Changeset 28899 for main/trunk/greenstone2/runtime-src/src/recpt/documentaction.cpp

Timestamp:

2014-03-14T22:46:25+13:00 (10 years ago)

Author:

ak19

Message:

Third commit for security, for ensuring cgiargs macros are websafe. This time all the changes to the runtime action classes.

File:

• main/trunk/greenstone2/runtime-src/src/recpt/documentaction.cpp (modified) (8 diffs)

main/trunk/greenstone2/runtime-src/src/recpt/documentaction.cpp

@@ -607 +607 @@
       outlink = "_httpdocument_&d=" + response.docInfo[0].metadata["section"].values[0];
 #else
-      outlink = "_httpdocumenthandle_("+args["c"]+","+response.docInfo[0].metadata["section"].values[0]+")";
+      outlink = "_httpdocumenthandle_("+encodeForURL(args["c"])+","+response.docInfo[0].metadata["section"].values[0]+")";
 #endif
 
@@ -1066 +1066 @@
 #ifndef DOCHANDLE
         << "<frame name=\"documenttop\" frameborder=0 src=\"_gwcgi_?_optsite_e=_compressedoptions_&a=d&d=" 
-        << args["d"] << "\">"
+        << encodeForURL(args["d"]) << "\">"
 #else
         << "<frame name=\"documenttop\" frameborder=0 src=\"_httpdocumenthandle_(" 
-        << args["c"] << "," << args["d"] << ")\">"
+        << encodeForURL(args["c"]) << "," << encodeForURL(args["d"]) << ")\">"
 #endif
         << "<noframes>\n"
@@ -1143 +1143 @@
             #ifndef DOCHANDLE
                 << "<frame name=\"documenttop\" frameborder=0 src=\"_gwcgi_?_optsite_e=_compressedoptions_&a=d&d=" 
-                << args["d"] << "\">"
+                << encodeForURL(args["d"]) << "\">"
             #else
                 << "<frame name=\"documenttop\" frameborder=0 src=\"_httpdocumenthandle_(" 
-                << args["c"] << "," << args["d"] << ")\">"
+                << encodeForURL(args["c"]) << "," << encodeForURL(args["d"]) << ")\">"
             #endif
                 << "<noframes>\n"
@@ -1462 +1462 @@
                 logout << text_t2ascii
                     << "documentaction::output_document: call to QueryFilter failed "
-                    << "for " << args["c"] << " collection (" << get_comerror_string (err) << ")\n";
+                    << "for " << args["c"] << " collection (" << get_comerror_string (err) << ")\n";
                 highlight = false;
             } 
@@ -1645 +1645 @@
   if (haschildren) {
 #ifndef DOCHANLE
-    disp.setmacro ("httpnextarrow", "document", "_httpdocument_&amp;cl=" + args["cl"] +
-           "&amp;d=" + arg_d + ".fc");
+    disp.setmacro ("httpnextarrow", "document", "_httpdocument_&amp;cl=" + encodeForURL(args["cl"]) +
+           "&amp;d=" + encodeForURL(arg_d) + ".fc");
 #else
-    disp.setmacro ("httpnextarrow", "document", "_httpdocumenthandle_("+args["c"]+","+arg_d + ".fc)";
+    disp.setmacro ("httpnextarrow", "document", "_httpdocumenthandle_("+encodeForURL(args["c"])+","+encodeForURL(arg_d) + ".fc)";
 
 #endif
@@ -1658 +1658 @@
       if (!(*h).empty()) {
 #ifndef DOCHANLE
-    disp.setmacro ("httpnextarrow", "document", "_httpdocument_&amp;cl=" + args["cl"] +
+    disp.setmacro ("httpnextarrow", "document", "_httpdocument_&amp;cl=" + encodeForURL(args["cl"]) +
                "&amp;d=" + *h);
 #else
-    disp.setmacro ("httpnextarrow", "document", "_httpdocumenthandle_("+args["c"]+","+*h+")";
+    disp.setmacro ("httpnextarrow", "document", "_httpdocumenthandle_("+encodeForURL(args["c"])+","+*h+")";
 
 #endif
@@ -1674 +1674 @@
   if (!previous_sibling.empty()) {
 #ifndef DOCHANDLE
-    disp.setmacro ("httpprevarrow", "document", "_httpdocument_&amp;cl=" + args["cl"] +
+    disp.setmacro ("httpprevarrow", "document", "_httpdocument_&amp;cl=" + encodeForURL(args["cl"]) +
            "&amp;d=" + previous_sibling);
 #else
-    disp.setmacro ("httpprevarrow", "document", "_httpdocumenthandle_("+args["c"]+","+ previous_sibling+")");
+    disp.setmacro ("httpprevarrow", "document", "_httpdocumenthandle_("+encodeForURL(args["c"])+","+ previous_sibling+")");
 
 #endif
@@ -1684 +1684 @@
     if (countchar(arg_d.begin(), arg_d.end(), '.')) {
 #ifndef DOCHANDLE
-      disp.setmacro ("httpprevarrow", "document", "_httpdocument_&amp;cl=" + args["cl"] +
+      disp.setmacro ("httpprevarrow", "document", "_httpdocument_&amp;cl=" + encodeForURL(args["cl"]) +
              "&amp;d=" + get_parent(arg_d));
 #else
-      disp.setmacro ("httpprevarrow", "document", "_httpdocumenthandle_("+args["c"]+","+get_parent(arg_d)+")");
+      disp.setmacro ("httpprevarrow", "document", "_httpdocumenthandle_("+encodeForURL(args["c"])+","+get_parent(arg_d)+")");
 
 #endif