Running python cgi scripts that require external cvs under apache

[chris.levis]

All:

I have written a Python webapp under MS IIS 5.0 that does the
following:
-Does a CVS checkout of a particular bit of xml
-Gets a list of valid cvs tags for that xml file
-Based on user input via forms, modifies that xml
-CVS checkin's that file

To have correct permissions to run the cvs binaries and to write
out the xml to be modified into a temp dir, I ended up having to
have the app run as a valid user account on this Windows box
that was hosting the app (it's just my workstation, with IIS
running). I.e., instead of IUSR_/IWAM_<compname>, it is running
as domain\someone. This "solution" worked well enough for me
to develop the cvs transactions, the html, etc.

However, it has been requested that I move this app onto one of
the IS Dept's servers. They insist that I put it on a solaris
box, which is running Apache. I have no administrative control
over this box, and I know very little about it, besides the fact
that test scripts (e.g., /cgi-bin/test.py ) work as expected.

However, I'm have a not-unexpected problem with permissions. When
folks use this page to modify the XML, it fails because:
1. the "effective-user-id" of the connecting person
has insufficient rights to run the cvs binaries
on the box
2. can't run cvs, so checkouts/rlogs/commits don't happen

I have heard of cgiwrap (http://cgiwrap.unixtools.com), and I'm
going to take a look at that. I was hoping that others have a
similar experience - with a happy ending - that they can share.

Any help is greatly appreciated.

-cjl

[Noah]

How do you run the cvs binary from your script? If this is a simple CGI
that calls os.popen() or os.system() then the cvs binary is most likely
running as the same user as the Apache HTTP server (usually someone
like "nobody", "apache", or "www"). http://cgiwrap.unixtools.org/ is
one solution. Also consider suEXEC which is part of the Apache
distribution; although, it is not installed by default. See
http://httpd.apache.org/docs/suexec.html . There are reasons why this
is dangerous and those reasons are discussed in the suEXEC
documentation. You can also see if the system administrator can allow
the web server user or group to run cvs. Again, this exposes your
server and so it's dangerous, but allowing cvs commit from a CGI is
dangerous, so I assume you know what you are doing. All of these
solutions will require the involvement of your UNIX system
administrator.

You may also want to look at the ViewCVS project
(http://viewcvs.sourceforge.net/ ) since that is written in Python and
implements a CGI-to-cvs interface. This may give you some
implementation hints.

Yours,
Noah