From a89437b3c168e6d5f38b8e577f31ea89f5c9c8d0 Mon Sep 17 00:00:00 2001 From: Ted Trask Date: Thu, 15 Jan 2009 21:44:39 +0000 Subject: Modified html.lua and viewlibrary.lua and all html files to html_escape variables before displaying them. git-svn-id: svn://svn.alpinelinux.org/acf/tinydns/trunk@1678 ab2d0c66-481e-0410-8bed-d214d4d58bed --- tinydns-config-html.lsp | 2 +- tinydns-edit-html.lsp | 18 +++++++++--------- tinydns-html.lsp | 2 +- tinydns-listfiles-html.lsp | 6 +++--- tinydns-listpermissions-html.lsp | 6 +++--- tinydns-status-html.lsp | 4 ++-- tinydns-view-html.lsp | 26 +++++++++++++------------- 7 files changed, 32 insertions(+), 32 deletions(-) diff --git a/tinydns-config-html.lsp b/tinydns-config-html.lsp index 1193b65..9f10a4c 100755 --- a/tinydns-config-html.lsp +++ b/tinydns-config-html.lsp @@ -15,7 +15,7 @@ io.write("") viewlibrary.dispatch_component("status") end %> -

<%= form.label %>

+

<%= html.html_escape(form.label) %>

<% form.action = page_info.script .. page_info.prefix .. page_info.controller .. "/" .. page_info.action displayform(form) diff --git a/tinydns-edit-html.lsp b/tinydns-edit-html.lsp index f8d8dbb..785589a 100644 --- a/tinydns-edit-html.lsp +++ b/tinydns-edit-html.lsp @@ -35,9 +35,9 @@ var entrytext = entry.find("select").val() + entry.find("input:not(.submit)").map(function(){ if (this.name == "fixme") { if ($(this).val() != "") - return $(this).val() + ".<%= domain %>"; + return $(this).val() + ".<%= html.html_escape(domain) %>"; else - return "<%= domain %>"; + return "<%= html.html_escape(domain) %>"; } else { return $(this).val(); } @@ -70,11 +70,11 @@ for (i=0; i' + entryType.descriptions[i] + '
$/i, "") + '" name="fixme"> . <%= domain %>
'; + form = form + '
' + entryType.descriptions[i] + '
$/i, "") + '" name="fixme"> . <%= html.html_escape(domain) %>
'; else form = form + '
' + entryType.descriptions[i] + '
'; } - form = form + '\n
'; + form = form + '\n
'; form = form + "\n"; entry.empty().append(form); entry.find("select").change(function(){ @@ -83,7 +83,7 @@ createForm(entry); }); entry.find("input.submit").click(function() { - $("input[name='<%= form.option %>']").click(); + $("input[name='<%= html.html_escape(form.option) %>']").click(); }); } function editLine(){ @@ -157,8 +157,8 @@ displayitem(form.value.mtime)

File Entries

-<% if form.descr then %>

<%= string.gsub(form.descr, "\n", "
") %>

<% end %> -<% if form.errtxt then %>

<%= string.gsub(form.errtxt, "\n", "
") %>

<% end %> +<% if form.descr then %>

<%= string.gsub(html.html_escape(form.descr), "\n", "
") %>

<% end %> +<% if form.errtxt then %>

<%= string.gsub(html.html_escape(form.errtxt), "\n", "
") %>

<% end %> <% for line in string.gmatch(html.html_escape(form.value.filecontent.value).."\n", "([^\n]*)\n") do %> @@ -166,11 +166,11 @@ displayitem(form.value.mtime) <% end %>
-<% if form.value.filecontent.errtxt then %>

<%= string.gsub(form.value.filecontent.errtxt, "\n", "
") %>

<% end %> +<% if form.value.filecontent.errtxt then %>

<%= string.gsub(html.html_escape(form.value.filecontent.errtxt), "\n", "
") %>

<% end %> <% form.action = page_info.script .. page_info.prefix .. page_info.controller .. "/" .. page_info.action %> <% displayformstart(form) %> - +

Save and Apply Above Settings

<% displayformend(form) %> diff --git a/tinydns-html.lsp b/tinydns-html.lsp index abe7bf1..a135d3b 100644 --- a/tinydns-html.lsp +++ b/tinydns-html.lsp @@ -2,7 +2,7 @@ require("viewfunctions") %> -

<%= form.label %>

+

<%= html.html_escape(form.label) %>

<% form.action = page_info.script .. page_info.prefix .. page_info.controller .. "/" .. page_info.action if form.value.userid then form.value.userid.readonly = true end diff --git a/tinydns-listfiles-html.lsp b/tinydns-listfiles-html.lsp index 4286122..14f8419 100644 --- a/tinydns-listfiles-html.lsp +++ b/tinydns-listfiles-html.lsp @@ -31,9 +31,9 @@ io.write("") if session.permissions[page_info.controller].editfile then io.write(html.link{value = "editfile?filename=" .. file.value.filename.value.."&redir="..page_info.orig_action, label="Expert " }) end %> - <%= file.value.filesize.value %> - <%= file.value.mtime.value %> - <%= string.gsub(file.value.filename.value, "^.*/", "") %> + <%= html.html_escape(file.value.filesize.value) %> + <%= html.html_escape(file.value.mtime.value) %> + <%= html.html_escape(string.gsub(file.value.filename.value, "^.*/", "")) %> <% end %> diff --git a/tinydns-listpermissions-html.lsp b/tinydns-listpermissions-html.lsp index fc80db9..55d09b5 100644 --- a/tinydns-listpermissions-html.lsp +++ b/tinydns-listpermissions-html.lsp @@ -6,7 +6,7 @@ <% displaycommandresults({"edituserpermisisons", "editrolepermissions"}, session) %> -

<%= view.label %>

+

<%= html.html_escape(view.label) %>

User Permissions

@@ -14,7 +14,7 @@ <% for i,user in ipairs(view.value.user) do %> <% end %> @@ -26,7 +26,7 @@ <% for i,role in ipairs(view.value.role) do %> <% end %> diff --git a/tinydns-status-html.lsp b/tinydns-status-html.lsp index 5eafebd..efe77b8 100644 --- a/tinydns-status-html.lsp +++ b/tinydns-status-html.lsp @@ -12,14 +12,14 @@ displayitem(data.value.status) displayitem(data.value.version) if data.value.version and data.value.version.errtxt and session.permissions.apk and session.permissions.apk.install then %> - Install + Install <% end displayitem(data.value.autostart) if not (data.value.version and data.value.version.errtxt) and data.value.autostart and data.value.autostart.errtxt and session.permissions.rc and session.permissions.rc.edit then %> - Schedule autostart + Schedule autostart <% end diff --git a/tinydns-view-html.lsp b/tinydns-view-html.lsp index b163ce5..35052ab 100644 --- a/tinydns-view-html.lsp +++ b/tinydns-view-html.lsp @@ -51,7 +51,7 @@ io.write("") %>

DNS Entries -<% if view.filename then io.write(" for "..string.gsub(view.filename, "^.*/", "")) end %> +<% if view.filename then io.write(" for "..html.html_escape(string.gsub(view.filename, "^.*/", ""))) end %>

Locations

@@ -63,13 +63,13 @@ for i,loc in ipairs(view.value) do if currentloc ~= "" then %> <% end %> -
  • <%= loc[1] %>
    • +
  • <%= html.html_escape(loc[1]) %>
      • <% end currentloc = loc[1] %> -
    • - <%= loc[2] %><% if loc[2] == "" then io.write('*') end %> - <% if (loc.errtxt) then %>

      <%= string.gsub(loc.errtxt, "\n", "
      ") %>

      <% end %> +
    • + <%= html.html_escape(loc[2]) %><% if loc[2] == "" then io.write('*') end %> + <% if (loc.errtxt) then %>

      <%= string.gsub(html.html_escape(loc.errtxt), "\n", "
      ") %>

      <% end %>
      • <% end end %> @@ -102,7 +102,7 @@ local function doListIndents(next, indent) end for j=1,starting do io.write("
      • ") - io.write(table.concat(newentry, ".", #newentry-(i+j-2), #newentry)) + io.write(html.html_escape(table.concat(newentry, ".", #newentry-(i+j-2), #newentry))) io.write("\n") end return revnewentry @@ -117,20 +117,20 @@ end for j,entry in ipairs(view.value) do if entry.type ~= '%' then indent = doListIndents(entry[1], indent) %> -
        • - <%= entry.label %>
          - 
          <%= entry.configline %>
          -
    <%= html.link{value=page_info.script .. page_info.prefix .. page_info.controller .. "/edituserpermissions?userid=" .. user.id .. "&redir="..page_info.orig_action, label=user.id} %> <% for y,allowed in pairs(user.allowed) do - print(allowed, "
    ") + print(html.html_escape(allowed), "
    ") end %>
    <%= html.link{value=page_info.script .. page_info.prefix .. page_info.controller .. "/editrolepermissions?role=" .. role.id .. "&redir="..page_info.orig_action, label=role.id} %> <% for y,allowed in pairs(role.allowed) do - print(allowed, "
    ") + print(html.html_escape(allowed), "
    ") end %>
    +
    <% for k=2,#entry do local option = entry[k] if (option) and option ~= "" then %> - - + + <% end end %>
    <%= view.fieldlabels[entry.type][k] %>:<%= option %>
    <%= html.html_escape(view.fieldlabels[entry.type][k]) %>:<%= html.html_escape(option) %>
    <% if entry.errtxt then %> -

    <%= string.gsub(entry.errtxt, "\n", "
    ") %>

    +

    <%= string.gsub(html.html_escape(entry.errtxt), "\n", "
    ") %>

    <% end %> <% end -- cgit v1.2.3