Ignore:
Timestamp:
2014-03-14T22:46:25+13:00 (10 years ago)
Author:
ak19
Message:

Third commit for security, for ensuring cgiargs macros are websafe. This time all the changes to the runtime action classes.

File:
1 edited

Legend:

Unmodified
Added
Removed

  • main/trunk/greenstone2/runtime-src/src/recpt/phindaction.cpp

    r22984 r28899  
    152152
    153153  unsigned long count_l, count_e, count_d;
    154   unsigned long phrase = args["ppnum"].getulong();
     154  unsigned long phrase = args["ppnum"].getulong(); // needn't encodeFor<web> on vars which have getulong() applied
    155155  text_t &word = args["pptext"];
    156156  unsigned long first_e = args["pfe"].getulong();
    … …  
    208208   
    209209    if (result.empty()) {
    210       output_error("phindaction: The search term ("+word+") does not occur in the collection",
     210      output_error("phindaction: The search term ("+encodeForHTML(word)+") does not occur in the collection",
    211211           textout, outconvert, disp, logout, XMLmode);
    212212      return true;
    … …  
    255255  if (XMLmode) {
    256256    textout << "<phinddata id=\"" << phrase
    257         << "\" text=\"" << word
     257        << "\" text=\"" << encodeForHTMLAttr(word)
    258258        << "\" tf=\"" << tf
    259259        << "\" ef=\"" << ef
    … …  
    262262        << "\">\n";
    263263  } else {
    264     textout << "<html><head><title>" << word << "</title></head>\n"
     264    textout << "<html><head><title>" << encodeForHTML(word) << "</title></head>\n"
    265265        << "<body><center>\n"
    266         << "<p><h1>" << word << "</h1>\n"
    267         << "<p><b>"<< word << "</b> occurs "
     266        << "<p><h1>" << encodeForHTML(word) << "</h1>\n"
     267        << "<p><b>"<< encodeForHTML(word) << "</b> occurs "
    268268        << tf << " times in " << df << " documents\n";
    269269  }
    … …  
    316316      textout << outconvert << disp
    317317          << "<br><a href=\"_gwcgi_?"
    318           << "c=" << args["c"]
     318          << "c=" << encodeForURL(args["c"])
    319319          << "&ppnum=" << phrase
    320320          << "&pfe=" << first_e
    … …  
    328328    textout << outconvert << disp
    329329        << "<br><a href=\"_gwcgi_?"
    330         << "c=" << args["c"]
     330        << "c=" << encodeForURL(args["c"])
    331331        << "&ppnum=" << phrase
    332332        << "&pfe=" << first_e
    … …  
    379379      textout << outconvert << disp
    380380          << "<br><a href=\"_gwcgi_?"
    381           << "c=" << args["c"]
     381          << "c=" << encodeForURL(args["c"])
    382382          << "&ppnum=" << phrase
    383383          << "&pfe=" << first_e
    … …  
    391391    textout << outconvert << disp
    392392        << "<br><a href=\"_gwcgi_?"
    393         << "c=" << args["c"]
     393        << "c=" << encodeForURL(args["c"])
    394394        << "&ppnum=" << phrase
    395395        << "&pfe=" << first_e
    … …  
    453453      textout << outconvert << disp
    454454          << "<br><a href=\"_gwcgi_?"
    455           << "c=" << args["c"]
     455          << "c=" << encodeForURL(args["c"])
    456456          << "&ppnum=" << phrase
    457457          << "&pfe=" << first_e
    … …  
    465465    textout << outconvert << disp
    466466        << "<br><a href=\"_gwcgi_?"
    467         << "c=" << args["c"]
     467        << "c=" << encodeForURL(args["c"])
    468468        << "&ppnum=" << phrase
    469469        << "&pfe=" << first_e
    … …  
    742742      textout << "<tr valign=top><td>" << type << "</td><td>";
    743743      textout << outconvert << disp
    744           << "<a href=\"_gwcgi_?c=" << collection;
     744          << "<a href=\"_gwcgi_?c=" << encodeForURL(collection);
    745745      textout << "&ppnum=" << phrase << "\">" << text << "</a>"
    746746          << "</td><td>" << tf << "</td><td>" << df << "</td></tr>\n";
    … …  
    847847          << "\" df=\"" << df;
    848848      if (!prefix.empty()) {
    849     textout << "\" prefix=\"" << prefix;
     849    text_t prefix_txt;
     850    fromUCArray(prefix, prefix_txt);
     851    textout << "\" prefix=\"" << encodeForHTMLAttr(prefix_txt);
    850852      }
    851853      if (!suffix.empty()) {
    852     textout << "\" suffix=\"" << suffix;
     854    text_t suffix_txt;
     855    fromUCArray(suffix, suffix_txt);
     856    textout << "\" suffix=\"" << encodeForHTMLAttr(suffix_txt);
    853857      }
    854858      textout << "\"/>\n";
    … …  
    856860      textout << outconvert << disp
    857861          << "<tr valign=top><td align=right><a href=\"_gwcgi_?"
    858           << "c=" << collection << "&ppnum=" << phrase << "\">";
     862          << "c=" << encodeForURL(collection) << "&ppnum=" << phrase << "\">";
    859863      textout << prefix << "</a></td>";
    860864      textout <<outconvert << disp
    861865          << "<td align=center><a href=\"_gwcgi_?"
    862           << "c=" << collection << "&ppnum=" << phrase << "\">"
    863           << body << "</a></td>"
     866          << "c=" << encodeForURL(collection) << "&ppnum=" << phrase << "\">"
     867          << encodeForHTML(body) << "</a></td>"
    864868          << "<td align=left><a href=\"_gwcgi_?"
    865           << "c=" << collection << "&ppnum=" << phrase << "\">";
     869          << "c=" << encodeForURL(collection) << "&ppnum=" << phrase << "\">";
    866870      textout << suffix << "</a></td>"
    867871          << "<td>" << tf << "</td><td>" << df << "</td></tr>\n";
    … …  
    986990      textout << outconvert << disp
    987991          << "<tr valign=top><td><a href=\"_gwcgi_?"
    988           << "c=" << collection;
     992          << "c=" << encodeForURL(collection);
    989993      textout << "&a=d&d=" << hash << "\">" << title << "</a>"
    990994          << "</td><td>" << freq << "</td></tr>\n";
    … …  
    10571061}
    10581062
     1063void phindaction::fromUCArray(const UCArray &arrin, text_t &txtout) {
     1064  txtout.clear();
     1065  if (txtout.capacity() < arrin.size() + 1) {
     1066    txtout.reserve(arrin.size() + 1);
     1067  }
     1068  vector<unsigned char>::const_iterator here = arrin.begin();
     1069  vector<unsigned char>::const_iterator end = arrin.end();
     1070  while (here != end) {
     1071    txtout.push_back(*here); // don't need to cast unsigned char to unsigned short
     1072    ++here;
     1073  }
     1074}
     1075
     1076
    10591077void phindaction::output_error (const text_t &message, ostream &textout,
    10601078                outconvertclass &outconvert,
Note: See TracChangeset for help on using the changeset viewer.