Ignore:
Timestamp:
2014-03-13T14:34:48+13:00 (10 years ago)
Author:
ak19
Message:

First security commit. 1. Introducing the new securitools.h and .cpp files, which port the functions necessary to implement security in Greenstone from OWASP-ESAPI for Java, since OWASP's C++ version is largely not yet implemented, even though their code compiles. The newly added runtime-src/packages/security which contains OWASP ESAPI for C++ will therefore be removed again shortly. 2. receptionist.cpp now sets various web-encoded variants for each cgiarg macro, such as HTML entity encoded, attr encoded, javascript encoded (and css encoded variants). These are now used in the macro files based on which variant is suited to the context. 3. This commit further contains the minimum changes to protect the c, d, and p cgi variables.

File:
1 edited

Legend:

Unmodified
Added
Removed

  • main/trunk/greenstone2/macros/usability.dm

    r12180 r28888  
    4848function failnicely(message,usabwindow)\{
    4949  var errhtml='<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">';
    50   errhtml+='<head><title>_greenstoneusabilitytext__texterror_</title><meta http-equiv="Content-Type" content="text/html; charset=_cgiargw_"></head><body bgcolor="#FFFFFF">';
     50  errhtml+='<head><title>_greenstoneusabilitytext__texterror_</title><meta http-equiv="Content-Type" content="text/html; charset=_cgiargwJssafe_"></head><body bgcolor="#FFFFFF">';
    5151  errhtml+='_usabbanner_'; 
    5252  errhtml+=message;
    … …  
    8686
    8787  //need a character type for valid html
    88   winhtml+='<meta http-equiv="Content-Type" content="text/html; charset=_cgiargw_"></head><body bgcolor=\"#FFFFFF\">';
     88  winhtml+='<meta http-equiv="Content-Type" content="text/html; charset=_cgiargwJssafe_"></head><body bgcolor=\"#FFFFFF\">';
    8989
    9090  //get the location of the cgi program
    … …  
    131131  winhtml+=('<input type="hidden" name="opentime" value="'+(new Date()).toString()+'">');   
    132132  winhtml+=('<input type="hidden" name="sendtime" value="None">');
    133   winhtml+=('<input type="hidden" name="collection" value="_cgiargc_">');
     133  winhtml+=('<input type="hidden" name="collection" value="_cgiargcJssafe_">');
    134134  if(document.getElementsByTagName)\{   
    135135   //get interface variables
Note: See TracChangeset for help on using the changeset viewer.