Public/elog
1
0
Fork 0
mirror of https://gitea.psi.ch/ELOG/elog.git synced 2026-09-08 17:13:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Encode command line if it contains a '<'

Browse Source 
SVN revision: 2123
This commit is contained in:
Stefan Ritt 2008-08-15 12:50:44 +00:00
parent 9bbe6c0e97
commit 945817bb29
1 changed files with 12 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
src/elogd.c
View File

@ -1391,7 +1391,7 @@ Encode the given string in-place by adding %XX escapes
pd = str; pd = str;
p = (unsigned char *) ps; p = (unsigned char *) ps;
while (*p && pd < str + 250) { while (*p && pd < str + 250) {
if (strchr("%&=#?+", *p) || *p > 127) { if (strchr("%&=#?+<>", *p) || *p > 127) {
sprintf((char *) pd, "%%%02X", *p); sprintf((char *) pd, "%%%02X", *p);
pd += 3; pd += 3;
p++; p++;
@ -23630,7 +23630,7 @@ void show_elog_entry(LOGBOOK * lbs, char *dec_path, char *command)
BOOL check_password(LOGBOOK * lbs, char *name, char *password, char *redir) BOOL check_password(LOGBOOK * lbs, char *name, char *password, char *redir)
{ {
char str[256]; char str[1000];
/* get password from configuration file */ /* get password from configuration file */
if (getcfg(lbs->name, name, str, sizeof(str))) { if (getcfg(lbs->name, name, str, sizeof(str))) {
@ -23658,8 +23658,12 @@ BOOL check_password(LOGBOOK * lbs, char *name, char *password, char *redir)
rsprintf("<tr><td class=\"dlgtitle\">\n"); rsprintf("<tr><td class=\"dlgtitle\">\n");
/* define hidden fields for current destination */ /* define hidden fields for current destination */
if (redir[0]) if (redir[0]) {
rsprintf("<input type=hidden name=redir value=\"%s\">\n", redir); strlcpy(str, redir, sizeof(str));
if (strchr(str, '<'))
url_encode(str, sizeof(str));
rsprintf("<input type=hidden name=redir value=\"%s\">\n", str);
}
if (strcmp(name, "Write password") == 0) { if (strcmp(name, "Write password") == 0) {
rsprintf("%s</td></tr>\n", loc("Please enter password to obtain write access")); rsprintf("%s</td></tr>\n", loc("Please enter password to obtain write access"));
@ -24272,7 +24276,10 @@ BOOL check_user_password(LOGBOOK * lbs, char *user, char *password, char *redir)
rsprintf("<form name=form1 method=\"POST\" action=\"./\" enctype=\"multipart/form-data\">\n\n"); rsprintf("<form name=form1 method=\"POST\" action=\"./\" enctype=\"multipart/form-data\">\n\n");
/* define hidden fields for current destination */ /* define hidden fields for current destination */
rsprintf("<input type=hidden name=redir value=\"%s\">\n", redir); strlcpy(str, redir, sizeof(str));
if (strchr(str, '<'))
url_encode(str, sizeof(str));
rsprintf("<input type=hidden name=redir value=\"%s\">\n", str);
rsprintf("<table class=\"dlgframe\" cellspacing=0 align=center>"); rsprintf("<table class=\"dlgframe\" cellspacing=0 align=center>");