Fossil SCM

Reverted [5abc0f6e7] because testing has shown the referrer to simply be too fragile and subject to browser-side whims (which also includes the option to send only the scheme and host, without the path, as the referrer, which breaks what that commit did). Now style.css supports both style.css/pagename and style.css?page=name, preferring the former, pending a decision on which one of those syntaxes the other devs prefer.

stephan 2020-05-18 12:32 style-css-revamp
Commit 45341a2869324d1c57d3f5ca8ef5d98768d021dd5c28ce58ed200fc4268a57bb
Parent a21e26684f76a36…
3 files changed -36 +1 -2 -19
~ src/cgi.c ~ src/style.c ~ src/url.c
M src/cgi.c
-36
--- src/cgi.c
+++ src/cgi.c
@@ -447,46 +447,10 @@
447447
 zRef = P("HTTP_REFERER");
448448
 if( zRef==0 ) zRef = zDefault;
449449
 }
450450
 return zRef;
451451
 }
452
-
453
-/*
454
-** If cgi_referer(0) returns a non-0 AND the referrer is from the same
455
-** fossil app path (i.e. the referrer's path starts with g.zTop), this
456
-** function returns the first path element of the referring page, up
457
-** to, but not including, the first slash. Thus if he refer[r]er is
458
-** https://foo.com/fossil.cgi/foo/bar, this returns "foo". The
459
-** returned memory is malloc'd and needs to be freed by the caller.
460
-*/
461
-char * cgi_referer_fossil_page_name(){
462
- UrlData url;
463
- char * zPage = 0;
464
- const char * zRef = cgi_referer(0);
465
-
466
- if(zRef==0) return 0;
467
- memset(&url, 0, sizeof(url));
468
- url_parse_local(zRef, 0, &url);
469
- if(url.path==strstr(url.path, g.zTop)){
470
- /* g.zTop is, e.g., /cgi-bin/fossil.cgi,
471
- url.path is, e.g., /cgi-bin/fossil.cgi/page/... */
472
- char * zSlash = 0;
473
- zPage = url.path + strlen(g.zTop);
474
- if('/' == zPage[0]){
475
- *zPage++ = 0;
476
- if((zSlash = strstr(zPage,"/"))!=0){
477
- *zSlash = 0;
478
- }
479
- zPage = mprintf("%s", zPage);
480
- }else{ /*unexpected result*/
481
- zPage = 0;
482
- }
483
- }
484
- url_cleanup(&url);
485
- return zPage;
486
-}
487
-
488452
489453
 /*
490454
 ** Return true if the current request appears to be safe from a
491455
 ** Cross-Site Request Forgery (CSRF) attack. Conditions that must
492456
 ** be met:
493457
--- src/cgi.c
+++ src/cgi.c
@@ -447,46 +447,10 @@
447 zRef = P("HTTP_REFERER");
448 if( zRef==0 ) zRef = zDefault;
449 }
450 return zRef;
451 }
452
453 /*
454 ** If cgi_referer(0) returns a non-0 AND the referrer is from the same
455 ** fossil app path (i.e. the referrer's path starts with g.zTop), this
456 ** function returns the first path element of the referring page, up
457 ** to, but not including, the first slash. Thus if he refer[r]er is
458 ** https://foo.com/fossil.cgi/foo/bar, this returns "foo". The
459 ** returned memory is malloc'd and needs to be freed by the caller.
460 */
461 char * cgi_referer_fossil_page_name(){
462 UrlData url;
463 char * zPage = 0;
464 const char * zRef = cgi_referer(0);
465
466 if(zRef==0) return 0;
467 memset(&url, 0, sizeof(url));
468 url_parse_local(zRef, 0, &url);
469 if(url.path==strstr(url.path, g.zTop)){
470 /* g.zTop is, e.g., /cgi-bin/fossil.cgi,
471 url.path is, e.g., /cgi-bin/fossil.cgi/page/... */
472 char * zSlash = 0;
473 zPage = url.path + strlen(g.zTop);
474 if('/' == zPage[0]){
475 *zPage++ = 0;
476 if((zSlash = strstr(zPage,"/"))!=0){
477 *zSlash = 0;
478 }
479 zPage = mprintf("%s", zPage);
480 }else{ /*unexpected result*/
481 zPage = 0;
482 }
483 }
484 url_cleanup(&url);
485 return zPage;
486 }
487
488
489 /*
490 ** Return true if the current request appears to be safe from a
491 ** Cross-Site Request Forgery (CSRF) attack. Conditions that must
492 ** be met:
493
--- src/cgi.c
+++ src/cgi.c
@@ -447,46 +447,10 @@
447 zRef = P("HTTP_REFERER");
448 if( zRef==0 ) zRef = zDefault;
449 }
450 return zRef;
451 }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
452
453 /*
454 ** Return true if the current request appears to be safe from a
455 ** Cross-Site Request Forgery (CSRF) attack. Conditions that must
456 ** be met:
457
M src/style.c
+1 -2
--- src/style.c
+++ src/style.c
@@ -1079,11 +1079,11 @@
10791079
 ** Return the style sheet.
10801080
 */
10811081
 void page_style_css(void){
10821082
 Blob css = empty_blob;
10831083
 int i;
1084
- char *zPage = cgi_referer_fossil_page_name();
1084
+ const char *zPage = PD("name",P("page"));
10851085
10861086
 cgi_set_content_type("text/css");
10871087
 /* Emit all default rules... */
10881088
 for(i=1; cssDefaultList[i].elementClass; i++){
10891089
 char *z = blob_str(&css);
@@ -1117,11 +1117,10 @@
11171117
 "***********************************************************/\n",
11181118
 zPage);
11191119
 }
11201120
 fossil_free(zFile);
11211121
 }
1122
- fossil_free(zPage);
11231122
 blob_append(&css,
11241123
 "\n/***********************************************************\n"
11251124
 "** All CSS which follows is supplied by the repository \"skin\".\n"
11261125
 "***********************************************************/\n",
11271126
 -1);
11281127
--- src/style.c
+++ src/style.c
@@ -1079,11 +1079,11 @@
1079 ** Return the style sheet.
1080 */
1081 void page_style_css(void){
1082 Blob css = empty_blob;
1083 int i;
1084 char *zPage = cgi_referer_fossil_page_name();
1085
1086 cgi_set_content_type("text/css");
1087 /* Emit all default rules... */
1088 for(i=1; cssDefaultList[i].elementClass; i++){
1089 char *z = blob_str(&css);
@@ -1117,11 +1117,10 @@
1117 "***********************************************************/\n",
1118 zPage);
1119 }
1120 fossil_free(zFile);
1121 }
1122 fossil_free(zPage);
1123 blob_append(&css,
1124 "\n/***********************************************************\n"
1125 "** All CSS which follows is supplied by the repository \"skin\".\n"
1126 "***********************************************************/\n",
1127 -1);
1128
--- src/style.c
+++ src/style.c
@@ -1079,11 +1079,11 @@
1079 ** Return the style sheet.
1080 */
1081 void page_style_css(void){
1082 Blob css = empty_blob;
1083 int i;
1084 const char *zPage = PD("name",P("page"));
1085
1086 cgi_set_content_type("text/css");
1087 /* Emit all default rules... */
1088 for(i=1; cssDefaultList[i].elementClass; i++){
1089 char *z = blob_str(&css);
@@ -1117,11 +1117,10 @@
1117 "***********************************************************/\n",
1118 zPage);
1119 }
1120 fossil_free(zFile);
1121 }
 
1122 blob_append(&css,
1123 "\n/***********************************************************\n"
1124 "** All CSS which follows is supplied by the repository \"skin\".\n"
1125 "***********************************************************/\n",
1126 -1);
1127
M src/url.c
-19
--- src/url.c
+++ src/url.c
@@ -65,29 +65,10 @@
6565
 char *proxyUrlPath;
6666
 int proxyOrigPort; /* Tunneled port number for https through proxy */
6767
 };
6868
 #endif /* INTERFACE */
6969
70
-/*
71
-** Frees (almost) all (char*) members of pUrlData and zeroes out
72
-** pUrlData. Results are undefined if pUrlData passed an uninitialized
73
-** object.
74
-*/
75
-void url_cleanup(UrlData *pUrlData){
76
- fossil_free(pUrlData->user);
77
- fossil_free(pUrlData->passwd);
78
- if(pUrlData->hostname != pUrlData->name){
79
- fossil_free(pUrlData->name);
80
- }
81
- fossil_free(pUrlData->hostname);
82
- fossil_free(pUrlData->path);
83
- fossil_free(pUrlData->canonical);
84
- /* ??? fossil_free(pUrlData->proxyAuth); */
85
- /* ??? fossil_free(pUrlData->fossil); */
86
- /* ??? fossil_free(pUrlData->proxyUrlPath); */
87
- memset(pUrlData, 0, sizeof(*pUrlData));
88
-}
8970
9071
 /*
9172
 ** Parse the given URL. Populate members of the provided UrlData structure
9273
 ** as follows:
9374
 **
9475
--- src/url.c
+++ src/url.c
@@ -65,29 +65,10 @@
65 char *proxyUrlPath;
66 int proxyOrigPort; /* Tunneled port number for https through proxy */
67 };
68 #endif /* INTERFACE */
69
70 /*
71 ** Frees (almost) all (char*) members of pUrlData and zeroes out
72 ** pUrlData. Results are undefined if pUrlData passed an uninitialized
73 ** object.
74 */
75 void url_cleanup(UrlData *pUrlData){
76 fossil_free(pUrlData->user);
77 fossil_free(pUrlData->passwd);
78 if(pUrlData->hostname != pUrlData->name){
79 fossil_free(pUrlData->name);
80 }
81 fossil_free(pUrlData->hostname);
82 fossil_free(pUrlData->path);
83 fossil_free(pUrlData->canonical);
84 /* ??? fossil_free(pUrlData->proxyAuth); */
85 /* ??? fossil_free(pUrlData->fossil); */
86 /* ??? fossil_free(pUrlData->proxyUrlPath); */
87 memset(pUrlData, 0, sizeof(*pUrlData));
88 }
89
90 /*
91 ** Parse the given URL. Populate members of the provided UrlData structure
92 ** as follows:
93 **
94
--- src/url.c
+++ src/url.c
@@ -65,29 +65,10 @@
65 char *proxyUrlPath;
66 int proxyOrigPort; /* Tunneled port number for https through proxy */
67 };
68 #endif /* INTERFACE */
69
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
70
71 /*
72 ** Parse the given URL. Populate members of the provided UrlData structure
73 ** as follows:
74 **
75

Keyboard Shortcuts

Open search /
Next entry (timeline) j
Previous entry (timeline) k
Open focused entry Enter
Show this help ?
Toggle theme Top nav button