Show
Ignore:
Timestamp:
14.03.2014 22:46:25 (5 years ago)
Author:
ak19
Message:

Third commit for security, for ensuring cgiargs macros are websafe. This time all the changes to the runtime action classes.

Files:
1 modified

Legend:

Unmodified
Added
Removed
  • main/trunk/greenstone2/runtime-src/src/recpt/phindaction.cpp

    r22984 r28899  
    152152 
    153153  unsigned long count_l, count_e, count_d; 
    154   unsigned long phrase = args["ppnum"].getulong(); 
     154  unsigned long phrase = args["ppnum"].getulong(); // needn't encodeFor<web> on vars which have getulong() applied 
    155155  text_t &word = args["pptext"]; 
    156156  unsigned long first_e = args["pfe"].getulong(); 
     
    208208     
    209209    if (result.empty()) { 
    210       output_error("phindaction: The search term ("+word+") does not occur in the collection", 
     210      output_error("phindaction: The search term ("+encodeForHTML(word)+") does not occur in the collection", 
    211211           textout, outconvert, disp, logout, XMLmode); 
    212212      return true; 
     
    255255  if (XMLmode) { 
    256256    textout << "<phinddata id=\"" << phrase  
    257         << "\" text=\"" << word  
     257        << "\" text=\"" << encodeForHTMLAttr(word)  
    258258        << "\" tf=\"" << tf  
    259259        << "\" ef=\"" << ef  
     
    262262        << "\">\n"; 
    263263  } else { 
    264     textout << "<html><head><title>" << word << "</title></head>\n" 
     264    textout << "<html><head><title>" << encodeForHTML(word) << "</title></head>\n" 
    265265        << "<body><center>\n" 
    266         << "<p><h1>" << word << "</h1>\n" 
    267         << "<p><b>"<< word << "</b> occurs "  
     266        << "<p><h1>" << encodeForHTML(word) << "</h1>\n" 
     267        << "<p><b>"<< encodeForHTML(word) << "</b> occurs "  
    268268        << tf << " times in " << df << " documents\n"; 
    269269  } 
     
    316316      textout << outconvert << disp  
    317317          << "<br><a href=\"_gwcgi_?" 
    318           << "c=" << args["c"] 
     318          << "c=" << encodeForURL(args["c"]) 
    319319          << "&ppnum=" << phrase  
    320320          << "&pfe=" << first_e  
     
    328328    textout << outconvert << disp 
    329329        << "<br><a href=\"_gwcgi_?" 
    330         << "c=" << args["c"] 
     330        << "c=" << encodeForURL(args["c"]) 
    331331        << "&ppnum=" << phrase  
    332332        << "&pfe=" << first_e  
     
    379379      textout << outconvert << disp  
    380380          << "<br><a href=\"_gwcgi_?" 
    381           << "c=" << args["c"] 
     381          << "c=" << encodeForURL(args["c"]) 
    382382          << "&ppnum=" << phrase  
    383383          << "&pfe=" << first_e  
     
    391391    textout << outconvert << disp 
    392392        << "<br><a href=\"_gwcgi_?" 
    393         << "c=" << args["c"] 
     393        << "c=" << encodeForURL(args["c"]) 
    394394        << "&ppnum=" << phrase  
    395395        << "&pfe=" << first_e  
     
    453453      textout << outconvert << disp 
    454454          << "<br><a href=\"_gwcgi_?" 
    455           << "c=" << args["c"] 
     455          << "c=" << encodeForURL(args["c"]) 
    456456          << "&ppnum=" << phrase  
    457457          << "&pfe=" << first_e  
     
    465465    textout << outconvert << disp  
    466466        << "<br><a href=\"_gwcgi_?" 
    467         << "c=" << args["c"] 
     467        << "c=" << encodeForURL(args["c"]) 
    468468        << "&ppnum=" << phrase  
    469469        << "&pfe=" << first_e  
     
    742742      textout << "<tr valign=top><td>" << type << "</td><td>"; 
    743743      textout << outconvert << disp 
    744           << "<a href=\"_gwcgi_?c=" << collection; 
     744          << "<a href=\"_gwcgi_?c=" << encodeForURL(collection); 
    745745      textout << "&ppnum=" << phrase << "\">" << text << "</a>" 
    746746          << "</td><td>" << tf << "</td><td>" << df << "</td></tr>\n"; 
     
    847847          << "\" df=\"" << df; 
    848848      if (!prefix.empty()) { 
    849     textout << "\" prefix=\"" << prefix; 
     849    text_t prefix_txt;  
     850    fromUCArray(prefix, prefix_txt); 
     851    textout << "\" prefix=\"" << encodeForHTMLAttr(prefix_txt); 
    850852      } 
    851853      if (!suffix.empty()) { 
    852     textout << "\" suffix=\"" << suffix; 
     854    text_t suffix_txt;  
     855    fromUCArray(suffix, suffix_txt); 
     856    textout << "\" suffix=\"" << encodeForHTMLAttr(suffix_txt); 
    853857      } 
    854858      textout << "\"/>\n"; 
     
    856860      textout << outconvert << disp  
    857861          << "<tr valign=top><td align=right><a href=\"_gwcgi_?" 
    858           << "c=" << collection << "&ppnum=" << phrase << "\">"; 
     862          << "c=" << encodeForURL(collection) << "&ppnum=" << phrase << "\">"; 
    859863      textout << prefix << "</a></td>"; 
    860864      textout <<outconvert << disp 
    861865          << "<td align=center><a href=\"_gwcgi_?" 
    862           << "c=" << collection << "&ppnum=" << phrase << "\">" 
    863           << body << "</a></td>" 
     866          << "c=" << encodeForURL(collection) << "&ppnum=" << phrase << "\">" 
     867          << encodeForHTML(body) << "</a></td>" 
    864868          << "<td align=left><a href=\"_gwcgi_?" 
    865           << "c=" << collection << "&ppnum=" << phrase << "\">"; 
     869          << "c=" << encodeForURL(collection) << "&ppnum=" << phrase << "\">"; 
    866870      textout << suffix << "</a></td>" 
    867871          << "<td>" << tf << "</td><td>" << df << "</td></tr>\n"; 
     
    986990      textout << outconvert << disp 
    987991          << "<tr valign=top><td><a href=\"_gwcgi_?" 
    988           << "c=" << collection; 
     992          << "c=" << encodeForURL(collection); 
    989993      textout << "&a=d&d=" << hash << "\">" << title << "</a>" 
    990994          << "</td><td>" << freq << "</td></tr>\n";  
     
    10571061} 
    10581062 
     1063void phindaction::fromUCArray(const UCArray &arrin, text_t &txtout) { 
     1064  txtout.clear(); 
     1065  if (txtout.capacity() < arrin.size() + 1) { 
     1066    txtout.reserve(arrin.size() + 1); 
     1067  } 
     1068  vector<unsigned char>::const_iterator here = arrin.begin(); 
     1069  vector<unsigned char>::const_iterator end = arrin.end(); 
     1070  while (here != end) { 
     1071    txtout.push_back(*here); // don't need to cast unsigned char to unsigned short 
     1072    ++here; 
     1073  } 
     1074} 
     1075 
     1076 
    10591077void phindaction::output_error (const text_t &message, ostream &textout,  
    10601078                outconvertclass &outconvert,