Fossil SCM

In /raw and /secureraw, ensure that the "m" and "at" vars are fetched before the malice check. Typo fix in cgi.c.

stephan 2023-07-17 12:18 verify-options-cgi

Commit 83015b0d9ad35644a56a3a0e9a790cd566b86b91df824bbec2410bcc5f0e8b0a

Parent 5d6efeee477ff30…

2 files changed +3 -3 +4

M src/cgi.c

+3 -3

		--- src/cgi.c
		+++ src/cgi.c
		@@ -1542,16 +1542,16 @@
1542	1542	style_submenu_enable(0);
1543	1543	style_header("Malicious Query Detected");
1544	1544	@ <h2>Begone, Knave!</h2>
1545	1545	@ <p>This page was generated because Fossil detected an (unsuccessful)
1546	1546	@ SQL injection attack or other nefarious content in your HTTP request.
1547		- @
	1547	+ @
1548	1548	@ <p>If you believe you are innocent and have reached this page in error,
1549		- @ contact the Fossil developers on the Fossil-SCM Forum. Type
	1549	+ @ contact the Fossil developers on the Fossil-SCM Forum. Type
1550	1550	@ "fossil-scm forum" into any search engine to locate the Fossil-SCM Forum.
1551	1551	style_finish_page();
1552		- cgi_set_status(418,"I'm a teapotgrep ");
	1552	+ cgi_set_status(418,"I'm a teapot");
1553	1553	cgi_reply();
1554	1554	fossil_errorlog("possible hack attempt - 418 response on \"%s\"", zName);
1555	1555	exit(0);
1556	1556	}
1557	1557
1558	1558

	--- src/cgi.c
	+++ src/cgi.c
	@@ -1542,16 +1542,16 @@
1542	style_submenu_enable(0);
1543	style_header("Malicious Query Detected");
1544	@ <h2>Begone, Knave!</h2>
1545	@ <p>This page was generated because Fossil detected an (unsuccessful)
1546	@ SQL injection attack or other nefarious content in your HTTP request.
1547	@
1548	@ <p>If you believe you are innocent and have reached this page in error,
1549	@ contact the Fossil developers on the Fossil-SCM Forum. Type
1550	@ "fossil-scm forum" into any search engine to locate the Fossil-SCM Forum.
1551	style_finish_page();
1552	cgi_set_status(418,"I'm a teapotgrep ");
1553	cgi_reply();
1554	fossil_errorlog("possible hack attempt - 418 response on \"%s\"", zName);
1555	exit(0);
1556	}
1557
1558

	--- src/cgi.c
	+++ src/cgi.c
	@@ -1542,16 +1542,16 @@
1542	style_submenu_enable(0);
1543	style_header("Malicious Query Detected");
1544	@ <h2>Begone, Knave!</h2>
1545	@ <p>This page was generated because Fossil detected an (unsuccessful)
1546	@ SQL injection attack or other nefarious content in your HTTP request.
1547	@
1548	@ <p>If you believe you are innocent and have reached this page in error,
1549	@ contact the Fossil developers on the Fossil-SCM Forum. Type
1550	@ "fossil-scm forum" into any search engine to locate the Fossil-SCM Forum.
1551	style_finish_page();
1552	cgi_set_status(418,"I'm a teapot");
1553	cgi_reply();
1554	fossil_errorlog("possible hack attempt - 418 response on \"%s\"", zName);
1555	exit(0);
1556	}
1557
1558

M src/info.c

		--- src/info.c
		+++ src/info.c
		@@ -1858,10 +1858,12 @@
1858	1858	*/
1859	1859	void rawartifact_page(void){
1860	1860	int rid = 0;
1861	1861	char *zUuid;
1862	1862
	1863	+ (void)P("at")/for cgi_check_for_malice()/;
	1864	+ (void)P("m");
1863	1865	if( P("ci") ){
1864	1866	rid = artifact_from_ci_and_filename(0);
1865	1867	}
1866	1868	if( rid==0 ){
1867	1869	rid = name_to_rid_www("name");
		@@ -1891,10 +1893,12 @@
1891	1893	*/
1892	1894	void secure_rawartifact_page(void){
1893	1895	int rid = 0;
1894	1896	const char *zName = PD("name", "");
1895	1897
	1898	+ (void)P("at")/for cgi_check_for_malice()/;
	1899	+ (void)P("m");
1896	1900	cgi_check_for_malice();
1897	1901	login_check_credentials();
1898	1902	if( !g.perm.Read ){ login_needed(g.anon.Read); return; }
1899	1903	rid = db_int(0, "SELECT rid FROM blob WHERE uuid=%Q", zName);
1900	1904	if( rid==0 ){
1901	1905

	--- src/info.c
	+++ src/info.c
	@@ -1858,10 +1858,12 @@
1858	*/
1859	void rawartifact_page(void){
1860	int rid = 0;
1861	char *zUuid;
1862


1863	if( P("ci") ){
1864	rid = artifact_from_ci_and_filename(0);
1865	}
1866	if( rid==0 ){
1867	rid = name_to_rid_www("name");
	@@ -1891,10 +1893,12 @@
1891	*/
1892	void secure_rawartifact_page(void){
1893	int rid = 0;
1894	const char *zName = PD("name", "");
1895


1896	cgi_check_for_malice();
1897	login_check_credentials();
1898	if( !g.perm.Read ){ login_needed(g.anon.Read); return; }
1899	rid = db_int(0, "SELECT rid FROM blob WHERE uuid=%Q", zName);
1900	if( rid==0 ){
1901

	--- src/info.c
	+++ src/info.c
	@@ -1858,10 +1858,12 @@
1858	*/
1859	void rawartifact_page(void){
1860	int rid = 0;
1861	char *zUuid;
1862
1863	(void)P("at")/for cgi_check_for_malice()/;
1864	(void)P("m");
1865	if( P("ci") ){
1866	rid = artifact_from_ci_and_filename(0);
1867	}
1868	if( rid==0 ){
1869	rid = name_to_rid_www("name");
	@@ -1891,10 +1893,12 @@
1893	*/
1894	void secure_rawartifact_page(void){
1895	int rid = 0;
1896	const char *zName = PD("name", "");
1897
1898	(void)P("at")/for cgi_check_for_malice()/;
1899	(void)P("m");
1900	cgi_check_for_malice();
1901	login_check_credentials();
1902	if( !g.perm.Read ){ login_needed(g.anon.Read); return; }
1903	rid = db_int(0, "SELECT rid FROM blob WHERE uuid=%Q", zName);
1904	if( rid==0 ){
1905