Changeset 28911

Timestamp:

2014-03-17T21:36:16+13:00 (10 years ago)

Author:

ak19

Message:

Fourth commit for security and safe cgiargs.

Location:

main/trunk/greenstone2

Files:

• macros/query.dm (modified) (1 diff)
• perllib/plugouts/BasePlugout.pm (modified) (1 diff)
• runtime-src/src/recpt/basequeryaction.cpp (modified) (1 diff)
• runtime-src/src/recpt/queryaction.cpp (modified) (2 diffs)
• runtime-src/src/recpt/rssaction.cpp (modified) (3 diffs)
• runtime-src/src/recpt/statusaction.cpp (modified) (1 diff)

main/trunk/greenstone2/macros/query.dm

@@ -111 +111 @@
 _historypagescriptextra_{
 
-var histvalue0='_histvalue0_';
-var histvalue1='_histvalue1_';
-var histvalue2='_histvalue2_';
-var histvalue3='_histvalue3_';
-var histvalue4='_histvalue4_';
-var histvalue5='_histvalue5_';
-var histvalue6='_histvalue6_';
-var histvalue7='_histvalue7_';
-var histvalue8='_histvalue8_';
-var histvalue9='_histvalue9_';
-var histvalue10='_histvalue10_';
-var histvalue11='_histvalue11_';
-var histvalue12='_histvalue12_';
-var histvalue13='_histvalue13_';
-var histvalue14='_histvalue14_';
-var histvalue15='_histvalue15_';
-var histvalue16='_histvalue16_';
-var histvalue17='_histvalue17_';
-var histvalue18='_histvalue18_';
-var histvalue19='_histvalue19_';
+var histvalue0='_histvalue0Jssafe_';
+var histvalue1='_histvalue1Jssafe_';
+var histvalue2='_histvalue2Jssafe_';
+var histvalue3='_histvalue3Jssafe_';
+var histvalue4='_histvalue4Jssafe_';
+var histvalue5='_histvalue5Jssafe_';
+var histvalue6='_histvalue6Jssafe_';
+var histvalue7='_histvalue7Jssafe_';
+var histvalue8='_histvalue8Jssafe_';
+var histvalue9='_histvalue9Jssafe_';
+var histvalue10='_histvalue10Jssafe_';
+var histvalue11='_histvalue11Jssafe_';
+var histvalue12='_histvalue12Jssafe_';
+var histvalue13='_histvalue13Jssafe_';
+var histvalue14='_histvalue14Jssafe_';
+var histvalue15='_histvalue15Jssafe_';
+var histvalue16='_histvalue16Jssafe_';
+var histvalue17='_histvalue17Jssafe_';
+var histvalue18='_histvalue18Jssafe_';
+var histvalue19='_histvalue19Jssafe_';
 
 function inputQuery(value) \{

main/trunk/greenstone2/perllib/plugouts/BasePlugout.pm

@@ -918 +918 @@
         my $rss_entry = "<item>\n";
         $rss_entry   .= "   <title>$dc_title</title>\n";
-    $rss_entry   .= "   <link>_httpdomain__httpcollection_/document/$oid</link>\n";
+    $rss_entry   .= "   <link>_httpdomainHtmlsafe__httpcollection_/document/$oid</link>\n";
     $rss_entry   .= "</item>";
 

main/trunk/greenstone2/runtime-src/src/recpt/basequeryaction.cpp

@@ -606 +606 @@
     histvalue += i;
     disp.setmacro(histvalue, "query", escquery);
+    disp.setmacro(histvalue+"Jssafe", "query", encodeForJavascript(escquery));
     format_user_info(cgiargs, userinfo, args, protos, logout);
     

main/trunk/greenstone2/runtime-src/src/recpt/queryaction.cpp

@@ -743 +743 @@
       << "<form name=\"QueryForm\" method=\"get\" action=\"_gwcgi_\">\n"
       << "<input type=\"hidden\" name=\"a\" value=\"q\">\n"
-          << "<input type=\"hidden\" name=\"site\" value=\"_cgiargsite_\"\n"
+          << "<input type=\"hidden\" name=\"site\" value=\"_cgiargsiteAttrsafe_\"\n"
       << "<input type=\"hidden\" name=\"e\" value=\"_compressedoptions_\">\n"
       << "<input type=\"hidden\" name=\"ccp\" value=\"1\">\n"
@@ -1390 +1390 @@
     decode_cgi_arg (compressedoptions); 
     if (args["w"] == "utf-8") { // if the encoding was utf-8, then compressed options was utf-8, and we need unicode.
-    // if encoding wasn't utf-8, then compressed opotions may be screwed up, but seems to work for 8 bit encodings?
+    // if encoding wasn't utf-8, then compressed options may be screwed up, but seems to work for 8 bit encodings?
       compressedoptions = to_uni(compressedoptions);
     }

main/trunk/greenstone2/runtime-src/src/recpt/rssaction.cpp

@@ -68 +68 @@
       << "<channel>\n"
       << "  <title>_collectionname_</title>\n"
-      << "  <link>_httpdomain__httppageabout_</link>\n"
+      << "  <link>_httpdomainHtmlsafe__httppageabout_</link>\n"
       << "  <description>_collectionextra_</description>\n"
       << "  <language>_cgiarglHtmlsafe_</language>\n"
@@ -79 +79 @@
       << "  <title>_collectionname_</title>\n"
       << "  <url>_iconcollection_</url>\n"
-      << "  <link>_httpdomain__httppageabout_</link>\n"
+      << "  <link>_httpdomainHtmlsafe__httppageabout_</link>\n"
       << "  <description>_collectionextra_</description>\n"
       << "</image>\n";
@@ -125 +125 @@
     
     if(!args["hostname"].empty()) {
-      disp.setmacro("httpdomain", "Global", "http://" + encodeForURL(args["hostname"]));
+      disp.setmacro("httpdomain", "Global", "http://" + args["hostname"]);
+      disp.setmacro("httpdomainHtmlsafe", "Global", "http://" + encodeForHTML(args["hostname"]));
     } 
     else { // we shouldn't have to get here
-      disp.setmacro("httpdomain", "Global", "http://localhost:8282"); // the default used in zextra.dm. (Could perhaps default this to localhost too)
+      text_t default_domain = "http://localhost:8282";
+      disp.setmacro("httpdomain", "Global", default_domain); // the default used in zextra.dm. (Could perhaps default this to localhost too)
+      disp.setmacro("httpdomain", "Global", encodeForHTML(default_domain));
     }
   }

main/trunk/greenstone2/runtime-src/src/recpt/statusaction.cpp

@@ -786 +786 @@
       << "<pre>\n";
 
+  text_t logcontent = file_tail (logfilename, 100, 1500);
+
   // note that we're expecting lines to be no more than 1500 characters on
   // average - should fix this file_tail() thing sometime
-  textout << outconvert << file_tail (logfilename, 100, 1500);
+  textout << outconvert << encodeForHTML(logcontent);
 
   textout << outconvert << disp << "</pre>\n"