AltME groups: search

3) I would not put rebol in cgi-bin. If it is there, one can call 
the rebol-exe from the outside, without it doing a string. Never 
tried that, but it may think post-data is console-input. rights should 
be 755, only you can modify, but everyone can read it. the server 
may call it as "somebody else", and so it must be readable for that 
"user"

2) decode-cgi builds the data itself AFAIK. does not use load. so 
all data should be strings. i am not sure about words, i guess they 
are bound. when you only fetch the words and turn them immediate 
in a string, that should be ok. the usual way is 
 construct decode-cgi
that result is save, because all words are bound to that context.

No, that should only run, make a file in rebols dir and quit. Hmm, 
in the current dir, where is that?

I think that it is legitimate aproach though. IIRC, my first article 
I read in some 1996 regarding cgi, was stating something like - put 
your C app into cgi-bin directory. Back then the author was describing 
that cgi is simply common gateway interface, and that your executable 
app should be put in cgi-bin directory. And rebol is C app :-)

he's trying to start it up and leave a console running

but hard to exploit more. security is on, so only access to cgi-bin 
and childs. cgi-bin should not be writable by the cgi-user. except 
if cgis run as your account, then i could write a script with -cs 
and call that in the next step.

and getting data out does not work, because rebol first prints its 
version-stuff, and webserver thinks "header wrong"

I would say: do no exe in cgi if it cant handle cgi. and rebol cant 
(except with script).

Graham - my server is far from popular. I think no-one will do Volker's 
like trick. But you might be right, if we teach ppl to simply put 
rebol into cgi-bin dir, and then such "vulnerability" is found, ISPs 
might hate it ....

I did that for micha and it worked. thought that is common.

btw, ct mentioned virtual server for e4.99. Dont know about quality, 
and i see german, do you see english? http://www.netfabrik.de/

and since my cgi-local is a mapped directory, I can't create subdirectories

Sad. and no linux-sdk?

This is an odd one.  I have a form that records a user's email address, 
the time they filled in the form, and their ip address.

A user did so, and got two subscription notices - timed 30 seconds 
or so apart.  So, both were his email address, but the ip address 
of the later one was from Google!

My deduction is that somehow google is tracking his movements, and 
submitted the form themselves to get the content ...

Yep, that was it.  Mediapartners-Google/2.1 submitted the form again. 
 It looks like if you have the Google search bar, it submits all 
your internet traffic to google, who then go and try and index that 
site - including submitting your email address to a form!!

Good to know !!

Looking at some log on a server I have to administrate, Im affraid 
to see many request trying to find  some /ebay, /lassalebank, /admin, 
/phpmyadmin pages on the site.
Internet looks more and more like a jungle.

what if I have Rebol cgi script in folder /cgi-bin/ and want to write 
to folder /public/ which is out of the sendbox. How to do it?

I am running XP on my local computer. Out web host's server is running 
Red Hat Linux.


Which version of core should I use on the host server to run the 
cgi scripts?


If I download the proper Linux core interpreter to my  XP computer, 
and uncompress it using WinZip, will it be corrupted by XP?  How 
do I get a clean version of core to the Linux server?

<<Which version of core should I use>>

Use the most recent Core version that is supported on Red Hat and 
XP.

That way. you'll hit the least code incompatibilites when testing 
locally

And your web server reported the actual path in the 500 server error 
message.

OK, now that cgi is working, I want to make a form that will allow 
people to give their name and email address to be saved in a rebol 
db file on the server for me to download at my convenience. Has anyone 
already done this so that I don't have to reinvent the wheel?

It writes the date and remote-add to the file, but does not write 
cgi-data to the file. What is wrong?

I am trying for first time to setup rebol for cgi on  remote Apache 
web server on Linux.
I am working from WinXP
Site management is done with EnsimPro. Ftp does not yet working.
So what is done up to now:

Uploaded file Rebol from rebol-core-2602042.tar package for Linux 
to cgi-bin directory;

Set permisions to owner read, write, execute and for group and others 
to read, execute;
Test script -> write file read file,

Test script uploaded (throught web broeser by using EnsimPro web 
interface) test script:

#!/var/www/cgi-bin/rebol -cs

REBOL [Title: "CGI Basics"]

print ["Content-type: text/html" newline]

print "Hello!!!"

to cgi-bin directory;
Set the same permisions.


Pointing to the test file I am getting "500 Internal server errror" 
What else could be wrong?


Interesting that I have interpreters directory on this web server 
where are couple files regarding php and perl.
Could it be connected with my problem?

Is it o' k that it is just rebol file from linux package and that 
I extracted it on WinXp then uploaded?
What you meant under "mask"?

btw - always build your resulting string first out: copy "" ... and 
then everything append out stuff-you-want-to-add .... print out at 
the end ... it is MUCH faster to print everything at once, then to 
print incrementally to the client ...

Btw content of one of file in the interpreters dir:
#!/bin/bash
if [ -z "$REDIRECT_STATUS" ]; then
  echo -e "Content-Type: text/html\r\n\r
<b>Security Alert!</b> The Perl CGI cannot be accessed directly.


<p>This Perl CGI launcher is configured to require a redirect.  This

means that a page will only be served up if the REDIRECT_STATUS CGI 
variable 
is set, e.g. via an Apache Action directive.</p>


<p>For more information as to <i>why</i> this behaviour exists, see 
the <a href=\"http://php.net/security.cgi-bin\"> PHP manual page 
for CGI security</a>.</p>

 else
  export SCRIPT_NAME=${PATH_TRANSLATED##${DOCUMENT_ROOT}}
  
 export SCRIPT_FILENAME=$PATH_TRANSLATED
  /usr/bin/perl 
$SCRIPT_FILENAME"
fi


As newcomer in linux and apache I can only ques what it mean, but 
I am thinking about this line:
 This Perl CGI launcher is ...

ah, then this apache is configured strangely imo .... in Apache httpd.conf, 
you normally specify ScriptAlias for directory, where cgi is going 
to be placed. Then you can always manually set whatever directory, 
to perform cgi action by adding SetHandler cgi-script for specific 
directory .... but then all files in there are regarded being a cgi 
and Apache could try to run them ...

That web server is hosting and I think that I can not access httpd.conf.
Btw  - where it resides?

Janeks,  here are some things to try:

1. Make sure you uploaded the rebol exe as binary and the rebol script 
as ascii.

2. make sure you chmod your rebol files, rebol and even the cgi-bin 
(755).

Hope that helps. I have seen the same thing as you many times when 
I first set up rebol.

BTW, if i makes you feel any better, I tested your script in my host 
and it works. I'm wondering if the "#!/var/www/cgi-bin/rebol -cs" 
is not actually pointing to the where it should be. Did the hosting 
company give you the exact path?

Thanks all - as always most obvious things are those on which we 
make mistakes.

All was o' k except I changed rebol to rebcore, because I wanted 
also work with Rebol view and ...
... forgot it.
Too much copy & paste.


Well the next question is - if and what else is needed to install 
rebol view for cgi operations?

Janeks,  I suppose it depends on what you want View to do. You can 
go ahead and put it in your cgi bin but It won't create interactive 
interfaces as you can when you run it locally. You can try the plugin 
for that kind of thing.

What I want is just do some image conversation and to make some human 
control (small image with string on some patern background ...)

When I tried it, View seemed to want to try to install itself, and 
errored out when it tried to show an installation window. Various 
combinations of command line options were no help. I didnt try using 
old versions of view, or tricking view into thinking its already 
installed.

I susoect View may be trying to pop-up an installation window......And 
so that appears on the server's console (if any). meanwhile, you 
wait at the end of an Internet connection unable to see anything.

Possible work-around: manually install whatever files View is trying 
to configure?

I found that in my case on Linux RebViev needs linux-gate.so.1!

I tried to google for "download linux-gate.so.1", but there was a 
lot of links for different things and it seems form me that it is 
included in some installation packgage.

Could some body help with this library  an is it worthwile (will 
RebView takes it from current dit)?

according to Gabriele, Linux might have some default library locations 
... but e.g. I run sqlite as dll, and I point rebol to load the library 
and it loads it from anywhere. The question is, if the same is right 
for executable dependant libraries

first guess view may not work without X installed (does not on solaris) 
and there is no good reason to run X on a web server ... and then 
there are all those fiddley fonts

and if you do have X installed the cgi script is likely not run  
from a graphicly aware shell so there may be virtual frame buffers 
involved

Another story on Win:

Anybody noticed any differences in instalation of Rebol on MS IIS 
6.0 and IIS 5.0?

It looks like all things is the same but I am getting on my test.r 
 "The page cannot be found", while index shows that test.r is there.

Well - I found it: http://support.microsoft.com/?id=315122

And Rebol script works well when in Web Service Extensions you set 
as Allowed All Unknown CGI extensions.

But then you will get warning message, that it could be potential 
security threat - then the next question is from dummie:
Is it safe to install rebol in such way?

Personaly I do not like M$ as it is monster. ;-)

But in my last and current work I am not responsible on which web 
server to chose and therefore neither for security of web server.

And I am trying to separate my  resposibility and SP responsibility, 
but of course there is cases when they overlaps.

I am just trying to find  as much as possible info about security 
of web servers and it does no matter if it is M$ or not .

My first installations was on IIS 5.0 in intranet - so I relied on 
firewall. The last case is in public internet. 

So I think if there are no possibility to upload danger cgi scripts 
or pass danger code to existing scripts, than from my side I did 
all.

Anton, do you have any idea about ** Near: size-text self  with Linux 
and rebview for cgi?

Do you have a linux box at home to play with ? You could try install 
Rebol/View on it without X running and see what error you get...

size-text: xwindows is client/server. the x-server , that is your 
local computer, which offers to aplications to display things to 
you. And it has some important informations locally, especially the 
fonts (and can cache images and such).

/view needs access to the fonts and so access to a running x-server. 
the x-libs are only an interface to connect to the server. (The xserver-libs 
could be used directly, but well, /view does not do that. Seems to 
be tricky.)
A incomplete sketch how to do it, with no attention to security:

So with /view you need a running x-server, one way to do that  headless 
is vnc.  Can also run on another machine. 

Then you need to tell  rebol where it is, there is an env-var $DISPLAY. 
Which must be set before rebol runs. Did not figure out how to configure 
that. Running a bash-script as cgi, set  $DISPLAY, call the real 
rebol-script should work. And there may be issues with authentification, 
x-windows does not like everyone to connect by default, or the other 
way around, its too easy to make it too open ("xhost + ip"). There 
are more secure ways, but looked more complicated and i never tried. 
All in all i would run such things on windows.

Sounds like I should to think about other solutions of human control 
and image resizing & texts on them.
It is a pitty.

Human control could be organized by just set of image files with 
some "kidnaping" fonts letters and some simple script in Core.

Image resizing (f.ex. when uploading) theoreticaly could be done 
with Core - but it seems too much work for me now, because I dont 
know yet how image files is built and those resizing algorithms.
And about text placing on uploaded images I can forget.
All things above could be done in View just fine.
:(

It was good idea, that I made first my private blog site on Linux. 
Despite Rebol runs on so many systems - running the same things on 
other systems should be checked before. Especialy if there are no 
expierence of work on that system.


BTW I found in the google the similar response was caused from uncomplete 
View instalation: http://demo.rebol.net/list/list-msgs/34071.html
But it looks that this is not the case.

Because I don't know it.

And I whanted to use my blog site as demo for all those good things 
that could be done with Rebol.

But whell - as I undertood I can use it on Linux web server. Anyway 
thanks, Graham, I will check how can I use them.

graham, and how fast is it?

Henrik, at present I am converting PDFs to JPG, and since it uses 
ghostscript as well, it is not that fast ... but I don't have too 
long a wait.

or, presumably, include the ole object, and register it when the 
program installs

my app is less than 1 mb, and the installer is 40mb :)

No, it isn't which is kind of strange. I would use the Rebol plugin 
but I haven't had too much success and I don't want to create more 
work supporting users.

I checked it out and it basically has a button to add more inputs 
to the page. There was a snippet available on the web that does this. 
That definitely is a possiblity.

Yes, that may be a concern as well. I'm running on a virtual server 
so I could change those parameters. Maybe I should investigate some 
type of Rebol client app. instead. Basically, what I'm after is a 
what for my students to send in their homework files that is better 
and smarter than this dropbox solution that they have now. It doesn't 
give them feedback of a successful upload and I end up with files 
upon files of slightly uncategorized uploads.

I'm using FormMail.pl to handle some simple contact details collection, 
but seems it is not highly regarded in the Perl community due to 
it's vulnerability to SPAM and bots. nms seems to offer a more secure 
version, http://nms-cgi.sourceforge.net/faq_nms.html, but I haven't 
done anything with Perl for years now. Anyone have a suggestion for 
a good FormMail.pl replacement, are are rumors of it's death greatly 
exaggerated?

afaik, the latest formmail.pl is "secure enough" (esp. if you configure 
it properly). it's not the best system out there, and being very 
popular it is also a popular target, but if you don't have time to 
replace it but can keep it up to date you should be fine.

james, I am sure this has been discussed before and pekr and/or sunanada 
gave such an example... try doing a search or reading about it here 
in earlier conversations...

My ISP just changed OS for FreeBSD 6.2 - and all my rebol cgi scripts 
are not working! What should I ask them to?

Yes - before I jast had in root directory a catalog with permissions 
and all worked.

Given the small download and simple installation, it may be worth 
a try.

Al I know is that the IS neglected to start the "Linux compatability 
module" on a reboot -- and so EBOL.org 500ed for most of a day until 
we got t sorted.

I've sent Alek the full emails from the ISP documenting the problem, 
but they don't realy say very much more.

Ok, I have a question regarding blog.r .  I set it up on a server 
to play with it for a few minutes.  After a couple kinks, I got it 
working with a few tests.   I went to delete the test blogs but found 
they were created under the www-data user and group (this is on a 
linux server) and I do not have writes to delete or modify these 
files.   In the future, is there a way to have the files created 
under a different user / group?

And my second question, is this blogger.r the most fully featured 
version of the orginal blog.r ?   I've been out of the loop for a 
while.

change-dir %blogs/
foreach file read %. [
		port: open file
    set-modes port [
        world-read: true
        world-write: true
        world-execute: true
    ]
    close port
]


But with my tired mind, and the no end of 500 errors, I must be forgetting 
something.

And I am officially tired.  It does help to make the script executable.......

Also, I don't know if this is so with every setup, but when you create 
a file with a CGI script, the process owner, not the script owner, 
is the owner of the file, so you'd need to be able to do owner-read/owner-write. 
 I usually set owner/group/world-read/write to true and execute to 
false.

yes; and if you use SuExec the process owner becomes the script owner 
(i.e. your user id), but SuExec is tricky business.

google "javascript cookies tutorial" and use rebol to call javascript 
to get the cookies

Hi,  question for the webheads.


   In short.  Can a form call a cgi action that processes data but doesn't 
   output any Content-type

(or anything for that matter) without the browser status coming up 
with "waiting for reply".


   I've got a client that wants a form for requesting more info, but 
   they want to leave the user on

the same screen, so I thought I could have a %process.cgi that takes 
the data and plays with it

and then have an intrinsic  onsubmit=alert(...)  to inform the user 
that the request has been submitted.

The %process.cgi doesn't 
print "Content-type ..."


it doesn't print anything, as I was hoping to leave the same browser 
screen up.

Am I living in lalaland?


Should the %process.cgi just redirect back to the original page with?


print "location: /original.html^/content-type: text/html^/"  or is 
that deprecated now?  It works under my test heads, Cheyenne and 
nonIE browser, but is there a bigger better way?  Or do I tell the 
client that the browser needs a new page and I can add a back link 
(not preferred).

Thanks for listening

And thanks to %blog.r's abuse? code, I should be able to stop most 
of the potential harm...but I'm still reiterating this to the client.

Hello, I need to send multipart/form-data to a server for uploading 
a file from the console. I've been googling and searching the script 
archive, to no avail. Can anyone help?

I am the lead (and have been working on this some time).  Any code 
that you have that you want included you can send to me by email.

Have a chat, if you haven't already, to Robert about the RPC as there 
may be some overlap in efforts. I'm more than happy to work with 
you to ensure RebGUI fits the proposed model (from both a code and 
documentation perspective). Some things to consider:

	- Coding standard(s)
	- Documentation standard(s)
	- Optimization methodology
	- Testing methodology
	- REBOL baseline (I'd aim for 1.3 - forget the past)


I've said this to a few people on AltME already, but for this type 
of project to succeed it needs four things:


 1) Technology (including a sound & easily understood conceptual basis)
	2) Documentation (good documentation is better than good code)
	3) Momentum (a sense that things are happening)

 4) Community (an environment where people are encouraged to contribute)


Getting all four right is *hard* work. *My* definition of success 
for a project is to be able to answer YES to the following two questions:

	1) Does it work?
	2) Is it used?

Ashley I'm Absolutly agreed with your point of view  !!! The way 
to participate actively to a project can take a lot of shapes. 1) 
make doc 2) making code optimisation 3) adding brand new code 4) 
debugging 5) giving feedbacks and needs 6)  making translation 7) 
making sample code (as far as I saw in my peronnal experience it's 
easier to understand how to use a thing if you provide a sample code 
that's an illustration not a goal. Sample code alone are only accessible 
to yet powerred users. Documentation without sample code is abstract. 
That's for example what I like in the rebol documentation diccionnary 
it explains and shows you concretly little sample to pretty understand 
the cancept explain... Making good doc is a hard and painfull task 
... If it belongs only to one people my personnal expirence shows 
me that the effort is not made along a long time... so it's obvious 
that we need a doc commity where people emulates each others and 
fixe periodically new goals. In French speaking community we all 
share teh same point of view that' why we try to put at disposal 
of all the people some usefull tools like a dokuwiki in http://www.rebolfrance.org
and doc collectors in http://www.rebolfrance.frand http://rebdocproj.sourceforge.net/) 
our public is french speaking mainly but we are so few that we can't 
say hey our tools are for french speaking people only. So if those 
tools seems you usefull for any project and any information sharing 
or cooperative work go ahead use them ;)

a good documentation must respond to all type of question and knowledge 
... Using cooperativ dynamic writing/publishing  tools other to redactors 
and readers a close interaction if you read a documentation and steel 
have questions you can mail, altme, or forum the redactors to makes 
your ask in order for them to bettering the documentation  very fast

for example on french scene forum the amount of information on rebol 
coding is so high that we can't easyly synthetise it into a meanning 
documentation. Why ? because structural we choose a forum based interface 
betwin coders without taking strictly the time to produce a syntetic 
documentation for every issues that were submitted and discussed 
on the solution apported from the very beginning (a participant number 
issue is in the scope  too )

So know synthetising the informations on our forum to make it disponnible 
for every one is a very very hudge task (more than 20 000 topics 
it's hard to sort and put in value ...)

Note that RP will be bundling all those good (proven?) libs and make 
them accessible from one place. Your rebgui, but also mysql:// are 
excellent examples. But imagine your new to REBOL, wouldn't it be 
nice if there were a link on rebol.net /.com that gave you immediate 
access to these libs?

Good points, Maarten about accessibility.


If I were looking for an alternative REBOL GUI and typed REBOL GUI 
into Google, I'd probably soon conclude that there wasn't one. And 
that might end my evaluation of REBOL.


Having many useful tools scattered across personal websites has other 
weaknesses too -- look at how hard it's been for people to find Gavin 
MacKenzies's XML libraries after his personal website went offline.

I will just addon..with the vaious 'powerpacks' in place.. it is 
possible to build something similiar to 'Ruby on Rails'


I believe the French community already have some well defined framework 
called Magic!... and we have Temple(?) lying around somewhere.

That's why I am doing this. I will start as Strong Leader, simply 
to make a Fast Start. Once the powerpack is well-established others 
may (and probably want to) join.

don't forget make-doc! :)) and maybe pdfmaker?

Uniserve is very nice, I have been using it to prototype/test before 
I upload to actual server.  It broke my heart it was gpl.  BSD is 
very good choice.  Free software should not be restricted, and GPL 
has too many of those.    makedoc/spec is the killer app,  and in 
that intensional programming vein is coursing all the best documentation, 
and REBOL  does a fine job of documenting itself because it is so 
semantic by nature.  To understand how to use a moderately complex 
system like a full-featured web server, it is going to be important 
to capture the thinking of those who wrote the code.  REBOL parsing 
allows all information pertaining to the code to be right there with 
the code,  and a function of  DO -ing anything.  the standard documentation 
scheme should follow how REBOL [] headers work, and simply have the 
makedoc embedded within the scripts.

BSD allows jailing free birds. GPL forces to let them go free next 
spring :) and only if they want to go with their binary offsprings.

jailable: taking free software, change a bit, close it. BSD.

paid: yes. goto DcKimbel, say "your Uniserv is wooonderfull!! How 
many bucks". I am sure you can make a deal and jail - uhm, close 
your project as much as you want.

while closed means, you can go to the central commitee of **, politely 
inform them and hope they dont jail you.

well, it sorta does.  because what if I want to release something 
someday as an actual product, and I go digging around trying to figure 
out what is what and I find gpl in there alongside bsd.

that's a deal breaker for me and I bounce the gpl stuff.

and anything longer than one page is done out of personal principle

Well, you said "To understand how to use a moderately complex system 
like a full-featured web server, it is going to be important to capture 
the thinking of those who wrote the code.". and then you want to 
force your users not to look at it?

I wish I would not have said anything about licensing, but I saw 
uniserver on the list and it's gpl.  that doesn't mean BSD, which 
was part of the spec.  I like BSD MIT school of thinking.  My brain 
doesn't jive with GNUfree  the old free was just fine.

and I could have skipped straight to the documentation discussion.

AFAIK the community is a bit more BSD, but Carl not, and GPL means 
he will not use it. Thats a heavy argument.

and from what I've read, the only thing that really weighs on him 
is a bunch of soap opera caliber licensing discussions, which I can 
now say that I participated in. . .oh well.  guess I'll have to label 
that button hot, I generally avoid that discussion.

basicly Free means the author is free to choose the licence of his 
creation ... You can't contest the right of an author to protect 
his creation ... Offerring the  use and sharing the code is yet a 
great thing .. And with GPL you can work on the creation  as you 
want until you respect the licence terms and do not want to appropriate 
a creation that doesn't belongs to you ;)

property and robe are the base of our culture read the bibble it's 
full of those deprecated concepts ...

you can make free to use things and do not want people to claim what 
they don't have

if we take MacOS X example we all know what is the gain for Apple 
but it is more blur to see what is the befefit that OpenBSD project 
writers retrieves of this experience. A part a spot light put uppon 
there project. But every a little serrious coder was yet knowing 
that freeBSD and OpenBSD were rock stable OS

and other thing - blog very often raises some questions, dunno if 
those are mainly rhetorical questions or so, but decision for particular 
areas are never announced.