Fossil SCM

Show the complete CGI environment in the error log on a 418 hack attempt error.

drh 2023-08-31 12:20 trunk
Commit 0204f4aab5acb39bac06a24e2b50d6a7ca938a657652f551e2393ece46f7b25d
Parent 2afff83e7eb608f…
5 files changed +1 -1 +21 -9 +2 -2 +19 -7 +2 -2
~ src/alerts.c ~ src/cgi.c ~ src/main.c ~ src/printf.c ~ src/style.c
M src/alerts.c
+1 -1
--- src/alerts.c
+++ src/alerts.c
@@ -3475,11 +3475,11 @@
34753475
 style_set_current_feature("alerts");
34763476
 if( fossil_strcmp(P("name"),"test1")==0 ){
34773477
 /* Visit the /announce/test1 page to see the CGI variables */
34783478
 zAction = "announce/test1";
34793479
 @ <p style='border: 1px solid black; padding: 1ex;'>
3480
- cgi_print_all(0, 0);
3480
+ cgi_print_all(0, 0, 0);
34813481
 @ </p>
34823482
 }else if( P("submit")!=0 && cgi_csrf_safe(1) ){
34833483
 char *zErr = alert_send_announcement();
34843484
 style_header("Announcement Sent");
34853485
 if( zErr ){
34863486
--- src/alerts.c
+++ src/alerts.c
@@ -3475,11 +3475,11 @@
3475 style_set_current_feature("alerts");
3476 if( fossil_strcmp(P("name"),"test1")==0 ){
3477 /* Visit the /announce/test1 page to see the CGI variables */
3478 zAction = "announce/test1";
3479 @ <p style='border: 1px solid black; padding: 1ex;'>
3480 cgi_print_all(0, 0);
3481 @ </p>
3482 }else if( P("submit")!=0 && cgi_csrf_safe(1) ){
3483 char *zErr = alert_send_announcement();
3484 style_header("Announcement Sent");
3485 if( zErr ){
3486
--- src/alerts.c
+++ src/alerts.c
@@ -3475,11 +3475,11 @@
3475 style_set_current_feature("alerts");
3476 if( fossil_strcmp(P("name"),"test1")==0 ){
3477 /* Visit the /announce/test1 page to see the CGI variables */
3478 zAction = "announce/test1";
3479 @ <p style='border: 1px solid black; padding: 1ex;'>
3480 cgi_print_all(0, 0, 0);
3481 @ </p>
3482 }else if( P("submit")!=0 && cgi_csrf_safe(1) ){
3483 char *zErr = alert_send_announcement();
3484 style_header("Announcement Sent");
3485 if( zErr ){
3486
M src/cgi.c
+21 -9
--- src/cgi.c
+++ src/cgi.c
@@ -1549,11 +1549,11 @@
15491549
 @ contact the Fossil developers on the Fossil-SCM Forum. Type
15501550
 @ "fossil-scm forum" into any search engine to locate the Fossil-SCM Forum.
15511551
 style_finish_page();
15521552
 cgi_set_status(418,"I'm a teapot");
15531553
 cgi_reply();
1554
- fossil_errorlog("possible hack attempt - 418 response on \"%s\"", zName);
1554
+ fossil_errorlog("Xpossible hack attempt - 418 response on \"%s\"", zName);
15551555
 exit(0);
15561556
 }
15571557
15581558
 /*
15591559
 ** If looks_like_sql_injection() returns true for the given string, calls
@@ -1759,33 +1759,45 @@
17591759
 ** Omit the values of the cookies unless showAll is true.
17601760
 **
17611761
 ** The eDest parameter determines where the output is shown:
17621762
 **
17631763
 ** eDest==0: Rendering as HTML into the CGI reply
1764
-** eDest==1: Written to stderr
1764
+** eDest==1: Written to fossil_trace
17651765
 ** eDest==2: Written to cgi_debug
1766
+** eDest==3: Written to out (Used only by fossil_errorlog())
17661767
 */
1767
-void cgi_print_all(int showAll, unsigned int eDest){
1768
+void cgi_print_all(int showAll, unsigned int eDest, FILE *out){
17681769
 int i;
17691770
 cgi_parameter("",""); /* Force the parameters into sorted order */
17701771
 for(i=0; i<nUsedQP; i++){
17711772
 const char *zName = aParamQP[i].zName;
1772
- if( !showAll ){
1773
- if( fossil_stricmp("HTTP_COOKIE",zName)==0 ) continue;
1774
- if( fossil_strnicmp("fossil-",zName,7)==0 ) continue;
1773
+ const char *zValue = aParamQP[i].zValue;
1774
+ if( fossil_stricmp("HTTP_COOKIE",zName)==0
1775
+ || fossil_strnicmp("fossil-",zName,7)==0
1776
+ ){
1777
+ if( !showAll ) continue;
1778
+ if( eDest==3 ) zValue = "...";
17751779
 }
17761780
 switch( eDest ){
17771781
 case 0: {
1778
- cgi_printf("%h = %h <br>\n", zName, aParamQP[i].zValue);
1782
+ cgi_printf("%h = %h <br>\n", zName, zValue);
17791783
 break;
17801784
 }
17811785
 case 1: {
1782
- fossil_trace("%s = %s\n", zName, aParamQP[i].zValue);
1786
+ fossil_trace("%s = %s\n", zName, zValue);
17831787
 break;
17841788
 }
17851789
 case 2: {
1786
- cgi_debug("%s = %s\n", zName, aParamQP[i].zValue);
1790
+ cgi_debug("%s = %s\n", zName, zValue);
1791
+ break;
1792
+ }
1793
+ case 3: {
1794
+ if( strlen(zValue)>100 ){
1795
+ fprintf(out,"%s = %.100s...\n", zName, zValue);
1796
+ }else{
1797
+ fprintf(out,"%s = %s\n", zName, zValue);
1798
+ }
17871799
 break;
17881800
 }
17891801
 }
17901802
 }
17911803
 }
17921804
--- src/cgi.c
+++ src/cgi.c
@@ -1549,11 +1549,11 @@
1549 @ contact the Fossil developers on the Fossil-SCM Forum. Type
1550 @ "fossil-scm forum" into any search engine to locate the Fossil-SCM Forum.
1551 style_finish_page();
1552 cgi_set_status(418,"I'm a teapot");
1553 cgi_reply();
1554 fossil_errorlog("possible hack attempt - 418 response on \"%s\"", zName);
1555 exit(0);
1556 }
1557
1558 /*
1559 ** If looks_like_sql_injection() returns true for the given string, calls
@@ -1759,33 +1759,45 @@
1759 ** Omit the values of the cookies unless showAll is true.
1760 **
1761 ** The eDest parameter determines where the output is shown:
1762 **
1763 ** eDest==0: Rendering as HTML into the CGI reply
1764 ** eDest==1: Written to stderr
1765 ** eDest==2: Written to cgi_debug
 
1766 */
1767 void cgi_print_all(int showAll, unsigned int eDest){
1768 int i;
1769 cgi_parameter("",""); /* Force the parameters into sorted order */
1770 for(i=0; i<nUsedQP; i++){
1771 const char *zName = aParamQP[i].zName;
1772 if( !showAll ){
1773 if( fossil_stricmp("HTTP_COOKIE",zName)==0 ) continue;
1774 if( fossil_strnicmp("fossil-",zName,7)==0 ) continue;
 
 
 
1775 }
1776 switch( eDest ){
1777 case 0: {
1778 cgi_printf("%h = %h <br>\n", zName, aParamQP[i].zValue);
1779 break;
1780 }
1781 case 1: {
1782 fossil_trace("%s = %s\n", zName, aParamQP[i].zValue);
1783 break;
1784 }
1785 case 2: {
1786 cgi_debug("%s = %s\n", zName, aParamQP[i].zValue);
 
 
 
 
 
 
 
 
1787 break;
1788 }
1789 }
1790 }
1791 }
1792
--- src/cgi.c
+++ src/cgi.c
@@ -1549,11 +1549,11 @@
1549 @ contact the Fossil developers on the Fossil-SCM Forum. Type
1550 @ "fossil-scm forum" into any search engine to locate the Fossil-SCM Forum.
1551 style_finish_page();
1552 cgi_set_status(418,"I'm a teapot");
1553 cgi_reply();
1554 fossil_errorlog("Xpossible hack attempt - 418 response on \"%s\"", zName);
1555 exit(0);
1556 }
1557
1558 /*
1559 ** If looks_like_sql_injection() returns true for the given string, calls
@@ -1759,33 +1759,45 @@
1759 ** Omit the values of the cookies unless showAll is true.
1760 **
1761 ** The eDest parameter determines where the output is shown:
1762 **
1763 ** eDest==0: Rendering as HTML into the CGI reply
1764 ** eDest==1: Written to fossil_trace
1765 ** eDest==2: Written to cgi_debug
1766 ** eDest==3: Written to out (Used only by fossil_errorlog())
1767 */
1768 void cgi_print_all(int showAll, unsigned int eDest, FILE *out){
1769 int i;
1770 cgi_parameter("",""); /* Force the parameters into sorted order */
1771 for(i=0; i<nUsedQP; i++){
1772 const char *zName = aParamQP[i].zName;
1773 const char *zValue = aParamQP[i].zValue;
1774 if( fossil_stricmp("HTTP_COOKIE",zName)==0
1775 || fossil_strnicmp("fossil-",zName,7)==0
1776 ){
1777 if( !showAll ) continue;
1778 if( eDest==3 ) zValue = "...";
1779 }
1780 switch( eDest ){
1781 case 0: {
1782 cgi_printf("%h = %h <br>\n", zName, zValue);
1783 break;
1784 }
1785 case 1: {
1786 fossil_trace("%s = %s\n", zName, zValue);
1787 break;
1788 }
1789 case 2: {
1790 cgi_debug("%s = %s\n", zName, zValue);
1791 break;
1792 }
1793 case 3: {
1794 if( strlen(zValue)>100 ){
1795 fprintf(out,"%s = %.100s...\n", zName, zValue);
1796 }else{
1797 fprintf(out,"%s = %s\n", zName, zValue);
1798 }
1799 break;
1800 }
1801 }
1802 }
1803 }
1804
M src/main.c
+2 -2
--- src/main.c
+++ src/main.c
@@ -2100,11 +2100,11 @@
21002100
 db_protect(PROTECT_READONLY);
21012101
 }
21022102
 }
21032103
 if( g.fCgiTrace ){
21042104
 fossil_trace("######## Calling %s #########\n", pCmd->zName);
2105
- cgi_print_all(1, 1);
2105
+ cgi_print_all(1, 1, 0);
21062106
 }
21072107
 #ifdef FOSSIL_ENABLE_TH1_HOOKS
21082108
 {
21092109
 /*
21102110
 ** The TH1 return codes from the hook will be handled as follows:
@@ -2565,11 +2565,11 @@
25652565
 cgi_load_environment();
25662566
 g.fDebug = fossil_fopen(blob_str(&value), "ab");
25672567
 blob_reset(&value);
25682568
 cgi_debug("-------- BEGIN cgi at %s --------\n", zNow);
25692569
 fossil_free(zNow);
2570
- cgi_print_all(1,2);
2570
+ cgi_print_all(1,2,0);
25712571
 continue;
25722572
 }
25732573
 }
25742574
 blob_reset(&config);
25752575
 if( g.db==0 && g.zRepositoryName==0 && nRedirect==0 ){
25762576
--- src/main.c
+++ src/main.c
@@ -2100,11 +2100,11 @@
2100 db_protect(PROTECT_READONLY);
2101 }
2102 }
2103 if( g.fCgiTrace ){
2104 fossil_trace("######## Calling %s #########\n", pCmd->zName);
2105 cgi_print_all(1, 1);
2106 }
2107 #ifdef FOSSIL_ENABLE_TH1_HOOKS
2108 {
2109 /*
2110 ** The TH1 return codes from the hook will be handled as follows:
@@ -2565,11 +2565,11 @@
2565 cgi_load_environment();
2566 g.fDebug = fossil_fopen(blob_str(&value), "ab");
2567 blob_reset(&value);
2568 cgi_debug("-------- BEGIN cgi at %s --------\n", zNow);
2569 fossil_free(zNow);
2570 cgi_print_all(1,2);
2571 continue;
2572 }
2573 }
2574 blob_reset(&config);
2575 if( g.db==0 && g.zRepositoryName==0 && nRedirect==0 ){
2576
--- src/main.c
+++ src/main.c
@@ -2100,11 +2100,11 @@
2100 db_protect(PROTECT_READONLY);
2101 }
2102 }
2103 if( g.fCgiTrace ){
2104 fossil_trace("######## Calling %s #########\n", pCmd->zName);
2105 cgi_print_all(1, 1, 0);
2106 }
2107 #ifdef FOSSIL_ENABLE_TH1_HOOKS
2108 {
2109 /*
2110 ** The TH1 return codes from the hook will be handled as follows:
@@ -2565,11 +2565,11 @@
2565 cgi_load_environment();
2566 g.fDebug = fossil_fopen(blob_str(&value), "ab");
2567 blob_reset(&value);
2568 cgi_debug("-------- BEGIN cgi at %s --------\n", zNow);
2569 fossil_free(zNow);
2570 cgi_print_all(1,2,0);
2571 continue;
2572 }
2573 }
2574 blob_reset(&config);
2575 if( g.db==0 && g.zRepositoryName==0 && nRedirect==0 ){
2576
M src/printf.c
+19 -7
--- src/printf.c
+++ src/printf.c
@@ -1037,17 +1037,21 @@
10371037
 }
10381038
10391039
 /*
10401040
 ** Write a message to the error log, if the error log filename is
10411041
 ** defined.
1042
+**
1043
+** If the message format begins with 'X', then omit that X from the
1044
+** beginning of the message and add much more CGI context.
10421045
 */
10431046
 void fossil_errorlog(const char *zFormat, ...){
10441047
 struct tm *pNow;
10451048
 time_t now;
10461049
 FILE *out;
10471050
 const char *z;
10481051
 int i;
1052
+ int bDetail = 0;
10491053
 va_list ap;
10501054
 static const char *const azEnv[] = { "HTTP_HOST", "HTTP_REFERER",
10511055
 "HTTP_USER_AGENT",
10521056
 "PATH_INFO", "QUERY_STRING", "REMOTE_ADDR", "REQUEST_METHOD",
10531057
 "REQUEST_URI", "SCRIPT_NAME" };
@@ -1062,20 +1066,28 @@
10621066
 pNow = gmtime(&now);
10631067
 fprintf(out, "------------- %04d-%02d-%02d %02d:%02d:%02d UTC ------------\n",
10641068
 pNow->tm_year+1900, pNow->tm_mon+1, pNow->tm_mday,
10651069
 pNow->tm_hour, pNow->tm_min, pNow->tm_sec);
10661070
 va_start(ap, zFormat);
1071
+ if( zFormat[0]=='X' ){
1072
+ bDetail = 1;
1073
+ zFormat++;
1074
+ }
10671075
 vfprintf(out, zFormat, ap);
10681076
 fprintf(out, "\n");
10691077
 va_end(ap);
1070
- for(i=0; i<count(azEnv); i++){
1071
- char *p;
1072
- if( (p = fossil_getenv(azEnv[i]))!=0 && p[0]!=0 ){
1073
- fprintf(out, "%s=%s\n", azEnv[i], p);
1074
- fossil_path_free(p);
1075
- }else if( (z = P(azEnv[i]))!=0 && z[0]!=0 ){
1076
- fprintf(out, "%s=%s\n", azEnv[i], z);
1078
+ if( bDetail ){
1079
+ cgi_print_all(1,3,out);
1080
+ }else{
1081
+ for(i=0; i<count(azEnv); i++){
1082
+ char *p;
1083
+ if( (p = fossil_getenv(azEnv[i]))!=0 && p[0]!=0 ){
1084
+ fprintf(out, "%s=%s\n", azEnv[i], p);
1085
+ fossil_path_free(p);
1086
+ }else if( (z = P(azEnv[i]))!=0 && z[0]!=0 ){
1087
+ fprintf(out, "%s=%s\n", azEnv[i], z);
1088
+ }
10771089
 }
10781090
 }
10791091
 fclose(out);
10801092
 }
10811093
10821094
--- src/printf.c
+++ src/printf.c
@@ -1037,17 +1037,21 @@
1037 }
1038
1039 /*
1040 ** Write a message to the error log, if the error log filename is
1041 ** defined.
 
 
 
1042 */
1043 void fossil_errorlog(const char *zFormat, ...){
1044 struct tm *pNow;
1045 time_t now;
1046 FILE *out;
1047 const char *z;
1048 int i;
 
1049 va_list ap;
1050 static const char *const azEnv[] = { "HTTP_HOST", "HTTP_REFERER",
1051 "HTTP_USER_AGENT",
1052 "PATH_INFO", "QUERY_STRING", "REMOTE_ADDR", "REQUEST_METHOD",
1053 "REQUEST_URI", "SCRIPT_NAME" };
@@ -1062,20 +1066,28 @@
1062 pNow = gmtime(&now);
1063 fprintf(out, "------------- %04d-%02d-%02d %02d:%02d:%02d UTC ------------\n",
1064 pNow->tm_year+1900, pNow->tm_mon+1, pNow->tm_mday,
1065 pNow->tm_hour, pNow->tm_min, pNow->tm_sec);
1066 va_start(ap, zFormat);
 
 
 
 
1067 vfprintf(out, zFormat, ap);
1068 fprintf(out, "\n");
1069 va_end(ap);
1070 for(i=0; i<count(azEnv); i++){
1071 char *p;
1072 if( (p = fossil_getenv(azEnv[i]))!=0 && p[0]!=0 ){
1073 fprintf(out, "%s=%s\n", azEnv[i], p);
1074 fossil_path_free(p);
1075 }else if( (z = P(azEnv[i]))!=0 && z[0]!=0 ){
1076 fprintf(out, "%s=%s\n", azEnv[i], z);
 
 
 
 
1077 }
1078 }
1079 fclose(out);
1080 }
1081
1082
--- src/printf.c
+++ src/printf.c
@@ -1037,17 +1037,21 @@
1037 }
1038
1039 /*
1040 ** Write a message to the error log, if the error log filename is
1041 ** defined.
1042 **
1043 ** If the message format begins with 'X', then omit that X from the
1044 ** beginning of the message and add much more CGI context.
1045 */
1046 void fossil_errorlog(const char *zFormat, ...){
1047 struct tm *pNow;
1048 time_t now;
1049 FILE *out;
1050 const char *z;
1051 int i;
1052 int bDetail = 0;
1053 va_list ap;
1054 static const char *const azEnv[] = { "HTTP_HOST", "HTTP_REFERER",
1055 "HTTP_USER_AGENT",
1056 "PATH_INFO", "QUERY_STRING", "REMOTE_ADDR", "REQUEST_METHOD",
1057 "REQUEST_URI", "SCRIPT_NAME" };
@@ -1062,20 +1066,28 @@
1066 pNow = gmtime(&now);
1067 fprintf(out, "------------- %04d-%02d-%02d %02d:%02d:%02d UTC ------------\n",
1068 pNow->tm_year+1900, pNow->tm_mon+1, pNow->tm_mday,
1069 pNow->tm_hour, pNow->tm_min, pNow->tm_sec);
1070 va_start(ap, zFormat);
1071 if( zFormat[0]=='X' ){
1072 bDetail = 1;
1073 zFormat++;
1074 }
1075 vfprintf(out, zFormat, ap);
1076 fprintf(out, "\n");
1077 va_end(ap);
1078 if( bDetail ){
1079 cgi_print_all(1,3,out);
1080 }else{
1081 for(i=0; i<count(azEnv); i++){
1082 char *p;
1083 if( (p = fossil_getenv(azEnv[i]))!=0 && p[0]!=0 ){
1084 fprintf(out, "%s=%s\n", azEnv[i], p);
1085 fossil_path_free(p);
1086 }else if( (z = P(azEnv[i]))!=0 && z[0]!=0 ){
1087 fprintf(out, "%s=%s\n", azEnv[i], z);
1088 }
1089 }
1090 }
1091 fclose(out);
1092 }
1093
1094
M src/style.c
+2 -2
--- src/style.c
+++ src/style.c
@@ -834,11 +834,11 @@
834834
 g.cgiOutput = 1;
835835
 headerHasBeenGenerated = 1;
836836
 sideboxUsed = 0;
837837
 if( g.perm.Debug && P("showqp") ){
838838
 @ <div class="debug">
839
- cgi_print_all(0, 0);
839
+ cgi_print_all(0, 0, 0);
840840
 @ </div>
841841
 }
842842
 }
843843
844844
 #if INTERFACE
@@ -1474,11 +1474,11 @@
14741474
 }
14751475
 }
14761476
 @ <hr>
14771477
 P("HTTP_USER_AGENT");
14781478
 P("SERVER_SOFTWARE");
1479
- cgi_print_all(showAll, 0);
1479
+ cgi_print_all(showAll, 0, 0);
14801480
 if( showAll && blob_size(&g.httpHeader)>0 ){
14811481
 @ <hr>
14821482
 @ <pre>
14831483
 @ %h(blob_str(&g.httpHeader))
14841484
 @ </pre>
14851485
--- src/style.c
+++ src/style.c
@@ -834,11 +834,11 @@
834 g.cgiOutput = 1;
835 headerHasBeenGenerated = 1;
836 sideboxUsed = 0;
837 if( g.perm.Debug && P("showqp") ){
838 @ <div class="debug">
839 cgi_print_all(0, 0);
840 @ </div>
841 }
842 }
843
844 #if INTERFACE
@@ -1474,11 +1474,11 @@
1474 }
1475 }
1476 @ <hr>
1477 P("HTTP_USER_AGENT");
1478 P("SERVER_SOFTWARE");
1479 cgi_print_all(showAll, 0);
1480 if( showAll && blob_size(&g.httpHeader)>0 ){
1481 @ <hr>
1482 @ <pre>
1483 @ %h(blob_str(&g.httpHeader))
1484 @ </pre>
1485
--- src/style.c
+++ src/style.c
@@ -834,11 +834,11 @@
834 g.cgiOutput = 1;
835 headerHasBeenGenerated = 1;
836 sideboxUsed = 0;
837 if( g.perm.Debug && P("showqp") ){
838 @ <div class="debug">
839 cgi_print_all(0, 0, 0);
840 @ </div>
841 }
842 }
843
844 #if INTERFACE
@@ -1474,11 +1474,11 @@
1474 }
1475 }
1476 @ <hr>
1477 P("HTTP_USER_AGENT");
1478 P("SERVER_SOFTWARE");
1479 cgi_print_all(showAll, 0, 0);
1480 if( showAll && blob_size(&g.httpHeader)>0 ){
1481 @ <hr>
1482 @ <pre>
1483 @ %h(blob_str(&g.httpHeader))
1484 @ </pre>
1485

Keyboard Shortcuts

Open search /
Next entry (timeline) j
Previous entry (timeline) k
Open focused entry Enter
Show this help ?
Toggle theme Top nav button