When viewing an image, the following pieces are involved. URL = .../cgi-bin/viewpat.cmd/US05551212___?MODE=fstv In the IPN World URL = .../viewpat/US05551212__?cdlabel=IPN-SBY In the NPO World In the NPO world, httpd.conf translates viewpat to cgi-bin/viewpat.cmd by the line ScriptAlias /viewpat /dfs/prod/ips/cgi-bin/viewpat.cmd ============================================================================== /dfs/prod/ips/cgi-bin/viewpat.cmd is a Perl program, which reads cgi-bin/local.pl. It eventually calls cgi-bin/anycgi.cmd to get into the any2html program. Realize that any2html is normally a fast cgi program, but when it is first called by viewpat, it's called as a subtask of this viewpat.cmd/anycgi.cmd chain. It's only when filling in the individual frames (thumbnails and the first page), and subsequent pages, is any2html under the fast cgi environment. Why is this important to understand? Because of the configuration of the any2html program. Tom has some documentation under his http://w3/~tom/manyimage/any2html.html page, but it's not complete. Here's what I learned about any2html's environment variables on June 30, 2003. QUERY_STRING = This string is parsed by any2html. It contains the normal, URL-encoded, QUERY_STRING that has something like FILENAME=cache%2F00%2F00$2FUS06000000__.IPN-SBY.tif &MODE=fstv &USER_HTML=%3CA+HREF=/cgi-bin/download.cmd/US06000000__.pdf %3Fcdlabel=IPN-SBY%3E %3CIMG+SRC=/icons/pdf.gif+ALIGN=MIDDLE%3E %3C/A%3E+%28~1710+KB%29 That last bit, un-URL-encoded is FILENAME=cache/00/00/US06000000__.IPN-SBY.tif &USER_HTML= (~1710 KB) The FILENAME part of the query string is used by any2html as the image to work with (but see ANY2HTML_ROOT below). The USER_HTML part of the query string is used by any2html to append whatever valid HTML you want after its navigation buttons. In this case, to the right of this row of buttons ====== ===== ===== ====== ===== ===== ======== | |< | | < | | > | | >| | | + | | - | | 1/14 | ====== ===== ===== ====== ===== ===== ======== along the top of an image view, there will be another gif button for the download function, followed by "(~1710 KB)". CACHEDIR = This is the real directory of where any2html is allowed to generate the single-page gif files. E.G. /ips/gifcache/ CACHEDIR_URL = This is the "web space" equivalent of $CACHEDIR. E.G. /gifcache and if the web server's DocumentRoot is /ips/prod/htdocs, then /ips/prod/htdocs/gifcache had better link to /ips/gifcache. ANY2HTML_URL = This is the URL to get to any2html, E.G. /fcgi-bin/any2html. ANY2HTML_ROOT = If this parameter is not null, then any2html runs in a "secure" mode where no file references are allowed outside the ANY2HTML_ROOT environment. On top of that, the FILENAME part of the QUERY_STRING is prefixed by this ANY2HTML_ROOT value. In Japan, this is /ips/images, so the real image file in our example FILENAME above, lives at /ips/images/cache/00/00/US06000000__.IPN-SBY.tif. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - The known security hole which was patched with the ANY2HTML_ROOT concept, was that one can use any2html to pick up any file in the file system that the web server can get to. For example, back when ANY2HTML_ROOT was incorrectly set to /dfs/prod/ips/htdocs/ in Japan, to get to the /dfs/prod/ips/htdocs/macro/v4/os_aix.d2w file, which has userid names & passwords in it, you would use http://ips06i.ips4db2.com/cgi-bin/any2html?FILENAME=macro/v4/os_aix.d2w&IN_FORMAT=txt using &PAGE=2, et cetera, to page through it. It's interesting that the Canadian Patent Office still has this any2html exposure. Tom claims he has sent a note, but that was long ago and evidently never acted upon. To get the Canadian /etc/passwd file for example, you can http://patents1.ic.gc.ca/cgi-bin/anycgi.cmd?FILENAME=/etc/passwd&IN_FORMAT=txt or to adjust the size so it's readable, append a &SCALE=0.50 Or to see their os_aix.d2w file with passwords, use ...?FILENAME=macro/os_aix.d2w&IN_FORMAT=txt&SCALE=0.50 which resides in DocumentRoot, which must be /cpoti/prod/apache/htdocs. And there you see their database is cataloged as CPODSN and to connect, you can use userid=CIPOWEB2 and password=WEBCIPO2. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - To test any2html on the command line, you can /dfs/prod/ips/fcgi-bin/any2html -#1 /dfs/images/US/00/57/US06295700__.tif /tmp/raj.tif (Yes, this looks like an any2any call, but it works.) This says to write page 1 (the -#1), using /dfs/images/US/00/57/US06295700__.tif as input, and write it to /tmp/raj.tif. You can use any2any to verify it's a good tif file /ips/bin/anyinfo /tmp/raj.tif 1 pages. tif format. Page Width Height bps hres vres comp model 1 2320 3408 1 300 300 4 0