--- sql2xls.cgi 2008/11/03 21:53:30 16 +++ sql2xls.cgi 2008/11/03 22:26:57 18 @@ -85,15 +85,21 @@ my $sql_dir = $ENV{SCRIPT_FILENAME} || '.'; $sql_dir =~ s,/[^/]+$,,; -my $config_path = $1 if "$sql_dir/config.pl" =~ m/^(.+)$/; # untaint -warn "# using $config_path\n"; -require $config_path if -e $config_path; +sub require_config { + my $config_path = $1 if "$sql_dir/config.pl" =~ m/^(.+)$/; # untaint + warn "# using $config_path\n"; + require $config_path if -e $config_path; +} + +require_config; my $reports_path = $ENV{PATH_INFO}; $reports_path =~ s/\.\.//g; # some protection against path exploits $reports_path ||= shift @ARGV; # for CLI invocation $sql_dir .= "/$reports_path" if -e "$sql_dir/$reports_path"; +require_config; + warn "# reading SQL queries from $sql_dir\n" if $debug; opendir(DIR, $sql_dir) || die "can't opendir $sql_dir: $!";