X-Git-Url: http://www.privoxy.org/gitweb/?p=privoxy.git;a=blobdiff_plain;f=cgi.c;h=062b9761e235db6efa27bf7825a31aa431f39162;hp=f138f653fc0f711c2accb3eaa5b4e06c99ba8417;hb=137a54f05a90e845dc43c4c2508684916d948ead;hpb=cbc0c9cc68e3e2bbe6a5bae7c05c9a2274589267 diff --git a/cgi.c b/cgi.c index f138f653..062b9761 100644 --- a/cgi.c +++ b/cgi.c @@ -1,4 +1,4 @@ -const char cgi_rcs[] = "$Id: cgi.c,v 1.59 2002/04/05 15:51:51 oes Exp $"; +const char cgi_rcs[] = "$Id: cgi.c,v 1.62 2002/04/10 19:59:46 jongfoster Exp $"; /********************************************************************* * * File : $Source: /cvsroot/ijbswa/current/cgi.c,v $ @@ -38,6 +38,17 @@ const char cgi_rcs[] = "$Id: cgi.c,v 1.59 2002/04/05 15:51:51 oes Exp $"; * * Revisions : * $Log: cgi.c,v $ + * Revision 1.62 2002/04/10 19:59:46 jongfoster + * Fixes to #include in templates: + * - Didn't close main file if loading an included template fails. + * - I'm paranoid and want to disallow "#include /etc/passwd". + * + * Revision 1.61 2002/04/10 13:37:48 oes + * Made templates modular: template_load now recursive with max depth 1 + * + * Revision 1.60 2002/04/08 20:50:25 swa + * fixed JB spelling + * * Revision 1.59 2002/04/05 15:51:51 oes * - added send-stylesheet CGI * - bugfix: error-pages now get correct request protocol @@ -549,7 +560,7 @@ static struct map *parse_cgi_parameters(char *argstring); * Function : dispatch_cgi * * Description : Checks if a request URL has either the magical - * hostname CGI_SITE_1_HOST (usully http://i.j.b/) or + * hostname CGI_SITE_1_HOST (usually http://p.p/) or * matches CGI_SITE_2_HOST CGI_SITE_2_PATH (usually * http://ijbswa.sourceforge.net/config). If so, it passes * the (rest of the) path onto dispatch_known_cgi, which @@ -944,9 +955,9 @@ jb_err cgi_error_no_template(struct client_state *csp, "
Privoxy encountered an error while processing your request:
\r\n" "Could not load template file ";
static const char body_suffix[] =
- "
Please contact your proxy administrator.
\r\n" - "If you are the proxy administrator, please put the required file " + "
If you are the proxy administrator, please put the required file(s)"
"in the (confdir)/templates
directory. The "
"location of the (confdir)
directory "
"is specified in the main Privoxy config
"
@@ -1248,13 +1259,16 @@ void free_http_response(struct http_response *rsp)
*
* Description : CGI support function that loads a given HTML
* template from the confdir, ignoring comment
- * lines.
+ * lines and following #include statements up to
+ * a depth of 1.
*
* Parameters :
* 1 : csp = Current client state (buffers, headers, etc...)
* 2 : template_ptr = Destination for pointer to loaded
* template text.
* 3 : template = name of the HTML template to be used
+ * 4 : recursive = Flag set if this function calls itself
+ * following an #include statament
*
* Returns : JB_ERR_OK on success
* JB_ERR_MEMORY on out-of-memory error.
@@ -1262,11 +1276,14 @@ void free_http_response(struct http_response *rsp)
*
*********************************************************************/
jb_err template_load(struct client_state *csp, char **template_ptr,
- const char *templatename)
+ const char *templatename, int recursive)
{
+ jb_err err;
char *templates_dir_path;
char *full_path;
char *file_buffer;
+ char *included_module;
+ const char *p;
FILE *fp;
char buf[BUFFER_SIZE];
@@ -1276,9 +1293,21 @@ jb_err template_load(struct client_state *csp, char **template_ptr,
*template_ptr = NULL;
- /*
- * Open template file or fail
- */
+ /* Validate template name. Paranoia. */
+ for (p = templatename; *p != 0; p++)
+ {
+ if ( ((*p < 'a') || (*p > 'z'))
+ && ((*p < 'A') || (*p > 'Z'))
+ && ((*p < '0') || (*p > '9'))
+ && (*p != '-')
+ && (*p != '.'))
+ {
+ /* Illegal character */
+ return JB_ERR_FILE;
+ }
+ }
+
+ /* Generate full path */
templates_dir_path = make_path(csp->config->confdir, "templates");
if (templates_dir_path == NULL)
@@ -1293,6 +1322,8 @@ jb_err template_load(struct client_state *csp, char **template_ptr,
return JB_ERR_MEMORY;
}
+ /* Allocate buffer */
+
file_buffer = strdup("");
if (file_buffer == NULL)
{
@@ -1300,6 +1331,8 @@ jb_err template_load(struct client_state *csp, char **template_ptr,
return JB_ERR_MEMORY;
}
+ /* Open template file */
+
if (NULL == (fp = fopen(full_path, "r")))
{
log_error(LOG_LEVEL_ERROR, "Cannot open template file %s: %E", full_path);
@@ -1310,15 +1343,34 @@ jb_err template_load(struct client_state *csp, char **template_ptr,
free(full_path);
/*
- * Read the file, ignoring comments.
+ * Read the file, ignoring comments, and honoring #include
+ * statements, unless we're already called recursively.
*
* FIXME: The comment handling could break with lines >BUFFER_SIZE long.
* This is unlikely in practise.
*/
while (fgets(buf, BUFFER_SIZE, fp))
{
+ if (!recursive && !strncmp(buf, "#include ", 9))
+ {
+ if (JB_ERR_OK != (err = template_load(csp, &included_module, chomp(buf + 9), 1)))
+ {
+ free(file_buffer);
+ fclose(fp);
+ return err;
+ }
+
+ if (string_join(&file_buffer, included_module))
+ {
+ fclose(fp);
+ return JB_ERR_MEMORY;
+ }
+
+ continue;
+ }
+
/* skip lines starting with '#' */
- if(*buf == '#')
+ if (*buf == '#')
{
continue;
}
@@ -1478,7 +1530,7 @@ jb_err template_fill_for_cgi(struct client_state *csp,
assert(exports);
assert(rsp);
- err = template_load(csp, &rsp->body, templatename);
+ err = template_load(csp, &rsp->body, templatename, 0);
if (err == JB_ERR_FILE)
{
free_map(exports);