Ignore:
Timestamp:
03/13/14 14:34:48 (7 years ago)
Author:
ak19
Message:

First security commit. 1. Introducing the new securitools.h and .cpp files, which port the functions necessary to implement security in Greenstone from OWASP-ESAPI for Java, since OWASP's C++ version is largely not yet implemented, even though their code compiles. The newly added runtime-src/packages/security which contains OWASP ESAPI for C++ will therefore be removed again shortly. 2. receptionist.cpp now sets various web-encoded variants for each cgiarg macro, such as HTML entity encoded, attr encoded, javascript encoded (and css encoded variants). These are now used in the macro files based on which variant is suited to the context. 3. This commit further contains the minimum changes to protect the c, d, and p cgi variables.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • main/trunk/greenstone2/macros/base.dm

    r27150 r28888  
    7373_cgiargd_ {}
    7474_cgiargcl_ {}
     75
    7576
    7677# set from within the query action
     
    142143_httpcollimg_  {_httpcollection_/index/assoc}
    143144
    144 _httpcollection_ {_httpprefix_/collect/_cgiargc_}
     145_httpcollection_ {_httpprefix_/collect/_cgiargcUrlsafe_}
    145146
    146147_httppagex_ {_gwcgi_?e=_compressedoptions_&a=p&p=_1_}
     
    153154#_httppagehome_ {_httppagex_(home)}
    154155###_httppagehome_ {http://www.nzdl.org/cgi-bin/dblibrary?a=p&p=home}
    155 _httppagehome_ {_gwcgi_?a=p&p=home&l=_cgiargl_&w=_cgiargw_}
     156_httppagehome_ {_gwcgi_?a=p&p=home&l=_cgiarglUrlsafe_&w=_cgiargwUrlsafe_}
    156157_httppagehelp_ {_httppagex_(help)}
    157158_httppagepref_ {_httppagex_(preferences)}
     
    163164_httppublications_ {_httpdownload_/greenstone/publications}
    164165
    165 _httpcurrentdocument_ {_gwcgi_?e=_compressedoptions_&cl=_cgiargcl_&d=_cgiargd_}
     166_httpcurrentdocument_ {_gwcgi_?e=_compressedoptions_&cl=_cgiargclUrlsafe_&d=_cgiargdUrlsafe_}
    166167_httpquery_    {_gwcgi_?e=_compressedoptions_&a=_If_("_cgiargqt_" eq "2",sqlq,q)}
    167168_httpsqlquery_ {_gwcgi_?e=_compressedoptions_&a=sqlq&qt=2}
Note: See TracChangeset for help on using the changeset viewer.