301832 - Windows installation: ScriptInterpreterSource registry requires the -T (taint mode) flag

Status: RESOLVED FIXED

(Bugzilla :: Documentation, defect)

Description

[Kiffin Gish]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.10) Gecko/20050716 Firefox/1.0.6
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.10) Gecko/20050716 Firefox/1.0.6

I am using the ActiveState Perl v5.8.7 binary build 813.

Reproducible: Always

Steps to Reproduce:
I followed the steps given in the documentation for installation, pointed my
broswer to recently installed bugzilla directory: localhost/bugzilla/

Also via the command line, cd to the bugzilla directory and run 'perl index.cgi'
Actual Results:  
505 from Apache

Perl Error message (and in the Apache error-log):

"-T" is on the #! line, it must also be used on the command line at index.cgi li
ne 1.

Expected Results:  
No errors, e.g. just worked.

After struggling around for ages, I finally figured it out. By adding this to
the documentation I believe that you will greatly help other poor windows users
like myself.

Start | Run ... | 'explorer'
Select 'Tools | Folder Options...' from the toolbar.
Click on the 'File Types' tab.

Under registered file types look for the 'CGI' extension, select it and click
the [Advanced]-button.

Under actions, select 'Open' and hit the [Edit]-button.

Make sure that the following appears just below 'Application used to perform
action':

"C:\Perl\bin\perl.exe" -T "%1" %* 

IMPORTANT: Note the use of the -T flag for allowing taint mode, This is because
the shebang line in the Bugzilla CGI-file contain -wT.

Of course, if the CGI extenstion is not available or the 'Open' action is not
defined, you will have to create them.

I am using the ActiveState Perl v5.8.7 binary build 813.

Comment 1

[Frédéric Buclin]

glob, any idea?

Comment 2

[:glob ✱]

http://www.bugzilla.org/docs/win32install.html already says to use -T

yes, 2.4.1.4 needs to be updated to reflect this.

Comment 3

[victory <[e-mail]>]

it seems what the reporter saying is that execute .cgi file on client instead of server so this won't work unless access using his machine only, isn't it?
so this won't work when access from another machine.
if so, i don't think this is common usage of Bugzilla so this cannot be acceptable.

Comment 4

[Frédéric Buclin]

Attachment: patch, v1

Comment 5

[Frédéric Buclin]

tip:

Checking in docs/xml/installation.xml;
/cvsroot/mozilla/webtools/bugzilla/docs/xml/installation.xml,v  <--  installation.xml
new revision: 1.143; previous revision: 1.142
done

3.0.2:

Checking in docs/xml/installation.xml;
/cvsroot/mozilla/webtools/bugzilla/docs/xml/installation.xml,v  <--  installation.xml
new revision: 1.136.2.3; previous revision: 1.136.2.2
done

2.22.3:

Checking in docs/xml/installation.xml;
/cvsroot/mozilla/webtools/bugzilla/docs/xml/installation.xml,v  <--  installation.xml
new revision: 1.107.2.18; previous revision: 1.107.2.17
done

2.20.5:

Checking in docs/xml/installation.xml;
/cvsroot/mozilla/webtools/bugzilla/docs/xml/installation.xml,v  <--  installation.xml
new revision: 1.98.2.23; previous revision: 1.98.2.22
done