Changeset 30465 for main

Timestamp:

2016-04-07T13:55:26+12:00 (8 years ago)

Author:

kjdon

Message:

fixes for depositor. when getting the post ata and putting it together into form data, need to escape cgi args special characters

Location:

main/trunk/greenstone2/runtime-src/src/recpt

Files:

• cgiutils.cpp (modified) (4 diffs)
• cgiutils.h (modified) (1 diff)

main/trunk/greenstone2/runtime-src/src/recpt/cgiutils.cpp

@@ -103 +103 @@
       }
       if (!argstr.empty()) argstr += "&";
+ 
+      // we need to convert arg to cgi safe variant - escape '&' and '%', '+', '=', turn space to +
+      cgi_safe_post_arg(argdata);
       argstr += argname + "=" + argdata;
 
@@ -162 +165 @@
   if (findword(content_type_begin, content_type_end, "multipart/form-data") == content_type_end) {
     // a simple post request
-
     return raw_post_data;
 
@@ -331 +333 @@
 }
 
+//Need to escape special chars in post data so they don't interfere with arg parsing once its a get style string
+void cgi_safe_post_arg(text_t &argstr) {
+
+  text_t::iterator in = argstr.begin();
+  text_t out = "";
+  text_t::iterator end = argstr.end();
+  
+  while (in != end) {
+    if (*in == '&') out += "%26";
+    else if (*in == '%') out += "%2525";
+    else if (*in == '+') out += "%2B";
+    else if (*in == '=') out += "%3D";
+    else if (*in == ' ') out += "+";
+    else { // append whatever char is in *in, but as a char, not int
+            //out += *in; // appends as int
+      out.push_back(*in);
+    }
+    ++in;
+  }
+  
+  argstr.erase (argstr.begin(), end);
+  argstr += out;  
+}
+
+
+
 // Ensure dangerous tags and chars in cgi-args are URL encoded, to prevent obvious XSS attempts
 // (e.g. c=<script>alert("hacked")</script>) and log poisoning (apache writes unrecognised URLs
@@ -414 +442 @@
   // get seems to be not unicode, while post is, so don't want to just assume encoding is 1 (not unicode)
   unsigned short args_encoding = argstr.getencoding();
-  cerr << "args enc = "<< args_encoding<<endl;
+
   text_t key, value;
  

main/trunk/greenstone2/runtime-src/src/recpt/cgiutils.h

@@ -38 +38 @@
 // convert %xx and + to their appropriate equivalents
 void decode_cgi_arg (text_t &argstr);
+// convert &,%,+,=,space to encoded versions so that post args can be put together into a get style string
+void cgi_safe_post_arg(text_t &argstr);
 
 // split up the cgi arguments