Perl question

[bloodofeve]

I'm using a MailForm.Pl in my cgi-bin linked to some online forms that I have set up for a new website and have received this when I tried to test if a form would send:-

Bad Referrer - Access Denied

The form attempting to use this script resides at http://www.novalifestyles.eu/show.php?contentid=80, which is not allowed to access this program.

If you are attempting to configure FormMail to run with this form, you need to add the following to @referers, explained in detail in the README file.

Add 'www.novalifestyles.eu' to your @referers array.

I am not sure if I need to change the @referers from this

use strict;
use vars qw(
  $DEBUGGING $emulate_matts_code $secure %more_config
  $allow_empty_ref $max_recipients $mailprog @referers
  @allow_mail_to @recipients %recipient_alias
  @valid_ENV $date_fmt $style $send_confirmation_mail
  $confirmation_text $locale $charset $no_content
  $double_spacing $wrap_text $wrap_style $postmaster
  $address_style
);

To this:-

use strict;
use vars qw(
  $DEBUGGING $emulate_matts_code $secure %more_config
  $allow_empty_ref $max_recipients $mailprog @www.novalifestyles.eu
  @allow_mail_to @recipients %recipient_alias
  @valid_ENV $date_fmt $style $send_confirmation_mail
  $confirmation_text $locale $charset $no_content
  $double_spacing $wrap_text $wrap_style $postmaster
  $address_style
);

Or is the problem due to the fact that I have the website set under a protected directory whilst it is being set up.

The site is run using a database driven system written in PHP (I'm using QnECMS)

I have attached the perl file as a .doc.
If some one can point me in the correct direction I'd be very pleased.

[PhilipToop]

Not sure I understand where you are having the problem.

Bad Referrer - Access Denied

should be followed by more information - something like

<p>
  The form attempting to use this script resides at <tt>$escaped_referer</tt>,
  which is not allowed to access this program.
</p>
<p>
  If you are attempting to configure FormMail to run with this form,
  you need to add the following to \@referers, explained in detail in the
  README file.
</p>
<p>
  Add <tt>'$host'</tt> to your <tt><b>\@referers</b></tt> array.
</p>

The script is having a problem with the referer as given in $escaped_referer.

This is given by the environmental variable HTTP_REFERER.

In connection with this variable the script says

Some web proxies and office firewalls may strip certain headers from the
HTTP request that is sent by a browser. Among these is the HTTP_REFERER
that FormMail uses as an additional check of the requests validity - this
will cause the program to fail with a 'bad referer' message even though the
configuration seems fine.

In these cases, setting this configuration setting to 1 will stop the
program from complaining about requests where no referer header was sent
while leaving the rest of the security features intact.

The scripts want the referer to be made up of the character A-Z, a-Z, 0-9, -, ., /, :, ;, %, @, #, ~, =, +, ?. And not more than 100 characters long.

Cannot reach the web page you provided as a hyperlink since it is protected by a username/password. Even if I could I'm not sure how you think that would help anybody in solving your problem - or am I missing something.

[bloodofeve]

Hi Phil,
what I wanted to know is where I would put the 'www.novalifestyles.eu' in the mailForm.
What I needed to know was do I replace the @referers with the web address in the
code

use vars qw(
  $DEBUGGING $emulate_matts_code $secure %more_config
  $allow_empty_ref $max_recipients $mailprog @referers
  @allow_mail_to @recipients %recipient_alias
  @valid_ENV $date_fmt $style $send_confirmation_mail
  $confirmation_text $locale $charset $no_content
  $double_spacing $wrap_text $wrap_style $postmaster
  $address_style
);

You can login into the site using User - Lifestyles
pw mouse12

[PhilipToop]

Don't change the use vars block.

You should only need to change the USER CONFIGURATION SECTION.

For @referers you are missing the www. to the domain name. I wonder if that might be the problem.

You did not say if you were getting any other information after Access Denied.

Are you confident that the $mailprog in the configuration section is available to you?