- dancer-users - lists.preshweb.co.uk

Request Context uploads - changed?
by Zahir Lalani 30 May '18

30 May '18

Hi All Our current application uploader mechanism has broken since the dancer update. The issue seems to be how the tempfilename is reported. In Dancer2 0.205, the temp file name would report as : /tmp/XKdggo8aBt.pptx Since 0.206, the extension is dropped off Is this expected? Zahir Lalani Head of Development & Architecture [cid:96F784CA-E917-4CC1-A9A9-96CBDA2AF2BC] 151 Rosebery Avenue, London, EC1R 4AB m: +44 (0)7956 455168 t: +44 (0)203 142 3619 e: zahirlalani@oliver<mailto:zahirlalani@oliver-marketing.com>.agency w: www.oliver.agency

1 0

External access to Dancer2 settings
by Nathan Bailey 30 May '18

30 May '18

1. The script from the Cookbook <https://metacpan.org/pod/release/XSAWYERX/Dancer2-0.08/lib/Dancer2/Cookbook…> : # bin/script2.pl use FindBin <https://metacpan.org/pod/FindBin>; use Cwd <https://metacpan.org/pod/Cwd> qw/realpath/; use Dancer2 <https://metacpan.org/pod/Dancer2>; #tell the Dancer2 where the app lives my $appdir=realpath( "$FindBin::Bin/.."); Dancer2::Config::setting('appdir',$appdir); Dancer2::Config::load(); #getter print "environment:".config->{environment}."\n"; #development print "log:".config->{log}."\n"; #value from development environment fails with: Undefined subroutine &Dancer2::Config::setting called at script2.pl line 9. Although I can see a setting function in Dancer2::Core::Role::ConfigReader? 2. What's the best way for my perl modules to access settings? eg. if Main.pm says: my $foo = myApp::FooMaker->new(); FooMaker.pm can get config settings via: a) Using an approach similar to the above b) Having all config or specific parts of config passed in since FooMaker is Dancer2 unaware. Does adding: use Dancer2; to FooMaker make it Dancer2 aware? (ie. give it access to all the Dancer environment?) and if so, what kind of Dancer2 environment does one need to make for unit tests of FooMaker functions/methods? thanks, Nathan

1 0

Dancer2 -- multiple apps with different config(.yml) in one process
by Erik Huelsmann 28 May '18

28 May '18

Hi, Over at the LedgerSMB project (https://ledgersmb.org/) we moved a lot of our old CGI code to PSGI over the last year. Recently, I've factored out many "infrastructure" level items into Plack middleware. We've wanted to move to Dancer as our web framework for years. And this weekend I made a first stab at such a move. As a result I have some questions (but more may come). Some questions were immediately answered by Stephan Hornburg in our chat channel (thanks Stephan!) but the most important one remains open. Question: Dancer2's documentation points out that we can use 2 applications hosted on 1 PSGI server. The relevant section is: http://search.cpan.org/~cromedome/Dancer2-0.205002/lib/Dancer2/Manual.pod#R… And while that works, both of these applications resolve their configuration to one and the same "config.yml". This is where my problem is: while I don't mind (would like to, even) share 99% of the configuration between two applications I want to mount, the two applications I want to mount, need separate authentication cookies. As far as I'm aware, I'd need to resolve to two different "config.yml" files (in my case I'd prefer "main_config.yml" and "setup_config.yml"). A bit of background to my question: LedgerSMB is an ERP application which consists of two logically separate applications: 'main' and 'setup'. "main" is the application for regular users while "setup" is for application/functional maintenance (application admin). Since many businesses have a "superuser" appointed as their admin, this user has 2 roles. He may want to log into both applications at the same time, each in a separate window on the same browser. In order to be able to do that, I need to be able to set the session cookie for both applications to be different from each other. It's my understanding that the "best" way to set cookie names through the configuration. Hence my question how to get two applications pointing to two different configuration files. I've tried multiple approaches so far without success: 1. "use Dancer2 config_location => 'path/to/config';" 2. read the sources of Dancer2 for a couple of hours 3. Ask racke Could you please advise? Thanks in advance! -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

2 2

Dancer::Plugin::SimpleCRUD security update
by David Precious 07 May '18

07 May '18

Hi all, Importance notice for anyone using Dancer::Plugin::SimpleCRUD - if you use the `auth` option to control access to the CRUD interface/routes via DPAE, then please update to 1.15 immediately; previous versions contain a security vulnerability as a result of incorrect calls to _ensure_auth(), meaning that only some routes are correctly protected, and some others aren't. Full details can be see in PR #109 which fixes this problem: https://github.com/bigpresh/Dancer-Plugin-SimpleCRUD/pull/109 This is a pretty embarassing fuckup - a security problem on one of my projects. I hold my hands up and apologise to anyone affected by this, for this is a stupid mistake. A better test suite would have caught this. I'm not sure if a CVE ID is warranted or not, but I have submitted a request for one via Distributed Weakness Filing Project, so they can decide if one is required for this or not. So, again, please upgrade immediately if you rely on the `auth` option, and sorry. Also, many many thanks to Josh Rabinowitz (joshrabinowitz) for finding this problem and submitting a test which illustrates it. Cheers Dave P (bigpresh)

2 1

Dancer2 0.206000 released, addresses potential security issues
by Jason Crome 20 Apr '18

20 Apr '18

Dancer2 0.206000 has been released, and it is recommended that all users of Dancer2 should upgrade as soon as it is feasible to address several potential security issues: - There is a potential RCE with regards to Storable. We have added session ID validation to the session engine so that session backends based on Storable can reject malformed session IDs that may lead to exploitation of the RCE. Please see the Storable documentation(https://perldoc.perl.org/Storable.html#SECURITY-WARNING) for more information. - We have changed from HTTP::Body to HTTP::Entity::Parser (the same as Plack uses) for parsing requests. Apart from being faster, this change also resolves a situation when forwarding requests where the request body could be re-parsed without correctly seeking a filehandle to the beginning of the request body, potentially resulting in an infinite loop. The implementation using `HTTP::Entity::Parser` does not require the request body to be re-parsed. This addresses a potential DoS attack vector. In addition to the security fixes, this release offers a number of bug fixes and documentation enhancements. Thanks to all who contributed, both old and new. The complete changelog is as follows: 0.206000 2018-04-19 22:09:46-04:00 America/New_York [ BUG FIXES ] * GH #1090, #1406: Replace HTTP::Body with HTTP::Entity::Parser in Dancer2::Core::Request. (Russell @veryrusty Jenkins) * GH #1292: Fix multiple attribute definitions within Plugins (Nigel Gregoire) * GH #1304: Fix the order by which config files are loaded, independently of their filename extension (Alberto Simões, Russell @veryrusty Jenkins) * GH #1400: Fix infinite recursion with exceptions that use circular references. (Andre Walker) * GH #1430: Fix `dancer2 gen` from source directory when Dancer2 not installed. (Tina @perlpunk Müller - Tina) * GH #1434: Add `validate_id` method to verify a session id before requesting the session engine fetch it from its data store. (Russell @veryrusty Jenkins) * GH #1435, #1438: Allow XS crush_cookie methods to return an arrayref of values. (Russell @veryrusty Jenkins) * GH #1443: Update copyright year (Joseph Frazer) * GH #1445: Use latest HTTP::Headers::Fast (Russell @veryrusty Jenkins) * PR #1447: Fix missing build requires (Mohammad S Anwar) [ ENHANCEMENTS ] * PR #1354: TemplateToolkit template engine will log (at debug level) if a template is not found. (Kiel R Stirling, Russell @veryrusty Jenkins) * GH #1432: Support Content-Disposition of inline in send_file() (Dave Webb) * PR #1433: Verbose testing in AppVeyor (Graham Knop) [ DOCUMENTATION ] * GH #1314: Documentation tweaks (David Precious) * GH #1317: Document serializer configuration (sdeseille) * GH #1386: Add Hello World example (Gabor Szabo) * PR #1408: List project development resources (Steve Dondley) * PR #1426: Move performance improvement information from Migration guide to Deployment (Pedro Melo) Thank you to our outstanding community and contributors. Keep on dancing! CromeDome

1 0

Dancer2 0.206000_02 Trial Released
by Jason Crome 10 Apr '18

10 Apr '18

This is a quick update to yesterday's Dancer2 release to fix a couple of minor issues reported by the community. Please see the Changes file for details. Thank you for the swift feedback! We are targeting an official release on or before April 20th. Keep Dancing! Jason/CromeDome

1 0

Dancer2 0.206000_01 trial version released
by Jason Crome 09 Apr '18

09 Apr '18

A trial release of Dancer2 (0.206000_01) was just uploaded, and should be available on your local mirror soon. This release addresses some couple of potential security exploits, and could use some scrutiny prior to an official release. Please see the release for the full list of changes. There will be a coordinated Dancer/Dancer2 release in the near future with more detail. In the meanwhile, the more eyes on this, the better. Please leave us your feedback through the usual channels (IRC, email, github, etc.). Thanks. Keep dancing! Jason

1 0

Best practice to escape HTML entities in Dancer2 and TT
by Lutz Gehlen 22 Mar '18

22 Mar '18

Hello all, in Dancer1, I have been using Dancer::Plugin::EscapeHTML to automatically escape HTML entities in server generated output. I have never tried to figure out how it does its job, but it seemed to do what I needed. I have not found a similar plugin for Dancer2. However, this must be a widespread problem, isn't it? What is the best practice to automatically escape HTML entities with Dancer2 and Template::Toolkit? Thank you and best wishes, Lutz

6 16

apache2 and fastcgi
by Scott H 08 Mar '18

08 Mar '18

I usually use the apache2 plack handler but from what I understand you cant do that if you plan on using apache for more then 1 dancer site. Im running into an issue with setting up fast cgi. [Wed Mar 07 10:31:26.962311 2018] [fastcgi:error] [pid 20247] [client 205.125.62.200:50442] FastCGI: comm with server "/opt/guestaccess/millard/public/dispatch.fcgi" aborted: idle timeout (30 sec) [Wed Mar 07 10:31:26.962415 2018] [fastcgi:error] [pid 20247] [client 205.125.62.200:50442] FastCGI: incomplete headers (0 bytes) received from server "/opt/guestaccess/millard/public/dispatch.fcgi" I first had to chmod +x dispatch.fcgi so it would execute. I then set apache2 to do prefork rather then event mpm. chowned www-data user to own the dancer2 folder, Now I am getting those errors. <goog_401013921> http://search.cpan.org/dist/Dancer2/lib/Dancer2/Manual/Deployment.pod#As_a_… I followed that guide but it doesnt seem to work. I went with mod_fastcgi. This is on ubuntu 16.04.x LTS. Worst case is i setup starman and proxy it but i dont really want to do that this time. What am i missing?

2 4

Dancer2/starman/NGINX deployment question
by Richard Reina 22 Feb '18

22 Feb '18

Followed Gabor's tutorial https://perlmaven.com/getting-started-with-perl-dancer-on-digital-ocean and got my app running on my digitalocean droplet. However, am only able to view it with http://my.ip.ad.ress:5000 and not if I leave off the :5000 cat /home/starman/nginx-demo.conf server { location / { proxy_set_header Host $http_host; proxy_set_header X-Forwarded-Host $http_host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_pass http://localhost:5000; } cat /home/starman/starman.pl #!/usr/bin/perl use warnings; use strict; use Daemon::Control; use Cwd qw(abs_path); Daemon::Control->new( { name => "Starman", lsb_start => '$syslog $remote_fs', lsb_stop => '$syslog', lsb_sdesc => 'Starman Short', lsb_desc => 'Starman controls the web sites.', path => abs_path($0), #program => 'plackup -E deployment -s Starman', program => '/home/starman/perl5/bin/starman', program_args => [ '--workers', '3', '/home/starman/rushlogistics/bin/app.psgi' ], #plackup -E deployment -s Starman --workers=10 -p 5001 -a bin/app.psgipl user => 'starman', group => 'starman', pid_file => '/tmp/starman.pid', stderr_file => '/tmp/starman.err', stdout_file => '/tmp/starman.out', fork => 2, } )->run; tail /tmp/starman.err 2018/02/22-02:08:12 Server closing! 2018/02/22-02:08:12 Starman::Server (type Net::Server::PreFork) starting! pid(13960) Resolved [*]:5000 to [0.0.0.0]:5000, IPv4 Binding to TCP port 5000 on host 0.0.0.0 with IPv4 Setting gid to "1002 1002 0" Any idea what I might have missed? Thanks

2 1