From 76cbb205333360ae618c3b8a20faccf747039070 Mon Sep 17 00:00:00 2001 From: Ted Trask Date: Thu, 15 Jan 2009 21:44:39 +0000 Subject: Modified html.lua and viewlibrary.lua and all html files to html_escape variables before displaying them. git-svn-id: svn://svn.alpinelinux.org/acf/core/trunk@1678 ab2d0c66-481e-0410-8bed-d214d4d58bed --- lib/html.lua | 32 +++++++++++++++++--------------- lib/viewfunctions.lua | 33 +++++++++++++++++---------------- 2 files changed, 34 insertions(+), 31 deletions(-) (limited to 'lib') diff --git a/lib/html.lua b/lib/html.lua index 96bf4ad..4dac45f 100644 --- a/lib/html.lua +++ b/lib/html.lua @@ -22,8 +22,8 @@ cookie.set = function ( name, value, path ) if path == nil then path = "/" end - return (string.format('Set-Cookie: %s=%s; path=%s; %s\n', tostring(name), - tostring(value), path, expires)) + return (string.format('Set-Cookie: %s=%s; path=%s; %s\n', html_escape(tostring(name)), + html_escape(tostring(value)), html_escape(path), html_escape(expires))) end @@ -39,7 +39,9 @@ function html_escape (text ) text = text or "" local str = string.gsub (text, "&", "&" ) str = string.gsub (str, "<", "<" ) - return string.gsub (str, ">", ">" ) + str = string.gsub (str, ">", ">" ) + str = string.gsub (str, "'", "'" ) + return string.gsub (str, '"', """ ) end -- return a name,value pair as a string. @@ -55,7 +57,7 @@ local nv_pair = function ( name, value) if ( value == nil ) then return ( "" ) else - return (string.format (' %s="%s" ', name , ( value or "" ) )) + return (string.format (' %s="%s" ', html_escape(name) , html_escape(value) )) end end @@ -87,7 +89,7 @@ local generic_input = function ( field_type, v ) return nil end - local str = string.format ( '" .. (v.value or "" ) .. "" ) + return ( str .. ">" .. html_escape(v.value) .. "" ) end @@ -201,10 +203,10 @@ function form.select ( v ) str = str .. " selected" selected = true end - str = str .. nv_pair("value", val) .. ">" .. k .. "" + str = str .. nv_pair("value", val) .. ">" .. html_escape(val) .. "" end if not selected then - str = str .. '' + str = str .. '' end str = str .. "" return (str) @@ -224,9 +226,9 @@ function form.start ( v) local method = v.method or "get" return ( string.format ( '
', - nv_pair ( "class", v.class ), - nv_pair ( "method", v.method), - nv_pair ( "action", v.action ) + nv_pair ( "class", html_escape(v.class) ), + nv_pair ( "method", html_escape(v.method) ), + nv_pair ( "action", html_escape(v.action) ) ) ) end @@ -240,9 +242,9 @@ end function entity (tag, text, class, id) return ( string.format ( "<%s%s%s>%s", - tag, + html_escape(tag), nv_pair ("class", class), - nv_pair("id", id), text , tag) + nv_pair("id", id), html_escape(text), html_escape(tag)) ) end @@ -256,7 +258,7 @@ function link ( v ) str = str .. nv_pair ( k, v[k] ) end - return ( "" .. (v.label or "" ) .. "" ) + return ( "" .. html_escape(v.label) .. "" ) end @@ -265,7 +267,7 @@ end function cfe_unpack ( a ) if type(a) == "table" then value = session.serialize("cfe", a) - value = "
" .. value .. "
" + value = "
" .. html_escape(value) .. "
" return value end diff --git a/lib/viewfunctions.lua b/lib/viewfunctions.lua index 139b6f6..f1c5436 100644 --- a/lib/viewfunctions.lua +++ b/lib/viewfunctions.lua @@ -1,3 +1,4 @@ +require("html") function displayinfo(myform,tags,viewtype) for k,v in pairs(tags) do @@ -91,11 +92,11 @@ function displayitem(myitem) myitem.class = "error" io.write(" class='error'") end - io.write(">" .. myitem.label .. "\n") + io.write(">" .. html.html_escape(myitem.label) .. "\n") io.write("
") - io.write(string.gsub(tostring(myitem.value), "\n", "
") .. "\n") - if myitem.descr then io.write("

" .. string.gsub(myitem.descr, "\n", "
") .. "

\n") end - if myitem.errtxt then io.write("

" .. string.gsub(myitem.errtxt, "\n", "
") .. "

\n") end + io.write(string.gsub(html.html_escape(tostring(myitem.value)), "\n", "
") .. "\n") + if myitem.descr then io.write("

" .. string.gsub(html.html_escape(myitem.descr), "\n", "
") .. "

\n") end + if myitem.errtxt then io.write("

" .. string.gsub(html.html_escape(myitem.errtxt), "\n", "
") .. "

\n") end io.write("
\n") end @@ -108,7 +109,7 @@ function displayformitem(myitem, name, viewtype) myitem.class = "error" io.write(' class="error"') end - io.write(">" .. myitem.label .. "\n") + io.write(">" .. html.html_escape(myitem.label) .. "\n") io.write("
\n") end if (viewtype == "viewonly") then @@ -131,7 +132,7 @@ function displayformitem(myitem, name, viewtype) myitem.value = val myitem.checked = reverseval[val] myitem.name = tempname .. "." .. x - io.write(html.form.checkbox(myitem) .. val .. "
\n") + io.write(html.form.checkbox(myitem) .. html.html_escape(val) .. "
\n") end -- Check for values not in options if myitem.errtxt then @@ -142,7 +143,7 @@ function displayformitem(myitem, name, viewtype) if not reverseopt[val] then myitem.value = val myitem.checked = true - io.write(html.form.checkbox(myitem) .. val .. "
\n") + io.write(html.form.checkbox(myitem) .. html.html_escape(val) .. "
\n") end end if myitem.errtxt then @@ -161,8 +162,8 @@ function displayformitem(myitem, name, viewtype) io.write((html.form[myitem.type](myitem) or "") .. "\n") end if myitem.type ~= "hidden" then - if myitem.descr then io.write('

' .. string.gsub(myitem.descr, "\n", "
") .. "

\n") end - if myitem.errtxt then io.write('

' .. string.gsub(myitem.errtxt, "\n", "
") .. "

\n") end + if myitem.descr then io.write('

' .. string.gsub(html.html_escape(myitem.descr), "\n", "
") .. "

\n") end + if myitem.errtxt then io.write('

' .. string.gsub(html.html_escape(myitem.errtxt), "\n", "
") .. "

\n") end io.write("
\n") end end @@ -172,9 +173,9 @@ function displayformstart(myform, page_info) if not myform.action and page_info then myform.action = page_info.script .. page_info.prefix .. page_info.controller .. "/" .. page_info.action end - if myform.descr then io.write('

' .. string.gsub(myform.descr, "\n", "
") .. "

\n") end - if myform.errtxt then io.write('

' .. string.gsub(myform.errtxt, "\n", "
") .. "

\n") end - io.write('\n') + if myform.descr then io.write('

' .. string.gsub(html.html_escape(myform.descr), "\n", "
") .. "

\n") end + if myform.errtxt then io.write('

' .. string.gsub(html.html_escape(myform.errtxt), "\n", "
") .. "

\n") end + io.write('\n') if myform.value.redir then displayformitem(myform.value.redir, "redir") end @@ -221,7 +222,7 @@ end function displayformend(myform) if not myform then return end io.write('
\n') - io.write('
\n') + io.write('
\n') io.write('
\n') io.write('
') end @@ -239,9 +240,9 @@ function displaycommandresults(commands, session, preserveerrors) if #cmdresult > 0 then io.write("

Command Result

\n
\n") for i,result in ipairs(cmdresult) do - if type(result.value) == "string" and result.value ~= "" then io.write(result.value:gsub("\n", "
") .. "\n") end - if result.descr then io.write('

' .. string.gsub(result.descr, "\n", "
") .. "

\n") end - if result.errtxt then io.write('

' .. string.gsub(result.errtxt, "\n", "
") .. "

\n") end + if type(result.value) == "string" and result.value ~= "" then io.write(string.gsub(html.html_escape(result.value), "\n", "
") .. "\n") end + if result.descr then io.write('

' .. string.gsub(html.html_escape(result.descr), "\n", "
") .. "

\n") end + if result.errtxt then io.write('

' .. string.gsub(html.html_escape(result.errtxt), "\n", "
") .. "

\n") end end io.write("
\n") end -- cgit v1.2.3