Changeset 28912 for main/trunk

Timestamp:

2014-03-18T16:45:46+13:00 (10 years ago)

Author:

ak19

Message:

Commit 5 for security. Handles setmacro() occurrences in non action.cpp files. cl is safe from hacks now.

Location:

main/trunk/greenstone2/runtime-src/src/recpt

Files:

• browsetoolsclass.cpp (modified) (2 diffs)
• pagedbrowserclass.cpp (modified) (3 diffs)
• receptionist.cpp (modified) (2 diffs)

main/trunk/greenstone2/runtime-src/src/recpt/browsetoolsclass.cpp

@@ -31 +31 @@
 #include "OIDtools.h"
 #include "gsdlunicode.h"
+#include "securitytools.h"
 
 #if defined(GSDL_USE_IOS_H)
@@ -831 +832 @@
   if (formatinfo.DocumentContents || args["d"].empty()) {
     if (args["d"].empty()) {
-      disp.setmacro("tocopenextra", "document", "id=\"" + cl_top + "\"");
+      disp.setmacro("tocopenextra", "document", "id=\"" + encodeForHTMLAttr(cl_top) + "\"");
     } else {
       disp.setmacro("tocopenextra", "document", "");

main/trunk/greenstone2/runtime-src/src/recpt/pagedbrowserclass.cpp

@@ -107 +107 @@
 
   if (section.OID != args["d"]) {
-    text_t httpprevarrow = "_httpdocument_&cl=" + args["cl"] + "&d=" + dm_safe(section.OID);
+    text_t httpprevarrow = "_httpdocument_&cl=" + encodeForURL(args["cl"]) + "&d=" + dm_safe(section.OID);
     text_t parentarrow = "<a href=\"" + httpprevarrow + "\">_iconprev_</a>\n";
     disp.setmacro ("httpprevarrow", "document", httpprevarrow);
@@ -176 +176 @@
 
   if (!found) {
-    httpnextarrow = "_httpdocument_&cl=" + args["cl"] + "&d=" + sections.docInfo[0].OID;
+    httpnextarrow = "_httpdocument_&cl=" + encodeForURL(args["cl"]) + "&d=" + sections.docInfo[0].OID;
     nextarrow = "<a href=\"" + httpnextarrow + "\">" + 
       sections.docInfo[0].metadata["Title"].values[0] + "_iconnext_</a>\n";
@@ -182 +182 @@
   } else {
     if (!previousOID.empty()) {
-      httpprevarrow = "_httpdocument_&cl=" + args["cl"] + "&d=" + dm_safe(previousOID);
+      httpprevarrow = "_httpdocument_&cl=" + encodeForURL(args["cl"]) + "&d=" + dm_safe(previousOID);
       prevarrow = "<a href=\"" + httpprevarrow + "\">_iconprev_" + previoustitle + "</a>\n";
     }
     if (!nextOID.empty()) {
-      httpnextarrow = "_httpdocument_&cl=" + args["cl"] + "&d=" + dm_safe(nextOID);
+      httpnextarrow = "_httpdocument_&cl=" + encodeForURL(args["cl"]) + "&d=" + dm_safe(nextOID);
       nextarrow = "<a href=\"" + httpnextarrow + "\">" + nexttitle + "_iconnext_</a>\n";
     }

main/trunk/greenstone2/runtime-src/src/recpt/receptionist.cpp

@@ -1478 +1478 @@
   text_t compressedoptions = get_compressed_arg(args, logout);
   disp.setmacro ("compressedoptions", displayclass::defaultpackage, dm_safe(compressedoptions));
+  //disp.setmacro ("compressedoptionsUrlsafe", displayclass::defaultpackage, encodeForURL(dm_safe(compressedoptions))); // seems to be unnecessary after testing e=hack or e=hack<collect>... or e=...<collect>hack in a live server
+
   // need a decoded version of compressedoptions for use within forms
   // as browsers encode values from forms before sending to server
@@ -1635 +1637 @@
       if (!cinfo.httpdomain.empty()) httpcollection = "http://";
       httpcollection += cinfo.httpdomain + httpprefix + "/collect/"
-    + collection; 
+    + encodeForURL(collection); 
       disp.setmacro ("httpcollection", displayclass::defaultpackage,
              httpcollection);