| | @@ -864,22 +864,80 @@ |
| 864 | 864 | } |
| 865 | 865 | blob_init(&out, zTxt, -1); |
| 866 | 866 | cgi_set_content(&out); |
| 867 | 867 | } |
| 868 | 868 | |
| 869 | +/* |
| 870 | +** All possible capabilities |
| 871 | +*/ |
| 872 | +static const char allCap[] = |
| 873 | + "abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKL"; |
| 874 | + |
| 875 | +/* |
| 876 | +** Compute the current login capabilities |
| 877 | +*/ |
| 878 | +static char *find_capabilities(char *zCap){ |
| 879 | + int i, j; |
| 880 | + char c; |
| 881 | + for(i=j=0; (c = allCap[j])!=0; j++){ |
| 882 | + if( login_has_capability(&c, 1, 0) ) zCap[i++] = c; |
| 883 | + } |
| 884 | + zCap[i] = 0; |
| 885 | + return zCap; |
| 886 | +} |
| 887 | + |
| 888 | +/* |
| 889 | +** Compute the current login capabilities that were |
| 890 | +** contributed by Anonymous |
| 891 | +*/ |
| 892 | +static char *find_anon_capabilities(char *zCap){ |
| 893 | + int i, j; |
| 894 | + char c; |
| 895 | + for(i=j=0; (c = allCap[j])!=0; j++){ |
| 896 | + if( login_has_capability(&c, 1, LOGIN_ANON) |
| 897 | + && !login_has_capability(&c, 1, 0) ) zCap[i++] = c; |
| 898 | + } |
| 899 | + zCap[i] = 0; |
| 900 | + return zCap; |
| 901 | +} |
| 869 | 902 | |
| 870 | 903 | /* |
| 871 | 904 | ** WEBPAGE: test_env |
| 872 | 905 | ** |
| 873 | 906 | ** Display CGI-variables and other aspects of the run-time |
| 874 | 907 | ** environment, for debugging and trouble-shooting purposes. |
| 875 | 908 | */ |
| 876 | 909 | void page_test_env(void){ |
| 877 | | - char c; |
| 910 | + webpage_error(""); |
| 911 | +} |
| 912 | + |
| 913 | +/* |
| 914 | +** WEBPAGE: honeypot |
| 915 | +** This page is a honeypot for spiders and bots. |
| 916 | +*/ |
| 917 | +void honeypot_page(void){ |
| 918 | + cgi_set_status(403, "Forbidden"); |
| 919 | + @ <p>Please enable javascript or log in to see this content</p> |
| 920 | +} |
| 921 | + |
| 922 | +/* |
| 923 | +** Webpages that encounter an error due to missing or incorrect |
| 924 | +** query parameters can jump to this routine to render an error |
| 925 | +** message screen. |
| 926 | +** |
| 927 | +** For administators, or if the test_env_enable setting is true, then |
| 928 | +** details of the request environment are displayed. Otherwise, just |
| 929 | +** the error message is shown. |
| 930 | +** |
| 931 | +** If zFormat is an empty string, then this is the /test_env page. |
| 932 | +*/ |
| 933 | +void webpage_error(const char *zFormat, ...){ |
| 878 | 934 | int i; |
| 879 | 935 | int showAll; |
| 880 | | - char zCap[30]; |
| 936 | + char *zErr; |
| 937 | + int isAuth = 0; |
| 938 | + char zCap[100]; |
| 881 | 939 | static const char *const azCgiVars[] = { |
| 882 | 940 | "COMSPEC", "DOCUMENT_ROOT", "GATEWAY_INTERFACE", |
| 883 | 941 | "HTTP_ACCEPT", "HTTP_ACCEPT_CHARSET", "HTTP_ACCEPT_ENCODING", |
| 884 | 942 | "HTTP_ACCEPT_LANGUAGE", "HTTP_AUTHENICATION", |
| 885 | 943 | "HTTP_CONNECTION", "HTTP_HOST", |
| | @@ -895,48 +953,56 @@ |
| 895 | 953 | "FOSSIL_TCL_PATH", "TH1_DELETE_INTERP", "TH1_ENABLE_DOCS", |
| 896 | 954 | "TH1_ENABLE_HOOKS", "TH1_ENABLE_TCL", "REMOTE_HOST" |
| 897 | 955 | }; |
| 898 | 956 | |
| 899 | 957 | login_check_credentials(); |
| 900 | | - if( !g.perm.Admin && !g.perm.Setup && !db_get_boolean("test_env_enable",0) ){ |
| 901 | | - login_needed(0); |
| 902 | | - return; |
| 958 | + if( g.perm.Admin || g.perm.Setup || db_get_boolean("test_env_enable",0) ){ |
| 959 | + isAuth = 1; |
| 903 | 960 | } |
| 904 | 961 | for(i=0; i<count(azCgiVars); i++) (void)P(azCgiVars[i]); |
| 905 | | - style_header("Environment Test"); |
| 906 | | - showAll = PB("showall"); |
| 907 | | - style_submenu_checkbox("showall", "Cookies", 0, 0); |
| 908 | | - style_submenu_element("Stats", "%R/stat"); |
| 962 | + if( zFormat[0] ){ |
| 963 | + va_list ap; |
| 964 | + va_start(ap, zFormat); |
| 965 | + zErr = vmprintf(zFormat, ap); |
| 966 | + va_end(ap); |
| 967 | + style_header("Bad Request"); |
| 968 | + @ <h1>/%h(g.zPath): %h(zErr)</h1> |
| 969 | + fossil_free(zErr); |
| 970 | + showAll = 0; |
| 971 | + if( !isAuth ){ |
| 972 | + style_footer(); |
| 973 | + return; |
| 974 | + } |
| 975 | + }else if( !isAuth ){ |
| 976 | + login_needed(0); |
| 977 | + return; |
| 978 | + }else{ |
| 979 | + style_header("Environment Test"); |
| 980 | + showAll = PB("showall"); |
| 981 | + style_submenu_checkbox("showall", "Cookies", 0, 0); |
| 982 | + style_submenu_element("Stats", "%R/stat"); |
| 983 | + } |
| 909 | 984 | |
| 910 | 985 | #if !defined(_WIN32) |
| 911 | 986 | @ uid=%d(getuid()), gid=%d(getgid())<br /> |
| 912 | 987 | #endif |
| 913 | 988 | @ g.zBaseURL = %h(g.zBaseURL)<br /> |
| 914 | 989 | @ g.zHttpsURL = %h(g.zHttpsURL)<br /> |
| 915 | 990 | @ g.zTop = %h(g.zTop)<br /> |
| 916 | 991 | @ g.zPath = %h(g.zPath)<br /> |
| 917 | | - for(i=0, c='a'; c<='z'; c++){ |
| 918 | | - if( login_has_capability(&c, 1, 0) ) zCap[i++] = c; |
| 919 | | - } |
| 920 | | - zCap[i] = 0; |
| 921 | 992 | @ g.userUid = %d(g.userUid)<br /> |
| 922 | 993 | @ g.zLogin = %h(g.zLogin)<br /> |
| 923 | 994 | @ g.isHuman = %d(g.isHuman)<br /> |
| 924 | 995 | if( g.nRequest ){ |
| 925 | 996 | @ g.nRequest = %d(g.nRequest)<br /> |
| 926 | 997 | } |
| 927 | 998 | if( g.nPendingRequest>1 ){ |
| 928 | 999 | @ g.nPendingRequest = %d(g.nPendingRequest)<br /> |
| 929 | 1000 | } |
| 930 | | - @ capabilities = %s(zCap)<br /> |
| 931 | | - for(i=0, c='a'; c<='z'; c++){ |
| 932 | | - if( login_has_capability(&c, 1, LOGIN_ANON) |
| 933 | | - && !login_has_capability(&c, 1, 0) ) zCap[i++] = c; |
| 934 | | - } |
| 935 | | - zCap[i] = 0; |
| 936 | | - if( i>0 ){ |
| 937 | | - @ anonymous-adds = %s(zCap)<br /> |
| 1001 | + @ capabilities = %s(find_capabilities(zCap))<br /> |
| 1002 | + if( zCap[0] ){ |
| 1003 | + @ anonymous-adds = %s(find_anon_capabilities(zCap))<br /> |
| 938 | 1004 | } |
| 939 | 1005 | @ g.zRepositoryName = %h(g.zRepositoryName)<br /> |
| 940 | 1006 | @ load_average() = %f(load_average())<br /> |
| 941 | 1007 | @ cgi_csrf_safe(0) = %d(cgi_csrf_safe(0))<br /> |
| 942 | 1008 | @ <hr /> |
| | @@ -946,21 +1012,7 @@ |
| 946 | 1012 | @ <hr /> |
| 947 | 1013 | @ <pre> |
| 948 | 1014 | @ %h(blob_str(&g.httpHeader)) |
| 949 | 1015 | @ </pre> |
| 950 | 1016 | } |
| 951 | | - if( g.perm.Setup ){ |
| 952 | | - const char *zRedir = P("redirect"); |
| 953 | | - if( zRedir ) cgi_redirect(zRedir); |
| 954 | | - } |
| 955 | 1017 | style_footer(); |
| 956 | | - if( g.perm.Admin && P("err") ) fossil_fatal("%s", P("err")); |
| 957 | | -} |
| 958 | | - |
| 959 | | -/* |
| 960 | | -** WEBPAGE: honeypot |
| 961 | | -** This page is a honeypot for spiders and bots. |
| 962 | | -*/ |
| 963 | | -void honeypot_page(void){ |
| 964 | | - cgi_set_status(403, "Forbidden"); |
| 965 | | - @ <p>Please enable javascript or log in to see this content</p> |
| 966 | 1018 | } |
| 967 | 1019 | |