mirror of
https://gitea.psi.ch/ELOG/elog.git
synced 2026-09-08 17:13:56 +00:00
Implemented "Allow HTML" flag
SVN revision: 2230
This commit is contained in:
Stefan Ritt
parent
e042165f83
commit
e8a15552de
@ -2340,6 +2340,14 @@ Options Location = Main Building{a}, New Building{b}, Old Building{c}
|
|||||||
be allowed for installations where it is really needed and with no
|
be allowed for installations where it is really needed and with no
|
||||||
public write access.
|
public write access.
|
||||||
</li>
|
</li>
|
||||||
|
<li>
|
||||||
|
<b><code>Allow HTML = 0|1</code></b><br>
|
||||||
|
This flag allows or denys the usage of HTML in attributes. Note that
|
||||||
|
allowing HTML encoding may cause some security risk, since an elog
|
||||||
|
entry may contain malicious scripting code. It should therefor only
|
||||||
|
be allowed for installations where it is really needed and with no
|
||||||
|
public write access. The default value is <b>0</b>.
|
||||||
|
</li>
|
||||||
<li>
|
<li>
|
||||||
<b><code>Suppress default = 0|1|2|3</code></b><br>
|
<b><code>Suppress default = 0|1|2|3</code></b><br>
|
||||||
This specifies the default state of the "<i>Suppress Email
|
This specifies the default state of the "<i>Suppress Email
|
||||||
|
|||||||
93
src/elogd.c
93
src/elogd.c
@ -5408,6 +5408,16 @@ int is_html(char *s)
|
|||||||
return FALSE;
|
return FALSE;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/*------------------------------------------------------------------*/
|
||||||
|
|
||||||
|
int html_allowed(LOGBOOK *lbs)
|
||||||
|
{
|
||||||
|
char str[80];
|
||||||
|
|
||||||
|
return (getcfg(lbs->name, "Allow HTML", str, sizeof(str)) && atoi(str) == 1);
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
/*------------------------------------------------------------------*/
|
/*------------------------------------------------------------------*/
|
||||||
|
|
||||||
char *script_tags[] = { "onerror", "onabort", "onchange", "onclick", "ondblclick", "onfocus", "onkeydown",
|
char *script_tags[] = { "onerror", "onabort", "onchange", "onclick", "ondblclick", "onfocus", "onkeydown",
|
||||||
@ -16860,7 +16870,8 @@ void display_line(LOGBOOK * lbs, int message_id, int number, char *mode, int exp
|
|||||||
else
|
else
|
||||||
rsprintf("\n<b>");
|
rsprintf("\n<b>");
|
||||||
|
|
||||||
if (is_html(display) && !is_script(display))
|
|
||||||
|
if (is_html(display) && !is_script(display) && html_allowed(lbs))
|
||||||
rsputs(display);
|
rsputs(display);
|
||||||
else
|
else
|
||||||
rsputs2(lbs, absolute_link, display);
|
rsputs2(lbs, absolute_link, display);
|
||||||
@ -17013,7 +17024,7 @@ void display_line(LOGBOOK * lbs, int message_id, int number, char *mode, int exp
|
|||||||
} else
|
} else
|
||||||
rsprintf(", ");
|
rsprintf(", ");
|
||||||
|
|
||||||
if (is_html(attrib[i]) && !is_script(attrib[i]))
|
if (is_html(attrib[i]) && !is_script(attrib[i]) && html_allowed(lbs))
|
||||||
rsputs(attrib[i]);
|
rsputs(attrib[i]);
|
||||||
else
|
else
|
||||||
rsputs2(lbs, absolute_link, attrib[i]);
|
rsputs2(lbs, absolute_link, attrib[i]);
|
||||||
@ -17083,7 +17094,7 @@ void display_line(LOGBOOK * lbs, int message_id, int number, char *mode, int exp
|
|||||||
} else
|
} else
|
||||||
rsprintf(", ");
|
rsprintf(", ");
|
||||||
|
|
||||||
if (is_html(attrib[i]) && !is_script(attrib[i]))
|
if (is_html(attrib[i]) && !is_script(attrib[i]) && html_allowed(lbs))
|
||||||
rsputs(attrib[i]);
|
rsputs(attrib[i]);
|
||||||
else
|
else
|
||||||
rsputs2(lbs, absolute_link, attrib[i]);
|
rsputs2(lbs, absolute_link, attrib[i]);
|
||||||
@ -17153,49 +17164,45 @@ void display_line(LOGBOOK * lbs, int message_id, int number, char *mode, int exp
|
|||||||
else {
|
else {
|
||||||
rsprintf("<td class=\"%s\">", sclass);
|
rsprintf("<td class=\"%s\">", sclass);
|
||||||
|
|
||||||
if (is_html(attrib[i]) && !is_script(attrib[i]))
|
if (disp_attr_link == NULL || disp_attr_link[index])
|
||||||
rsputs(attrib[i]);
|
rsprintf("<a href=\"%s\">", ref);
|
||||||
|
|
||||||
|
sprintf(str, "List Change %s", attr_list[i]);
|
||||||
|
if (getcfg(lbs->name, str, display, sizeof(display))) {
|
||||||
|
j = build_subst_list(lbs, (char (*)[NAME_LENGTH]) slist,
|
||||||
|
(char (*)[NAME_LENGTH]) svalue, attrib, TRUE);
|
||||||
|
sprintf(str, "%d", message_id);
|
||||||
|
add_subst_list((char (*)[NAME_LENGTH]) slist, (char (*)[NAME_LENGTH]) svalue,
|
||||||
|
"message id", str, &j);
|
||||||
|
add_subst_time(lbs, (char (*)[NAME_LENGTH]) slist, (char (*)[NAME_LENGTH]) svalue,
|
||||||
|
"entry time", date, &j, 0);
|
||||||
|
|
||||||
|
strsubst_list(display, sizeof(display), (char (*)[NAME_LENGTH]) slist,
|
||||||
|
(char (*)[NAME_LENGTH]) svalue, j);
|
||||||
|
|
||||||
|
} else
|
||||||
|
strcpy(display, attrib[i]);
|
||||||
|
|
||||||
|
if (is_html(display) && !is_script(display) && html_allowed(lbs))
|
||||||
|
rsputs(display);
|
||||||
else {
|
else {
|
||||||
if (disp_attr_link == NULL || disp_attr_link[index])
|
if (isparam(attr_list[i])) {
|
||||||
rsprintf("<a href=\"%s\">", ref);
|
highlight_searchtext(re_buf + 1 + i, display, str, TRUE);
|
||||||
|
strlcpy(display, str, sizeof(display));
|
||||||
sprintf(str, "List Change %s", attr_list[i]);
|
} else if (isparam("subtext") && isparam("sall") && atoi(getparam("sall"))) {
|
||||||
if (getcfg(lbs->name, str, display, sizeof(display))) {
|
highlight_searchtext(re_buf, display, str, TRUE);
|
||||||
j = build_subst_list(lbs, (char (*)[NAME_LENGTH]) slist,
|
strlcpy(display, str, sizeof(display));
|
||||||
(char (*)[NAME_LENGTH]) svalue, attrib, TRUE);
|
|
||||||
sprintf(str, "%d", message_id);
|
|
||||||
add_subst_list((char (*)[NAME_LENGTH]) slist, (char (*)[NAME_LENGTH]) svalue,
|
|
||||||
"message id", str, &j);
|
|
||||||
add_subst_time(lbs, (char (*)[NAME_LENGTH]) slist, (char (*)[NAME_LENGTH]) svalue,
|
|
||||||
"entry time", date, &j, 0);
|
|
||||||
|
|
||||||
strsubst_list(display, sizeof(display), (char (*)[NAME_LENGTH]) slist,
|
|
||||||
(char (*)[NAME_LENGTH]) svalue, j);
|
|
||||||
|
|
||||||
} else
|
|
||||||
strcpy(display, attrib[i]);
|
|
||||||
|
|
||||||
if (is_html(display) && !is_script(display))
|
|
||||||
rsputs(display);
|
|
||||||
else {
|
|
||||||
if (isparam(attr_list[i])) {
|
|
||||||
highlight_searchtext(re_buf + 1 + i, display, str, TRUE);
|
|
||||||
strlcpy(display, str, sizeof(display));
|
|
||||||
} else if (isparam("subtext") && isparam("sall") && atoi(getparam("sall"))) {
|
|
||||||
highlight_searchtext(re_buf, display, str, TRUE);
|
|
||||||
strlcpy(display, str, sizeof(display));
|
|
||||||
}
|
|
||||||
rsputs2(lbs, absolute_link, display);
|
|
||||||
}
|
}
|
||||||
|
rsputs2(lbs, absolute_link, display);
|
||||||
if (disp_attr_link == NULL || disp_attr_link[index])
|
|
||||||
rsprintf("</a>");
|
|
||||||
|
|
||||||
/* at least one space to produce non-empty table cell */
|
|
||||||
if (!display[0])
|
|
||||||
rsprintf(" ");
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (disp_attr_link == NULL || disp_attr_link[index])
|
||||||
|
rsprintf("</a>");
|
||||||
|
|
||||||
|
/* at least one space to produce non-empty table cell */
|
||||||
|
if (!display[0])
|
||||||
|
rsprintf(" ");
|
||||||
|
|
||||||
rsprintf("</td>");
|
rsprintf("</td>");
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@ -23739,7 +23746,7 @@ void show_elog_entry(LOGBOOK * lbs, char *dec_path, char *command)
|
|||||||
} else
|
} else
|
||||||
strcpy(display, attrib[i]);
|
strcpy(display, attrib[i]);
|
||||||
|
|
||||||
if (is_html(display) && !is_script(display))
|
if (is_html(display) && !is_script(display) && html_allowed(lbs))
|
||||||
rsputs(display);
|
rsputs(display);
|
||||||
else
|
else
|
||||||
rsputs2(lbs, email, display);
|
rsputs2(lbs, email, display);
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user