[mod_python] Re: popen() and mod_python

Jorey Bump <list at joreybump.com> writes:

> Jon-Pierre Gentil wrote:
>> Sebastien Maret wrote:
>>
>>> import os
>>>
>>> def index(req):
>>>           p = os.popen ("/bin/sh", 'w')
>>>    p.write ("ls >> log")
>>>    p.close ()
>>>
>>>    f = open("log")
>>>    s = f.readlines()
>>>    f.close()
>>>
>>>    return s
>>>
>>> Although the same kind of script works fine when I run it from the
>>> command line, it does not work when I put it on my webserver. The pipe
>>> does not seems to be opened. Is it for security reasons? Is there a
>>> workaround?
>>
>>
>> It looks like you're returning the string instead of using req.write()
>> to output the data.  A request handler expects an HTTP code return
>> value, not the string output..
>
> That's not true of all handlers. The OP might be using Publisher,
> which only requires a string to be returned.

I do use the publisher. I should have mentioned that.

> Try using full paths to all binaries and files. The apache user is
> likely to have a very different environment than your normal user at
> the command line, and there's no guarantee that it won't change
> beneath your feet. Rule out all ambiguity.

That was it. The ls >> log command was trying to create a file in the
current directory, which turns out to be /. Using a full path for the
log file solved the problem.

> Also, you might want to try with something simpler, such as returning
> only the output of ls. In fact, I'm not sure I see the purpose of
> opening /bin/sh here, but maybe you have something else in mind other
> than this example, hopefully not evil. :)

This was just an example.

Thanks for the help.
Sébastien