Show
Ignore:
Timestamp:
13.03.2014 14:34:48 (6 years ago)
Author:
ak19
Message:

First security commit. 1. Introducing the new securitools.h and .cpp files, which port the functions necessary to implement security in Greenstone from OWASP-ESAPI for Java, since OWASP's C++ version is largely not yet implemented, even though their code compiles. The newly added runtime-src/packages/security which contains OWASP ESAPI for C++ will therefore be removed again shortly. 2. receptionist.cpp now sets various web-encoded variants for each cgiarg macro, such as HTML entity encoded, attr encoded, javascript encoded (and css encoded variants). These are now used in the macro files based on which variant is suited to the context. 3. This commit further contains the minimum changes to protect the c, d, and p cgi variables.

Files:
1 modified

Legend:

Unmodified
Added
Removed
  • main/trunk/greenstone2/macros/malayalam2.dm

    r19604 r28888  
    119119     collection (it links to the "_2_" collection).  
    120120    àŽ‡àŽ€àµ àŽ•àŽŸàŽ£àŽ£àŽ®àµ†àŽ™àµàŽ•àŽ¿ e "_2_" collection àŽ‰àŽªàŽ¯àµ‹àŽ—àŽ¿àŽšàµàŽšàµ   
    121      <a href="_httpdoc_&c=_1_&cl=_cgiargcl_&d=_3_">àŽ®àµàŽšàµàŽšàµ‹àŽŸàµàŽŸàµ àŽªàµ‹àŽµàµàŽ•àµ</a>    
     121     <a href="_httpdoc_&c=_1_&cl=_cgiargclUrlsafe_&d=_3_">àŽ®àµàŽšàµàŽšàµ‹àŽŸàµàŽŸàµ àŽªàµ‹àŽµàµàŽ•àµ</a>    
    122122     àŽ 
    123123àŽ²àµàŽ²àµ†àŽ™àµàŽ•àŽ¿  "back" àŽ¬àŽŸàµàŽŸ àŽ‰àŽªàŽ¯àµ‹àŽ—àŽ¿àŽšàµàŽšàµ àŽªàŽŽàŽ¯àŽ€àŽ¿àŽ²àµ‡àŽ•àµàŽ•àµ àŽ®àŽŸàŽ™àµàŽ™àµàŽ•àµ}   
     
    140140àŽŸàŽ¯àŽŸàŽ³àŽªàŽŠàŽ‚}   
    141141 
    142 _textmustbelongtogroup_ [l=ml] {àŽˆ àŽªàµ‡àŽœàŽ¿àŽ²àµ‡àŽ•àµàŽ•àµàŽ³àµàŽ³ àŽžàŽšàµàŽŠàŽ°àµàŽ¶àŽŸàŽšàµàŽ®àŽ€àŽ¿ '-cgiargug-' àŽ•àµ‚àŽŸàµàŽŸàŽ€àµàŽ€àŽ¿àŽ²àµ àŽªàµ†àŽŸàµàŽŸàŽµàŽ°àµàŽ•àµàŽ•àµàŽ®àŽŸàŽ€àµàŽ°àŽ‚}   
     142_textmustbelongtogroup_ [l=ml] {àŽˆ àŽªàµ‡àŽœàŽ¿àŽ²àµ‡àŽ•àµàŽ•àµàŽ³àµàŽ³ àŽžàŽšàµàŽŠàŽ°àµàŽ¶àŽŸàŽšàµàŽ®àŽ€àŽ¿ '_cgiargugHtmlsafe_' àŽ•àµ‚àŽŸàµàŽŸàŽ€àµàŽ€àŽ¿àŽ²àµ àŽªàµ†àŽŸàµàŽŸàŽµàŽ°àµàŽ•àµàŽ•àµàŽ®àŽŸàŽ€àµàŽ°àŽ‚}   
    143143 
    144144_textmessageinvalid_ [l=ml] {àŽ€àŽŸàŽ™àµàŽ•àŽ³àµ  àŽ†àŽµàŽ¶àµàŽ¯àŽªàµàŽªàµ†àŽŸàµàŽŸ àŽªàµ‡àŽœàµàŽ²àŽ­àŽ¿àŽ•àµàŽ•àµàŽµàŽŸàŽšàµ àŽžàµˆàŽšàµ àŽ“àŽ£àµ àŽšàµ†àŽ¯àµàŽ¯àµàŽ•  
     
    402402_textretcoll_ [l=ml] {àŽ•àŽ³àŽ•àµàŽŸàŽ±àŽ¿àŽ²àµ‡àŽ•àµàŽ•àµ àŽ®àŽŸàŽ™àµàŽ™àŽ¿àŽµàŽ°àŽ¿àŽ•}   
    403403 
    404 _textdelperm_ [l=ml] {_cgiargbc1dirname_ àŽ¶àµ‡àŽ–àŽ°àŽ™àµàŽ™àŽ³àŽ¿àŽ²àµ àŽšàŽ¿àŽ²àŽ€àµ‹ àŽŽàŽ²àµàŽ²àŽŸàŽ®àµ‹ àŽšàµ€àŽ•àµàŽ•àŽ‚ àŽšàµ†àŽ¯àµàŽ¯àŽŸàŽšàµ àŽ•àŽŽàŽ¿àŽ¯àµàŽšàµàŽšàŽ¿àŽ²àµàŽ². àŽžàŽŸàŽŠàµàŽ§àµàŽ¯àŽ®àŽŸàŽ¯ àŽ•àŽŸàŽ°àŽ£àŽ™àµàŽ™àŽ³àµ <ul>  
    405 <li> _gsdlhome_/collect/_cgiargbc1dirname_àŽ¡àŽ¯àŽ±àŽ•àµàŽŸàŽ±àŽ¿ àŽšàµ€àŽ•àµàŽ•àŽ‚ àŽšàµ†àŽ¯àµàŽ¯àŽŸàŽšàµ àŽ—àµàŽ°àµ€àŽšàµàŽžàµàŽ±àµàŽ±àµ‹àŽ£àŽ¿àŽšàµ àŽ 
     404_textdelperm_ [l=ml] {_cgiargbc1dirnameHtmlsafe_ àŽ¶àµ‡àŽ–àŽ°àŽ™àµàŽ™àŽ³àŽ¿àŽ²àµ àŽšàŽ¿àŽ²àŽ€àµ‹ àŽŽàŽ²àµàŽ²àŽŸàŽ®àµ‹ àŽšàµ€àŽ•àµàŽ•àŽ‚ àŽšàµ†àŽ¯àµàŽ¯àŽŸàŽšàµ àŽ•àŽŽàŽ¿àŽ¯àµàŽšàµàŽšàŽ¿àŽ²àµàŽ². àŽžàŽŸàŽŠàµàŽ§àµàŽ¯àŽ®àŽŸàŽ¯ àŽ•àŽŸàŽ°àŽ£àŽ™àµàŽ™àŽ³àµ <ul>  
     405<li> _gsdlhome_/collect/_cgiargbc1dirnameHtmlsafe_àŽ¡àŽ¯àŽ±àŽ•àµàŽŸàŽ±àŽ¿ àŽšàµ€àŽ•àµàŽ•àŽ‚ àŽšàµ†àŽ¯àµàŽ¯àŽŸàŽšàµ àŽ—àµàŽ°àµ€àŽšàµàŽžàµàŽ±àµàŽ±àµ‹àŽ£àŽ¿àŽšàµ àŽ 
    406406àŽšàµàŽ®àŽ€àŽ¿àŽ¯àŽ¿àŽ²àµàŽ²<br>  
    407 àŽ¡àŽ¯àŽ±àŽ•àµàŽŸàŽ±àŽ¿ àŽ’àŽšàµàŽšàµŠàŽšàµàŽšàŽŸàŽ¯àŽ¿ àŽšàµ€àŽ•àµàŽ•àŽ‚àŽšàµ†àŽ¯àµàŽ€àŽŸàŽ²àµ àŽ®àŽŸàŽ€àµàŽ°àŽ®àµ‡ àŽžàŽ®àµàŽªàµ‚àŽ°àµàŽ£àŽ®àŽŸàŽ¯ _cgiargbc1dirname_àŽšàµ€àŽ•àµàŽ•àŽ‚àŽšàµ†àŽ¯àµàŽ¯àŽ²àµ àŽµàŽ¿àŽœàŽ¯àŽ¿àŽ•àµàŽ•àµàŽ•àŽ¯àµàŽ³àµàŽ³àµ‚  
     407àŽ¡àŽ¯àŽ±àŽ•àµàŽŸàŽ±àŽ¿ àŽ’àŽšàµàŽšàµŠàŽšàµàŽšàŽŸàŽ¯àŽ¿ àŽšàµ€àŽ•àµàŽ•àŽ‚àŽšàµ†àŽ¯àµàŽ€àŽŸàŽ²àµ àŽ®àŽŸàŽ€àµàŽ°àŽ®àµ‡ àŽžàŽ®àµàŽªàµ‚àŽ°àµàŽ£àŽ®àŽŸàŽ¯ _cgiargbc1dirnameHtmlsafe_àŽšàµ€àŽ•àµàŽ•àŽ‚àŽšàµ†àŽ¯àµàŽ¯àŽ²àµ àŽµàŽ¿àŽœàŽ¯àŽ¿àŽ•àµàŽ•àµàŽ•àŽ¯àµàŽ³àµàŽ³àµ‚  
    408408àŽ—àµàŽ°àµ€àŽšàµàŽžàµàŽ±àµàŽ±àµ‹àŽ£àŽ¿àŽšàµ _gsdlhome_/bin/script/delcol.pl.àŽªàµàŽ°àµ‡àŽŸàŽ—àµàŽ°àŽŸàŽ‚ àŽªàµàŽ°àŽµàŽ°àµàŽ€àµàŽ€àŽ¿àŽªàµàŽªàŽ¿àŽ•àµàŽ•àŽŸàŽšàµ àŽ•àŽŽàŽ¿àŽ¯àµàŽ•àŽ¯àŽ¿àŽ²àµàŽ². àŽˆ àŽ«àŽ¯àŽ²àµ àŽµàŽŸàŽ¯àŽ¿àŽ•àµàŽ•àŽŸàŽµàµàŽšàµàŽšàŽ€àµàŽ‚ àŽªàµàŽ°àŽµàŽ°àµàŽ€àµàŽ€àŽšàŽ¯àµ‹àŽ—àµàŽ¯àŽ®àŽŸàŽ•àµàŽ•àŽŸàŽµàµàŽšàµàŽšàŽ€àŽŸàŽ£àµ‹ àŽŽàŽšàµàŽšàµàŽ‚ àŽªàŽ°àŽ¿àŽ¶àµ‹àŽ§àŽ¿àŽ•àµàŽ•àµàŽ•</li>  
    409409</ul>}   
    410410 
    411 _textdelinv_ [l=ml] {_cgiargbc1dirname_àŽ¶àµ‡àŽ–àŽ°àŽ‚ àŽžàŽ‚àŽ°àŽ•àµàŽ·àŽ¿àŽ•àµàŽ•àŽªàµàŽªàµ†àŽŸàµàŽŸàŽ€àµ‹ àŽŠàµàŽ°àµàŽ¬àŽ²àŽ®àŽŸàŽ•àµàŽ•àŽªàµàŽªàµ†àŽŸàµàŽŸàŽ€àµ‹ àŽ†àŽ£àµ. àŽšàµ€àŽ•àµàŽ•àŽ‚àŽšàµ†àŽ¯àµàŽ¯àŽ²àµ àŽ±àŽŠàµàŽŠàµàŽšàµ†àŽ¯àµàŽ¯àµàŽšàµàŽšàµ}   
    412  
    413 _textdelsuc_ [l=ml] {_cgiargbc1dirname_àŽ¶àµ‡àŽ–àŽ°àŽ‚ àŽµàŽ¿àŽœàŽ¯àŽ•àŽ°àŽ®àŽŸàŽ¯àŽ¿ àŽšàµ€àŽ•àµàŽ•àŽ‚ àŽšàµ†àŽ¯àµâ€ŒàŽ€àµ}   
    414  
    415 _textclonefail_ [l=ml] {àŽªàµàŽ€àŽ¿àŽ¯ _cgiargclonecol_ àŽ¶àµ‡àŽ–àŽ°àŽ‚ àŽ•àµàŽ²àµ‹àŽ£àµ àŽšàµ†àŽ¯àµàŽ¯àŽŸàŽšàµ àŽ•àŽŽàŽ¿àŽžàµàŽžàŽ¿àŽ²àµàŽ².   
     411_textdelinv_ [l=ml] {_cgiargbc1dirnameHtmlsafe_àŽ¶àµ‡àŽ–àŽ°àŽ‚ àŽžàŽ‚àŽ°àŽ•àµàŽ·àŽ¿àŽ•àµàŽ•àŽªàµàŽªàµ†àŽŸàµàŽŸàŽ€àµ‹ àŽŠàµàŽ°àµàŽ¬àŽ²àŽ®àŽŸàŽ•àµàŽ•àŽªàµàŽªàµ†àŽŸàµàŽŸàŽ€àµ‹ àŽ†àŽ£àµ. àŽšàµ€àŽ•àµàŽ•àŽ‚àŽšàµ†àŽ¯àµàŽ¯àŽ²àµ àŽ±àŽŠàµàŽŠàµàŽšàµ†àŽ¯àµàŽ¯àµàŽšàµàŽšàµ}   
     412 
     413_textdelsuc_ [l=ml] {_cgiargbc1dirnameHtmlsafe_àŽ¶àµ‡àŽ–àŽ°àŽ‚ àŽµàŽ¿àŽœàŽ¯àŽ•àŽ°àŽ®àŽŸàŽ¯àŽ¿ àŽšàµ€àŽ•àµàŽ•àŽ‚ àŽšàµ†àŽ¯àµâ€ŒàŽ€àµ}   
     414 
     415_textclonefail_ [l=ml] {àŽªàµàŽ€àŽ¿àŽ¯ _cgiargclonecolHtmlsafe_ àŽ¶àµ‡àŽ–àŽ°àŽ‚ àŽ•àµàŽ²àµ‹àŽ£àµ àŽšàµ†àŽ¯àµàŽ¯àŽŸàŽšàµ àŽ•àŽŽàŽ¿àŽžàµàŽžàŽ¿àŽ²àµàŽ².   
    416416àŽ 
    417417àŽ€àŽ¿àŽšàµàŽ³àµàŽ³ àŽ•àŽŸàŽ°àŽ£àŽ™àµàŽ™àŽ³àµ  <ul>  
    418 <li> _cgiargclonecol_àŽ¶àµ‡àŽ–àŽ°àŽ‚ àŽšàŽ¿àŽ²àŽµàŽ¿àŽ²àŽ¿àŽ²àµàŽ²  
    419 <li>_cgiargclonecol_ àŽ¶àµ‡àŽ–àŽ°àŽ€àµàŽ€àŽ¿àŽšàµ collect.cfg àŽ•àŽ²àŽ•àµàŽ·àµàŽšàµ àŽ•àµ‹àŽ£àµàŽ«àŽ¿àŽ—àŽ±àµ‡àŽ·àŽšàµ àŽ«àŽ¯àŽ²àµ àŽ‰àŽ£àµàŽŸàŽŸàŽ¯àŽ¿àŽ°àŽ¿àŽ•àµàŽ•àŽ¿àŽ²àµàŽ²  
     418<li> _cgiargclonecolHtmlsafe_àŽ¶àµ‡àŽ–àŽ°àŽ‚ àŽšàŽ¿àŽ²àŽµàŽ¿àŽ²àŽ¿àŽ²àµàŽ²  
     419<li>_cgiargclonecolHtmlsafe_ àŽ¶àµ‡àŽ–àŽ°àŽ€àµàŽ€àŽ¿àŽšàµ collect.cfg àŽ•àŽ²àŽ•àµàŽ·àµàŽšàµ àŽ•àµ‹àŽ£àµàŽ«àŽ¿àŽ—àŽ±àµ‡àŽ·àŽšàµ àŽ«àŽ¯àŽ²àµ àŽ‰àŽ£àµàŽŸàŽŸàŽ¯àŽ¿àŽ°àŽ¿àŽ•àµàŽ•àŽ¿àŽ²àµàŽ²  
    420420<li> àŽªàµàŽ°àŽžàµàŽ€àµàŽ€ collect.cfg àŽ«àŽ¯àŽ²àµ àŽµàŽŸàŽ¯àŽ¿àŽ•àµàŽ•àŽŸ àŽ—àµàŽ°àµ€àŽžàµàŽ±àµàŽ±àµ‹àŽ£àŽ¿àŽšàµ àŽ 
    421421àŽšàµàŽ®àŽ€àŽ¿àŽ¯àµàŽ£àµàŽŸàŽŸàŽ¯àŽ¿àŽ°àŽ¿àŽ•àµàŽ•àŽ¿àŽ²àµàŽ²</ul>}   
     
    439439_textreloaderror_ [l=ml] {àŽªàµàŽ€àŽ¿àŽ¯ àŽ¶àµ‡àŽ–àŽ°àŽšàŽ¿àŽ°àµâ€àŽ®àµàŽ®àŽŸàŽ£àŽ€àµàŽ€àŽ¿àŽšàŽ¿àŽŸàŽ¯àŽ¿àŽ²àµâ€ àŽ’àŽ°àµ àŽªàŽ¿àŽŽàŽµàµ àŽªàŽ±àµàŽ±àŽ¿. àŽ€àŽŸàŽ™àµàŽ•àŽ³àµàŽŸàµ† àŽ¬àµàŽ°àµ—àŽžàŽ±àŽ¿àŽ²àµ† "reload", "back" àŽ¬àŽŸàµàŽŸàŽ£àµàŽ•àŽ³àµàŽŸàµ† àŽ‰àŽªàŽ¯àµ‹àŽ—àŽ€àµàŽ€àµ†àŽªàµàŽªàŽ±àµàŽ±àŽ¿ àŽ—àµàŽ°àµ€àŽžàµàŽ±àµàŽ±àµ‹àŽ£àŽ¿àŽšàµ àŽžàŽ‚àŽ­àŽµàŽ¿àŽšàµàŽš àŽ§àŽŸàŽ°àŽ£àŽŸàŽªàŽ¿àŽ¶àŽ•àµ àŽ®àµ‚àŽ²àŽ®àŽŸàŽµàŽŸàŽ‚ àŽ‡àŽ€àµâ€Œ. (àŽ¶àµ‡àŽ–àŽ°àŽšàŽ¿àŽ°àµâ€àŽ®àµàŽ®àŽŸàŽ£ àŽµàµ‡àŽ³àŽ¯àŽ¿àŽ²àµâ€ àŽˆ àŽ¬àŽŸàµàŽŸàŽ£àµàŽ•àŽ³àµàŽŸàµ† àŽ‰àŽªàŽ¯àµ‹àŽ—àŽ‚ àŽ’àŽŽàŽ¿àŽµàŽŸàŽ•àµàŽ•àŽŸàŽšàµâ€ àŽ¶àµàŽ°àŽŠàµàŽ§àŽ¿àŽ•àµàŽ•àµàŽ•). àŽ•àŽ²àŽ•àµàŽŸàŽ°àµâ€ àŽ†àŽŠàµàŽ¯àŽ®àµ‡ àŽ†àŽ°àŽ‚àŽ­àŽ¿àŽ•àµàŽ•àµàŽµàŽŸàŽšàµâ€ àŽ¶àµàŽªàŽŸàŽ°àµâ€àŽ¶àŽšàµ†àŽ¯àµàŽ¯àµàŽšàµàŽšàµ. }   
    440440 
    441 _textexptsuc_ [l=ml] {_cgiargbc1dirname_ àŽ¶àµ‡àŽ–àŽ°àŽ‚ àŽµàŽ¿àŽœàŽ¯àŽ•àŽ°àŽ®àŽŸàŽ¯àŽ¿  _gsdlhome_/tmp/exported\__cgiargbc1dirname_  àŽ¡àŽ¯àŽ±àŽ•àµàŽŸàŽ±àŽ¿àŽ¯àŽ¿àŽ²àµ‡àŽ•àµàŽ•àµ àŽŽàŽ•àµàŽžàµàŽªàµ‹àŽ°àµàŽŸàµàŽŸàµàŽšàµ†àŽ¯àµàŽ€àµ.}   
     441_textexptsuc_ [l=ml] {_cgiargbc1dirnameHtmlsafe_ àŽ¶àµ‡àŽ–àŽ°àŽ‚ àŽµàŽ¿àŽœàŽ¯àŽ•àŽ°àŽ®àŽŸàŽ¯àŽ¿  _gsdlhome_/tmp/exported\__cgiargbc1dirnameHtmlsafe_  àŽ¡àŽ¯àŽ±àŽ•àµàŽŸàŽ±àŽ¿àŽ¯àŽ¿àŽ²àµ‡àŽ•àµàŽ•àµ àŽŽàŽ•àµàŽžàµàŽªàµ‹àŽ°àµàŽŸàµàŽŸàµàŽšàµ†àŽ¯àµàŽ€àµ.}   
    442442 
    443443_textexptfail_ [l=ml] {<p>àŽ¶àµ‡àŽ–àŽ°àŽ‚ àŽŽàŽ•àµàŽžàµàŽªàµ‹àŽ°àµàŽŸàµàŽŸàµàŽšàµ†àŽ¯àµàŽ¯àµàŽšàµàŽšàŽ€àŽ¿àŽ²àµ àŽªàŽ°àŽŸàŽœàŽ¯àŽ‚