Beefy Boxes and Bandwidth Generously Provided by pair Networks
The stupid question is the question not asked
 
PerlMonks  

Weather Forecast CGI

by mcstayinskool (Acolyte)
on Jun 26, 2002 at 21:13 UTC ( #177534=CUFP: print w/ replies, xml ) Need Help??

I was just dinking around with Geo::WeatherNOAA, which does most of the work in this CGI. I just thought it was cool how easy it is to home-grow a weather forecast webpage. I am using the make_noaa_table function from the module, which returns formatted html--there are also functions that return in plain text so you can format as needed...

I use a file cache for results since it takes 5 seconds or so to return data from NOAA. If the cache is more than an hour old, it will retrieve the data and overwrite the cache. Otherwise, data just gets pulled from the file.

If you implement this CGI, make sure you add a "weather_cache" subdirectory of your cgi-bin directory and make it world-writeable.

#!/usr/bin/perl use strict; use Geo::WeatherNOAA; use CGI qw(param); my ($city, $state); if (param("city")) { $city = param("city"); } else { $city = "Minneapolis"; } if (param("state")) { $state = param("state"); } else { $state = "MN"; } print "Content-type: text/html\n\n"; print <<EOHTML; <HTML> <HEAD> <TITLE>NOAA Weather</title> </head> <BODY TEXT="#003366" BGCOLOR="#FFFFFF" ALINK="#0000FF" VLINK="#FF232D" +> <CENTER> <h1>Perl Weather Reporter</h1> <HR> EOHTML print "<form><table><tr><td align = right><b>City:</b></td> <td align = left><input type = text name = city></td></tr>\n"; print "<tr><td align = right><b>State:</b></td> <td align = left>"; print_state_select_menu(); print "</td></tr>\n"; print "<tr><td colspan = 2 align = center><input type = submit value = + \"Get Forecast\"></td></tr>\n"; print "</table></form>\n"; print "<h3><font color = red>Weather Forecast for</font> $city, $state +</h3>"; my $html_weather_table = get_weather_data($city,$state); print $html_weather_table; print "</body></html>\n"; exit; sub get_weather_data { my ($city, $state) = @_; my $filename = "weather_cache/${city}_${state}.out"; my ($return, $time, $mtime, $diff); if (-e $filename) { $time = time; $mtime = (stat("weather_cache/$filename"))[9]; $diff = $mtime - $time; } else { $diff = 0; } if ($diff > 3600 || !$diff) { # file older than an hour or doesn't +exist $return = make_noaa_table($city,$state); open(CACHE,">$filename") or warn "couldn't open weather_cac +he/$filename: $!"; print CACHE $return; close(CACHE); return $return; } else { open(CACHE,"<$filename") or warn "couldn't open weather_cac +he/$filename: $!"; { local $/ = "\0"; $return = <CACHE>; } close(CACHE); return $return; } } sub print_state_select_menu { print '<select name="state" > <option value=""> -- select one -- <option value="AL">Alabama <option value="AK">Alaska <option value="AZ">Arizona <option value="AR">Arkansas <option value="CA">California <option value="CO">Colorado <option value="CN">Connecticut <option value="DE">Delaware <option value="FL">Florida <option value="GA">Georgia <option value="HA">Hawaii <option value="ID">Idaho <option value="IL">Illinois <option value="IN">Indiana <option value="IO">Iowa <option value="KA">Kansas <option value="KY">Kentucky <option value="LA">Louisiana <option value="ME">Maine <option value="MD">Maryland <option value="MA">Massachusetts <option value="MI">Michigan <option value="MN">Minnesota <option value="MS">Mississippi <option value="MO">Missouri <option value="MT">Montana <option value="NE">Nebraska <option value="NV">Nevada <option value="NH">New Hampshire <option value="NJ">New Jersey <option value="NM">New Mexico <option value="NY">New York <option value="NC">North Carolina <option value="ND">North Dakota <option value="OH">Ohio <option value="OK">Oklahoma <option value="OR">Oregon <option value="PA">Pennsylvania <option value="RI">Rhode Island <option value="SC">South Carolina <option value="SD">South Dakota <option value="TN">Tenneessee <option value="TX">Texas <option value="UT">Utah <option value="VT">Vermont <option value="VA">Virginia <option value="WA">Washington <option value="WV">West Virginia <option value="WI">Wisconsin <option value="WY">Wyoming </select>'; }

Comment on Weather Forecast CGI
Download Code
Re: Weather Forecast CGI
by hossman (Prior) on Jun 27, 2002 at 05:35 UTC
    You've got a pretty big security hole here.

    You aren't doing any sanity checking on the city/state input -- and Geo::WeatherNOAA isn't doing it for you. Given a bogus city/state combo, make_noaa_table is perfectly happy to output a large chunk of HTML which indicates that there was a Network problem retrieving a URL constructed using the users bogus state/city.

    If a malicious user hit this CGI repeatedly using giberish as the city/state, they could easily fill up your disk in no time.

    PS: even if you aren't worried about that, you should be scrubbing your input at least a little to make sure i don't enter something like "../../../../../../../../../" as my city..

Re: Weather Forecast CGI
by thraxil (Prior) on Jun 27, 2002 at 17:21 UTC

    in addition to the security hole pointed out, the script would be much easier to read and customize if it utilized a templating library like HTML::Template or Template::Toolkit to seperate the html from the perl.

    anders pearson

Re: Weather Forecast CGI
by mcstayinskool (Acolyte) on Jun 28, 2002 at 19:42 UTC
    Re: security-- Okay, I now sanitize the data from the input form. My intention in this CGI was to show how cool Geo::WeatherNOAA is, not to distribute a production quality script. But, for those that care, the more secure code sits below.

    Re: HTML templates-- yes, I am a big supporter of separating html from code, but not for quick and dirty scripts to demonstrate something. I use HTML::Template and other tools quite frequently, but for this script I do think that it would be overkill.

    cheers

    #!/usr/bin/perl use strict; use Geo::WeatherNOAA; use CGI qw(param); my $OK_CHARS = "-a-zA-Z0-9_.@'\"\s"; foreach (param()) { # sanitize data input from form if (param($_) =~ /[^$OK_CHARS]/) { print "Content-type: text/html\n\n"; print "<html><head><title>Form Error</title></head><body><b>Warnin +g:</b> One of the characters in your form entry is not allowed by thi +s program. Characters that are allowed are A-Za-z0-9.@-\"'. Please hi +t back on your browser and try again.</body></html>"; exit(0); } } my ($city, $state); if (param("city")) { $city = param("city"); } else { $city = "Minneapolis"; } if (param("state")) { $state = param("state"); } else { $state = "MN"; } print "Content-type: text/html\n\n"; print <<EOHTML; <HTML> <HEAD> <TITLE>BenWorld</TITLE> <link rel="SHORTCUT ICON" href="/bk.ico"> </HEAD> <BODY TEXT="#003366" BGCOLOR="#FFFFFF" ALINK="#0000FF" VLINK="#FF232D" +> <CENTER> <IMG SRC="/images/benwlogo.jpg"><br> <HR> EOHTML print "<h3><font color = red>Weather Forecast for</font> $city, $state +</h3>"; my $html_weather_table = get_weather_data($city,$state); print $html_weather_table; print "<hr><p>\n"; print "<form><table> <tr><td colspan = 2 align = center><b>Get weather for another City/Sta +te</b></td></tr> <td align = right><b>City:</b></td> <td align = left><input type = text name = city></td></tr>\n"; print "<tr><td align = right><b>State:</b></td> <td align = left>"; print_state_select_menu(); print "</td></tr>\n"; print "<tr><td colspan = 2 align = center><input type = submit value = + \"Get Forecast\"></td></tr>\n"; print "</table></form>\n"; print "</body></html>\n"; exit; sub get_weather_data { my ($city, $state) = @_; my $filename = "weather_cache/${city}_${state}.out"; my ($return, $time, $mtime, $diff); if (-e $filename) { $time = time; $mtime = (stat("weather_cache/$filename"))[9]; $diff = $time - $mtime; } else { $diff = 0; } if ($diff > 3600 || !$diff) { # file older than an hour or doesn't +exist $return = make_noaa_table($city,$state); open(CACHE,">$filename") or warn "couldn't open weather_cache/$ +filename: $!"; print CACHE $return; close(CACHE); return $return; } else { open(CACHE,"<$filename") or warn "couldn't open weather_cache/$ +filename: $!"; { local $/ = "\0"; $return = <CACHE>; } close(CACHE); return $return; } } sub print_state_select_menu { print '<select name="state" > <option value=""> -- select one -- <option value="AL">Alabama <option value="AK">Alaska <option value="AZ">Arizona <option value="AR">Arkansas <option value="CA">California <option value="CO">Colorado <option value="CN">Connecticut <option value="DE">Delaware <option value="FL">Florida <option value="GA">Georgia <option value="HA">Hawaii <option value="ID">Idaho <option value="IL">Illinois <option value="IN">Indiana <option value="IO">Iowa <option value="KA">Kansas <option value="KY">Kentucky <option value="LA">Louisiana <option value="ME">Maine <option value="MD">Maryland <option value="MA">Massachusetts <option value="MI">Michigan <option value="MN">Minnesota <option value="MS">Mississippi <option value="MO">Missouri <option value="MT">Montana <option value="NE">Nebraska <option value="NV">Nevada <option value="NH">New Hampshire <option value="NJ">New Jersey <option value="NM">New Mexico <option value="NY">New York <option value="NC">North Carolina <option value="ND">North Dakota <option value="OH">Ohio <option value="OK">Oklahoma <option value="OR">Oregon <option value="PA">Pennsylvania <option value="RI">Rhode Island <option value="SC">South Carolina <option value="SD">South Dakota <option value="TN">Tenneessee <option value="TX">Texas <option value="UT">Utah <option value="VT">Vermont <option value="VA">Virginia <option value="WA">Washington <option value="WV">West Virginia <option value="WI">Wisconsin <option value="WY">Wyoming </select>'; }

      Two minor things:

      1. You don't support cities with spaces in the name
      2. You've got Connecticut as "CN" instead of "CT"

      As an additional level of optimization, you could just pull the state (and country) data from the noaa.gov page directly, so you always get the ones that are supported there, and then template out the HTML with some brief HTML::Template fu. Easy to do, and makes the code a lot smaller.

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: CUFP [id://177534]
Approved by particle
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others surveying the Monastery: (12)
As of 2014-08-01 17:41 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    Who would be the most fun to work for?















    Results (36 votes), past polls