Changeset 28913 for main/trunk/greenstone2/runtime-src/src/recpt/extlinkaction.cpp

Timestamp:

2014-03-18T20:22:59+13:00 (10 years ago)

Author:

ak19

Message:

6th commit for security of cgiargs. Looked over all occurrences of setmacro in *action.cpp files

File:

• main/trunk/greenstone2/runtime-src/src/recpt/extlinkaction.cpp (modified) (1 diff)

main/trunk/greenstone2/runtime-src/src/recpt/extlinkaction.cpp

@@ -124 +124 @@
   // problem in whist, above line changed.  Perhaps decode_cgi_arg ??
   // see also HTML plugin
-  disp.setmacro("nexturl", "extlink", args["href"]);
+
+  text_t nexturl_macro = args["href"];
+  if(!isValidURLProtocol(nexturl_macro)) {
+    nexturl_macro = encodeForURL(nexturl_macro); // URL has invalid protocol like javascript:, so URL encode it
+  } else {
+    nexturl_macro = encodeForHTMLAttr(nexturl_macro);
+  }
+
+  disp.setmacro("nexturl", "extlink", nexturl_macro); // goes into a full-url context
   disp.setmacro("prevdoc", "extlink", args["d"]);
 }