Author Topic: A tip for using Perl CGI scripts with the built-in web server (LS-XHL)  (Read 1715 times)

daoswald

  • Buffalo
  • ***
  • Posts: 100

Some of the newer models of Buffalo NAS devices have a mode (embedded within the latest firmware) that allows you to enable a webserver.  This is different from web access; you start with nothing.  Only people who understand how to create HTML, and how to handle a webserver (including security concerns) should venture further with this post...

 

After creating a share dedicated to the webserver, and activating the webserver under the network settings for the NAS, you're off to the races.  I recommend not setting any port forwarding on your router to the port that the webserver is configured to use.... at least not until you're absolutely sure you want to deal with outside queries.

 

The NAS's setup pages do list PHP as being the de-facto CGI language for the NAS.  But I stumbled into the fact that it also supports Perl.  However, that opened the question of what Perl modules are actually installed on the NAS.  By dropping the following script into your cgi-bin folder on the web share, and pointing your browser to it, you'll get a list of installed Perl modules on the NAS.  The webserver will expect your Perl CGI script to be in the cgi-bin folder, and to be named something.pl (in other words, you need the .pl extension).

 

Here's the script:

 


use CGI::Carp qw/fatalsToBrowser/;
use strict;
use File::Find qw/find/;

print "Content-type: text/html\n\n";


print "<html><head><title>NAS Module Lister</title></head>";
print "<body><h1>NAS Module Lister.</h1>\n";

print "<p>The values in \@INC:</p>\n";

print "<p><ul>\n";
foreach ( @INC ) {
    print "<li>$_</li>\n";
}
print "</p></ul>\n";

print "<p>The installed modules:</p><ul>\n";
find ( \&wanted, @INC );

print "</ul>";

sub wanted {
    print "<li>$File::Find::name</li>\n";
}

 

 

 

 

Enjoy.......  This is actually a dump of the files accessible through @INC, so not all of them are actually modules.  For example, I see some .pod in there.  But certanly the files with .pm suffixes will be noteworthy.  I suppose I could have dropped printing for any entries that don't end in .pm, but maybe more info than less will be useful to someone.

 

By the way, if you change "find (\&wanted, @INC);" to "find( \&wanted, "/" );", you will dump a list of every file on your NAS into the web browser.  ....obviously this amount of flexibility could pose a risk if scripts are not well behaved, so use the entire webserver feature at your own risk! 


daoswald

  • Buffalo
  • ***
  • Posts: 100
Re: A tip for using Perl CGI scripts with the built-in web server (LS-XHL)
« Reply #1 on: October 26, 2010, 03:17:17 AM »

Just a followup to my previous post:  A theory I haven't tested....

 

If a CGI script has access to viewing the entire NAS filestructure (including the shares), it probably would also have the ability to write or modify files pretty much anywhere on the NAS.  It seems that even shares with access restrictions are visible to the webserver.  This could be a security concern, particularly with poorly written scripts.


andysuth

  • Calf
  • *
  • Posts: 1
Re: A tip for using Perl CGI scripts with the built-in web server (LS-XHL)
« Reply #2 on: February 09, 2011, 07:02:38 AM »

Could this procedure be used to host CRM (e.g. Sugar CRM) or PDM (e.g. ARAS Innovator) on a LinkStation Pro?

 

Thanks,

 

-Andy.