[weric]

how do i setup a cgi-bin in my username/sites directory? i assume that there is a list somewhere that says what directories cgi scripts can run in. i've looked through previous posts, but they confuse me often because the threads go all over the place. anyhow, if anyone can give me the answer - or point me to a place where i can find it, i would greatly appreciate it.

running os x 10.1.3

-eric

[Axel]

Here's what I did
I created a "CGI-Executables" folder in my home folder, and I typed this in /etc/httpd/users/axel.conf :

ScriptAlias /~axel/cgi-bin/ "/Users/axel/CGI-Executables/"

I don't know if it's the best way but it does work

[ 03-23-2002: Message edited by: Axel ]

[Gee4orce]

Here's what I did, to enable any number of cgi-bin directories in any Sites subfolder. Eg, I can have:

/andy/Sites/mysite/
/andy/Sites/mysite/cgi-bin
/andy/Sites/myothersite/
/andy/Sites/myothersite/cgi-bin

I edited my /etc/httpd/users/andy.conf , and added:

<font face = "courier">
&lt;DirectoryMatch "^/Users/andy/Sites/?.*/cgi-bin/"&gt;
AddHandler cgi-script .cgi .pl
Options +ExecCGI -Indexes
SetHandler cgi-script
&lt;/DirectoryMatch&gt;
</font>

I also enabled mod_perl on my machine, and added an entry for that (for /perl directories):

<font face = "courier">
&lt;DirectoryMatch "^/Users/andy/Sites/?.*/perl/"&gt;
SetHandler perl-script
PerlHandler Apache::Registry
Options +ExecCGI -Indexes
&lt;/DirectoryMatch&gt;
</font>

Look at the docs on http://&lt;your machine&gt;/manual for a full explanation of this.

[rkt]

Originally posted by Gee4orce:
<STRONG>Here's what I did, to enable any number of cgi-bin directories in any Sites subfolder.
</STRONG>

that's an elegant solution, but a little undesirable from the security point of view, as you want to avoid having your cgi-bin under your web root.

axel's method of using scriptalias directive and a directory in his home is a more secure setup.

[Zim]

I believe you can also edit in http.conf

#
# AddHandler allows you to map certain file extensions to "handlers",
# actions unrelated to filetype. These can be either built into the server
# or added with the Action command (see below)
#
# If you want to use server side includes, or CGI outside
# ScriptAliased directories, uncomment the following lines.
#
# To use CGI scripts:
#
AddHandler cgi-script .cgi

The pucker-factor for the security conscious is probably prety high on this one :-) but for all the screaming about security, on 6 out of 6 web hosts I worked on, all cgi-bin directories were in the web root (until Mac OS X). I have to imagine there would be more hacks if this was as wrong as many have implied in other threads.

This would appear to be the lazy way to do it, as opposed to entering a new script alias for each user that wants to run cgi.

again, based on the fact that every web host I've used put cgi-bin in my document tree, my conclusion is that they feel that any security risks are out-weighed by the management task of doing per-user entries.

Obviously you now have several solutions and can make your own choice.

Mike

[Gee4orce]

I'm sure that you could combine the ScriptAlias approach with my approach, to redirect */cgi-bin/ to /Library/Webserver/CGI-Executables/* and keep it out of the web root.

Security wasn't an issue for me as this was just for private development on a laptop.

Aint Apache great ??