Public/elog
1
0
Fork 0
mirror of https://gitea.psi.ch/ELOG/elog.git synced 2026-09-12 19:33:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

Implemented "Allow HTML" flag

Browse Source 
SVN revision: 2230
This commit is contained in:
Stefan Ritt 2009-07-09 07:50:13 +00:00
parent e042165f83
commit e8a15552de
2 changed files with 58 additions and 43 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
doc/config.html
View File

@ -2340,6 +2340,14 @@ Options Location = Main Building{a}, New Building{b}, Old Building{c}
be allowed for installations where it is really needed and with no be allowed for installations where it is really needed and with no
public write access. public write access.
</li> </li>
<li>
<b><code>Allow HTML = 0|1</code></b><br>
This flag allows or denys the usage of HTML in attributes. Note that
allowing HTML encoding may cause some security risk, since an elog
entry may contain malicious scripting code. It should therefor only
be allowed for installations where it is really needed and with no
public write access. The default value is <b>0</b>.
</li>
<li> <li>
<b><code>Suppress default = 0|1|2|3</code></b><br> <b><code>Suppress default = 0|1|2|3</code></b><br>
This specifies the default state of the "<i>Suppress Email This specifies the default state of the "<i>Suppress Email

25
src/elogd.c
View File

@ -5408,6 +5408,16 @@ int is_html(char *s)
return FALSE; return FALSE;
} }
/*------------------------------------------------------------------*/
int html_allowed(LOGBOOK *lbs)
{
char str[80];
return (getcfg(lbs->name, "Allow HTML", str, sizeof(str)) && atoi(str) == 1);
}
/*------------------------------------------------------------------*/ /*------------------------------------------------------------------*/
char *script_tags[] = { "onerror", "onabort", "onchange", "onclick", "ondblclick", "onfocus", "onkeydown", char *script_tags[] = { "onerror", "onabort", "onchange", "onclick", "ondblclick", "onfocus", "onkeydown",
@ -16860,7 +16870,8 @@ void display_line(LOGBOOK * lbs, int message_id, int number, char *mode, int exp
else else
rsprintf("\n<b>"); rsprintf("\n<b>");
if (is_html(display) && !is_script(display))
if (is_html(display) && !is_script(display) && html_allowed(lbs))
rsputs(display); rsputs(display);
else else
rsputs2(lbs, absolute_link, display); rsputs2(lbs, absolute_link, display);
@ -17013,7 +17024,7 @@ void display_line(LOGBOOK * lbs, int message_id, int number, char *mode, int exp
} else } else
rsprintf(", "); rsprintf(", ");
if (is_html(attrib[i]) && !is_script(attrib[i])) if (is_html(attrib[i]) && !is_script(attrib[i]) && html_allowed(lbs))
rsputs(attrib[i]); rsputs(attrib[i]);
else else
rsputs2(lbs, absolute_link, attrib[i]); rsputs2(lbs, absolute_link, attrib[i]);
@ -17083,7 +17094,7 @@ void display_line(LOGBOOK * lbs, int message_id, int number, char *mode, int exp
} else } else
rsprintf(", "); rsprintf(", ");
if (is_html(attrib[i]) && !is_script(attrib[i])) if (is_html(attrib[i]) && !is_script(attrib[i]) && html_allowed(lbs))
rsputs(attrib[i]); rsputs(attrib[i]);
else else
rsputs2(lbs, absolute_link, attrib[i]); rsputs2(lbs, absolute_link, attrib[i]);
@ -17153,9 +17164,6 @@ void display_line(LOGBOOK * lbs, int message_id, int number, char *mode, int exp
else { else {
rsprintf("<td class=\"%s\">", sclass); rsprintf("<td class=\"%s\">", sclass);
if (is_html(attrib[i]) && !is_script(attrib[i]))
rsputs(attrib[i]);
else {
if (disp_attr_link == NULL || disp_attr_link[index]) if (disp_attr_link == NULL || disp_attr_link[index])
rsprintf("<a href=\"%s\">", ref); rsprintf("<a href=\"%s\">", ref);
@ -17175,7 +17183,7 @@ void display_line(LOGBOOK * lbs, int message_id, int number, char *mode, int exp
} else } else
strcpy(display, attrib[i]); strcpy(display, attrib[i]);
if (is_html(display) && !is_script(display)) if (is_html(display) && !is_script(display) && html_allowed(lbs))
rsputs(display); rsputs(display);
else { else {
if (isparam(attr_list[i])) { if (isparam(attr_list[i])) {
@ -17194,7 +17202,6 @@ void display_line(LOGBOOK * lbs, int message_id, int number, char *mode, int exp
/* at least one space to produce non-empty table cell */ /* at least one space to produce non-empty table cell */
if (!display[0]) if (!display[0])
rsprintf("&nbsp;"); rsprintf("&nbsp;");
}
rsprintf("</td>"); rsprintf("</td>");
} }
@ -23739,7 +23746,7 @@ void show_elog_entry(LOGBOOK * lbs, char *dec_path, char *command)
} else } else
strcpy(display, attrib[i]); strcpy(display, attrib[i]);
if (is_html(display) && !is_script(display)) if (is_html(display) && !is_script(display) && html_allowed(lbs))
rsputs(display); rsputs(display);
else else
rsputs2(lbs, email, display); rsputs2(lbs, email, display);