Changeset 28930

Timestamp:

2014-03-19T19:11:13+13:00 (10 years ago)

Author:

ak19

Message:

Commit to do with security surrounding cgiargs. Depositor and collector.

Location:

main/trunk/greenstone2/runtime-src/src/recpt

Files:

• collectoraction.cpp (modified) (2 diffs)
• depositoraction.cpp (modified) (1 diff)

main/trunk/greenstone2/runtime-src/src/recpt/collectoraction.cpp

@@ -962 +962 @@
 
   // set _pagescriptextra_ macro to _cpagescriptextra_
-  disp.setmacro ("pagescriptextra", "collector", "_" + collector_page + "scriptextra_");
+  disp.setmacro ("pagescriptextra", "collector", "_" + encodeForHTML(collector_page) + "scriptextra_");
 
   if (collector_page == "bildstatus" || collector_page == "bilddone" || 
       collector_page == "bildfail" || collector_page == "bildframe1") {
-    disp.setmacro ("header", "collector", "_" + collector_page + "header_");
+    disp.setmacro ("header", "collector", "_" + encodeForHTML(collector_page) + "header_");
   }
 
@@ -1332 +1332 @@
       // output page ("bild" page was already output above)
       textout << outconvert << disp << ("_collector:header_\n")
-          << ("_collector:" + collector_page + "content_\n")
+          << ("_collector:" + encodeForHTML(collector_page) + "content_\n")
           << ("_collector:footer_\n");
     }

main/trunk/greenstone2/runtime-src/src/recpt/depositoraction.cpp

@@ -424 +424 @@
                 }
 
-                cached_metadata_values += "\"" + args_name + "\":\"" + args_val + "\"";
+                cached_metadata_values += "\"" + args_name + "\":\"" + encodeForJavascript(args_val) + "\"";
               }
             }