Fossil SCM

Add the cgi_referer() utility function. Use it to cause the setup_uedit page to always go back to the page it came from.

drh 2017-07-01 22:38 trunk
Commit 59a51b8267da45846820295f3148b6faa1692e331910706c481dc68fc5925c6e
Parent 564e42dfe577d60…
2 files changed +14 +10 -6
~ src/cgi.c ~ src/setup.c
M src/cgi.c
+14
--- src/cgi.c
+++ src/cgi.c
@@ -437,10 +437,24 @@
437437
 va_list ap;
438438
 va_start(ap, zFormat);
439439
 cgi_redirect(vmprintf(zFormat, ap));
440440
 va_end(ap);
441441
 }
442
+
443
+/*
444
+** Return the URL for the caller. This is obtained from either the
445
+** referer CGI parameter, if it exists, or the HTTP_REFERER HTTP parameter.
446
+** If neither exist, return zDefault.
447
+*/
448
+const char *cgi_referer(const char *zDefault){
449
+ const char *zRef = P("referer");
450
+ if( zRef==0 ){
451
+ zRef = P("HTTP_REFERER");
452
+ if( zRef==0 ) zRef = zDefault;
453
+ }
454
+ return zRef;
455
+}
442456
443457
 /*
444458
 ** Information about all query parameters and cookies are stored
445459
 ** in these variables.
446460
 */
447461
--- src/cgi.c
+++ src/cgi.c
@@ -437,10 +437,24 @@
437 va_list ap;
438 va_start(ap, zFormat);
439 cgi_redirect(vmprintf(zFormat, ap));
440 va_end(ap);
441 }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
442
443 /*
444 ** Information about all query parameters and cookies are stored
445 ** in these variables.
446 */
447
--- src/cgi.c
+++ src/cgi.c
@@ -437,10 +437,24 @@
437 va_list ap;
438 va_start(ap, zFormat);
439 cgi_redirect(vmprintf(zFormat, ap));
440 va_end(ap);
441 }
442
443 /*
444 ** Return the URL for the caller. This is obtained from either the
445 ** referer CGI parameter, if it exists, or the HTTP_REFERER HTTP parameter.
446 ** If neither exist, return zDefault.
447 */
448 const char *cgi_referer(const char *zDefault){
449 const char *zRef = P("referer");
450 if( zRef==0 ){
451 zRef = P("HTTP_REFERER");
452 if( zRef==0 ) zRef = zDefault;
453 }
454 return zRef;
455 }
456
457 /*
458 ** Information about all query parameters and cookies are stored
459 ** in these variables.
460 */
461
M src/setup.c
+10 -6
--- src/setup.c
+++ src/setup.c
@@ -440,11 +440,11 @@
440440
 higherUser = zOldCaps && strchr(zOldCaps,'s');
441441
 }
442442
443443
 if( P("can") ){
444444
 /* User pressed the cancel button */
445
- cgi_redirect("setup_ulist");
445
+ cgi_redirect(cgi_referer("setup_ulist"));
446446
 return;
447447
 }
448448
449449
 /* If we have all the necessary information, write the new or
450450
 ** modified user record. After writing the user record, redirect
@@ -467,11 +467,12 @@
467467
 zLogin = P("login");
468468
 if( strlen(zLogin)==0 ){
469469
 style_header("User Creation Error");
470470
 @ <span class="loginError">Empty login not allowed.</span>
471471
 @
472
- @ <p><a href="setup_uedit?id=%d(uid)">[Bummer]</a></p>
472
+ @ <p><a href="setup_uedit?id=%d(uid)&referer=%T(cgi_referer("setup_ulist"))">
473
+ @ [Bummer]</a></p>
473474
 style_footer();
474475
 return;
475476
 }
476477
 if( isValidPwString(zPw) ){
477478
 zPw = sha1_shared_secret(zPw, zLogin, 0);
@@ -482,11 +483,12 @@
482483
 if( db_exists("SELECT 1 FROM user WHERE login=%Q AND uid!=%d", zLogin, uid) ){
483484
 style_header("User Creation Error");
484485
 @ <span class="loginError">Login "%h(zLogin)" is already used by
485486
 @ a different user.</span>
486487
 @
487
- @ <p><a href="setup_uedit?id=%d(uid)">[Bummer]</a></p>
488
+ @ <p><a href="setup_uedit?id=%d(uid)&referer=%T(cgi_referer("setup_ulist"))">
489
+ @ [Bummer]</a></p>
488490
 style_footer();
489491
 return;
490492
 }
491493
 login_verify_csrf_secret();
492494
 db_multi_exec(
@@ -527,16 +529,17 @@
527529
 if( zErr ){
528530
 style_header("User Change Error");
529531
 admin_log( "Error updating user '%q': %s'.", zLogin, zErr );
530532
 @ <span class="loginError">%h(zErr)</span>
531533
 @
532
- @ <p><a href="setup_uedit?id=%d(uid)">[Bummer]</a></p>
534
+ @ <p><a href="setup_uedit?id=%d(uid)&referer=%T(cgi_referer("setup_ulist"))">
535
+ @ [Bummer]</a></p>
533536
 style_footer();
534537
 return;
535538
 }
536539
 }
537
- cgi_redirect("setup_ulist");
540
+ cgi_redirect(cgi_referer("setup_ulist"));
538541
 return;
539542
 }
540543
541544
 /* Load the existing information about the user, if any
542545
 */
@@ -595,11 +598,11 @@
595598
 free(z2);
596599
 }
597600
598601
 /* Begin generating the page
599602
 */
600
- style_submenu_element("Cancel", "setup_ulist");
603
+ style_submenu_element("Cancel", cgi_referer("setup_ulist"));
601604
 if( uid ){
602605
 style_header("Edit User %h", zLogin);
603606
 }else{
604607
 style_header("Add A New User");
605608
 }
@@ -609,10 +612,11 @@
609612
 if( login_is_special(zLogin) ){
610613
 @ <input type="hidden" name="login" value="%s(zLogin)">
611614
 @ <input type="hidden" name="info" value="">
612615
 @ <input type="hidden" name="pw" value="*">
613616
 }
617
+ @ <input type="hidden" name="referer" value="%h(cgi_referer("setup_ulist"))">
614618
 @ <script>
615619
 @ function updateCapabilityString(){
616620
 @ /*
617621
 @ ** This function updates the "#usetupEditCapability" span content
618622
 @ ** with the capabilities selected by the interactive user, based
619623
--- src/setup.c
+++ src/setup.c
@@ -440,11 +440,11 @@
440 higherUser = zOldCaps && strchr(zOldCaps,'s');
441 }
442
443 if( P("can") ){
444 /* User pressed the cancel button */
445 cgi_redirect("setup_ulist");
446 return;
447 }
448
449 /* If we have all the necessary information, write the new or
450 ** modified user record. After writing the user record, redirect
@@ -467,11 +467,12 @@
467 zLogin = P("login");
468 if( strlen(zLogin)==0 ){
469 style_header("User Creation Error");
470 @ <span class="loginError">Empty login not allowed.</span>
471 @
472 @ <p><a href="setup_uedit?id=%d(uid)">[Bummer]</a></p>
 
473 style_footer();
474 return;
475 }
476 if( isValidPwString(zPw) ){
477 zPw = sha1_shared_secret(zPw, zLogin, 0);
@@ -482,11 +483,12 @@
482 if( db_exists("SELECT 1 FROM user WHERE login=%Q AND uid!=%d", zLogin, uid) ){
483 style_header("User Creation Error");
484 @ <span class="loginError">Login "%h(zLogin)" is already used by
485 @ a different user.</span>
486 @
487 @ <p><a href="setup_uedit?id=%d(uid)">[Bummer]</a></p>
 
488 style_footer();
489 return;
490 }
491 login_verify_csrf_secret();
492 db_multi_exec(
@@ -527,16 +529,17 @@
527 if( zErr ){
528 style_header("User Change Error");
529 admin_log( "Error updating user '%q': %s'.", zLogin, zErr );
530 @ <span class="loginError">%h(zErr)</span>
531 @
532 @ <p><a href="setup_uedit?id=%d(uid)">[Bummer]</a></p>
 
533 style_footer();
534 return;
535 }
536 }
537 cgi_redirect("setup_ulist");
538 return;
539 }
540
541 /* Load the existing information about the user, if any
542 */
@@ -595,11 +598,11 @@
595 free(z2);
596 }
597
598 /* Begin generating the page
599 */
600 style_submenu_element("Cancel", "setup_ulist");
601 if( uid ){
602 style_header("Edit User %h", zLogin);
603 }else{
604 style_header("Add A New User");
605 }
@@ -609,10 +612,11 @@
609 if( login_is_special(zLogin) ){
610 @ <input type="hidden" name="login" value="%s(zLogin)">
611 @ <input type="hidden" name="info" value="">
612 @ <input type="hidden" name="pw" value="*">
613 }
 
614 @ <script>
615 @ function updateCapabilityString(){
616 @ /*
617 @ ** This function updates the "#usetupEditCapability" span content
618 @ ** with the capabilities selected by the interactive user, based
619
--- src/setup.c
+++ src/setup.c
@@ -440,11 +440,11 @@
440 higherUser = zOldCaps && strchr(zOldCaps,'s');
441 }
442
443 if( P("can") ){
444 /* User pressed the cancel button */
445 cgi_redirect(cgi_referer("setup_ulist"));
446 return;
447 }
448
449 /* If we have all the necessary information, write the new or
450 ** modified user record. After writing the user record, redirect
@@ -467,11 +467,12 @@
467 zLogin = P("login");
468 if( strlen(zLogin)==0 ){
469 style_header("User Creation Error");
470 @ <span class="loginError">Empty login not allowed.</span>
471 @
472 @ <p><a href="setup_uedit?id=%d(uid)&referer=%T(cgi_referer("setup_ulist"))">
473 @ [Bummer]</a></p>
474 style_footer();
475 return;
476 }
477 if( isValidPwString(zPw) ){
478 zPw = sha1_shared_secret(zPw, zLogin, 0);
@@ -482,11 +483,12 @@
483 if( db_exists("SELECT 1 FROM user WHERE login=%Q AND uid!=%d", zLogin, uid) ){
484 style_header("User Creation Error");
485 @ <span class="loginError">Login "%h(zLogin)" is already used by
486 @ a different user.</span>
487 @
488 @ <p><a href="setup_uedit?id=%d(uid)&referer=%T(cgi_referer("setup_ulist"))">
489 @ [Bummer]</a></p>
490 style_footer();
491 return;
492 }
493 login_verify_csrf_secret();
494 db_multi_exec(
@@ -527,16 +529,17 @@
529 if( zErr ){
530 style_header("User Change Error");
531 admin_log( "Error updating user '%q': %s'.", zLogin, zErr );
532 @ <span class="loginError">%h(zErr)</span>
533 @
534 @ <p><a href="setup_uedit?id=%d(uid)&referer=%T(cgi_referer("setup_ulist"))">
535 @ [Bummer]</a></p>
536 style_footer();
537 return;
538 }
539 }
540 cgi_redirect(cgi_referer("setup_ulist"));
541 return;
542 }
543
544 /* Load the existing information about the user, if any
545 */
@@ -595,11 +598,11 @@
598 free(z2);
599 }
600
601 /* Begin generating the page
602 */
603 style_submenu_element("Cancel", cgi_referer("setup_ulist"));
604 if( uid ){
605 style_header("Edit User %h", zLogin);
606 }else{
607 style_header("Add A New User");
608 }
@@ -609,10 +612,11 @@
612 if( login_is_special(zLogin) ){
613 @ <input type="hidden" name="login" value="%s(zLogin)">
614 @ <input type="hidden" name="info" value="">
615 @ <input type="hidden" name="pw" value="*">
616 }
617 @ <input type="hidden" name="referer" value="%h(cgi_referer("setup_ulist"))">
618 @ <script>
619 @ function updateCapabilityString(){
620 @ /*
621 @ ** This function updates the "#usetupEditCapability" span content
622 @ ** with the capabilities selected by the interactive user, based
623

Keyboard Shortcuts

Open search /
Next entry (timeline) j
Previous entry (timeline) k
Open focused entry Enter
Show this help ?
Toggle theme Top nav button