Executing user shell command from python cgi

Question

I have a task assigned to me to create a python script which when called as a cgi should execute the command on the user machine.

Is it possible that I can execute a shell command passed to the python cgi from a html form?

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
  <meta content="text/html; charset=ISO-8859-1"
 http-equiv="content-type">
  <title>xyz</title>
</head>
<body>
<big><big>Login
Here<br>
<br>
</big></big>
<form action="/var/www/cgi-bin/xyz.py" name="xyzform"><big>xyz
<br>
 enter your value<br>
  <input name="text"><br>
  <br>
  <br>
<input type="submit">
  <br>
</form>
&nbsp;__&nbsp;<br>
</body>
</html>

When the user submits this form the text should be matched in python cgi and then execute the command to access a file in nfs on the user calling machine.

Is it possible by using the cgi or cgitb modules? If not, then how can I achieve this?

You want a CGI to execute code on the user's machine? Are you sure? — Daniel Roseman
– Daniel Roseman, Commented Dec 10, 2012 at 13:45
no, fortunately it's not possible to acces the users computer that easily! — mata
– mata, Commented Dec 10, 2012 at 18:46
Not trivially possible (not via CGI as such, anyway), and certainly not in a browser/OS independent manner over all. What's the rationale of this tool? — tink
– tink, Commented Dec 10, 2012 at 18:57
The os on which we want is linux and the rational of this.the normal user needs to remember a long command shared with the them. — user1393251
– user1393251, Commented Dec 11, 2012 at 5:33

Sudheer · Accepted Answer · 2012-12-10 19:52:34Z

1

The best you can execute on a user's machine is javascript Anything more than that will compromise the security and hence will be obviously impossible

answered Dec 10, 2012 at 19:52

Sudheer

892 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Marwan Alsabbagh · Accepted Answer · 2012-12-11 03:41:35Z

Generally for security reasons and by design you cannot used typical web technologies to execute code on the users machine. But it is possible and sometimes necessary to do such a thing. One example is a web-based application that has certain screens that need to interact with the user's hardware devices. Here are some potential solutions that let you execute code on user's machines:

ActiveX only works in IE and only on windows. But this will let you write code that executes on the users machine.
Firefox extension using nsIProcess. This is a nice cross OS approach that I've used in the past. It will run on Linux, Win, Mac and let's you create an extension that can execute code on the machine. Then your web page can communicate with your extension to run the code you need.
Window's RPC is an approach where you can execute code on the user's machine from the server. This will only work if all the machines are windows machines and generally all of them are on the same LAN and part of the same windows domain. You're server should also have the privileges on the domain to execute code on the user's desktops. The real benefit of this is that you don't have to install anything in the users computer and it is cross-browser compatible.

I am sure there are many ways of doing this the above list is just a sample of them. It is very important to keep security in mind when you implement this. You have to be quite certain in your design that only your website which should be authorized to do such can execute commands on the users computer.

Collectives™ on Stack Overflow

Executing user shell command from python cgi

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related