source: main/trunk/greenstone2/macros/usability.dm

Last change on this file was 28888, checked in by ak19, 10 years ago

First security commit. 1. Introducing the new securitools.h and .cpp files, which port the functions necessary to implement security in Greenstone from OWASP-ESAPI for Java, since OWASP's C++ version is largely not yet implemented, even though their code compiles. The newly added runtime-src/packages/security which contains OWASP ESAPI for C++ will therefore be removed again shortly. 2. receptionist.cpp now sets various web-encoded variants for each cgiarg macro, such as HTML entity encoded, attr encoded, javascript encoded (and css encoded variants). These are now used in the macro files based on which variant is suited to the context. 3. This commit further contains the minimum changes to protect the c, d, and p cgi variables.
  • Property svn:keywords set to Author Date Id Revision
File size: 9.5 KB
Line 
1# Macros for Usability (I'd like to complain!)
2
3package Usability
4
5_content_ {
6<h2>_textaboutusabilitytitle_</h2>
7<p>_textaboutusability_
8}
9_pagetitle_{_textaboutusabilitypagetitle_}
10
11package Style
12
13# override this to include _usabilityscript_
14_globalscripts_{
15<script language="javascript" type="text/javascript">
16_If_(_pagescriptextra_,_pagescriptextra_)
17_imagescript_
18_usabilityscript_
19</script>
20
21}
22
23
24package Global
25
26#override globallinks (in nav_css.dm) to include usability links if needed
27_globallinks_ {_If_("_cgiargu_" ne "1",_homelink_) _helplink_ _preflink_ _usability_}
28
29# set by receptionist to be _usablink_ if needed
30_usability_ {}
31_usablink_ {_navtaborig_(_httppageusab_,_linktextusab_,_textdescrusab_)}
32
33_httppageusab_ {javascript:usabilityfunction()}
34
35# set to _usab<type>_ by receptionist eg _usabmulti_
36# type comes from config file (format Usability <type>), options are
37# textonly, stepwise, multi
38_usabinterface_ {}
39
40# set to usabshowscript by receptionist if needed
41_usabilityscript_ {}
42
43_httpusabbanner_ {_httpimg_/usabbnr.gif}
44
45_usabshowscript_ {
46
47//this is for where something goes wrong and an error message has to be shown.
48function failnicely(message,usabwindow)\{
49 var errhtml='<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">';
50 errhtml+='<head><title>_greenstoneusabilitytext__texterror_</title><meta http-equiv="Content-Type" content="text/html; charset=_cgiargwJssafe_"></head><body bgcolor="#FFFFFF">';
51 errhtml+='_usabbanner_';
52 errhtml+=message;
53 errhtml+='<p><form action=""><input type="button" value="_textclosewindow_" onClick="window.close();"></form>';
54 errhtml+='</body></html>';
55 usabwindow.document.write(errhtml);
56 usabwindow.document.close();
57\}
58
59function usabilityfunction()\{
60
61 checkusab=window.open("","checkusab","scrollbars=1,toolbars=0,height=600,width=420");
62
63 //set up the window
64 var winhtml='<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">';
65 winhtml += '<html><head><title>_greenstoneusabilitytext_</title>';
66 winhtml += '<script type="text/javascript">\\n<!--\\n';
67
68 //this function is for getting the time when the complaint data is sent
69 winhtml += 'function gettime()\\{\\n';
70 winhtml += 'document.usabform.sendtime.value = (new Date()).toString();\\n'
71 winhtml+='\\}\\n';
72
73 //this function is to allow the user to track the usability report
74 winhtml+='function viewdetails()\\{\\n';
75 winhtml+='\\t alert(\\'_textunderdev_\\');\\}';
76
77 //this function is to show the privacy/about data in a new window
78 winhtml+='function infowindow(url)\\{ \\
79 infowin = window.open(url,\\'infowin\\',\\'toolbars=0, height=600, width=600\\');\\}';
80
81 winhtml += '\\n//-->\\n</';
82 winhtml += 'script>';
83 if(navigator.appName!="Netscape" || parseInt(navigator.appVersion)>=5)\{
84 winhtml += '_usabstyle_';
85 \}
86
87 //need a character type for valid html
88 winhtml+='<meta http-equiv="Content-Type" content="text/html; charset=_cgiargwJssafe_"></head><body bgcolor=\"#FFFFFF\">';
89
90 //get the location of the cgi program
91 cgiloc='_gwcgi_';
92 if(cgiloc.lastIndexOf("/")<0)\{
93 failnicely('_cannotfindcgierror_', checkusab);
94 return;
95 \}
96 cgiloc=cgiloc.substring(0,(cgiloc.lastIndexOf("/")+1));
97 cgiloc+='savereport.cgi';
98
99 //adds the banner with the koru-thing and the links to about and privacy
100 //information
101 winhtml+='_usabbanner_';
102 winhtml+='_aboutprivacylinks_';
103
104
105 // set up the form
106 winhtml += '<form name="usabform" method="post" action="'+cgiloc+'" onSubmit="gettime();">';
107 winhtml += '_usabinterface_';
108
109
110 //get javascript environment variables
111
112 // to replace &s in the URL with &amp;s
113 urlgs=new String(window.location);
114 a=urlgs.split("&");
115 urlgs=a.join("&amp;");
116 winhtml+=('<input type="hidden" name="URL" value="'+urlgs+'">');
117
118 winhtml+=('<input type="hidden" name="resolution" value="'+window.screen.width+'x'+window.screen.height+'">');
119 winhtml+=('<input type="hidden" name="screencolour" value="'+window.screen.color+'">');
120
121 //colordepth and pixeldepth are NS and IE versions of the same thing.
122 if(screen.colorDepth)\{
123 winhtml+=('<input type="hidden" name="pixeldepth" value="'+window.screen.colorDepth+'">');
124 \}
125 else\{
126 winhtml+=('<input type="hidden" name="pixeldepth" value="'+window.screen.pixelDepth+'">');
127 \}
128
129 winhtml+=('<input type="hidden" name="browser" value="'+navigator.platform+' ,'+navigator.appName+', '+navigator.appVersion+', '+navigator.appCodeName+', '+navigator.appUserAgent+'">');
130 winhtml+=('<input type="hidden" name="language" value="'+navigator.language+'">');
131 winhtml+=('<input type="hidden" name="opentime" value="'+(new Date()).toString()+'">');
132 winhtml+=('<input type="hidden" name="sendtime" value="None">');
133 winhtml+=('<input type="hidden" name="collection" value="_cgiargcJssafe_">');
134 if(document.getElementsByTagName)\{
135 //get interface variables
136 if(document.getElementsByTagName("form"))\{
137 docarray=document.getElementsByTagName("input");
138 if(docarray.length>0)\{
139 for(i=0; i<docarray.length; i++)\{
140 //this leaves out uninteresting inputs, such as buttons
141 //and unchecked checkboxes
142 if(docarray[i].type!='reset' && docarray[i].type!='button' &&
143 docarray[i].type!='image' && docarray[i].type!='submit'
144 && !((docarray[i].type=='radio'|| docarray[i].type=='checkbox') &&
145 !docarray[i].checked))\{
146 winhtml+=('<input type="hidden" name="'+docarray[i].type+'-'+docarray[i].name+'" value="'+docarray[i].value+'">');
147 \}
148 \}
149 \}
150 docarray=document.getElementsByTagName("select")
151 if(docarray.length>0)\{
152 for(i=0; i<docarray.length; i++)\{
153 winhtml+=('<input type="hidden" name="'+docarray[i].type+'-'+docarray[i].name+'" value="'+docarray[i].value+'">');
154 \}
155 \}
156 docarray=document.getElementsByTagName("textarea")
157 if(docarray.length>0)\{
158 for(i=0; i<docarray.length; i++)\{
159 winhtml+=('<input type="hidden" name="'+docarray[i].type+'-'+docarray[i].name+'" value="'+docarray[i].value+'">');
160 \}
161 \}
162 \}
163 \}
164 //finish the form
165 winhtml += '</form>';
166
167 winhtml +='</body></html>'
168
169
170 //write to the window
171 checkusab.document.write(winhtml);
172 checkusab.document.close();
173 return;
174
175\}
176}
177
178
179#####################################################################
180#
181# These macros are for use by the usability logging (I'd like to
182# complain) functionality - they are to be included in a JavaScript
183# string, hence the \s
184#
185#####################################################################
186
187_usabinterface_{}
188_httpusabhtml_ {_httpprefix_/usability/}
189
190#the banner to "brand" any boxes as part of the usability interface
191_usabbanner_{<table width=\"100%\"><tr><td><h1>_greenstoneusabilitytext_</h1></td><td align="right" width="135"><img src=\"_httpusabbanner_\" title=\"_textusabbanner_\" alt=\"_textusabbanner_\"></td></tr></table>}
192
193#the about and privacy lins separated by a mid dot.
194_aboutprivacylinks_ {<p class="label"><a href="javascript:infowindow(\\'_httpusabhtml_about.html\\')">_textabout_</a> &#8226; <a href="javascript:infowindow(\\'_httpusabhtml_/privacy.html\\')">_textprivacy_</a>}
195
196
197###################################################################
198# Various usability interfaces: textonly, nosubmit, stepwise, multi
199###################################################################
200
201#gives a text only interface with some guff about privacy
202#########################################################
203_usabtextonly_{ \\
204_textwhy_\\
205_textprivacybasic_\\
206_textstillsend_\\
207_usabyesnosubmit_}
208
209_usabyesnosubmit_{<p><input type="submit" value="_textyes_"><input type="button" value="_textno_" onClick="window.close();">}
210
211#gives an interface with the privacy guff at the bottom, and
212#steps to describe the problem
213############################################################
214
215_usabstepwise_{\\
216<p>_textwhatdoing_<br> \\
217<textarea name="doingwhat" rows="3" cols="40"></textarea> \\
218<p>_textwhatexpected_<br> \\
219<textarea name="whatexpected" rows="6" cols="40"></textarea> \\
220<p>_textwhathappened_<br> \\
221<textarea name="whathappened" rows="6" cols="40"></textarea> \\
222_usabtextonly_}
223
224
225#gives a multipart interface allowing the user to fill out less or more.
226########################################################################
227
228_usabmulti_{\\
229_textwhy__textextraforform_\\
230<h2>_textoptionally_:</h2>\\
231<p class="label">_textmoredetails_:<br>\\
232<textarea name="moredetails" rows="6" cols="45"></textarea>\\
233<table><tr><td>\\
234<p class="label">_textcharacterise_? </td>\\
235<td><select name="probtype">\\
236<option>\\
237<option>_textbadrender_\\
238<option>_textcontenterror_\\
239<option>_textstrangebehaviour_\\
240<option>_textunexpected_\\
241<option>_textfunctionality_\\
242<option>_textother_\\
243</select></td></tr>\\
244<tr><td><p class="label">_textseverity_? </td>\\
245<td><select name="severity">\\
246<option>\\
247<option>_textcritical_\\
248<option>_textmajor_\\
249<option>_textmedium_\\
250<option>_textminor_\\
251<option>_texttrivial_\\
252</select>\\
253</td></tr></table>\\
254_textprivacybasic__textstillsend_\\
255<table width="100%"><tr><td><a href="javascript:viewdetails()"><p class="label">_textviewdetails_</a></td><td align="right"><button type="button" onClick="window.close()"><b>_textdontsend_</b></button></td><td align="right"><button type="submit"><b>_textsend_</b></button></td></tr></table>\\
256}
257
258#style definitions to please NS 4.7
259_usabstyle_{\\
260<style type="text/css">\\
261\\
262table \{ width: 100% \} \\
263td.right \{ align:right \} \\
264\\
265h1 \{font-size:20px; font-family: sans-serif; vertical-align:middle\\} \\
266h2 \{font-size:14px; color: #009966; font-family: sans-serif; font-weight:bold \}\\
267p.label \{ font-family:sans-serif; \}\\
268</style>\\
269}
270
Note: See TracBrowser for help on using the repository browser.