CGI
view release on metacpan or search on metacpan
(RT #75628)
- prevent corruption of POSTDATA/PUTDATA when -utf8 flag is used and use
tempfiles to handle this data (RT #79102, thanks anonymous)
- unescape request URI *after* having removed the query string to prevent
removal of ? chars that are part of the original URI (and were encoded)
(RT #83265)
- fix q( to qq( in CGI::Carp so $@ is correct interpolated (RT #83360)
- don't call ->query_string in url unless -query is passed (RT #87790)
(optimisation and fits the current documented behaviour)
4.04 2014-09-04
[ RELEASE NOTES ]
- this release removes some long deprecated modules/functions and
includes refactoring to the temporary file handling in CGI.pm. if
you are doing anything out of the ordinary with regards to temp
files you should test your code before deploying this update as
temp files may no longer be stored in previously used locations
[ REMOVED / DEPRECATIONS ]
- startform and endform methods removed (previously deprecated, you
should be using the start_form and end_form methods)
- both CGI::Apache and CGI::Switch have been removed as these modules
1) have been deprecated for *years*, and 2) do nothing whatsoever
[ SPEC / BUG FIXES ]
- handle multiple values in X-Forwarded-Host header, we follow the
logic in most other frameworks and take the last value from the list
(RT #54487)
- reverse the order of TEMP dir placement for WINDOWS: TEMP > TMP > WINDIR
(RT #71799, thanks to jeff@math.tntech.edu), this returns the behaviour
to pre e24d04e9bc5fda7722444b02fec135d8cc2ff488 but with the undefined
fix still in place
- refactor CGITempFile::find_tempdir to use File::Spec->tmpdir
(related: RT #71799)
- fix warnings when QUERY_STRING has empty key=value pairs (RT #54511)
- pad custom 500 status response messages to > 512 for MSIE (RT #81946)
- make Vars tied hash delete method return the value deleted from the hash
making it act like perl's delete (RT #51020)
[ TESTING ]
- add .travis.yml (https://travis-ci.org)
- test case for RT #53966 - disallow filenames with ~ char
- test case for RT #55166 - calling Vars to get the filename does not return
a filehandle, so this cannot be used in the call to uploadinfo, also
update documentation for the uploadInfo to show that ->Vars should not be
used to get the filename for this method
- fix t/url.t to pass on Win32 platforms that have the SCRIPT_NAME env
variable set (RT #89992)
- add procedural call tests for upload and uploadInfo to confirm these work
as should (RT #91136)
[ DOCUMENTATION ]
- tweak perldoc for -utf8 option (RT #54341, thanks to Helmut Richter)
- explain the HTML generation functions should no longer be used and that
they may be deprecated in a future release
4.03 2014-07-02
[ REMOVED / DEPRECATIONS ]
- the -multiple option to popup_menu is now IGNORED as this did not
function correctly. If you require a menu with multiple selections
use the scrolling_list method. (RT #30057)
[ SPEC / BUG FIXES ]
- support redirects in mod_perl2, or fall back to using env variable
for up to 5 redirects, when getting the query string (RT #36312)
- CGI::Cookie now correctly supports the -max-age argument, previously
if this was passed the value of the -expires argument would be used
meaning there was no way to supply *only* this argument (RT #50576)
- make :all actually import all methods, except for :cgi-lib, and add
:ssl to the :standard import (RT #70337)
[ DOCUMENTATION ]
- clarify documentation regarding query_string method (RT #48370)
- links fixed in some perldoc (Thanks to Michiel Beijen)
[ TESTING ]
- add t/changes.t for testing this Changes file
- test case for RT #31107 confirming multipart parsing is to spec
- improve t/rt-52469.t by adding a timeout check
4.02 2014-06-09
[ NEW FEATURES ]
- CGI::Carp learns noTimestamp / $CGI::Carp::NO_TIMESTAMP to prevent
timestamp in messages (RT #82364, EDAVIS@cpan.org)
- multipart_init and multipart_start learn -charset option (RT #22737)
[ SPEC / BUG FIXES ]
- Support multiple cookies when passing an ARRAY ref with -set-cookie
(RT #15065, JWILLIAMS@cpan.org)
[ DOCUMENTATION ]
- Made licencing information consistent and remove duplicate comments
about licence details, corrected location to report bugs (RT #38285)
4.01 2014-05-27
[ DOCUMENTATION ]
- CGI.pm hasn't been removed from core *just* yet, but will be soon:
http://perl5.git.perl.org/perl.git/commitdiff/e9fa5a80
4.00 2014-05-22
[ INTERNALS ]
- CGI::Fast split out into its own distribution, related files and tests removed
- developer test added for building with perlbrew
[ DOCUMENTATION ]
- Update perldoc to explain that CGI.pm has been removed from perl core
- Make =head2 perldoc less shouty (RT #91140)
- Tickets migrated from RT to github issues (both CGI and CGI.pm distributions)
- Repointing bugtracker at newly forked github repo and note that Lee Johnson
is the current maintainer.
- Bump version to 4.00 for clear boundary of above changes
Version 3.65 Feb 11, 2014
[INTERNALS]
- Update Makefile to refine where CGI.pm gets installed
[BUG FIXES]
1. In CGI::Pretty, we no longer add line breaks after tags we claim not to format. Thanks to rrt, Bob Kuo and
and Mark Stosberg. (RT#42114).
2. unescapeHTML() no longer falsely recognizes certain text as entities. Thanks to Pete Gamanche, Mark Stosberg
and Bob Kuo. (RT#39122)
3. checkbox_group() now correctly includes a space before the "checked" attribute.
Thanks to Andrew Speer and Bob Kuo. (RT#36583)
4. Fix case-sensitivity in http() and https() according to docs. Make https()
return list of keys in list context. Thanks to riQyRoe and Rhesa Rozendaal. (RT#12909)
5. XHTML is now automatically disabled for HTML 4, as well as HTML 2 and HTML 3. Thanks to
Dan Harkless and Yanick Champoux. (RT#27907)
6. Pre-compiling 'end_form' with ':form' switch now works. Thanks to ryochin and Yanick Champoux. (RT#41530)
7. Empty name/values pairs are now properly saved and restored from filehandles. Thanks to rlucas and
Rhesa Rozendaal (RT#13158)
8. Some differences between startform() and start_form() have been fixed. Thanks to Slaven Rezic and
Shawn Corey. (RT#22046)
9. url_param() has been updated to be more consistent with the documentation and param().
Thanks to Britton Kerin and Yanick Campoux. (RT#43587)
10.hidden() now correctly supports multiple default values.
Thanks to david@dierauer.net and Russell Jenkins. (RT#20436)
11.Calling CGI->new() no longer clobbers the value of $_ in the current scope.
Thanks to Alexey Tourbin, Bob Kuo and Mark Stosberg. (RT#25131)
12.UTF-8 params should not get double-decoded now.
Thanks to Yves, Bodo, Burak G�rsoy, and Michael Schout. (RT#19913)
13.We now give objects passed to CGI::Carp::die a chance to be stringified.
Thanks to teek and Yanick Champoux (RT#41530)
14.Turning off autoEscape() now only affects the behavior of built-in HTML
generation fuctions. Explicit calls to escapeHTML() always escape HTML regardless
of the setting. Thanks to vindex, Bob Kuo and Mark Stosberg (RT#40748)
15.In CGI::Fast, preferences set via pragmas are now preserved.
Thanks to heinst and Mark Stosberg (RT#32119)
[DOCUMENTATION]
1. remote_addr() is now documented. Thanks to Yanick Champoux. (RT#38884)
2. In CGI::Pretty in the list of tags left unformatted was updated to match the code. Thanks to Mark Stosberg. (RT#42114)
3. In CGI::Pretty, performance concerns are now documented. Thanks to Jochen, Rhesa Rozendaal and Mark Stosberg (RT#13223)
4. A number of outdated Netscape references have been removed. Thanks to Mark Stosberg.
5. The documentation has been purged of examples of using indirect object notation. Thanks to Mark Stosberg.
6. Some POD formatting was fixed. Thanks to Dave Mitchell (RT#48935).
7. Docs and examples were updated to highlight start_form instead of startform.
Thanks to Slaven Rezic.
8. Note that CGI::Carp::carpout() doesn't work with in-memory filehandles.
Thanks to rhubbell and Mark Stosberg.
9. The documentation for the -newstyle_urls is now less confusing.
Thanks to Ryan Tate and Mark Stosberg (RT#49454)
[INTERNALS]
1. Quit bundling an ancient copy of Test::More and and using a custom 'lib' path for the tests. Instead, Test::More
is now a dependency. Thanks to Ansgar and Mark Stosberg (RT#48811)
2. Automated tests for hidden() have been added, thanks to Russel Jenkins and Mark Stosberg (RT#20436)
3. t/util.t has been updated to use Test::More instead of a home-grown test function. Thanks to Bob Kuo.
Version 3.45, Aug 14, 2009
[BUG FIXES]
1. Prevent warnings about "uninitialized values" for REQUEST_URI, HTTP_USER_AGENT and other environment variables.
Patches by Callum Gibson, heiko and Mark Stosberg. (RT#24684, RT#29065)
2. Avoid death in some cases when running under Taint mode on Windows.
Patch by Peter Hancock (RT#43796)
3. Allow 0 to be used as a default value in popup_menu(). This was broken starting in 3.37.
Thanks to Haze, who was the first to report this and supply a patch, and pfschill, who pinpointed
when the bug was introduced. A regression test for this was also added. (RT#37908)
4. Allow "+" as a valid character in file names, which fixes temp file creation on OS X Leopard.
Thanks to Andy Armstrong, and alech for patches. (RT#30504)
5. Set binmode() on the Netware platform, thanks to Guenter Knauf (RT#27455)
6. Don't allow a CGI::Carp error handler to die recursively. Print a warning and exit instead.
Thanks to Marc Chantreux. (RT#45956)
7. The Dump() method now is fixed to escape HTML properly. Thanks to Mark Stosberg (RT#21341)
8. Support for <optgroup> with scrolling_list() now works the same way as it does for popup_menu().
Thanks to Stuart Johnston (RT#30097)
9. CGI::Pretty now works properly when $" is set to ''. Thanks to Jim Keenan (RT#12401)
10. Fix crash when used in combination with PerlEx::DBI. Thanks to Burak G�rsoy (RT#19902)
[DOCUMENTATION]
1. Several typos were fixed, Thanks to ambs. (RT#41105)
2. A typo related to the nosticky pragma was fixed, thanks to Britton Kerin. (RT#43220)
3. examples/nph-clock.cgi is now more portable, by calling localtime() rather than `/bin/date`,
thanks to Guenter Knauf. (RT#27456).
4. In CGI::Carp, the SEE ALSO section was cleaned up, thanks to Slaven Rezic. (RT#32769)
5. The docs for redirect() were updated to reflect that most headers are
ignored during redirection. Thanks to Mark Stosberg (RT#44911)
[INTERNALS]
1. New t/unescapeHTML.t test script has been added. It includes a TODO test for a pre-existing
bug which could use a patch. Thanks to Pete Gamache and Mark Stosberg (RT#39122)
2. New test scripts have been added for user_agent(), popup_menu() and query_string(), scrolling_list() and Dump()
Thanks to Mark Stosberg and Stuart Johnston. (RT#37908, RT#43006, RT#21341, RT#30097)
3. CGI::Carp and CGI::Util have been updated to have non-developer version numbers.
Thanks to Slaven Rezic. (RT#48425)
4. CGI::Switch and CGI::Apache now properly set their VERSION in their own name space.
Thanks to Alexey Tourbin (RT#11941,RT#11942)
Version 3.44, Jul 30, 2009
1. Patch from Kurt Jaeger to allow HTTP PUT even if the content length is unknown.
2. Patch from Pavel merdin to fix a problem for one of the FireFox addons.
3. Fixed issue in mod_perl & fastCGI environment of cookies returned from
CGI->cookie() leaking from one session to another.
Version 3.43, Apr 06, 2009
1. Documentation patch from MARKSTOS@cpan.org to replace all occurrences of
"new CGI" with CGI->new()" to reflect best perl practices.
2. Patch from Stepan Kasal to fix utf-8 related problems in perl 5.10
Version 3.42, Sep 08, 2008
1. Added patch from Renee Baecker that makes it possible to subclass
CGI::Pretty.
2. Added patch from Nicholas Clark to allow ~ characters in temporary directories.
3. Added patch from Renee Baecker that fixes the inappropriate escaping of fields
in multipart headers.
Version 3.41, Aug 25, 2008
1. Fix url() returning incorrect path when query string contains escaped newline.
2. Added additional windows temporary directories and environment variables, courtesy patch from Renee Baecker
3. Added a handle() method to the lightweight upload
filehandles. This method returns a real IO::Handle object.
4. Added patch from Tony Vanlingen to fix deep recursion warnings in CGI::Pretty.
Version 3.40, Aug 06, 2008
1. Fixed CGI::Fast docs to eliminate references to a "special"
version of Perl.
2. Makefile.PL now depends on FCGI so that CGI::Fast installs properly.
3. Fix script_name() call from Stephane Chazelas.
Version 3.39, Jun 29, 2008
1. Fixed regression in "exists" function when using tied interface to CGI via $q->Vars.
Version 3.38, Jun 25, 2008
1. Fix annoying warning in http://rt.cpan.org/Ticket/Display.html?id=34551
2. Added nobr() function http://rt.cpan.org/Ticket/Display.html?id=35377
3. popup_menu() allows multiple items to be selected by default, satisfying
http://rt.cpan.org/Ticket/Display.html?id=35376
4. Patch from Renee Backer to avoid doubled <http-equiv> headers.
5. Fixed documentation bug that describes what happens when a
parameter is empty (e.g. "?test1=").
6. Fixed minor warning described at http://rt.cpan.org/Public/Bug/Display.html?id=36435
7. Fixed overlap of attribute and parameter space described in http://rt.perl.org/rt3//Ticket/Display.html?id=24294
Version 3.37, Apr 22, 2008
1. Fix pragmas so that they persist over modperl invocations (e.g. RT 34761)
2. Fixed handling of chunked multipart uploads; thanks to Michael Bernhardt
who reported and fixed the problem.
Version 3.36
1. Fix CGI::Cookie to support cookies that are separated by "," instead of ";".
Version 3.35, Mar 27, 2008
1. Resync with bleadperl, primarily fixing a bug in parsing semicolons in uploaded filenames.
Version 3.34, Mar 18, 2008
1. Handle Unicode %uXXXX escapes properly -- patch from DANKOGAI@cpan.org
2. Fix url() method to not choke on path names that contain regex characters.
Version 3.33, Jan 02, 2008
1. Remove uninit variable warning when calling url(-relative=>1)
2. Fix uninit variable warnings for two lc calls
3. Fixed failure of tempfile upload due to sprintf() taint failure in perl 5.10
Version 3.32, Dec 27, 2007
1. Patch from Miguel Santinho to prevent sending premature headers under mod_perl 2.0
Version 3.31, Nov 30, 2007
1. Patch from Xavier Robin so that CGI::Carp issues a 500 Status code rather than a 200 status code.
2. Patch from Alexander Klink to select correct temporary directory in OSX Leopard so that upload works.
3. Possibly fixed "wrapped pack" error on 5.10 and higher.
Version 3.30
1. Patch from Mike Barry to handle POSTDATA in the same way as PUT.
2. Patch from Rafael Garcia-Suarez to correctly reencode unicode values as byte values.
Version 3.29, Apr 16, 2007
1. The position of file handles is now reset to zero when CGI->new is called.
(Mark Stosberg)
2. uploadInfo() now works across multiple object instances. Also, the first
tests for uploadInfo() were added as part of the fix. (CPAN bug 11895, with
contributions from drfrench and Mark Stosberg).
Version 3.28, Mar 29, 2007
1. Applied patch from Allen Day that makes Cookie parsing RFC2109 compliant
(attribute/values can be separated by commas as well as semicolons).
2. Applied patch from Stephan Struckmann that allows script_name() to be set correctly.
I finally got tired of all the 2.37 betas and released 2.38. The main
difference between this version and the last 2.37 beta (2.37b30) are
some fixes for VMS. This should allow file upload to work properly on
all VMS Web servers.
Version 2.37, various beta versions
1. Added a CGI::Cookie::parse() method for lucky mod_perl users.
2. No longer need separate -values and -labels arguments for
multi-valued form elements.
3. Added better interface to raw cookies (fix courtesy Ken Fox,
kfox@ford.com)
4. Added param_fetch() function for direct access to parameter list.
5. Fix to checkbox() to allow for multi-valued single checkboxes
(weird problem).
6. Added a compile() method for those who want to compile without
importing.
7. Documented the import pragmas a little better.
8. Added a -compile switch to the use clause for the long-suffering
mod_perl and Perl compiler users.
9. Fixed initialization routines so that FileHandle and type globs
work correctly (and hash initialization doesn't fail!).
10. Better deletion of temporary files on NT systems.
11. Added documentation on escape(), unescape(), unescapeHTML() and
unescapeHTML() subroutines.
12. Added documentation on creating subclasses.
13. Fixed problem when calling $self->SUPER::foo() from inheriting
subclasses.
14. Fixed problem using filehandles from within subroutines.
15. Fixed inability to use the string "CGI" as a parameter.
16. Fixed exponentially growing $FILLUNIT bug
17. Check for undef filehandle in read_from_client()
18. Now requires the UNIVERSAL.pm module, present in Perl 5.003_7 or
higher.
19. Fixed problem with uppercase-only parameters being ignored.
20. Fixed vanishing cookie problem.
21. Fixed warning in initialize_globals() under mod_perl.
22. File uploads from Macintosh versions of MSIE should now work.
23. Pragmas now preceded by dashes (-nph) rather than colons (:nph).
Old style is supported for backward compatibility.
24. Can now pass arguments to all functions using {} brackets,
resolving historical inconsistencies.
25. Removed autoloader warnings about absent MultipartBuffer::DESTROY.
26. Fixed non-sticky checkbox() when -name used without -value.
27. Hack to fix path_info() in IIS 2.0. Doesn't help with IIS 3.0.
28. Parameter syntax for debugging from command line now more
straightforward.
29. Added $DISABLE_UPLOAD to disable file uploads.
30. Added $POST_MAX to error out if POSTings exceed some ceiling.
31. Fixed url_param(), which wasn't working at all.
32. Fixed variable suicide problem in s///e expressions, where the
autoloader was needed during evaluation.
33. Removed excess spaces between elements of checkbox and radio
groups
34. Can now create "valueless" submit buttons
35. Can now set path_info as well as read it.
36. ReadParse() now returns a useful function result.
37. import_names() now allows you to optionally clear out the
namespace before importing (for mod_perl users)
38. Made it possible to have a popup menu or radio button with a value
of "0".
39. link() changed to Link() to avoid overriding native link function.
40. Takes advantage of mod_perl's register_cleanup() function to clear
globals.
41. <LAYER> and <ILAYER> added to :html3 functions.
42. Fixed problems with private tempfiles and NT/IIS systems.
43. No longer prints the DTD by default (I bet no one will complain).
44. Allow underscores to replace internal hyphens in parameter names.
45. CGI::Push supports heterogeneous MIME types and adjustable delays
between pages.
46. url_param() method added for retrieving URL parameters even when a
fill-out form is POSTed.
47. Got rid of warnings when radio_group() is called.
48. Cookies now moved to their very own module.
49. Fixed documentation bug in CGI::Fast.
50. Added a :no_debug pragma to the import list.
Version 2.36
1. Expanded JavaScript functionality
2. Preliminary support for cascading stylesheets
3. Security fixes for file uploads:
+ Module will bail out if its temporary file already exists
+ Temporary files can now be made completely private to avoid
peeking by other users or CGI scripts.
4. use CGI qw/:nph/ wasn't working correctly. Now it is.
5. Cookie and HTTP date formats didn't meet spec. Thanks to Mark
Fisher (fisherm@indy.tce.com) for catching and fixing this.
p
Version 2.35
1. Robustified multipart file upload against incorrect syntax in
POST.
2. Fixed more problems with mod_perl.
3. Added -noScript parameter to start_html().
4. Documentation fixes.
Version 2.34
1. Stupid typo fix
Version 2.33
1. Fixed a warning about an undefined environment variable.
2. Doug's patch for redirect() under mod_perl
3. Partial fix for busted inheritence from CGI::Apache
4. Documentation fixes.
Version 2.32
1. Improved support for Apache's mod_perl.
2. Changes to better support inheritance.
3. Support for OS/2.
Version 2.31
1. New uploadInfo() method to obtain header information from uploaded
files.
value always overrides the current one.
3. Improved the handling of sticky values in forms. It's now less
likely that sticky values will get stuck.
4. If you call server_name(), script_name() and several other methods
when running offline, the methods now create "dummy" values to
work with.
Bugs fixed in version 1.51
1. param() when called without arguments was returning an array of
length 1 even when there were no parameters to be had. Bad bug!
Bad!
2. The HTML code generated would break if input fields contained the
forbidden characters ">< or &. You can now use these characters
freely.
New features added in version 1.50
1. import() method allows all the parameters to be imported into a
namespace in one fell swoop.
2. Parameters are now returned in the same order in which they were
defined.
Bugs fixed in version 1.45
1. delete() method didn't work correctly. This is now fixed.
2. reset() method didn't allow you to set the name of the button.
Fixed.
Bugs fixed in version 1.44
1. self_url() didn't include the path information. This is now fixed.
New features added in version 1.43
1. Added the delete() method.
New features added in version 1.42
1. The image_button() method to create clickable images.
2. A few bug fixes involving forms embedded in <PRE> blocks.
New features added in version 1.4
1. New header shortcut methods
+ redirect() to create HTTP redirection messages.
+ start_html() to create the HTML title, complete with the
recommended <LINK> tag that no one ever remembers to include.
+ end_html() for completeness' sake.
2. A new save() method that allows you to write out the state of an
script to a file or pipe.
3. An improved version of the new() method that allows you to restore
the state of a script from a file or pipe. With (2) this gives you
dump and restore capabilities! (Wow, you can put a "121,931
customers served" banner at the bottom of your pages!)
4. A self_url() method that allows you to create state-maintaining
hypertext links. In addition to allowing you to maintain the state
of your scripts between invocations, this lets you work around a
problem that some browsers have when jumping to internal links in
a document that contains a form -- the form information gets lost.
5. The user-visible labels in checkboxes, radio buttons, popup menus
and scrolling lists have now been decoupled from the values sent
to your CGI script. Your script can know a checkbox by the name of
"cb1" while the user knows it by a more descriptive name. I've
also added some parameters that were missing from the text fields,
such as MAXLENGTH.
6. A whole bunch of methods have been added to get at environment
variables involved in user verification and other obscure
features.
Bug fixes
1. The problems with the hidden fields have (I hope at last) been
fixed.
2. You can create multiple query objects and they will all be
initialized correctly. This simplifies the creation of multiple
forms on one page.
3. The URL unescaping code works correctly now.
( run in 0.814 second using v1.01-cache-2.11-cpan-364913b4093 )