lunarmodules/cgilua

CGILua is a tool for creating dynamic HTML pages and manipulating input data from Web forms.

cgilua's Issues

can not load the module on ubuntu 22.04 with lua5.2

it always tried to find cgilua.lua or cgilua/init.lua but there are no such files in 6.x release

on a old cgilua release with lua-5.1, I saw cgilua.lua installed via luarocks, that worked fine.

am I missing something to use cgilua 6.x?

local cgilua = require "cgilua"
print("CGILua loaded successfully.")

Weak session IDs generated CVE-2014-2875

I don't actually see any bug reports open on this CVE, so I am creating a bug report here.

https://security-tracker.debian.org/tracker/CVE-2014-2875

As far as I can tell, the issue is still present in the latest git source.

I believe the vulnerable code itself is in
https://github.com/keplerproject/cgilua/blob/master/src/cgilua/session.lua
and is these bits:

 local RANGE = 999999999
 [...]
 randseed (mod (time(), RANGE))

 [...]

 local function new_id ()
   return rand (RANGE)
 end

I think it it probably safe to assume rand() doesn't meet the requirements for a session id. As in it generates numbers that are predictable.

I am not really familiar with how to generate an appropriate id, but I do notice there are some crypto libraries for LUA, e.g. https://github.com/philanc/plc

On the Debian mailing list, it was suggested "a more secure function is to simply read the value from /dev/urandom".

cgilua.fcgi wsapi is nil

I get this error with apache2.4

cgilua.fcgi:33: attempt to index global 'wsapi' (a nil value)

Update:
I believe I am using old version as I was using luarocks.

Update Luarock

Can I ask you to update the luarockt for this project, please?

I'm sorry I did not explain myself. I'm Massimiliano Bertinetti and I'm the new lead developer of Sailor. By applying the master branches of the packages on which sailor depends I managed to put into production Sailor with Lua 5.3. If published on Luarocks I can also update Sailor with new dependencies and allow Sailor users to use Lua 5.3 with Sailor 0.6.0. Thank you!

Lua Rocks doesn't install necessary dependancies

If this is intended behavior, make note in your installation page. The modules I had to install were:

• wsapi
• coxpcall

src.rock 6.0.2 missing

@tomasguisasola on Luarocks.org https://luarocks.org/modules/tomasguisasola/cgilua,
the latest version of CGILua (6.0.2) comes only with a rockspec.
Please, could you upload too the src.rock ?

The following command allows to create it :

    $ luarocks pack <your_rockspec>

Getting 500 error with version 5.1

I'm not sure what i'm doing wrong here but I get this error in my apache webserver logs, something about SAPI...
I made a paste on the apache paste bucket containing the error: http://apaste.info/ZM7
How do i fix that?

automated test suite (luadist)

The test suite may need some changes to permit unattended running during smoke tests. See [2] for suggestions. Currently LuaDist skips running tests [2] on this module.

• [1] https://github.com/LuaDist/cgilua/blob/master/CMakeLists.txt
• [2] http://lua-users.org/wiki/LuaPackagingGuide

What is the latest version?

Different web pages have different numbers.

• https://keplerproject.github.io/cgilua/ -> 5.2
• https://github.com/keplerproject/cgilua -> 5.2.1
• https://github.com/keplerproject/cgilua/releases -> 5.2 alfa 2
• b4ea261 -> 5.2.2
• 5c4d84a -> 6.0.1 (not sure what happened with 6.0.01).

It would be good if the official information for the project could be a little bit more consistent :-)

send custom http status

I did not found how to send custom http status. Is this posible?

authentication does not work with tokenPersistence as cookie

I am using the example files, which I set the options.tokenPersistence ot 'cookie'. Then I created a page named as aa.lp following the reference manual:

<title>Login</title> <% cgilua.enablesession () if not cgilua.authentication.username() then cgilua.redirect(cgilua.authentication.checkURL()) else -- continues with the application flow end %> dondoanfdafd

But the login fails, and the reason is there is no Set-Cookie in 302 redirection packet.

Running the example using FastCGI

Hi!

I'm trying to get the example app to run on Lua 5.2 and 5.3 and I'm having some problems. The first one is related to the builtin function unpack on Lua 5.3, installing the head of the branch master fix it. The seccond problem it with src/launchers/cgilua.fcgi, I'm not sure if I'm doing something wrong but the only way I can get it to work is if I set filename with the full path to app.lua

It maybe help to mention I'm using spawn-fcgi