Changeset 28913 for main/trunk/greenstone2/macros

Timestamp:

2014-03-18T20:22:59+13:00 (10 years ago)

Author:

ak19

Message:

6th commit for security of cgiargs. Looked over all occurrences of setmacro in *action.cpp files

Location:

main/trunk/greenstone2/macros

Files:

• gti.dm (modified) (6 diffs)
• users.dm (modified) (2 diffs)

main/trunk/greenstone2/macros/gti.dm

@@ -98 +98 @@
 # Content of the GTI "find text fragments" page
 _gtifind_ {
-<h2><a href="_gwcgi_?a=gti&amp;p=lang&amp;e=_compressedoptions_">_gtitargetlanguagename_</a> -- <a href="_gwcgi_?a=gti&amp;p=core&amp;e=_compressedoptions_">_gtitranslationfiledesc_</a></h2>
+<h2><a href="_gwcgi_?a=gti&amp;p=lang&amp;e=_compressedoptions_">_gtitargetlanguagename_</a> -- <a href="_gwcgi_?a=gti&amp;p=core&amp;e=_compressedoptions_">_gtitranslationfiledescHtmlsafe_</a></h2>
 <p>
 _textgtienterquery_:
@@ -111 +111 @@
 # Content of the GTI "offline" page
 _gtioffline_ {
-<h2><a href="_gwcgi_?a=gti&amp;p=lang&amp;e=_compressedoptions_">_gtitargetlanguagename_</a> -- _gtitranslationfiledesc_</h2>
+<h2><a href="_gwcgi_?a=gti&amp;p=lang&amp;e=_compressedoptions_">_gtitargetlanguagename_</a> -- _gtitranslationfiledescHtmlsafe_</h2>
 <p>
 _textgtiofflinetranslation_
@@ -118 +118 @@
 # Content of the GTI "core" page (with text areas for entering and updating translations)
 _gticore_ {
-<h2><a href="_gwcgi_?a=gti&amp;p=lang&amp;e=_compressedoptions_">_gtitargetlanguagename_</a> -- _gtitranslationfiledesc_</h2>
+<h2><a href="_gwcgi_?a=gti&amp;p=lang&amp;e=_compressedoptions_">_gtitargetlanguagename_</a> -- _gtitranslationfiledescHtmlsafe_</h2>
 <p>
 <center>
@@ -133 +133 @@
 # Content of the GTI "done" page, thanking the translator for completing the file
 _gtidone_ {
-<h2><a href="_gwcgi_?a=gti&amp;p=lang&amp;e=_compressedoptions_">_gtitargetlanguagename_</a> -- _gtitranslationfiledesc_</h2>
+<h2><a href="_gwcgi_?a=gti&amp;p=lang&amp;e=_compressedoptions_">_gtitargetlanguagename_</a> -- _gtitranslationfiledescHtmlsafe_</h2>
 <p>
 <center>
@@ -169 +169 @@
 # --------------------------------------------------------------------------------
 
-# _If_(_gtiglihelpzipfilepath_ ne "", <a href="_httpprefix_/_gtiglihelpzipfilepath_">_textgtiglihelpzipfile_</a>,)<br>
+# _If_(_gtiglihelpzipfilepath_ ne "", <a href="_httpprefix_/_gtiglihelpzipfilepathUrlsafe_">_textgtiglihelpzipfile_</a>,)<br>
 # <a href="_gwcgi_?a=gti&amp;p=glihelp&amp;e=_compressedoptions_">_textgtiglihelpzipfile_</a>
 
@@ -180 +180 @@
      _If_("_4_" eq "_gtidownloadglihelp_", <a href="_4_">, <a href="_httpprefix_/_4_">)_textgtidownloadtargetfile_</a>
 
-     _If_(_gtiglihelpzipfilepath_, <a href="_httpprefix_/_gtiglihelpzipfilepath_">_textgtiglihelpzipfile_</a>,)<br>
+     _If_(_gtiglihelpzipfilepath_, <a href="_httpprefix_/_gtiglihelpzipfilepathUrlsafe_">_textgtiglihelpzipfile_</a>,)<br>
 
      <a href="_gwcgi_?a=gti&amp;p=offline&amp;e=_compressedoptions_">_textgtitranslatefileoffline_</a><br>
-     _gtiviewtranslationfileinaction_
+     _gtiviewtranslationfileinactionHtmlsafe_
   </td></tr>)
 </table>

main/trunk/greenstone2/macros/users.dm

@@ -62 +62 @@
 
 <table border=0>
-<tr><td>_authen:textusername_</td><td><input type="text" name="umun" value="_users:usersargun_" size=15></td>
+<tr><td>_authen:textusername_</td><td><input type="text" name="umun" value="_users:usersargunAttrsafe_" size=15></td>
 <td><font color=gray>_textaboutusername_</font></td>
 </tr>
-<tr><td>_authen:textpassword_</td><td><input type="text" name="umpw" value="_users:usersargpw_" size=9></td>
+<tr><td>_authen:textpassword_</td><td><input type="text" name="umpw" value="_users:usersargpwAttrsafe_" size=9></td>
 <td><font color=gray>_textaboutpassword_
 _If_("_cgiarguma_" eq "edituser",_textoldpass_)
@@ -75 +75 @@
 </select>
 </td></tr>
-<tr><td>_userslistusers:textgroups_</td><td colspan=2><input type="text" name="umug" value="_users:usersargug_" size=50></td></tr>
+<tr><td>_userslistusers:textgroups_</td><td colspan=2><input type="text" name="umug" value="_users:usersargugAttrsafe_" size=50></td></tr>
 <tr><td></td><td></td>
 <td><font color=gray>_textaboutgroups_</font><br/><font color=gray>_textavailablegroups_</font></td></tr>
-<tr><td>_userslistusers:textcomment_</td><td colspan=2><input type="text" name="umc" value="_users:usersargc_" size=50></td></tr>
+<tr><td>_userslistusers:textcomment_</td><td colspan=2><input type="text" name="umc" value="_users:usersargcAttrsafe_" size=50></td></tr>
 <tr><td></td><td colspan=2><input type="submit" name=beu value="submit">
 <input type="submit" name=uma value="cancel"></td></tr>