From b314eeff3dd14f046a18305ccd68371108936244 Mon Sep 17 00:00:00 2001 From: Ingela Anderton Andin Date: Tue, 7 Apr 2015 10:51:04 +0200 Subject: inets: Remove SSI (Server Side Includes) SSI is an old technique implemented by mod_include, that was badly tested and not recommended to use, as having the server parse HTML pages is a double edged sword! It can be costly for a heavily loaded server to perform parsing of HTML pages while sending them. Furthermore, it can be considered a security risk to have average users executing commands in the name of the Erlang node user. --- lib/inets/doc/src/http_server.xml | 188 +------------------------------------- 1 file changed, 2 insertions(+), 186 deletions(-) (limited to 'lib/inets/doc/src/http_server.xml') diff --git a/lib/inets/doc/src/http_server.xml b/lib/inets/doc/src/http_server.xml index e3b763b4f3..65e89db391 100644 --- a/lib/inets/doc/src/http_server.xml +++ b/lib/inets/doc/src/http_server.xml @@ -46,8 +46,7 @@ Layer), ESI (Erlang Scripting Interface), CGI (Common Gateway Interface), User Authentication(using Mnesia, dets or plain text database), Common Logfile Format (with or without disk_log(3) - support), URL Aliasing, Action Mappings, Directory Listings and SSI - (Server-Side Includes).

+ support), URL Aliasing, Action Mappings, and Directory Listings

The configuration of the server is provided as an erlang property list, and for backwards compatibility also a configuration @@ -478,170 +477,9 @@ http://your.server.org/eval?httpd_example:print(atom_to_list(apply(erlang,halt,[

[date] access to path failed for remotehost, reason: reason

- - - +
- Server Side Includes -

Server Side Includes enables the server to run code embedded - in HTML pages to generate the response to the client.

- -

Having the server parse HTML pages is a double edged sword! - It can be costly for a heavily loaded server to perform - parsing of HTML pages while sending them. Furthermore, it can - be considered a security risk to have average users executing - commands in the name of the Erlang node user. Carefully - consider these items before activating server-side includes.

- - -
- - SERVER-SIDE INCLUDES (SSI) SETUP -

The server must be told which filename extensions to be used - for the parsed files. These files, while very similar to HTML, - are not HTML and are thus not treated the same. Internally, the - server uses the magic MIME type text/x-server-parsed-html - to identify parsed documents. It will then perform a format - conversion to change these files into HTML for the - client. Update the mime.types file, as described in the - Mime Type Settings, to tell the server which extension to use - for parsed files, for example: -

- 
-	text/x-server-parsed-html shtml shtm
-
-

This makes files ending with .shtml and .shtm - into parsed files. Alternatively, if the performance hit is not a - problem, all HTML pages can be marked as parsed: -

- 
-	text/x-server-parsed-html html htm
-
-
- -
- - Server-Side Includes (SSI) Format -

All server-side include directives to the server are formatted - as SGML comments within the HTML page. This is in case the - document should ever find itself in the client's hands - unparsed. Each directive has the following format: -

- 
-	<!--#command tag1="value1" tag2="value2" -->
-
-

Each command takes different arguments, most only accept one - tag at a time. Here is a breakdown of the commands and their - associated tags: -

-

The config directive controls various aspects of the - file parsing. There are two valid tags: -

- - errmsg - -

controls the message sent back to the client if an - error occurred while parsing the document. All errors are - logged in the server's error log.

- - sizefmt - -

determines the format used to display the size of - a file. Valid choices are bytes or - abbrev. bytes for a formatted byte count - or abbrev for an abbreviated version displaying - the number of kilobytes.

- - -

The include directory - will insert the text of a document into the parsed - document. This command accepts two tags:

- - virtual - -

gives a virtual path to a document on the - server. Only normal files and other parsed documents can - be accessed in this way.

- - file - -

gives a pathname relative to the current - directory. ../ cannot be used in this pathname, nor - can absolute paths. As above, you can send other parsed - documents, but you cannot send CGI scripts.

- - -

The echo directive prints the value of one of the include - variables (defined below). The only valid tag to this - command is var, whose value is the name of the - variable you wish to echo.

-

The fsize directive prints the size of the specified - file. Valid tags are the same as with the include - command. The resulting format of this command is subject - to the sizefmt parameter to the config - command.

-

The lastmod directive prints the last modification date of - the specified file. Valid tags are the same as with the - include command.

-

The exec directive executes a given shell command or CGI - script. Valid tags are:

- - cmd - -

executes the given string using /bin/sh. All - of the variables defined below are defined, and can be - used in the command.

- - cgi - -

executes the given virtual path to a CGI script and - includes its output. The server does not perform error - checking on the script output.

- - -
- -
- - Server-Side Includes (SSI) Environment Variables -

A number of variables are made available to parsed - documents. In addition to the CGI variable set, the following - variables are made available: -

- - DOCUMENT_NAME - -

The current filename.

- - DOCUMENT_URI - -

The virtual path to this document (such as - /docs/tutorials/foo.shtml).

- - QUERY_STRING_UNESCAPED - -

The unescaped version of any search query the client - sent, with all shell-special characters escaped with - \.

- - DATE_LOCAL - -

The current date, local time zone.

- - DATE_GMT - -

Same as DATE_LOCAL but in Greenwich mean time.

- - LAST_MODIFIED - -

The last modification date of the current document.

- - -
-
- -
The Erlang Web Server API

The process of handling a HTTP request involves several steps such as:

@@ -907,28 +745,6 @@ start() ->
-
- mod_include - SSI -

This module makes it possible to expand "macros" embedded in - HTML pages before they are delivered to the client, that is - Server-Side Includes (SSI). -

-

Uses the following Erlang Webserver API interaction data: -

- - real_name - from mod_alias - remote_user - from mod_auth - -

Exports the following Erlang Webserver API interaction data: -

- - {mime_type, MimeType} - The file suffix of the incoming URL mapped into a - MimeType as defined in the Mime Type Settings - section. - -
-
mod_log - Logging Using Text Files.

Standard logging using the "Common Logfile Format" and text -- cgit v1.2.3