Mr. ##NAME##, you ordered:
| ##PROD## | ##DESC## | ##QTY## | ##PRICE## | ##SUBTOTAL## |
For a total amount of: ##TOTAL##
3294l4.orig 100664 1061 330 7174 6766550553 11151 0 ustar mlr ljedit #!/usr/bin/perl -w
# Cgi to show customer's orders
# Secure path
$ENV{PATH} = '/bin/:/usr/bin:/usr/local/bin';
# Using CGI modules and creating a new CGI instance
use CGI;
$query = new CGI;
# Defining some variables
$htmltpl = '/home/httpd/html/result.html';
$basepath = '/var/tables/acmeinc/';
$cusfile = $basepath . 'customer.rdb';
$ctlgfile = $basepath . 'catalog.rdb';
# Getting customer name from the form
$cusname = $query->param('cusname');
# Avoid buffer overflow (maximum 50 chars) and command execution
# from the customer name: this is a security countermeasure
$cusname = substr($cusname, 0, 50);
$cusname =~ s/\///g;
$cusname =~ s/#//g;
$cusname =~ s/\n//g;
$cusname =~ s/"//g;
$cusname =~ s/'//g;
$cusname =~ s/\`//g;
$cusname =~ s/!//g;
$cusname =~ s/;//g;
$cusname =~ s///g;
# Extracting customer code for further queries and striping insecure stuffs
$cuscode = `nosql row 'NAME=="$cusname"' < $cusfile | nosql column CODE | nosql body`;
$cuscode =~ s/\///g;
$cuscode =~ s/#//g;
$cuscode =~ s/!//g;
$cuscode =~ s/\n//g;
$cusname =~ s/"//g;
$cusname =~ s/\`//g;
$cusname =~ s/;//g;
$cusname =~ s///g;
$cuscode =~ s/\s*//g;
# Getting customer datafile that is usually the code plus the ".rdb"
# extension
$datafile = $basepath . "received/" . $cuscode . ".rdb";
# Getting the rows containing the query of the pending orders
#
@cusdata = `nosql cat $datafile | nosql join -j PROD - $ctlgfile |
nosql addcol SUBTOTAL | nosql compute 'SUBTOTAL = QTY*PRICE' | nosql
column PROD DESC QTY PRICE SUBTOTAL | nosql body`;
# If no rows found, then customer may not exists or has no pending
# orders
if (@cusdata == 0) {
&log_and_die("No records found on the specified customer")
};
# Calculating total amount due
chop($total = `nosql cat $datafile | nosql join -j PROD - $ctlgfile |
nosql addcol SUBTOTAL | nosql compute 'SUBTOTAL = QTY*PRICE' | nosql
subtotal -T SUBTOTAL | nosql body`);
# If the string is empty, then something went wrong.
if ($total eq '') {
&log_and_die("Cannot calculate total")
};
# This opens html template file for reading and
# it's associated to the standard input space ($_)
open(HTMFILE, $htmltpl) || &log_and_die("Can't open file $htmltpl");
$_ = join("", An unrecoverable error occurred: $message