storm/w3m
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

use local_cookie for support local-cgi commands

Browse Source 
* file.c (loadGeneralFile): pass Local_cookie to DirBufferCommand
* fm.h (Local_cookie): Str
* local.c (setLocalCookie): Str, set_environ()
	(set_cgi_environ): remove LOCAL_COOKIE
* main.c (ldhelp): pass Local_cookie
	(adBmark): ditto
* rc.c (optionpanel_src1): cookie
	(load_option_panel): pass Local_cookie
* w3mbookmark.c (main): check Local_cookie
* w3mhelperpanel (main): ditto
* scripts/dirlist.cgi.in: ditto
* scripts/w3mhelp.cgi.in: ditto
* scripts/multipart/multipart.cgi.in: ditto
From: Hironori SAKAMOTO <hsaka@mth.biglobe.ne.jp>
This commit is contained in:
Fumitoshi UKAI
2002-11-26 18:03:18 +00:00
parent 0449e072cc
commit 77e0acc0d3
11 changed files with 123 additions and 65 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ChangeLog
+18 -1
View File
@@ -1,3 +1,20 @@
2002-11-27 Hironori SAKAMOTO <hsaka@mth.biglobe.ne.jp>
* use local_cookie for support local-cgi commands
* file.c (loadGeneralFile): pass Local_cookie to DirBufferCommand
* fm.h (Local_cookie): Str
* local.c (setLocalCookie): Str, set_environ()
(set_cgi_environ): remove LOCAL_COOKIE
* main.c (ldhelp): pass Local_cookie
(adBmark): ditto
* rc.c (optionpanel_src1): cookie
(load_option_panel): pass Local_cookie
* w3mbookmark.c (main): check Local_cookie
* w3mhelperpanel (main): ditto
* scripts/dirlist.cgi.in: ditto
* scripts/w3mhelp.cgi.in: ditto
* scripts/multipart/multipart.cgi.in: ditto
2002-11-27 Fumitoshi UKAI <ukai@debian.or.jp> 2002-11-27 Fumitoshi UKAI <ukai@debian.or.jp>
* frame.c (createFrameFile): html_quote() * frame.c (createFrameFile): html_quote()
@@ -5178,4 +5195,4 @@ a * [w3m-dev 03276] compile error on EWS4800
* release-0-2-1 * release-0-2-1
* import w3m-0.2.1 * import w3m-0.2.1
$Id: ChangeLog,v 1.562 2002/11/26 17:08:00 ukai Exp $ $Id: ChangeLog,v 1.563 2002/11/26 18:03:18 ukai Exp $
file.c
+5 -4
View File
@@ -1,4 +1,4 @@
/* $Id: file.c,v 1.131 2002/11/26 17:12:25 ukai Exp $ */ /* $Id: file.c,v 1.132 2002/11/26 18:03:24 ukai Exp $ */
#include "fm.h" #include "fm.h"
#include <sys/types.h> #include <sys/types.h>
#include "myctype.h" #include "myctype.h"
@@ -1544,9 +1544,10 @@ loadGeneralFile(char *path, ParsedURL *volatile current, char *referer,
return NULL; return NULL;
if (S_ISDIR(st.st_mode)) { if (S_ISDIR(st.st_mode)) {
if (UseExternalDirBuffer) { if (UseExternalDirBuffer) {
Str cmd = Strnew_charp(DirBufferCommand); Str cmd = Sprintf("%s?cookie=%s&dir=%s#current",
Strcat_m_charp(cmd, "?dir=", DirBufferCommand,
pu.file, "#current", NULL); (Str_form_quote(Local_cookie))->ptr,
pu.file);
b = loadGeneralFile(cmd->ptr, NULL, NO_REFERER, 0, b = loadGeneralFile(cmd->ptr, NULL, NO_REFERER, 0,
NULL); NULL);
if (b != NULL && b != NO_BUFFER) { if (b != NULL && b != NO_BUFFER) {
fm.h
+2 -2
View File
@@ -1,4 +1,4 @@
/* $Id: fm.h,v 1.88 2002/11/25 16:57:17 ukai Exp $ */ /* $Id: fm.h,v 1.89 2002/11/26 18:03:26 ukai Exp $ */
/* /*
* w3m: WWW wo Miru utility * w3m: WWW wo Miru utility
* *
@@ -936,7 +936,7 @@ global char *migemo_command init(DEF_MIGEMO_COMMAND);
#endif /* USE_MIGEMO */ #endif /* USE_MIGEMO */
global struct auth_cookie *Auth_cookie init(NULL); global struct auth_cookie *Auth_cookie init(NULL);
global char *Local_cookie init(NULL); global Str Local_cookie init(NULL);
#ifdef USE_COOKIE #ifdef USE_COOKIE
global struct cookie *First_cookie init(NULL); global struct cookie *First_cookie init(NULL);
#endif /* USE_COOKIE */ #endif /* USE_COOKIE */
local.c
+3 -5
View File
@@ -1,4 +1,4 @@
/* $Id: local.c,v 1.14 2002/02/04 15:18:42 ukai Exp $ */ /* $Id: local.c,v 1.15 2002/11/26 18:03:26 ukai Exp $ */
#include "fm.h" #include "fm.h"
#include <string.h> #include <string.h>
#include <stdio.h> #include <stdio.h>
@@ -26,12 +26,11 @@
void void
setLocalCookie() setLocalCookie()
{ {
Str buf;
char hostname[256]; char hostname[256];
gethostname(hostname, 256); gethostname(hostname, 256);
buf = Sprintf("%d.%ld@%s", getpid(), lrand48(), hostname); Local_cookie = Sprintf("%d.%ld@%s", getpid(), lrand48(), hostname);
Local_cookie = buf->ptr; set_environ("LOCAL_COOKIE", Local_cookie->ptr);
} }
Buffer * Buffer *
@@ -268,7 +267,6 @@ set_cgi_environ(char *name, char *fn, char *req_uri)
set_environ("SCRIPT_NAME", name); set_environ("SCRIPT_NAME", name);
set_environ("SCRIPT_FILENAME", fn); set_environ("SCRIPT_FILENAME", fn);
set_environ("REQUEST_URI", req_uri); set_environ("REQUEST_URI", req_uri);
set_environ("LOCAL_COOKIE", Local_cookie);
} }
static Str static Str
main.c
+5 -4
View File
@@ -1,4 +1,4 @@
/* $Id: main.c,v 1.155 2002/11/26 03:42:28 ukai Exp $ */ /* $Id: main.c,v 1.156 2002/11/26 18:03:27 ukai Exp $ */
#define MAINPROGRAM #define MAINPROGRAM
#include "fm.h" #include "fm.h"
#include <signal.h> #include <signal.h>
@@ -1961,7 +1961,8 @@ ldhelp(void)
lang = AcceptLang; lang = AcceptLang;
n = strcspn(lang, ";, \t"); n = strcspn(lang, ";, \t");
cmd_loadURL(Sprintf("file:///$LIB/" HELP_CGI CGI_EXTENSION cmd_loadURL(Sprintf("file:///$LIB/" HELP_CGI CGI_EXTENSION
"?version=%s&lang=%s", "?cookie=%s&version=%s&lang=%s",
Str_form_quote(Local_cookie)->ptr,
Str_form_quote(Strnew_charp(w3m_version))->ptr, Str_form_quote(Strnew_charp(w3m_version))->ptr,
Str_form_quote(Strnew_charp_n(lang, n))->ptr)->ptr, Str_form_quote(Strnew_charp_n(lang, n))->ptr)->ptr,
NULL, NO_REFERER); NULL, NO_REFERER);
@@ -4004,8 +4005,8 @@ adBmark(void)
Str tmp; Str tmp;
tmp = Sprintf("file://%s/" W3MBOOKMARK_CMDNAME tmp = Sprintf("file://%s/" W3MBOOKMARK_CMDNAME
"?mode=panel&bmark=%s&url=%s&title=%s", "?mode=panel&cookie=%s&bmark=%s&url=%s&title=%s",
w3m_lib_dir(), w3m_lib_dir(), (Str_form_quote(Local_cookie))->ptr,
(Str_form_quote(Strnew_charp(BookmarkFile)))->ptr, (Str_form_quote(Strnew_charp(BookmarkFile)))->ptr,
(Str_form_quote(parsedURL2Str(&Currentbuf->currentURL)))-> (Str_form_quote(parsedURL2Str(&Currentbuf->currentURL)))->
ptr, ptr,
rc.c
+4 -3
View File
@@ -1,4 +1,4 @@
/* $Id: rc.c,v 1.67 2002/11/25 16:57:17 ukai Exp $ */ /* $Id: rc.c,v 1.68 2002/11/26 18:03:28 ukai Exp $ */
/* /*
* Initialization file etc. * Initialization file etc.
*/ */
@@ -1387,7 +1387,7 @@ init_rc(char *config_filename)
static char optionpanel_src1[] = static char optionpanel_src1[] =
"<html><head><title>Option Setting Panel</title></head>\ "<html><head><title>Option Setting Panel</title></head>\
<body><center><b>Option Setting Panel</b><br><b>(w3m version %s)</b></center><p>\n" "<a href=\"file:///$LIB/" W3MHELPERPANEL_CMDNAME "?mode=panel\">%s</a>\n" "<form method=internal action=option>"; <body><center><b>Option Setting Panel</b><br><b>(w3m version %s)</b></center><p>\n" "<a href=\"file:///$LIB/" W3MHELPERPANEL_CMDNAME "?mode=panel&cookie=%s\">%s</a>\n" "<form method=internal action=option>";
static Str static Str
to_str(struct param_ptr *p) to_str(struct param_ptr *p)
@@ -1424,7 +1424,8 @@ to_str(struct param_ptr *p)
Buffer * Buffer *
load_option_panel(void) load_option_panel(void)
{ {
Str src = Sprintf(optionpanel_src1, w3m_version, CMT_HELPER); Str src = Sprintf(optionpanel_src1, w3m_version,
(Str_form_quote(Local_cookie))->ptr, CMT_HELPER);
struct param_ptr *p; struct param_ptr *p;
struct sel_c *s; struct sel_c *s;
int x, i; int x, i;
scripts/dirlist.cgi.in
+34 -20
View File
@@ -30,15 +30,17 @@ $NOW = time();
@OPT = &init_option($CONFIG); @OPT = &init_option($CONFIG);
$query = $ENV{'QUERY_STRING'}; $query = $ENV{'QUERY_STRING'};
$dir = '';
$cmd = ''; $cmd = '';
$cgi = 0; $cookie = '';
if ($query eq '') { # $cgi = 0;
$_ = `pwd`; # insecure? # if ($query eq '') {
chop; # $_ = `pwd`; # insecure?
s/\r$//; # chop;
$dir = $_; # s/\r$//;
$cgi = 0; # $dir = $_;
} elsif ($query =~ /^(opt\d+|dir|cmd)=/) { # $cgi = 0;
# } elsif ($query =~ /^(opt\d+|dir|cmd|cookie)=/) {
foreach(split(/\&/, $query)) { foreach(split(/\&/, $query)) {
if (s/^dir=//) { if (s/^dir=//) {
$dir = &form_decode($_); $dir = &form_decode($_);
@@ -46,20 +48,31 @@ if ($query eq '') {
$OPT[$1] = $_; $OPT[$1] = $_;
} elsif (s/^cmd=//) { } elsif (s/^cmd=//) {
$cmd = $_; $cmd = $_;
} elsif (s/^cookie=//) {
$cookie = &form_decode($_);
} }
} }
$cgi = 1; if (($cookie eq "") || ($cookie ne $ENV{"LOCAL_COOKIE"})) {
} else { print <<EOF;
$dir = $query; Content-Type: text/plain
if (($dir !~ m@^/@) &&
($WIN32 && $dir !~ /^[a-z]:/i)) { Local cookie doesn't match: It may be an illegal execution
$_ = `pwd`; # insecure? EOF
chop; exit(1);
s/\r$//;
$dir = "$_/$dir";
} }
$cgi = -1; $cookie = &html_quote($cookie);
} $cgi = 1;
# } else {
# $dir = $query;
# if (($dir !~ m@^/@) &&
# ($WIN32 && $dir !~ /^[a-z]:/i)) {
# $_ = `pwd`; # insecure?
# chop;
# s/\r$//;
# $dir = "$_/$dir";
# }
# $cgi = -1;
# }
if ($dir !~ m@/$@) { if ($dir !~ m@/$@) {
$dir .= '/'; $dir .= '/';
} }
@@ -117,7 +130,7 @@ Content-Type: text/html
<body> <body>
<h1>Directory list of $qdir</h1> <h1>Directory list of $qdir</h1>
EOF EOF
&print_form($edir, @OPT); &print_form($qdir, @OPT);
print <<EOF; print <<EOF;
<hr> <hr>
EOF EOF
@@ -420,6 +433,7 @@ EOF
</table> </table>
</center> </center>
<input type=hidden name=dir value="$d"> <input type=hidden name=dir value="$d">
<input type=hidden name=cookie value="$cookie">
</form> </form>
EOF EOF
} }
scripts/multipart/multipart.cgi.in
+13 -1
View File
@@ -28,11 +28,21 @@ if (defined($query)) {
} }
$file = &form_decode($v{'file'}); $file = &form_decode($v{'file'});
$boundary = &form_decode($v{'boundary'}); $boundary = &form_decode($v{'boundary'});
$cookie = &form_decode($v{'cookie'});
if (($cookie eq "") || ($cookie ne $ENV{"LOCAL_COOKIE"})) {
print <<EOF;
Content-Type: text/plain
Local cookie doesn't match: It may be an illegal execution
EOF
exit(1);
}
} else { } else {
$file = $ARGV[0]; $file = $ARGV[0];
if (@ARGV >= 2) { if (@ARGV >= 2) {
$boundary = $ARGV[1]; $boundary = $ARGV[1];
} }
$cookie = $ENV{'LOCAL_COOKIE'};
} }
open(F, "< $file"); open(F, "< $file");
@@ -121,6 +131,7 @@ if (defined($v{'count'})) {
$qcgi = &html_quote($CGI); $qcgi = &html_quote($CGI);
$qfile = &html_quote($file); $qfile = &html_quote($file);
$qboundary = &html_quote($boundary); $qboundary = &html_quote($boundary);
$qcookie = &html_quote($cookie);
if ($mbody =~ /\S/) { if ($mbody =~ /\S/) {
$_ = $mbody; $_ = $mbody;
@@ -195,9 +206,10 @@ while(! $end) {
print "<form method=POST action=\"$qcgi?$count\">\n"; print "<form method=POST action=\"$qcgi?$count\">\n";
print "<input type=hidden name=file value=\"$qfile\">\n"; print "<input type=hidden name=file value=\"$qfile\">\n";
print "<input type=hidden name=boundary value=\"$qboundary\">\n"; print "<input type=hidden name=boundary value=\"$qboundary\">\n";
print "<input type=hidden name=cookie value=\"$qcookie\">\n";
print "<input type=hidden name=count value=\"$count\">\n"; print "<input type=hidden name=count value=\"$count\">\n";
if ($image) { if ($image) {
print "<input type=image name=submit src=\"$CGI?file=$qfile&amp;boundary=$qboundary&amp;count=$count\" alt=\"", print "<input type=image name=submit src=\"$CGI?file=$qfile&amp;boundary=$qboundary&amp;cookie=$qcookie&amp;count=$count\" alt=\"",
&html_quote($name), "\">\n"; &html_quote($name), "\">\n";
} else { } else {
print "<input type=submit name=submit value=\"", print "<input type=submit name=submit value=\"",
scripts/w3mhelp.cgi.in
+16 -2
View File
@@ -1,5 +1,5 @@
#!@PERL@ #!@PERL@
# $Id: w3mhelp.cgi.in,v 1.16 2002/11/21 16:15:59 ukai Exp $ # $Id: w3mhelp.cgi.in,v 1.17 2002/11/26 18:03:30 ukai Exp $
if ( $^O =~ /^(ms)?(dos|win(32|nt)?)/i ) { if ( $^O =~ /^(ms)?(dos|win(32|nt)?)/i ) {
$CYGPATH = 1; $CYGPATH = 1;
@@ -49,6 +49,18 @@ if (defined($ENV{'QUERY_STRING'})) {
$lang = $tlang; $lang = $tlang;
} }
} }
if ($ENV{'QUERY_STRING'} =~ /(^|&)cookie=([^&]*)/) {
$cookie = $2;
$cookie =~ s/\+|%([0-9A-Fa-f][0-9A-Fa-f])/$& eq '+' ? ' ' : pack('C', hex($1))/ge;
}
}
if (($cookie eq "") || ($cookie ne $ENV{"LOCAL_COOKIE"})) {
print <<EOF;
Content-Type: text/plain
Local cookie doesn't match: It may be an illegal execution
EOF
exit(1);
} }
%f = %keyfunc; %f = %keyfunc;
@@ -103,7 +115,9 @@ HEADING
$q_version = $version; $q_version = $version;
$q_version =~ s/[^A-Za-z0-9_\$\.\-]/sprintf('%%%02X', ord($&))/ge; $q_version =~ s/[^A-Za-z0-9_\$\.\-]/sprintf('%%%02X', ord($&))/ge;
$script = "<A HREF=\"$ENV{'SCRIPT_NAME'}?version=$q_version&amp;lang="; $q_cookie = $cookie;
$q_cookie =~ s/[^A-Za-z0-9_\$\.\-]/sprintf('%%%02X', ord($&))/ge;
$script = "<A HREF=\"$ENV{'SCRIPT_NAME'}?cookie=$q_cookie&version=$q_version&amp;lang=";
# doc:en_English doc-jp:ja_Japanese # doc:en_English doc-jp:ja_Japanese
for $otherlang (@docdirs) { for $otherlang (@docdirs) {
w3mbookmark.c
+13 -13
View File
@@ -1,4 +1,4 @@
/* $Id: w3mbookmark.c,v 1.6 2002/11/12 12:41:58 ukai Exp $ */ /* $Id: w3mbookmark.c,v 1.7 2002/11/26 18:03:29 ukai Exp $ */
#ifdef __EMX__ #ifdef __EMX__
#include <stdlib.h> #include <stdlib.h>
#endif #endif
@@ -190,6 +190,17 @@ main(int argc, char *argv[], char **envp)
} }
cgiarg = cgistr2tagarg(qs); cgiarg = cgistr2tagarg(qs);
Local_cookie = getenv("LOCAL_COOKIE");
sent_cookie = tag_get_value(cgiarg, "cookie");
if (sent_cookie == NULL || Local_cookie == NULL ||
strcmp(sent_cookie, Local_cookie) != 0) {
/* local cookie doesn't match: It may be an illegal invocation */
printf("Content-Type: text/plain\n");
printf("\nLocal cookie doesn't match: It may be an illegal invocation\n");
exit(1);
}
mode = tag_get_value(cgiarg, "mode"); mode = tag_get_value(cgiarg, "mode");
bmark = expandPath(tag_get_value(cgiarg, "bmark")); bmark = expandPath(tag_get_value(cgiarg, "bmark"));
url = tag_get_value(cgiarg, "url"); url = tag_get_value(cgiarg, "url");
@@ -200,12 +211,6 @@ main(int argc, char *argv[], char **envp)
printf("Incomplete Request: QUERY_STRING=%s\n", qs); printf("Incomplete Request: QUERY_STRING=%s\n", qs);
exit(1); exit(1);
} }
Local_cookie = getenv("LOCAL_COOKIE");
sent_cookie = tag_get_value(cgiarg, "cookie");
if (Local_cookie == NULL) {
/* Local cookie not provided: maybe illegal invocation */
Local_cookie = "";
}
if (mode && !strcmp(mode, "panel")) { if (mode && !strcmp(mode, "panel")) {
if (title == NULL) if (title == NULL)
title = ""; title = "";
@@ -213,12 +218,7 @@ main(int argc, char *argv[], char **envp)
} }
else if (mode && !strcmp(mode, "register")) { else if (mode && !strcmp(mode, "register")) {
printf("Content-Type: text/plain\n"); printf("Content-Type: text/plain\n");
if (sent_cookie == NULL || Local_cookie[0] == '\0' || if (insert_bookmark(bmark, cgiarg)) {
strcmp(sent_cookie, Local_cookie) != 0) {
/* local cookie doesn't match: It may be an illegal invocation */
printf("\nBookmark not added: local cookie doesn't match\n");
}
else if (insert_bookmark(bmark, cgiarg)) {
printf("w3m-control: BACK\n"); printf("w3m-control: BACK\n");
printf("w3m-control: BACK\n\n"); printf("w3m-control: BACK\n\n");
} }
w3mhelperpanel.c
+10 -10
View File
@@ -1,4 +1,4 @@
/* $Id: w3mhelperpanel.c,v 1.9 2002/11/12 12:41:58 ukai Exp $ */ /* $Id: w3mhelperpanel.c,v 1.10 2002/11/26 18:03:29 ukai Exp $ */
#include <errno.h> #include <errno.h>
#include <stdlib.h> #include <stdlib.h>
#include <stdio.h> #include <stdio.h>
@@ -168,11 +168,18 @@ main(int argc, char *argv[], char **envp)
exit(1); exit(1);
cgiarg = cgistr2tagarg(qs); cgiarg = cgistr2tagarg(qs);
mode = tag_get_value(cgiarg, "mode");
local_cookie = getenv("LOCAL_COOKIE"); local_cookie = getenv("LOCAL_COOKIE");
sent_cookie = tag_get_value(cgiarg, "cookie");
if (local_cookie == NULL || sent_cookie == NULL ||
strcmp(local_cookie, sent_cookie) != 0) {
/* Local cookie doesn't match */
bye("Local cookie doesn't match: It may be an illegal execution", "");
}
mode = tag_get_value(cgiarg, "mode");
mailcapfile = Strnew_charp(expandPath(RC_DIR)); mailcapfile = Strnew_charp(expandPath(RC_DIR));
Strcat_charp(mailcapfile, "/mailcap"); Strcat_charp(mailcapfile, "/mailcap");
if (mode && !strcmp(mode, "edit")) { if (mode && !strcmp(mode, "edit")) {
char *referer; char *referer;
/* check if I can edit my mailcap */ /* check if I can edit my mailcap */
@@ -183,13 +190,6 @@ main(int argc, char *argv[], char **envp)
bye("It may be an illegal execution\n referer=", referer); bye("It may be an illegal execution\n referer=", referer);
} }
} }
sent_cookie = tag_get_value(cgiarg, "cookie");
if (local_cookie == NULL || sent_cookie == NULL ||
strcmp(local_cookie, sent_cookie) != 0) {
/* Local cookie doesn't match */
bye("Local cookie doesn't match: It may be an illegal execution",
"");
}
/* edit mailcap */ /* edit mailcap */
editMailcap(mailcapfile->ptr, cgiarg); editMailcap(mailcapfile->ptr, cgiarg);
} }