interwoven\TeamSite\iw-perl\bin>iwperl.exe -wc \Interwoven\TeamSite\httpd\iw-
bin\custom_import.cgi
Too late for "-T" option at \Interwoven\TeamSite\httpd\iw-bin\custom_import.cgi
line 1.

I:\Interwoven\TeamSite\iw-perl\bin>iwperl.exe -wc \Interwoven\TeamSite\httpd\iw-
bin\custom_import.cgi
\Interwoven\TeamSite\httpd\iw-bin\custom_import.cgi syntax OK

I:\Interwoven\TeamSite\iw-perl\bin>

I'm capable of logging into server through remote desktop so I do have logon local privileges.

Adam Stoller

Ghoti the script is actually custom_import.cgi. I just made a copy custom.ipl to try resolution. Syntax check shows output below.

1st check shows when Im using the taint switch "#!I:\Interwoven\TeamSite\iw-perl\bin\iwperl -Tw" and 2nd check when I remove it "#!I:\Interwoven\TeamSite\iw-perl\bin\iwperl -w". But I think I should leave taint switch in to make script more secure.

I:\Interwoven\TeamSite\iw-perl\bin>iwperl.exe -wc \Interwoven\TeamSite\httpd\iw-
bin\custom_import.cgi
Too late for "-T" option at \Interwoven\TeamSite\httpd\iw-bin\custom_import.cgi
line 1.

I:\Interwoven\TeamSite\iw-perl\bin>iwperl.exe -wc \Interwoven\TeamSite\httpd\iw-
bin\custom_import.cgi
\Interwoven\TeamSite\httpd\iw-bin\custom_import.cgi syntax OK

I:\Interwoven\TeamSite\iw-perl\bin>

I'm capable of logging into server through remote desktop so I do have logon local privileges.

becool321

Ok Ghoti, I remove -Tw from shebang line.

use strict and warnings were already in the code. Output didnt change when I ran syntax check with iwperl -wc again, syntax ok.

Now I get error below when I run /iw-bin/iw_cgi_wrapper.cgi/custom_import.ipl command via ui_custom.xml:

Permission denied trying to execute the command iw.group.import

when run /iw-bin/iw_cgi_wrapper.cgi/custom_import.cgi via ui_custom.xml I still get:

Teamsite : Wrapper
Error trying to open a pipe to: I:\Interwoven\TeamSite\httpd\iw-bin\custom_import.cgi(1)

Adam Stoller

Ok Ghoti, I remove -Tw from shebang line.

use strict and warnings were already in the code. Output didnt change when I ran syntax check with iwperl -wc again, syntax ok.

Now I get error below when I run /iw-bin/iw_cgi_wrapper.cgi/custom_import.ipl command via ui_custom.xml:

Permission denied trying to execute the command iw.group.import

when run /iw-bin/iw_cgi_wrapper.cgi/custom_import.cgi via ui_custom.xml I still get:

Teamsite : Wrapper
Error trying to open a pipe to: I:\Interwoven\TeamSite\httpd\iw-bin\custom_import.cgi(1)

At this point I cannot suggest much more without seeing the actual code - the "permission denied" error looks like a failed attempt to redirect to an OOTB UI, and the pipe error could be the result of the same thing.

becool321

Ghoti, here is the code.

Adam Stoller

As Boris pointed out a while back, you should verify that your code is processing what you think it's processing - e.g.:

my @ts_dir = $ENV{QUERY_STRING};

The above appears twice in your code, and that's not the only thing I'd want to debug.

I suggest you add a considerable amount of debugging to your code to print out information to a log file somewhere - to make sure your code is doing [most of] what you think it's supposed to be doing.

I'd also suggest you use a different delimiter for your pattern matches and substitutions - to make the code more readable. E.g. changing code like:

if ($upload_dir =~ /default\/main\/TestOnline/) {
    ...
}

to:

if ($upload_dir =~ m|default/main/TestOnline|) {
    ...
}

It's not that making such changes will fix your problem, but it does tend to eliminate potential issues in the code and, as stated, make it much easier to read the code.

The debugging statements are much more important to ascertain what's happening, e.g. changing:

sub debug {
    my $msg = shift;
    open(DBG, '>>', "$iwhome/tmp/dbg.log") || die " '$iwhome/tmp/dbg.log' ($!)";
    print DBG "$msg\n";
    close DBG;
}
# I'd prefer using Log::Log4perl, but I'll leave that as an exercise for you to do on your own
...
my $hostname = $ENV{HTTP_HOST};
my @ts_dir = $ENV{QUERY_STRING};
my $upload_dir = "";
debug("HOSTNAME: '$hostname'");
debug("TS_DIR: \n\t'" . join("'\n\t'", @ts_dir) . "'");

# Use CGI Environment Variables to get path
foreach my $d_path (@ts_dir) {
  $d_path =~ s/&done.*//;
  $d_path =~ s/.*=\/\/testserver\d{3}//i;  
  $upload_dir = $d_path;
}
debug("UPLOAD_DIR: '$upload_dir'");
...

Again, the above is just an example, I'd do similar things throughout the code until you can figure out where things are going wrong.

becool321

Ok Ghoti,

I reverted an earlier code (see attachment) and I got it to show up within wrapper (/iw-bin/iw_cgi_wrapper.cgi/custom_import_ccstd.ipl) but when I click upload button, I can't seem to get past this popup error below although code syntax is ok when checked via iwperl -wc:

Teamsite: Wrapper
Error: CGI Start up error: failed POST read - query_len = 2827, returned len = 2761.

Same code works when not in wrapper, file uploaded with correct content and file size. However we still have system id issue.

I think once I get beyond this error I should be ok, because the full fuuntionality of the code is already built.

becool321

Now I'm running complete updated code through wrapper (/iw-bin/iw_cgi_wrapper.cgi/custom_import.ipl) but still getting same error in previous post when I try uploading a file.

So the issue now appears to be the iw_cgi_wrapper.cgi file, which I'm on interwoven support case about it.

Adam Stoller

Now I'm running complete updated code through wrapper (/iw-bin/iw_cgi_wrapper.cgi/custom_import.ipl) but still getting same error in previous post when I try uploading a file.

So the issue now appears to be the iw_cgi_wrapper.cgi file, which I'm on interwoven support case about it.

It's possible that there's an incompatibility between iw_cgi_wrapper.cgi and the CPAN CGI module - I still suggest you add a lot of debugging to your code and compare the output between when you run the code with, and without the wrapper.