Fossil SCM

Enhance codecheck1.c to detect cases where style_header() is called with arguments that are not easily proven to be HTML-free. Fix multiple calls to style_header() to prove they are always HTML-free.

drh 2025-03-07 15:56 trunk
Commit 2da41072ffefda46af03195e4098099d0b3860cc8ccc567bbbd024e80a24bf6f
+1 -1
--- src/branch.c
+++ src/branch.c
@@ -944,11 +944,11 @@
944944
}
945945
if( showAll ) brFlags = BRL_BOTH;
946946
if( showClosed ) brFlags = BRL_CLOSED_ONLY;
947947
948948
style_set_current_feature("branch");
949
- style_header("%s", showClosed ? "Closed Branches" :
949
+ style_header("%h", showClosed ? "Closed Branches" :
950950
showAll ? "All Branches" : "Open Branches");
951951
style_submenu_element("Timeline", "brtimeline");
952952
if( showClosed ){
953953
style_submenu_element("All", "brlist?all");
954954
style_submenu_element("Open", "brlist?open");
955955
--- src/branch.c
+++ src/branch.c
@@ -944,11 +944,11 @@
944 }
945 if( showAll ) brFlags = BRL_BOTH;
946 if( showClosed ) brFlags = BRL_CLOSED_ONLY;
947
948 style_set_current_feature("branch");
949 style_header("%s", showClosed ? "Closed Branches" :
950 showAll ? "All Branches" : "Open Branches");
951 style_submenu_element("Timeline", "brtimeline");
952 if( showClosed ){
953 style_submenu_element("All", "brlist?all");
954 style_submenu_element("Open", "brlist?open");
955
--- src/branch.c
+++ src/branch.c
@@ -944,11 +944,11 @@
944 }
945 if( showAll ) brFlags = BRL_BOTH;
946 if( showClosed ) brFlags = BRL_CLOSED_ONLY;
947
948 style_set_current_feature("branch");
949 style_header("%h", showClosed ? "Closed Branches" :
950 showAll ? "All Branches" : "Open Branches");
951 style_submenu_element("Timeline", "brtimeline");
952 if( showClosed ){
953 style_submenu_element("All", "brlist?all");
954 style_submenu_element("Open", "brlist?open");
955
+2 -2
--- src/browse.c
+++ src/browse.c
@@ -232,11 +232,11 @@
232232
zHeader = mprintf("%z matching \"%s\"", zHeader, zRegexp);
233233
zMatch = mprintf(" matching \"%h\"", zRegexp);
234234
}else{
235235
zMatch = "";
236236
}
237
- style_header("%s", zHeader);
237
+ style_header("%h", zHeader);
238238
fossil_free(zHeader);
239239
style_adunit_config(ADUNIT_RIGHT_OK);
240240
sqlite3_create_function(g.db, "pathelement", 2, SQLITE_UTF8, 0,
241241
pathelementFunc, 0, 0);
242242
url_initialize(&sURI, "dir");
@@ -795,11 +795,11 @@
795795
zHeader = mprintf("Files in %s/ of %s", zD, zCI);
796796
}else{
797797
zHeader = mprintf("All Files in %s/", zD);
798798
}
799799
}
800
- style_header("%s", zHeader);
800
+ style_header("%h", zHeader);
801801
fossil_free(zHeader);
802802
803803
/* Compute the title of the page */
804804
blob_zero(&dirname);
805805
if( zD ){
806806
--- src/browse.c
+++ src/browse.c
@@ -232,11 +232,11 @@
232 zHeader = mprintf("%z matching \"%s\"", zHeader, zRegexp);
233 zMatch = mprintf(" matching \"%h\"", zRegexp);
234 }else{
235 zMatch = "";
236 }
237 style_header("%s", zHeader);
238 fossil_free(zHeader);
239 style_adunit_config(ADUNIT_RIGHT_OK);
240 sqlite3_create_function(g.db, "pathelement", 2, SQLITE_UTF8, 0,
241 pathelementFunc, 0, 0);
242 url_initialize(&sURI, "dir");
@@ -795,11 +795,11 @@
795 zHeader = mprintf("Files in %s/ of %s", zD, zCI);
796 }else{
797 zHeader = mprintf("All Files in %s/", zD);
798 }
799 }
800 style_header("%s", zHeader);
801 fossil_free(zHeader);
802
803 /* Compute the title of the page */
804 blob_zero(&dirname);
805 if( zD ){
806
--- src/browse.c
+++ src/browse.c
@@ -232,11 +232,11 @@
232 zHeader = mprintf("%z matching \"%s\"", zHeader, zRegexp);
233 zMatch = mprintf(" matching \"%h\"", zRegexp);
234 }else{
235 zMatch = "";
236 }
237 style_header("%h", zHeader);
238 fossil_free(zHeader);
239 style_adunit_config(ADUNIT_RIGHT_OK);
240 sqlite3_create_function(g.db, "pathelement", 2, SQLITE_UTF8, 0,
241 pathelementFunc, 0, 0);
242 url_initialize(&sURI, "dir");
@@ -795,11 +795,11 @@
795 zHeader = mprintf("Files in %s/ of %s", zD, zCI);
796 }else{
797 zHeader = mprintf("All Files in %s/", zD);
798 }
799 }
800 style_header("%h", zHeader);
801 fossil_free(zHeader);
802
803 /* Compute the title of the page */
804 blob_zero(&dirname);
805 if( zD ){
806
+1 -1
--- src/dispatch.c
+++ src/dispatch.c
@@ -838,11 +838,11 @@
838838
if( zCmd && *zCmd ){
839839
int rc;
840840
const CmdOrPage *pCmd = 0;
841841
842842
style_set_current_feature("tkt");
843
- style_header("Help: %s", zCmd);
843
+ style_header("Help: %h", zCmd);
844844
845845
style_submenu_element("Command-List", "%R/help");
846846
if( search_restrict(SRCH_HELP)!=0 ){
847847
style_submenu_element("Search","%R/search?y=h");
848848
}
849849
--- src/dispatch.c
+++ src/dispatch.c
@@ -838,11 +838,11 @@
838 if( zCmd && *zCmd ){
839 int rc;
840 const CmdOrPage *pCmd = 0;
841
842 style_set_current_feature("tkt");
843 style_header("Help: %s", zCmd);
844
845 style_submenu_element("Command-List", "%R/help");
846 if( search_restrict(SRCH_HELP)!=0 ){
847 style_submenu_element("Search","%R/search?y=h");
848 }
849
--- src/dispatch.c
+++ src/dispatch.c
@@ -838,11 +838,11 @@
838 if( zCmd && *zCmd ){
839 int rc;
840 const CmdOrPage *pCmd = 0;
841
842 style_set_current_feature("tkt");
843 style_header("Help: %h", zCmd);
844
845 style_submenu_element("Command-List", "%R/help");
846 if( search_restrict(SRCH_HELP)!=0 ){
847 style_submenu_element("Search","%R/search?y=h");
848 }
849
+8 -8
--- src/doc.c
+++ src/doc.c
@@ -791,14 +791,14 @@
791791
blob_init(&title,0,0);
792792
if( fossil_strcmp(zMime, "text/x-fossil-wiki")==0 ){
793793
Blob tail = BLOB_INITIALIZER;
794794
style_adunit_config(ADUNIT_RIGHT_OK);
795795
if( wiki_find_title(pBody, &title, &tail) ){
796
- if( !isPopup ) style_header("%s", blob_str(&title));
796
+ if( !isPopup ) style_header("%h", blob_str(&title));
797797
wiki_convert(&tail, 0, WIKI_BUTTONS);
798798
}else{
799
- if( !isPopup ) style_header("%s", zDefaultTitle);
799
+ if( !isPopup ) style_header("%h", zDefaultTitle);
800800
wiki_convert(pBody, 0, WIKI_BUTTONS);
801801
}
802802
if( !isPopup ){
803803
document_emit_js();
804804
style_finish_page();
@@ -807,40 +807,40 @@
807807
}else if( fossil_strcmp(zMime, "text/x-markdown")==0 ){
808808
Blob tail = BLOB_INITIALIZER;
809809
markdown_to_html(pBody, &title, &tail);
810810
if( !isPopup ){
811811
if( blob_size(&title)>0 ){
812
- style_header("%s", blob_str(&title));
812
+ style_header("%h", blob_str(&title));
813813
}else{
814
- style_header("%s", zDefaultTitle);
814
+ style_header("%h", zDefaultTitle);
815815
}
816816
}
817817
convert_href_and_output(&tail);
818818
if( !isPopup ){
819819
document_emit_js();
820820
style_finish_page();
821821
}
822822
blob_reset(&tail);
823823
}else if( fossil_strcmp(zMime, "text/plain")==0 ){
824
- style_header("%s", zDefaultTitle);
824
+ style_header("%h", zDefaultTitle);
825825
@ <blockquote><pre>
826826
@ %h(blob_str(pBody))
827827
@ </pre></blockquote>
828828
document_emit_js();
829829
style_finish_page();
830830
}else if( fossil_strcmp(zMime, "text/html")==0
831831
&& doc_is_embedded_html(pBody, &title) ){
832832
if( blob_size(&title)==0 ) blob_append(&title,zFilename,-1);
833
- if( !isPopup ) style_header("%s", blob_str(&title));
833
+ if( !isPopup ) style_header("%h", blob_str(&title));
834834
convert_href_and_output(pBody);
835835
if( !isPopup ){
836836
document_emit_js();
837837
style_finish_page();
838838
}
839839
}else if( fossil_strcmp(zMime, "text/x-pikchr")==0 ){
840840
style_adunit_config(ADUNIT_RIGHT_OK);
841
- if( !isPopup ) style_header("%s", zDefaultTitle);
841
+ if( !isPopup ) style_header("%h", zDefaultTitle);
842842
wiki_render_by_mimetype(pBody, zMime);
843843
if( !isPopup ) style_finish_page();
844844
#ifdef FOSSIL_ENABLE_TH1_DOCS
845845
}else if( Th_AreDocsEnabled() &&
846846
fossil_strcmp(zMime, "application/x-th1")==0 ){
@@ -847,11 +847,11 @@
847847
int raw = P("raw")!=0;
848848
if( !raw ){
849849
Blob tail;
850850
blob_zero(&tail);
851851
if( wiki_find_title(pBody, &title, &tail) ){
852
- style_header("%s", blob_str(&title));
852
+ style_header("%h", blob_str(&title));
853853
Th_Render(blob_str(&tail));
854854
blob_reset(&tail);
855855
}else{
856856
style_header("%h", zFilename);
857857
Th_Render(blob_str(pBody));
858858
--- src/doc.c
+++ src/doc.c
@@ -791,14 +791,14 @@
791 blob_init(&title,0,0);
792 if( fossil_strcmp(zMime, "text/x-fossil-wiki")==0 ){
793 Blob tail = BLOB_INITIALIZER;
794 style_adunit_config(ADUNIT_RIGHT_OK);
795 if( wiki_find_title(pBody, &title, &tail) ){
796 if( !isPopup ) style_header("%s", blob_str(&title));
797 wiki_convert(&tail, 0, WIKI_BUTTONS);
798 }else{
799 if( !isPopup ) style_header("%s", zDefaultTitle);
800 wiki_convert(pBody, 0, WIKI_BUTTONS);
801 }
802 if( !isPopup ){
803 document_emit_js();
804 style_finish_page();
@@ -807,40 +807,40 @@
807 }else if( fossil_strcmp(zMime, "text/x-markdown")==0 ){
808 Blob tail = BLOB_INITIALIZER;
809 markdown_to_html(pBody, &title, &tail);
810 if( !isPopup ){
811 if( blob_size(&title)>0 ){
812 style_header("%s", blob_str(&title));
813 }else{
814 style_header("%s", zDefaultTitle);
815 }
816 }
817 convert_href_and_output(&tail);
818 if( !isPopup ){
819 document_emit_js();
820 style_finish_page();
821 }
822 blob_reset(&tail);
823 }else if( fossil_strcmp(zMime, "text/plain")==0 ){
824 style_header("%s", zDefaultTitle);
825 @ <blockquote><pre>
826 @ %h(blob_str(pBody))
827 @ </pre></blockquote>
828 document_emit_js();
829 style_finish_page();
830 }else if( fossil_strcmp(zMime, "text/html")==0
831 && doc_is_embedded_html(pBody, &title) ){
832 if( blob_size(&title)==0 ) blob_append(&title,zFilename,-1);
833 if( !isPopup ) style_header("%s", blob_str(&title));
834 convert_href_and_output(pBody);
835 if( !isPopup ){
836 document_emit_js();
837 style_finish_page();
838 }
839 }else if( fossil_strcmp(zMime, "text/x-pikchr")==0 ){
840 style_adunit_config(ADUNIT_RIGHT_OK);
841 if( !isPopup ) style_header("%s", zDefaultTitle);
842 wiki_render_by_mimetype(pBody, zMime);
843 if( !isPopup ) style_finish_page();
844 #ifdef FOSSIL_ENABLE_TH1_DOCS
845 }else if( Th_AreDocsEnabled() &&
846 fossil_strcmp(zMime, "application/x-th1")==0 ){
@@ -847,11 +847,11 @@
847 int raw = P("raw")!=0;
848 if( !raw ){
849 Blob tail;
850 blob_zero(&tail);
851 if( wiki_find_title(pBody, &title, &tail) ){
852 style_header("%s", blob_str(&title));
853 Th_Render(blob_str(&tail));
854 blob_reset(&tail);
855 }else{
856 style_header("%h", zFilename);
857 Th_Render(blob_str(pBody));
858
--- src/doc.c
+++ src/doc.c
@@ -791,14 +791,14 @@
791 blob_init(&title,0,0);
792 if( fossil_strcmp(zMime, "text/x-fossil-wiki")==0 ){
793 Blob tail = BLOB_INITIALIZER;
794 style_adunit_config(ADUNIT_RIGHT_OK);
795 if( wiki_find_title(pBody, &title, &tail) ){
796 if( !isPopup ) style_header("%h", blob_str(&title));
797 wiki_convert(&tail, 0, WIKI_BUTTONS);
798 }else{
799 if( !isPopup ) style_header("%h", zDefaultTitle);
800 wiki_convert(pBody, 0, WIKI_BUTTONS);
801 }
802 if( !isPopup ){
803 document_emit_js();
804 style_finish_page();
@@ -807,40 +807,40 @@
807 }else if( fossil_strcmp(zMime, "text/x-markdown")==0 ){
808 Blob tail = BLOB_INITIALIZER;
809 markdown_to_html(pBody, &title, &tail);
810 if( !isPopup ){
811 if( blob_size(&title)>0 ){
812 style_header("%h", blob_str(&title));
813 }else{
814 style_header("%h", zDefaultTitle);
815 }
816 }
817 convert_href_and_output(&tail);
818 if( !isPopup ){
819 document_emit_js();
820 style_finish_page();
821 }
822 blob_reset(&tail);
823 }else if( fossil_strcmp(zMime, "text/plain")==0 ){
824 style_header("%h", zDefaultTitle);
825 @ <blockquote><pre>
826 @ %h(blob_str(pBody))
827 @ </pre></blockquote>
828 document_emit_js();
829 style_finish_page();
830 }else if( fossil_strcmp(zMime, "text/html")==0
831 && doc_is_embedded_html(pBody, &title) ){
832 if( blob_size(&title)==0 ) blob_append(&title,zFilename,-1);
833 if( !isPopup ) style_header("%h", blob_str(&title));
834 convert_href_and_output(pBody);
835 if( !isPopup ){
836 document_emit_js();
837 style_finish_page();
838 }
839 }else if( fossil_strcmp(zMime, "text/x-pikchr")==0 ){
840 style_adunit_config(ADUNIT_RIGHT_OK);
841 if( !isPopup ) style_header("%h", zDefaultTitle);
842 wiki_render_by_mimetype(pBody, zMime);
843 if( !isPopup ) style_finish_page();
844 #ifdef FOSSIL_ENABLE_TH1_DOCS
845 }else if( Th_AreDocsEnabled() &&
846 fossil_strcmp(zMime, "application/x-th1")==0 ){
@@ -847,11 +847,11 @@
847 int raw = P("raw")!=0;
848 if( !raw ){
849 Blob tail;
850 blob_zero(&tail);
851 if( wiki_find_title(pBody, &title, &tail) ){
852 style_header("%h", blob_str(&title));
853 Th_Render(blob_str(&tail));
854 blob_reset(&tail);
855 }else{
856 style_header("%h", zFilename);
857 Th_Render(blob_str(pBody));
858
+1 -1
--- src/event.c
+++ src/event.c
@@ -152,11 +152,11 @@
152152
}
153153
}else{
154154
blob_appendf(&title, "Tech-note %S", zId);
155155
tail = fullbody;
156156
}
157
- style_header("%s", blob_str(&title));
157
+ style_header("%h", blob_str(&title));
158158
if( g.perm.WrWiki && g.perm.Write && nextRid==0 ){
159159
style_submenu_element("Edit", "%R/technoteedit?name=%!S", zId);
160160
if( g.perm.Attach ){
161161
style_submenu_element("Attach",
162162
"%R/attachadd?technote=%!S&from=%R/technote/%!S", zId, zId);
163163
--- src/event.c
+++ src/event.c
@@ -152,11 +152,11 @@
152 }
153 }else{
154 blob_appendf(&title, "Tech-note %S", zId);
155 tail = fullbody;
156 }
157 style_header("%s", blob_str(&title));
158 if( g.perm.WrWiki && g.perm.Write && nextRid==0 ){
159 style_submenu_element("Edit", "%R/technoteedit?name=%!S", zId);
160 if( g.perm.Attach ){
161 style_submenu_element("Attach",
162 "%R/attachadd?technote=%!S&from=%R/technote/%!S", zId, zId);
163
--- src/event.c
+++ src/event.c
@@ -152,11 +152,11 @@
152 }
153 }else{
154 blob_appendf(&title, "Tech-note %S", zId);
155 tail = fullbody;
156 }
157 style_header("%h", blob_str(&title));
158 if( g.perm.WrWiki && g.perm.Write && nextRid==0 ){
159 style_submenu_element("Edit", "%R/technoteedit?name=%!S", zId);
160 if( g.perm.Attach ){
161 style_submenu_element("Attach",
162 "%R/attachadd?technote=%!S&from=%R/technote/%!S", zId, zId);
163
+2 -2
--- src/finfo.c
+++ src/finfo.c
@@ -384,13 +384,13 @@
384384
fnid = db_int(0, "SELECT fnid FROM filename WHERE name=%Q", zFilename);
385385
ridCi = zCI ? name_to_rid_www("ci") : 0;
386386
if( fnid==0 ){
387387
style_header("No such file");
388388
}else if( ridCi==0 ){
389
- style_header("All files named \"%s\"", zFilename);
389
+ style_header("All files named \"%h\"", zFilename);
390390
}else{
391
- style_header("History of %s of %s",zFilename, zCI);
391
+ style_header("History of %h of %h",zFilename, zCI);
392392
}
393393
login_anonymous_available();
394394
tmFlags = timeline_ss_submenu();
395395
if( tmFlags & TIMELINE_COLUMNAR ){
396396
zStyle = "Columnar";
397397
--- src/finfo.c
+++ src/finfo.c
@@ -384,13 +384,13 @@
384 fnid = db_int(0, "SELECT fnid FROM filename WHERE name=%Q", zFilename);
385 ridCi = zCI ? name_to_rid_www("ci") : 0;
386 if( fnid==0 ){
387 style_header("No such file");
388 }else if( ridCi==0 ){
389 style_header("All files named \"%s\"", zFilename);
390 }else{
391 style_header("History of %s of %s",zFilename, zCI);
392 }
393 login_anonymous_available();
394 tmFlags = timeline_ss_submenu();
395 if( tmFlags & TIMELINE_COLUMNAR ){
396 zStyle = "Columnar";
397
--- src/finfo.c
+++ src/finfo.c
@@ -384,13 +384,13 @@
384 fnid = db_int(0, "SELECT fnid FROM filename WHERE name=%Q", zFilename);
385 ridCi = zCI ? name_to_rid_www("ci") : 0;
386 if( fnid==0 ){
387 style_header("No such file");
388 }else if( ridCi==0 ){
389 style_header("All files named \"%h\"", zFilename);
390 }else{
391 style_header("History of %h of %h",zFilename, zCI);
392 }
393 login_anonymous_available();
394 tmFlags = timeline_ss_submenu();
395 if( tmFlags & TIMELINE_COLUMNAR ){
396 zStyle = "Columnar";
397
+2 -2
--- src/forum.c
+++ src/forum.c
@@ -1209,11 +1209,11 @@
12091209
" WHERE event.objid=forumpost.fpid"
12101210
" AND forumpost.fpid=%d;",
12111211
fpid
12121212
);
12131213
style_set_current_feature("forum");
1214
- style_header("%s%s", zThreadTitle, *zThreadTitle ? "" : "Forum");
1214
+ style_header("%h%s", zThreadTitle, *zThreadTitle ? "" : "Forum");
12151215
fossil_free(zThreadTitle);
12161216
if( mode!=FD_CHRONO ){
12171217
style_submenu_element("Chronological", "%R/%s/%s?t=c%s%s", g.zPath, zName,
12181218
bUnf ? "&unf" : "", bHist ? "&hist" : "");
12191219
}
@@ -1934,11 +1934,11 @@
19341934
login_needed(g.anon.RdForum);
19351935
return;
19361936
}
19371937
cgi_check_for_malice();
19381938
style_set_current_feature("forum");
1939
- style_header("%s%s", db_get("forum-title","Forum"),
1939
+ style_header("%h%s", db_get("forum-title","Forum"),
19401940
isSearch ? " Search Results" : "");
19411941
style_submenu_element("Timeline", "%R/timeline?ss=v&y=f&vfx");
19421942
if( g.perm.WrForum ){
19431943
style_submenu_element("New Thread","%R/forumnew");
19441944
}else{
19451945
--- src/forum.c
+++ src/forum.c
@@ -1209,11 +1209,11 @@
1209 " WHERE event.objid=forumpost.fpid"
1210 " AND forumpost.fpid=%d;",
1211 fpid
1212 );
1213 style_set_current_feature("forum");
1214 style_header("%s%s", zThreadTitle, *zThreadTitle ? "" : "Forum");
1215 fossil_free(zThreadTitle);
1216 if( mode!=FD_CHRONO ){
1217 style_submenu_element("Chronological", "%R/%s/%s?t=c%s%s", g.zPath, zName,
1218 bUnf ? "&unf" : "", bHist ? "&hist" : "");
1219 }
@@ -1934,11 +1934,11 @@
1934 login_needed(g.anon.RdForum);
1935 return;
1936 }
1937 cgi_check_for_malice();
1938 style_set_current_feature("forum");
1939 style_header("%s%s", db_get("forum-title","Forum"),
1940 isSearch ? " Search Results" : "");
1941 style_submenu_element("Timeline", "%R/timeline?ss=v&y=f&vfx");
1942 if( g.perm.WrForum ){
1943 style_submenu_element("New Thread","%R/forumnew");
1944 }else{
1945
--- src/forum.c
+++ src/forum.c
@@ -1209,11 +1209,11 @@
1209 " WHERE event.objid=forumpost.fpid"
1210 " AND forumpost.fpid=%d;",
1211 fpid
1212 );
1213 style_set_current_feature("forum");
1214 style_header("%h%s", zThreadTitle, *zThreadTitle ? "" : "Forum");
1215 fossil_free(zThreadTitle);
1216 if( mode!=FD_CHRONO ){
1217 style_submenu_element("Chronological", "%R/%s/%s?t=c%s%s", g.zPath, zName,
1218 bUnf ? "&unf" : "", bHist ? "&hist" : "");
1219 }
@@ -1934,11 +1934,11 @@
1934 login_needed(g.anon.RdForum);
1935 return;
1936 }
1937 cgi_check_for_malice();
1938 style_set_current_feature("forum");
1939 style_header("%h%s", db_get("forum-title","Forum"),
1940 isSearch ? " Search Results" : "");
1941 style_submenu_element("Timeline", "%R/timeline?ss=v&y=f&vfx");
1942 if( g.perm.WrForum ){
1943 style_submenu_element("New Thread","%R/forumnew");
1944 }else{
1945
+2 -2
--- src/info.c
+++ src/info.c
@@ -2928,11 +2928,11 @@
29282928
}else if( descOnly ){
29292929
zHeader = mprintf("Artifact Description [%S]", zUuid);
29302930
}else{
29312931
zHeader = mprintf("Artifact [%S]", zUuid);
29322932
}
2933
- style_header("%s", zHeader);
2933
+ style_header("%h", zHeader);
29342934
fossil_free(zCIUuid);
29352935
fossil_free(zHeader);
29362936
if( !isFile && g.perm.Admin ){
29372937
Stmt q;
29382938
db_prepare(&q,
@@ -3703,11 +3703,11 @@
37033703
cgi_redirectf("%R/ci/%S", zUuid);
37043704
}
37053705
blob_zero(&comment);
37063706
blob_append(&comment, zNewComment, -1);
37073707
zUuid[10] = 0;
3708
- style_header("Edit Check-in [%s]", zUuid);
3708
+ style_header("Edit Check-in [%h]", zUuid);
37093709
if( P("preview") ){
37103710
Blob suffix;
37113711
int nTag = 0;
37123712
@ <b>Preview:</b>
37133713
@ <blockquote>
37143714
--- src/info.c
+++ src/info.c
@@ -2928,11 +2928,11 @@
2928 }else if( descOnly ){
2929 zHeader = mprintf("Artifact Description [%S]", zUuid);
2930 }else{
2931 zHeader = mprintf("Artifact [%S]", zUuid);
2932 }
2933 style_header("%s", zHeader);
2934 fossil_free(zCIUuid);
2935 fossil_free(zHeader);
2936 if( !isFile && g.perm.Admin ){
2937 Stmt q;
2938 db_prepare(&q,
@@ -3703,11 +3703,11 @@
3703 cgi_redirectf("%R/ci/%S", zUuid);
3704 }
3705 blob_zero(&comment);
3706 blob_append(&comment, zNewComment, -1);
3707 zUuid[10] = 0;
3708 style_header("Edit Check-in [%s]", zUuid);
3709 if( P("preview") ){
3710 Blob suffix;
3711 int nTag = 0;
3712 @ <b>Preview:</b>
3713 @ <blockquote>
3714
--- src/info.c
+++ src/info.c
@@ -2928,11 +2928,11 @@
2928 }else if( descOnly ){
2929 zHeader = mprintf("Artifact Description [%S]", zUuid);
2930 }else{
2931 zHeader = mprintf("Artifact [%S]", zUuid);
2932 }
2933 style_header("%h", zHeader);
2934 fossil_free(zCIUuid);
2935 fossil_free(zHeader);
2936 if( !isFile && g.perm.Admin ){
2937 Stmt q;
2938 db_prepare(&q,
@@ -3703,11 +3703,11 @@
3703 cgi_redirectf("%R/ci/%S", zUuid);
3704 }
3705 blob_zero(&comment);
3706 blob_append(&comment, zNewComment, -1);
3707 zUuid[10] = 0;
3708 style_header("Edit Check-in [%h]", zUuid);
3709 if( P("preview") ){
3710 Blob suffix;
3711 int nTag = 0;
3712 @ <b>Preview:</b>
3713 @ <blockquote>
3714
+1 -1
--- src/report.c
+++ src/report.c
@@ -1213,11 +1213,11 @@
12131213
style_submenu_element("SQL", "%R/rptsql/%d",rn);
12141214
}
12151215
if( g.perm.NewTkt ){
12161216
style_submenu_element("New Ticket", "%R/tktnew");
12171217
}
1218
- style_header("%s", zTitle);
1218
+ style_header("%h", zTitle);
12191219
}
12201220
if( zDesc && zDesc[0] && zMimetype ){
12211221
Blob src;
12221222
blob_init(&src, zDesc, -1);
12231223
wiki_render_by_mimetype(&src, zMimetype);
12241224
--- src/report.c
+++ src/report.c
@@ -1213,11 +1213,11 @@
1213 style_submenu_element("SQL", "%R/rptsql/%d",rn);
1214 }
1215 if( g.perm.NewTkt ){
1216 style_submenu_element("New Ticket", "%R/tktnew");
1217 }
1218 style_header("%s", zTitle);
1219 }
1220 if( zDesc && zDesc[0] && zMimetype ){
1221 Blob src;
1222 blob_init(&src, zDesc, -1);
1223 wiki_render_by_mimetype(&src, zMimetype);
1224
--- src/report.c
+++ src/report.c
@@ -1213,11 +1213,11 @@
1213 style_submenu_element("SQL", "%R/rptsql/%d",rn);
1214 }
1215 if( g.perm.NewTkt ){
1216 style_submenu_element("New Ticket", "%R/tktnew");
1217 }
1218 style_header("%h", zTitle);
1219 }
1220 if( zDesc && zDesc[0] && zMimetype ){
1221 Blob src;
1222 blob_init(&src, zDesc, -1);
1223 wiki_render_by_mimetype(&src, zMimetype);
1224
+1 -1
--- src/skins.c
+++ src/skins.c
@@ -996,11 +996,11 @@
996996
isRevert = 1;
997997
}
998998
999999
db_begin_transaction();
10001000
style_set_current_feature("skins");
1001
- style_header("%s", zTitle);
1001
+ style_header("%h", zTitle);
10021002
for(j=0; j<count(aSkinAttr); j++){
10031003
style_submenu_element(aSkinAttr[j].zSubmenu,
10041004
"%R/setup_skinedit?w=%d&basis=%h&sk=%d",j,zBasis,iSkin);
10051005
}
10061006
@ <form action="%R/setup_skinedit" method="post"><div>
10071007
--- src/skins.c
+++ src/skins.c
@@ -996,11 +996,11 @@
996 isRevert = 1;
997 }
998
999 db_begin_transaction();
1000 style_set_current_feature("skins");
1001 style_header("%s", zTitle);
1002 for(j=0; j<count(aSkinAttr); j++){
1003 style_submenu_element(aSkinAttr[j].zSubmenu,
1004 "%R/setup_skinedit?w=%d&basis=%h&sk=%d",j,zBasis,iSkin);
1005 }
1006 @ <form action="%R/setup_skinedit" method="post"><div>
1007
--- src/skins.c
+++ src/skins.c
@@ -996,11 +996,11 @@
996 isRevert = 1;
997 }
998
999 db_begin_transaction();
1000 style_set_current_feature("skins");
1001 style_header("%h", zTitle);
1002 for(j=0; j<count(aSkinAttr); j++){
1003 style_submenu_element(aSkinAttr[j].zSubmenu,
1004 "%R/setup_skinedit?w=%d&basis=%h&sk=%d",j,zBasis,iSkin);
1005 }
1006 @ <form action="%R/setup_skinedit" method="post"><div>
1007
+1 -1
--- src/th_main.c
+++ src/th_main.c
@@ -1540,11 +1540,11 @@
15401540
){
15411541
if( argc!=2 ){
15421542
return Th_WrongNumArgs(interp, "styleHeader TITLE");
15431543
}
15441544
if( Th_IsRepositoryOpen() ){
1545
- style_header("%s", argv[1]);
1545
+ style_header("%h", argv[1]);
15461546
Th_SetResult(interp, 0, 0);
15471547
return TH_OK;
15481548
}else{
15491549
Th_SetResult(interp, "repository unavailable", -1);
15501550
return TH_ERROR;
15511551
--- src/th_main.c
+++ src/th_main.c
@@ -1540,11 +1540,11 @@
1540 ){
1541 if( argc!=2 ){
1542 return Th_WrongNumArgs(interp, "styleHeader TITLE");
1543 }
1544 if( Th_IsRepositoryOpen() ){
1545 style_header("%s", argv[1]);
1546 Th_SetResult(interp, 0, 0);
1547 return TH_OK;
1548 }else{
1549 Th_SetResult(interp, "repository unavailable", -1);
1550 return TH_ERROR;
1551
--- src/th_main.c
+++ src/th_main.c
@@ -1540,11 +1540,11 @@
1540 ){
1541 if( argc!=2 ){
1542 return Th_WrongNumArgs(interp, "styleHeader TITLE");
1543 }
1544 if( Th_IsRepositoryOpen() ){
1545 style_header("%h", argv[1]);
1546 Th_SetResult(interp, 0, 0);
1547 return TH_OK;
1548 }else{
1549 Th_SetResult(interp, "repository unavailable", -1);
1550 return TH_ERROR;
1551
+4 -2
--- src/tkt.c
+++ src/tkt.c
@@ -1250,11 +1250,12 @@
12501250
zTitle = mprintf("Check-ins Associated With Ticket %h", zUuid);
12511251
}else{
12521252
zTitle = mprintf("Timeline Of Ticket %h", zUuid);
12531253
}
12541254
style_set_current_feature("tkt");
1255
- style_header("%z", zTitle);
1255
+ style_header("%h", zTitle);
1256
+ fossil_free(zTitle);
12561257
12571258
sqlite3_snprintf(6, zGlobPattern, "%s", zUuid);
12581259
canonical16(zGlobPattern, strlen(zGlobPattern));
12591260
tagid = db_int(0, "SELECT tagid FROM tag WHERE tagname GLOB 'tkt-%q*'",zUuid);
12601261
if( tagid==0 ){
@@ -1306,11 +1307,12 @@
13061307
style_submenu_element("Decoded", "%R/tkthistory/%s", zUuid);
13071308
}else if( g.perm.Admin ){
13081309
style_submenu_element("Raw", "%R/tkthistory/%s?raw", zUuid);
13091310
}
13101311
style_set_current_feature("tkt");
1311
- style_header("%z", zTitle);
1312
+ style_header("%h", zTitle);
1313
+ fossil_free(zTitle);
13121314
13131315
tagid = db_int(0, "SELECT tagid FROM tag WHERE tagname GLOB 'tkt-%q*'",zUuid);
13141316
if( tagid==0 ){
13151317
@ No such ticket: %h(zUuid)
13161318
style_finish_page();
13171319
--- src/tkt.c
+++ src/tkt.c
@@ -1250,11 +1250,12 @@
1250 zTitle = mprintf("Check-ins Associated With Ticket %h", zUuid);
1251 }else{
1252 zTitle = mprintf("Timeline Of Ticket %h", zUuid);
1253 }
1254 style_set_current_feature("tkt");
1255 style_header("%z", zTitle);
 
1256
1257 sqlite3_snprintf(6, zGlobPattern, "%s", zUuid);
1258 canonical16(zGlobPattern, strlen(zGlobPattern));
1259 tagid = db_int(0, "SELECT tagid FROM tag WHERE tagname GLOB 'tkt-%q*'",zUuid);
1260 if( tagid==0 ){
@@ -1306,11 +1307,12 @@
1306 style_submenu_element("Decoded", "%R/tkthistory/%s", zUuid);
1307 }else if( g.perm.Admin ){
1308 style_submenu_element("Raw", "%R/tkthistory/%s?raw", zUuid);
1309 }
1310 style_set_current_feature("tkt");
1311 style_header("%z", zTitle);
 
1312
1313 tagid = db_int(0, "SELECT tagid FROM tag WHERE tagname GLOB 'tkt-%q*'",zUuid);
1314 if( tagid==0 ){
1315 @ No such ticket: %h(zUuid)
1316 style_finish_page();
1317
--- src/tkt.c
+++ src/tkt.c
@@ -1250,11 +1250,12 @@
1250 zTitle = mprintf("Check-ins Associated With Ticket %h", zUuid);
1251 }else{
1252 zTitle = mprintf("Timeline Of Ticket %h", zUuid);
1253 }
1254 style_set_current_feature("tkt");
1255 style_header("%h", zTitle);
1256 fossil_free(zTitle);
1257
1258 sqlite3_snprintf(6, zGlobPattern, "%s", zUuid);
1259 canonical16(zGlobPattern, strlen(zGlobPattern));
1260 tagid = db_int(0, "SELECT tagid FROM tag WHERE tagname GLOB 'tkt-%q*'",zUuid);
1261 if( tagid==0 ){
@@ -1306,11 +1307,12 @@
1307 style_submenu_element("Decoded", "%R/tkthistory/%s", zUuid);
1308 }else if( g.perm.Admin ){
1309 style_submenu_element("Raw", "%R/tkthistory/%s?raw", zUuid);
1310 }
1311 style_set_current_feature("tkt");
1312 style_header("%h", zTitle);
1313 fossil_free(zTitle);
1314
1315 tagid = db_int(0, "SELECT tagid FROM tag WHERE tagname GLOB 'tkt-%q*'",zUuid);
1316 if( tagid==0 ){
1317 @ No such ticket: %h(zUuid)
1318 style_finish_page();
1319
+1 -1
--- src/tktsetup.c
+++ src/tktsetup.c
@@ -134,11 +134,11 @@
134134
z = P("x");
135135
if( z==0 ){
136136
z = db_get(zDbField, zDfltValue);
137137
}
138138
style_set_current_feature("tktsetup");
139
- style_header("Edit %s", zTitle);
139
+ style_header("Edit %h", zTitle);
140140
if( P("clear")!=0 && cgi_csrf_safe(2) ){
141141
db_unset(zDbField/*works-like:"x"*/, 0);
142142
if( xRebuild ) xRebuild();
143143
cgi_redirect("tktsetup");
144144
}else if( isSubmit && cgi_csrf_safe(2) ){
145145
--- src/tktsetup.c
+++ src/tktsetup.c
@@ -134,11 +134,11 @@
134 z = P("x");
135 if( z==0 ){
136 z = db_get(zDbField, zDfltValue);
137 }
138 style_set_current_feature("tktsetup");
139 style_header("Edit %s", zTitle);
140 if( P("clear")!=0 && cgi_csrf_safe(2) ){
141 db_unset(zDbField/*works-like:"x"*/, 0);
142 if( xRebuild ) xRebuild();
143 cgi_redirect("tktsetup");
144 }else if( isSubmit && cgi_csrf_safe(2) ){
145
--- src/tktsetup.c
+++ src/tktsetup.c
@@ -134,11 +134,11 @@
134 z = P("x");
135 if( z==0 ){
136 z = db_get(zDbField, zDfltValue);
137 }
138 style_set_current_feature("tktsetup");
139 style_header("Edit %h", zTitle);
140 if( P("clear")!=0 && cgi_csrf_safe(2) ){
141 db_unset(zDbField/*works-like:"x"*/, 0);
142 if( xRebuild ) xRebuild();
143 cgi_redirect("tktsetup");
144 }else if( isSubmit && cgi_csrf_safe(2) ){
145
+4 -4
--- src/wiki.c
+++ src/wiki.c
@@ -471,11 +471,11 @@
471471
){
472472
style_set_current_feature("wiki");
473473
if( eType==WIKITYPE_UNKNOWN ) eType = wiki_page_type(zPageName);
474474
switch( eType ){
475475
case WIKITYPE_NORMAL: {
476
- style_header("%s%s", zExtra, zPageName);
476
+ style_header("%h%h", zExtra, zPageName);
477477
break;
478478
}
479479
case WIKITYPE_CHECKIN: {
480480
zPageName += 8;
481481
if( zExtra[0]==0 && !P("p") ){
@@ -1718,11 +1718,11 @@
17181718
cgi_redirectf("wiki?name=%T", zPageName);
17191719
return;
17201720
}
17211721
style_set_current_page("%T?name=%T", g.zPath, zPageName);
17221722
style_set_current_feature("wiki");
1723
- style_header("Append Comment To: %s", zPageName);
1723
+ style_header("Append Comment To: %h", zPageName);
17241724
if( !goodCaptcha ){
17251725
@ <p class="generalError">Error: Incorrect security code.</p>
17261726
}
17271727
if( isSandbox ){
17281728
@ <p class="generalError">Error: the Sandbox page may not
@@ -1776,11 +1776,11 @@
17761776
char zAuthor[64];
17771777
login_check_credentials();
17781778
if( !g.perm.RdWiki ){ login_needed(g.anon.RdWiki); return; }
17791779
zPageName = PD("name","");
17801780
style_set_current_feature("wiki");
1781
- style_header("History Of %s", zPageName);
1781
+ style_header("History Of %h", zPageName);
17821782
showRid = P("showid")!=0;
17831783
db_prepare(&q,
17841784
"SELECT"
17851785
" event.mtime,"
17861786
" blob.uuid,"
@@ -1920,11 +1920,11 @@
19201920
nextRid = wiki_next(wiki_tagid(pW1->zWikiTitle),pW1->rDate);
19211921
if( nextRid ){
19221922
style_submenu_element("Next", "%R/wdiff?rid=%d", nextRid);
19231923
}
19241924
style_set_current_feature("wiki");
1925
- style_header("Changes To %s", pW1->zWikiTitle);
1925
+ style_header("Changes To %h", pW1->zWikiTitle);
19261926
blob_zero(&d);
19271927
construct_diff_flags(1, &DCfg);
19281928
DCfg.diffFlags |= DIFF_HTML | DIFF_LINENO;
19291929
text_diff(&w2, &w1, &d, &DCfg);
19301930
@ %s(blob_str(&d))
19311931
--- src/wiki.c
+++ src/wiki.c
@@ -471,11 +471,11 @@
471 ){
472 style_set_current_feature("wiki");
473 if( eType==WIKITYPE_UNKNOWN ) eType = wiki_page_type(zPageName);
474 switch( eType ){
475 case WIKITYPE_NORMAL: {
476 style_header("%s%s", zExtra, zPageName);
477 break;
478 }
479 case WIKITYPE_CHECKIN: {
480 zPageName += 8;
481 if( zExtra[0]==0 && !P("p") ){
@@ -1718,11 +1718,11 @@
1718 cgi_redirectf("wiki?name=%T", zPageName);
1719 return;
1720 }
1721 style_set_current_page("%T?name=%T", g.zPath, zPageName);
1722 style_set_current_feature("wiki");
1723 style_header("Append Comment To: %s", zPageName);
1724 if( !goodCaptcha ){
1725 @ <p class="generalError">Error: Incorrect security code.</p>
1726 }
1727 if( isSandbox ){
1728 @ <p class="generalError">Error: the Sandbox page may not
@@ -1776,11 +1776,11 @@
1776 char zAuthor[64];
1777 login_check_credentials();
1778 if( !g.perm.RdWiki ){ login_needed(g.anon.RdWiki); return; }
1779 zPageName = PD("name","");
1780 style_set_current_feature("wiki");
1781 style_header("History Of %s", zPageName);
1782 showRid = P("showid")!=0;
1783 db_prepare(&q,
1784 "SELECT"
1785 " event.mtime,"
1786 " blob.uuid,"
@@ -1920,11 +1920,11 @@
1920 nextRid = wiki_next(wiki_tagid(pW1->zWikiTitle),pW1->rDate);
1921 if( nextRid ){
1922 style_submenu_element("Next", "%R/wdiff?rid=%d", nextRid);
1923 }
1924 style_set_current_feature("wiki");
1925 style_header("Changes To %s", pW1->zWikiTitle);
1926 blob_zero(&d);
1927 construct_diff_flags(1, &DCfg);
1928 DCfg.diffFlags |= DIFF_HTML | DIFF_LINENO;
1929 text_diff(&w2, &w1, &d, &DCfg);
1930 @ %s(blob_str(&d))
1931
--- src/wiki.c
+++ src/wiki.c
@@ -471,11 +471,11 @@
471 ){
472 style_set_current_feature("wiki");
473 if( eType==WIKITYPE_UNKNOWN ) eType = wiki_page_type(zPageName);
474 switch( eType ){
475 case WIKITYPE_NORMAL: {
476 style_header("%h%h", zExtra, zPageName);
477 break;
478 }
479 case WIKITYPE_CHECKIN: {
480 zPageName += 8;
481 if( zExtra[0]==0 && !P("p") ){
@@ -1718,11 +1718,11 @@
1718 cgi_redirectf("wiki?name=%T", zPageName);
1719 return;
1720 }
1721 style_set_current_page("%T?name=%T", g.zPath, zPageName);
1722 style_set_current_feature("wiki");
1723 style_header("Append Comment To: %h", zPageName);
1724 if( !goodCaptcha ){
1725 @ <p class="generalError">Error: Incorrect security code.</p>
1726 }
1727 if( isSandbox ){
1728 @ <p class="generalError">Error: the Sandbox page may not
@@ -1776,11 +1776,11 @@
1776 char zAuthor[64];
1777 login_check_credentials();
1778 if( !g.perm.RdWiki ){ login_needed(g.anon.RdWiki); return; }
1779 zPageName = PD("name","");
1780 style_set_current_feature("wiki");
1781 style_header("History Of %h", zPageName);
1782 showRid = P("showid")!=0;
1783 db_prepare(&q,
1784 "SELECT"
1785 " event.mtime,"
1786 " blob.uuid,"
@@ -1920,11 +1920,11 @@
1920 nextRid = wiki_next(wiki_tagid(pW1->zWikiTitle),pW1->rDate);
1921 if( nextRid ){
1922 style_submenu_element("Next", "%R/wdiff?rid=%d", nextRid);
1923 }
1924 style_set_current_feature("wiki");
1925 style_header("Changes To %h", pW1->zWikiTitle);
1926 blob_zero(&d);
1927 construct_diff_flags(1, &DCfg);
1928 DCfg.diffFlags |= DIFF_HTML | DIFF_LINENO;
1929 text_diff(&w2, &w1, &d, &DCfg);
1930 @ %s(blob_str(&d))
1931
+1 -1
--- src/xfersetup.c
+++ src/xfersetup.c
@@ -117,11 +117,11 @@
117117
z = P("x");
118118
if( z==0 ){
119119
z = db_get(zDbField, zDfltValue);
120120
}
121121
style_set_current_feature("xfersetup");
122
- style_header("Edit %s", zTitle);
122
+ style_header("Edit %h", zTitle);
123123
if( P("clear")!=0 && cgi_csrf_safe(2) ){
124124
db_unset(zDbField/*works-like:"x"*/, 0);
125125
if( xRebuild ) xRebuild();
126126
z = zDfltValue;
127127
}else if( isSubmit && cgi_csrf_safe(2) ){
128128
--- src/xfersetup.c
+++ src/xfersetup.c
@@ -117,11 +117,11 @@
117 z = P("x");
118 if( z==0 ){
119 z = db_get(zDbField, zDfltValue);
120 }
121 style_set_current_feature("xfersetup");
122 style_header("Edit %s", zTitle);
123 if( P("clear")!=0 && cgi_csrf_safe(2) ){
124 db_unset(zDbField/*works-like:"x"*/, 0);
125 if( xRebuild ) xRebuild();
126 z = zDfltValue;
127 }else if( isSubmit && cgi_csrf_safe(2) ){
128
--- src/xfersetup.c
+++ src/xfersetup.c
@@ -117,11 +117,11 @@
117 z = P("x");
118 if( z==0 ){
119 z = db_get(zDbField, zDfltValue);
120 }
121 style_set_current_feature("xfersetup");
122 style_header("Edit %h", zTitle);
123 if( P("clear")!=0 && cgi_csrf_safe(2) ){
124 db_unset(zDbField/*works-like:"x"*/, 0);
125 if( xRebuild ) xRebuild();
126 z = zDfltValue;
127 }else if( isSubmit && cgi_csrf_safe(2) ){
128
+2 -2
--- src/zip.c
+++ src/zip.c
@@ -990,11 +990,11 @@
990990
zKey = blob_str(&cacheKey);
991991
etag_check(ETAG_HASH, zKey);
992992
993993
style_set_current_feature("zip");
994994
if( P("debug")!=0 ){
995
- style_header("%s Archive Generator Debug Screen", zType);
995
+ style_header("%h Archive Generator Debug Screen", zType);
996996
@ zName = "%h(zName)"<br>
997997
@ rid = %d(rid)<br>
998998
if( zInclude ){
999999
@ zInclude = "%h(zInclude)"<br>
10001000
}
@@ -1004,11 +1004,11 @@
10041004
@ zKey = "%h(zKey)"
10051005
style_finish_page();
10061006
return;
10071007
}
10081008
if( referred_from_login() ){
1009
- style_header("%s Archive Download", zType);
1009
+ style_header("%h Archive Download", zType);
10101010
@ <form action='%R/%s(g.zPath)/%h(zName).%s(g.zPath)'>
10111011
cgi_query_parameters_to_hidden();
10121012
@ <p>%s(zType) Archive named <b>%h(zName).%s(g.zPath)</b>
10131013
@ holding the content of check-in <b>%h(zRid)</b>:
10141014
@ <input type="submit" value="Download">
10151015
--- src/zip.c
+++ src/zip.c
@@ -990,11 +990,11 @@
990 zKey = blob_str(&cacheKey);
991 etag_check(ETAG_HASH, zKey);
992
993 style_set_current_feature("zip");
994 if( P("debug")!=0 ){
995 style_header("%s Archive Generator Debug Screen", zType);
996 @ zName = "%h(zName)"<br>
997 @ rid = %d(rid)<br>
998 if( zInclude ){
999 @ zInclude = "%h(zInclude)"<br>
1000 }
@@ -1004,11 +1004,11 @@
1004 @ zKey = "%h(zKey)"
1005 style_finish_page();
1006 return;
1007 }
1008 if( referred_from_login() ){
1009 style_header("%s Archive Download", zType);
1010 @ <form action='%R/%s(g.zPath)/%h(zName).%s(g.zPath)'>
1011 cgi_query_parameters_to_hidden();
1012 @ <p>%s(zType) Archive named <b>%h(zName).%s(g.zPath)</b>
1013 @ holding the content of check-in <b>%h(zRid)</b>:
1014 @ <input type="submit" value="Download">
1015
--- src/zip.c
+++ src/zip.c
@@ -990,11 +990,11 @@
990 zKey = blob_str(&cacheKey);
991 etag_check(ETAG_HASH, zKey);
992
993 style_set_current_feature("zip");
994 if( P("debug")!=0 ){
995 style_header("%h Archive Generator Debug Screen", zType);
996 @ zName = "%h(zName)"<br>
997 @ rid = %d(rid)<br>
998 if( zInclude ){
999 @ zInclude = "%h(zInclude)"<br>
1000 }
@@ -1004,11 +1004,11 @@
1004 @ zKey = "%h(zKey)"
1005 style_finish_page();
1006 return;
1007 }
1008 if( referred_from_login() ){
1009 style_header("%h Archive Download", zType);
1010 @ <form action='%R/%s(g.zPath)/%h(zName).%s(g.zPath)'>
1011 cgi_query_parameters_to_hidden();
1012 @ <p>%s(zType) Archive named <b>%h(zName).%s(g.zPath)</b>
1013 @ holding the content of check-in <b>%h(zRid)</b>:
1014 @ <input type="submit" value="Download">
1015
--- tools/codecheck1.c
+++ tools/codecheck1.c
@@ -325,10 +325,30 @@
325325
if( strstr(z, "/*safe-for-%s*/")!=0 ) return 1;
326326
327327
return 0;
328328
}
329329
330
+
331
+/*
332
+** Return true if the input is an argument that is safe to use with %s
333
+** while building HTML output.
334
+*/
335
+static int is_html_safe(const char *z){
336
+ /* A string literal is safe for use with %s */
337
+ if( is_string_lit(z) ) return 1;
338
+
339
+ /* Expressions of the form: EXPR ? "..." : "...." can count as
340
+ ** a string literal. */
341
+ if( is_string_expr(z) ) return 1;
342
+
343
+ /* If the "safe-for-%s" comment appears in the argument, then
344
+ ** let it through */
345
+ if( strstr(z, "/*safe-for-%s*/")!=0 ) return 1;
346
+
347
+ return 0;
348
+}
349
+
330350
/*
331351
** Return true if the input is an argument that is never safe for use
332352
** with %s.
333353
*/
334354
static int never_safe(const char *z){
@@ -348,10 +368,11 @@
348368
#define FMT_SQL 0x00001 /* Generator for SQL text */
349369
#define FMT_HTML 0x00002 /* Generator for HTML text */
350370
#define FMT_URL 0x00004 /* Generator for URLs */
351371
#define FMT_JSON 0x00008 /* Generator for JSON */
352372
#define FMT_SAFE 0x00010 /* Generator for human-readable text */
373
+#define FMT_FIXME FMT_SAFE
353374
#define FMT_LIT 0x00020 /* Just verify that a string literal */
354375
#define FMT_PX 0x00040 /* Must have a literal prefix in format string */
355376
356377
/*
357378
** A list of internal Fossil interfaces that take a printf-style format
@@ -369,15 +390,15 @@
369390
{ "backoffice_log", 1, FMT_SAFE },
370391
{ "blob_append_sql", 2, FMT_SQL },
371392
{ "blob_appendf", 2, FMT_SAFE },
372393
{ "cgi_debug", 1, FMT_SAFE },
373394
{ "cgi_panic", 1, FMT_SAFE },
374
- { "cgi_printf", 1, FMT_HTML },
375
- { "cgi_printf_header", 1, FMT_HTML },
395
+ { "cgi_printf", 1, FMT_FIXME },
396
+ { "cgi_printf_header", 1, FMT_FIXME },
376397
{ "cgi_redirectf", 1, FMT_URL },
377398
{ "chref", 2, FMT_URL },
378
- { "CX", 1, FMT_HTML },
399
+ { "CX", 1, FMT_FIXME },
379400
{ "db_blob", 2, FMT_SQL },
380401
{ "db_debug", 1, FMT_SQL },
381402
{ "db_double", 2, FMT_SQL },
382403
{ "db_err", 1, FMT_SAFE },
383404
{ "db_exists", 1, FMT_SQL },
@@ -609,10 +630,14 @@
609630
610631
}else if( (fmtFlags & FMT_SQL)!=0 && !is_sql_safe(zExpr) ){
611632
printf("%s:%d: Argument %d to %.*s() not safe for SQL\n",
612633
zFilename, lnFCall, i+fmtArg, szFName, zFCall);
613634
nErr++;
635
+ }else if( (fmtFlags & FMT_HTML)!=0 && !is_html_safe(zExpr) ){
636
+ printf("%s:%d: Argument %d to %.*s() not safe for HTML\n",
637
+ zFilename, lnFCall, i+fmtArg, szFName, zFCall);
638
+ nErr++;
614639
}
615640
}
616641
}
617642
}
618643
}
@@ -662,10 +687,12 @@
662687
}else if( z[0]=='}' ){
663688
nCurly--;
664689
}else if( nCurly>0 && z[0]=='(' && ePrev==TK_ID
665690
&& (x = isFormatFunc(zPrev,szPrev,&fmtFlags))>0 ){
666691
nErr += checkFormatFunc(zName, zPrev, lnPrev, x, fmtFlags);
692
+ }else if( eVerbose>=3 ){
693
+ printf("TOKEN: [%.*s]\n", szToken, z);
667694
}
668695
}
669696
zPrev = z;
670697
ePrev = eToken;
671698
szPrev = szToken;
672699
--- tools/codecheck1.c
+++ tools/codecheck1.c
@@ -325,10 +325,30 @@
325 if( strstr(z, "/*safe-for-%s*/")!=0 ) return 1;
326
327 return 0;
328 }
329
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
330 /*
331 ** Return true if the input is an argument that is never safe for use
332 ** with %s.
333 */
334 static int never_safe(const char *z){
@@ -348,10 +368,11 @@
348 #define FMT_SQL 0x00001 /* Generator for SQL text */
349 #define FMT_HTML 0x00002 /* Generator for HTML text */
350 #define FMT_URL 0x00004 /* Generator for URLs */
351 #define FMT_JSON 0x00008 /* Generator for JSON */
352 #define FMT_SAFE 0x00010 /* Generator for human-readable text */
 
353 #define FMT_LIT 0x00020 /* Just verify that a string literal */
354 #define FMT_PX 0x00040 /* Must have a literal prefix in format string */
355
356 /*
357 ** A list of internal Fossil interfaces that take a printf-style format
@@ -369,15 +390,15 @@
369 { "backoffice_log", 1, FMT_SAFE },
370 { "blob_append_sql", 2, FMT_SQL },
371 { "blob_appendf", 2, FMT_SAFE },
372 { "cgi_debug", 1, FMT_SAFE },
373 { "cgi_panic", 1, FMT_SAFE },
374 { "cgi_printf", 1, FMT_HTML },
375 { "cgi_printf_header", 1, FMT_HTML },
376 { "cgi_redirectf", 1, FMT_URL },
377 { "chref", 2, FMT_URL },
378 { "CX", 1, FMT_HTML },
379 { "db_blob", 2, FMT_SQL },
380 { "db_debug", 1, FMT_SQL },
381 { "db_double", 2, FMT_SQL },
382 { "db_err", 1, FMT_SAFE },
383 { "db_exists", 1, FMT_SQL },
@@ -609,10 +630,14 @@
609
610 }else if( (fmtFlags & FMT_SQL)!=0 && !is_sql_safe(zExpr) ){
611 printf("%s:%d: Argument %d to %.*s() not safe for SQL\n",
612 zFilename, lnFCall, i+fmtArg, szFName, zFCall);
613 nErr++;
 
 
 
 
614 }
615 }
616 }
617 }
618 }
@@ -662,10 +687,12 @@
662 }else if( z[0]=='}' ){
663 nCurly--;
664 }else if( nCurly>0 && z[0]=='(' && ePrev==TK_ID
665 && (x = isFormatFunc(zPrev,szPrev,&fmtFlags))>0 ){
666 nErr += checkFormatFunc(zName, zPrev, lnPrev, x, fmtFlags);
 
 
667 }
668 }
669 zPrev = z;
670 ePrev = eToken;
671 szPrev = szToken;
672
--- tools/codecheck1.c
+++ tools/codecheck1.c
@@ -325,10 +325,30 @@
325 if( strstr(z, "/*safe-for-%s*/")!=0 ) return 1;
326
327 return 0;
328 }
329
330
331 /*
332 ** Return true if the input is an argument that is safe to use with %s
333 ** while building HTML output.
334 */
335 static int is_html_safe(const char *z){
336 /* A string literal is safe for use with %s */
337 if( is_string_lit(z) ) return 1;
338
339 /* Expressions of the form: EXPR ? "..." : "...." can count as
340 ** a string literal. */
341 if( is_string_expr(z) ) return 1;
342
343 /* If the "safe-for-%s" comment appears in the argument, then
344 ** let it through */
345 if( strstr(z, "/*safe-for-%s*/")!=0 ) return 1;
346
347 return 0;
348 }
349
350 /*
351 ** Return true if the input is an argument that is never safe for use
352 ** with %s.
353 */
354 static int never_safe(const char *z){
@@ -348,10 +368,11 @@
368 #define FMT_SQL 0x00001 /* Generator for SQL text */
369 #define FMT_HTML 0x00002 /* Generator for HTML text */
370 #define FMT_URL 0x00004 /* Generator for URLs */
371 #define FMT_JSON 0x00008 /* Generator for JSON */
372 #define FMT_SAFE 0x00010 /* Generator for human-readable text */
373 #define FMT_FIXME FMT_SAFE
374 #define FMT_LIT 0x00020 /* Just verify that a string literal */
375 #define FMT_PX 0x00040 /* Must have a literal prefix in format string */
376
377 /*
378 ** A list of internal Fossil interfaces that take a printf-style format
@@ -369,15 +390,15 @@
390 { "backoffice_log", 1, FMT_SAFE },
391 { "blob_append_sql", 2, FMT_SQL },
392 { "blob_appendf", 2, FMT_SAFE },
393 { "cgi_debug", 1, FMT_SAFE },
394 { "cgi_panic", 1, FMT_SAFE },
395 { "cgi_printf", 1, FMT_FIXME },
396 { "cgi_printf_header", 1, FMT_FIXME },
397 { "cgi_redirectf", 1, FMT_URL },
398 { "chref", 2, FMT_URL },
399 { "CX", 1, FMT_FIXME },
400 { "db_blob", 2, FMT_SQL },
401 { "db_debug", 1, FMT_SQL },
402 { "db_double", 2, FMT_SQL },
403 { "db_err", 1, FMT_SAFE },
404 { "db_exists", 1, FMT_SQL },
@@ -609,10 +630,14 @@
630
631 }else if( (fmtFlags & FMT_SQL)!=0 && !is_sql_safe(zExpr) ){
632 printf("%s:%d: Argument %d to %.*s() not safe for SQL\n",
633 zFilename, lnFCall, i+fmtArg, szFName, zFCall);
634 nErr++;
635 }else if( (fmtFlags & FMT_HTML)!=0 && !is_html_safe(zExpr) ){
636 printf("%s:%d: Argument %d to %.*s() not safe for HTML\n",
637 zFilename, lnFCall, i+fmtArg, szFName, zFCall);
638 nErr++;
639 }
640 }
641 }
642 }
643 }
@@ -662,10 +687,12 @@
687 }else if( z[0]=='}' ){
688 nCurly--;
689 }else if( nCurly>0 && z[0]=='(' && ePrev==TK_ID
690 && (x = isFormatFunc(zPrev,szPrev,&fmtFlags))>0 ){
691 nErr += checkFormatFunc(zName, zPrev, lnPrev, x, fmtFlags);
692 }else if( eVerbose>=3 ){
693 printf("TOKEN: [%.*s]\n", szToken, z);
694 }
695 }
696 zPrev = z;
697 ePrev = eToken;
698 szPrev = szToken;
699

Keyboard Shortcuts

Open search /
Next entry (timeline) j
Previous entry (timeline) k
Open focused entry Enter
Show this help ?
Toggle theme Top nav button