Forum OpenACS Q&A: Response to ns_conn content payload

Collapse
Posted by Tom Jackson on

Until I started looking into a form post vunerability in AOLserver, I didn't realize that the post data isn't read unless you call ns_conn form, ns_getform, ns_queryget or ns_querygetall. That makes it nice for anyone who wants to read data after the HTTP headers. Model code for doing this is in the TCL proc ns_queryget, which is in the tcl/form.tcl file. The basic method is to use ns_conncptofp to copy the remaining bytes from the connection to a temporary file, then parse the file. All you would really need to do is replace the parsing routine.

AOLserver 4.0 now has new posted data handling procedures, but you probably want to just write your own tcl based handler so it works with 3.x and 4.x servers.