#!/usr/bin/perl # Greeting Cards Image Preview Script # Russell Rychlak 12-17-03 # v1.0 require "../cgi-bin/vars.pl"; if ($ENV{'REQUEST_METHOD'} eq 'post') { read(STDIN, $buffer, $ENV{'CONTENT_LENGTH'}); @pairs = split(/&/, $buffer); } else { @pairs = split(/&/, $ENV{'QUERY_STRING'}); } foreach $pair (@pairs) { ($name, $value) = split(/=/, $pair); $value =~ tr/+/ /; $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg; $value =~ s/\<\!--.*?--\>//gs; $value =~ s///g; $value =~ s/system\(.+//g; $value =~ s/grep//g; $value =~ s/\srm\s//g; $value =~ s/\srf\s//g; $value =~ s/\smkdir\s//g; $value =~ s/\srmdir\s//g; $value =~ s/\.\.([\/\:]|$)//g; $value =~ s/< *((SCRIPT)|(APPLET)|(EMBED))[^>]+>//ig; $value =~ s/\/g; $value =~ s/\>//g; $name =~ s///g; $name =~ s/^\s-\w.+//g; $name =~ s/system\(.+//g; $name =~ s/grep//g; $name =~ s/\srm\s//g; $name =~ s/\srf\s//g; $name =~ s/\smkdir\s//g; $name =~ s/\srmdir\s//g; $name =~ s/\.\.([\/\:]|$)//g; $name =~ s/< *((SCRIPT)|(APPLET)|(EMBED))[^>]+>//ig; $name =~ s/\/g; $name =~ s/\>//g; $form{$name} = $value; } if ($form{'img'} ne "") { print "Content-type: text/html\n\n"; print qq~