Beefy Boxes and Bandwidth Generously Provided by pair Networks
We don't bite newbies here... much
 
PerlMonks  

by Samn (Monk)
on Jul 17, 2002 at 23:20 UTC ( [id://182637]=perlquestion: print w/replies, xml ) Need Help??

Samn has asked for the wisdom of the Perl Monks concerning the following question:

Replies are listed 'Best First'.
Re: Changing default carp error message
by Ovid (Cardinal) on Jul 17, 2002 at 23:35 UTC

    Actually, what you are looking for is:

    use CGI::Carp qw/fatalsToBrowser/;

    Now that I've answered your question, let me say "don't use my answer!!!!" That does what you ask, but gives out way too much information. Potential crackers visiting your site might appreciate the extra info you are giving them. What you want to do is read your Web server's documentation on how to produce a custom error document. Keep it simple with something like "Service temporarily unavailable." That way, you let people know that this isn't permanent, but you also don't give away the keys to your house.

    Cheers,
    Ovid

    Join the Perlmonks Setiathome Group or just click on the the link and check out our stats.

Re: Changing default carp error message
by MrCromeDome (Deacon) on Jul 17, 2002 at 23:43 UTC
    In my experience, it's generally not a good idea to leave FatalsToBrowser enabled in production code. There's a lot of discussion of this elsewhere in the monastery, and so I'll not delve into that. I'll also not ask you why are you putting code in a production environment with errors such as that ;)

    My lecturing aside. . . check the CPAN documentation for CGI::Carp. There's an excellent example of creating your own error message featured there. I'll repeat it here, however it's no substitute for reading the actualy documentation:

    use CGI::Carp qw(fatalsToBrowser set_message); BEGIN { sub handle_errors { my $msg = shift; print "<h1>Oh gosh</h1>"; print "<p>Got an error: $msg</p>"; } set_message(\&handle_errors); }
    In a production environment, I remove FatalsToBrowser and instead replace it with custom error handling (and don't let the code go out with compile errors ;) Statements I've known to fail from time to time (database calls, etc.) I instead wrap in an eval block:
    eval { $sql = $dbh_receipt->prepare_cached($script); $sql->execute(); $sql->bind_columns(\$receipt); $sql->fetch(); $sql->finish(); }; if($@) { log_error($dbh_receipt->err(), $dbh_receipt->errstr(), $script); }
    By processing my own errors, I control exactly what the user sees, and can then log them to a database and even e-mail them to myself so I can look like a good guy to my users when I fix their problems before they have a chance to call me about them.

    Granted, this might be overkill for what you are trying to do, and I've probably strayed too far OT from the original question, but you get the point ;)

    Hope this helps!
    MrCromeDome

    182652
    by Samn (Monk) on Jul 17, 2002 at 23:55 UTC

          You say you don't listen, but I want you to listen because maybe you don't care what happens to you, but I don't want your carelessness to affect me! I'm dead serious about that. Maybe the data is backed up and isn't sensitive. That's still a computer you have there and it's obviously hooked up to the net. If a cracker sees this, he or she is going to know that you don't care about security and I'm willing to bet that you have plenty of other security holes on this box. Now, here's a quote from a friend of mine that I've included in my CGI course:

          [A friend] found I had been running the server for a few months, and asked what kind of security I was running. I chuckled and told him there was no need, since the computer had no valuable information on it.

          He gave me a funny look, and he started port-scanning my machine. As you would expect, just about everything was open. As we looked further and further in to it, things starting looking bad. There was evidence that someone else had been in my system.

          The clincher came when we found a SQL server database of news groups on my server. Chances are I was used to spam these news groups.

          The person quoted above was apparently used to spam newsgroups. That's pretty annoying. It would have been more annoying to find out that his box was a slave participating in DDOS attacks.

          I strongly urge you to read through my course. It's not the best you'll find, but it's fairly decent and it will give you some background information that you need. I don't mean to sound harsh, but this is pretty serious and I don't want to kid around about it.

          I'm sick of klez.

          I'm sick of DDOS attacks.

          I'm sick of Sub Seven.

          I'm sick of all of those irritating and costly security issues caused by people thinking "the data's backed up and isn't sensitive so I don't need to worry about security". At the very least, if you truly believe that there's nothing wrong with your point of view, please don't advertise it. A lot of animals are silent in the jungle for a very good reason.

          Cheers,
          Ovid

          Join the Perlmonks Setiathome Group or just click on the the link and check out our stats.

    Re: Changing default carp error message
    by dooberwah (Pilgrim) on Jul 17, 2002 at 23:30 UTC

    Log In?
    Username:
    Password:

    What's my password?
    Create A New User
    Domain Nodelet?
    Node Status?
    node history
    Node Type: perlquestion [id://182637]
    Approved by MrCromeDome
    help
    Chatterbox?
    and the web crawler heard nothing...

    How do I use this?Last hourOther CB clients
    Other Users?
    Others romping around the Monastery: (3)
    As of 2024-04-25 23:50 GMT
    Sections?
    Information?
    Find Nodes?
    Leftovers?
      Voting Booth?

      No recent polls found