X-Git-Url: http://www.privoxy.org/gitweb/?a=blobdiff_plain;f=cgi.c;h=062b9761e235db6efa27bf7825a31aa431f39162;hb=46adfc8e72b8874fa6e5a9c61535f5137871cbeb;hp=03ca2fa8515a0739b4b9e94e95ff5e585d4a1bb5;hpb=1d3e6f7cff56e9304ae5eaa4f3950fcb4331b821;p=privoxy.git diff --git a/cgi.c b/cgi.c index 03ca2fa8..062b9761 100644 --- a/cgi.c +++ b/cgi.c @@ -1,4 +1,4 @@ -const char cgi_rcs[] = "$Id: cgi.c,v 1.58 2002/03/29 03:33:13 david__schmidt Exp $"; +const char cgi_rcs[] = "$Id: cgi.c,v 1.62 2002/04/10 19:59:46 jongfoster Exp $"; /********************************************************************* * * File : $Source: /cvsroot/ijbswa/current/cgi.c,v $ @@ -38,6 +38,23 @@ const char cgi_rcs[] = "$Id: cgi.c,v 1.58 2002/03/29 03:33:13 david__schmidt Exp * * Revisions : * $Log: cgi.c,v $ + * Revision 1.62 2002/04/10 19:59:46 jongfoster + * Fixes to #include in templates: + * - Didn't close main file if loading an included template fails. + * - I'm paranoid and want to disallow "#include /etc/passwd". + * + * Revision 1.61 2002/04/10 13:37:48 oes + * Made templates modular: template_load now recursive with max depth 1 + * + * Revision 1.60 2002/04/08 20:50:25 swa + * fixed JB spelling + * + * Revision 1.59 2002/04/05 15:51:51 oes + * - added send-stylesheet CGI + * - bugfix: error-pages now get correct request protocol + * - fixed + * - kludged CGI descriptions and menu not to break JS syntax + * * Revision 1.58 2002/03/29 03:33:13 david__schmidt * Fix Mac OSX compiler warnings * @@ -138,7 +155,7 @@ const char cgi_rcs[] = "$Id: cgi.c,v 1.58 2002/03/29 03:33:13 david__schmidt Exp * * CGI actions file editor that works and is actually useful. * - * Ability to toggle JunkBuster remotely using a CGI call. + * Ability to toggle Junkbuster remotely using a CGI call. * * You can turn off both the above features in the main configuration * file, e.g. if you are running a multi-user proxy. @@ -543,7 +560,7 @@ static struct map *parse_cgi_parameters(char *argstring); * Function : dispatch_cgi * * Description : Checks if a request URL has either the magical - * hostname CGI_SITE_1_HOST (usully http://i.j.b/) or + * hostname CGI_SITE_1_HOST (usually http://p.p/) or * matches CGI_SITE_2_HOST CGI_SITE_2_PATH (usually * http://ijbswa.sourceforge.net/config). If so, it passes * the (rest of the) path onto dispatch_known_cgi, which @@ -938,9 +955,9 @@ jb_err cgi_error_no_template(struct client_state *csp, "

Privoxy encountered an error while processing your request:

\r\n" "

Could not load template file "; static const char body_suffix[] = - "

\r\n" + " or one of it's included components.

\r\n" "

Please contact your proxy administrator.

\r\n" - "

If you are the proxy administrator, please put the required file " + "

If you are the proxy administrator, please put the required file(s)" "in the (confdir)/templates directory. The " "location of the (confdir) directory " "is specified in the main Privoxy config " @@ -1242,13 +1259,16 @@ void free_http_response(struct http_response *rsp) * * Description : CGI support function that loads a given HTML * template from the confdir, ignoring comment - * lines. + * lines and following #include statements up to + * a depth of 1. * * Parameters : * 1 : csp = Current client state (buffers, headers, etc...) * 2 : template_ptr = Destination for pointer to loaded * template text. * 3 : template = name of the HTML template to be used + * 4 : recursive = Flag set if this function calls itself + * following an #include statament * * Returns : JB_ERR_OK on success * JB_ERR_MEMORY on out-of-memory error. @@ -1256,11 +1276,14 @@ void free_http_response(struct http_response *rsp) * *********************************************************************/ jb_err template_load(struct client_state *csp, char **template_ptr, - const char *templatename) + const char *templatename, int recursive) { + jb_err err; char *templates_dir_path; char *full_path; char *file_buffer; + char *included_module; + const char *p; FILE *fp; char buf[BUFFER_SIZE]; @@ -1270,9 +1293,21 @@ jb_err template_load(struct client_state *csp, char **template_ptr, *template_ptr = NULL; - /* - * Open template file or fail - */ + /* Validate template name. Paranoia. */ + for (p = templatename; *p != 0; p++) + { + if ( ((*p < 'a') || (*p > 'z')) + && ((*p < 'A') || (*p > 'Z')) + && ((*p < '0') || (*p > '9')) + && (*p != '-') + && (*p != '.')) + { + /* Illegal character */ + return JB_ERR_FILE; + } + } + + /* Generate full path */ templates_dir_path = make_path(csp->config->confdir, "templates"); if (templates_dir_path == NULL) @@ -1287,6 +1322,8 @@ jb_err template_load(struct client_state *csp, char **template_ptr, return JB_ERR_MEMORY; } + /* Allocate buffer */ + file_buffer = strdup(""); if (file_buffer == NULL) { @@ -1294,6 +1331,8 @@ jb_err template_load(struct client_state *csp, char **template_ptr, return JB_ERR_MEMORY; } + /* Open template file */ + if (NULL == (fp = fopen(full_path, "r"))) { log_error(LOG_LEVEL_ERROR, "Cannot open template file %s: %E", full_path); @@ -1304,15 +1343,34 @@ jb_err template_load(struct client_state *csp, char **template_ptr, free(full_path); /* - * Read the file, ignoring comments. + * Read the file, ignoring comments, and honoring #include + * statements, unless we're already called recursively. * * FIXME: The comment handling could break with lines >BUFFER_SIZE long. * This is unlikely in practise. */ while (fgets(buf, BUFFER_SIZE, fp)) { + if (!recursive && !strncmp(buf, "#include ", 9)) + { + if (JB_ERR_OK != (err = template_load(csp, &included_module, chomp(buf + 9), 1))) + { + free(file_buffer); + fclose(fp); + return err; + } + + if (string_join(&file_buffer, included_module)) + { + fclose(fp); + return JB_ERR_MEMORY; + } + + continue; + } + /* skip lines starting with '#' */ - if(*buf == '#') + if (*buf == '#') { continue; } @@ -1472,7 +1530,7 @@ jb_err template_fill_for_cgi(struct client_state *csp, assert(exports); assert(rsp); - err = template_load(csp, &rsp->body, templatename); + err = template_load(csp, &rsp->body, templatename, 0); if (err == JB_ERR_FILE) { free_map(exports);