Fossil SCM

(cherry-pick): Fix an XSS issue with the /help webpage. Change a few %s format letters into %h

jan.nijtmans 2017-05-12 18:22 UTC branch-2.2
Commit f1a7360e621c3014faff530f914ed02f721adaca869a3a0d1a88bac119d12156
Parent cd24cf19dc618e9…
6 files changed +5 -5 +1 -1 +1 -1 +1 -1 +1 -1 +1 -1
~ src/dispatch.c ~ src/login.c ~ src/login.c ~ src/name.c ~ src/name.c ~ src/search.c
M src/dispatch.c
+5 -5
--- src/dispatch.c
+++ src/dispatch.c
@@ -243,22 +243,22 @@
243243
244244
 style_submenu_element("Command-List", "%s/help", g.zTop);
245245
 if( *zCmd=='/' ){
246246
 /* Some of the webpages require query parameters in order to work.
247247
 ** @ <h1>The "<a href='%R%s(zCmd)'>%s(zCmd)</a>" page:</h1> */
248
- @ <h1>The "%s(zCmd)" page:</h1>
248
+ @ <h1>The "%h(zCmd)" page:</h1>
249249
 }else{
250
- @ <h1>The "%s(zCmd)" command:</h1>
250
+ @ <h1>The "%h(zCmd)" command:</h1>
251251
 }
252252
 rc = dispatch_name_search(zCmd, CMDFLAG_ANY, &pCmd);
253253
 if( rc==1 ){
254
- @ unknown command: %s(zCmd)
254
+ @ unknown command: %h(zCmd)
255255
 }else if( rc==2 ){
256
- @ ambiguous command prefix: %s(zCmd)
256
+ @ ambiguous command prefix: %h(zCmd)
257257
 }else{
258258
 if( pCmd->zHelp[0]==0 ){
259
- @ no help available for the %s(pCmd->zName) command
259
+ @ no help available for the %h(pCmd->zName) command
260260
 }else{
261261
 @ <blockquote>
262262
 help_to_html(pCmd->zHelp, cgi_output_blob());
263263
 @ </blockquote>
264264
 }
265265
--- src/dispatch.c
+++ src/dispatch.c
@@ -243,22 +243,22 @@
243
244 style_submenu_element("Command-List", "%s/help", g.zTop);
245 if( *zCmd=='/' ){
246 /* Some of the webpages require query parameters in order to work.
247 ** @ <h1>The "<a href='%R%s(zCmd)'>%s(zCmd)</a>" page:</h1> */
248 @ <h1>The "%s(zCmd)" page:</h1>
249 }else{
250 @ <h1>The "%s(zCmd)" command:</h1>
251 }
252 rc = dispatch_name_search(zCmd, CMDFLAG_ANY, &pCmd);
253 if( rc==1 ){
254 @ unknown command: %s(zCmd)
255 }else if( rc==2 ){
256 @ ambiguous command prefix: %s(zCmd)
257 }else{
258 if( pCmd->zHelp[0]==0 ){
259 @ no help available for the %s(pCmd->zName) command
260 }else{
261 @ <blockquote>
262 help_to_html(pCmd->zHelp, cgi_output_blob());
263 @ </blockquote>
264 }
265
--- src/dispatch.c
+++ src/dispatch.c
@@ -243,22 +243,22 @@
243
244 style_submenu_element("Command-List", "%s/help", g.zTop);
245 if( *zCmd=='/' ){
246 /* Some of the webpages require query parameters in order to work.
247 ** @ <h1>The "<a href='%R%s(zCmd)'>%s(zCmd)</a>" page:</h1> */
248 @ <h1>The "%h(zCmd)" page:</h1>
249 }else{
250 @ <h1>The "%h(zCmd)" command:</h1>
251 }
252 rc = dispatch_name_search(zCmd, CMDFLAG_ANY, &pCmd);
253 if( rc==1 ){
254 @ unknown command: %h(zCmd)
255 }else if( rc==2 ){
256 @ ambiguous command prefix: %h(zCmd)
257 }else{
258 if( pCmd->zHelp[0]==0 ){
259 @ no help available for the %h(pCmd->zName) command
260 }else{
261 @ <blockquote>
262 help_to_html(pCmd->zHelp, cgi_output_blob());
263 @ </blockquote>
264 }
265
M src/login.c
+1 -1
--- src/login.c
+++ src/login.c
@@ -1458,11 +1458,11 @@
14581458
14591459
 if( db_exists("SELECT 1 FROM user WHERE login=%B", &login) ){
14601460
 /* Here lies the reason I don't use zErrMsg - it would not substitute
14611461
 * this %s(zUsername), or at least I don't know how to force it to.*/
14621462
 @ <p><span class="loginError">
1463
- @ %s(zUsername) already exists.
1463
+ @ %h(zUsername) already exists.
14641464
 @ </span></p>
14651465
 }else{
14661466
 char *zPw = sha1_shared_secret(blob_str(&passwd), blob_str(&login), 0);
14671467
 int uid;
14681468
 db_multi_exec(
14691469
--- src/login.c
+++ src/login.c
@@ -1458,11 +1458,11 @@
1458
1459 if( db_exists("SELECT 1 FROM user WHERE login=%B", &login) ){
1460 /* Here lies the reason I don't use zErrMsg - it would not substitute
1461 * this %s(zUsername), or at least I don't know how to force it to.*/
1462 @ <p><span class="loginError">
1463 @ %s(zUsername) already exists.
1464 @ </span></p>
1465 }else{
1466 char *zPw = sha1_shared_secret(blob_str(&passwd), blob_str(&login), 0);
1467 int uid;
1468 db_multi_exec(
1469
--- src/login.c
+++ src/login.c
@@ -1458,11 +1458,11 @@
1458
1459 if( db_exists("SELECT 1 FROM user WHERE login=%B", &login) ){
1460 /* Here lies the reason I don't use zErrMsg - it would not substitute
1461 * this %s(zUsername), or at least I don't know how to force it to.*/
1462 @ <p><span class="loginError">
1463 @ %h(zUsername) already exists.
1464 @ </span></p>
1465 }else{
1466 char *zPw = sha1_shared_secret(blob_str(&passwd), blob_str(&login), 0);
1467 int uid;
1468 db_multi_exec(
1469
M src/login.c
+1 -1
--- src/login.c
+++ src/login.c
@@ -1458,11 +1458,11 @@
14581458
14591459
 if( db_exists("SELECT 1 FROM user WHERE login=%B", &login) ){
14601460
 /* Here lies the reason I don't use zErrMsg - it would not substitute
14611461
 * this %s(zUsername), or at least I don't know how to force it to.*/
14621462
 @ <p><span class="loginError">
1463
- @ %s(zUsername) already exists.
1463
+ @ %h(zUsername) already exists.
14641464
 @ </span></p>
14651465
 }else{
14661466
 char *zPw = sha1_shared_secret(blob_str(&passwd), blob_str(&login), 0);
14671467
 int uid;
14681468
 db_multi_exec(
14691469
--- src/login.c
+++ src/login.c
@@ -1458,11 +1458,11 @@
1458
1459 if( db_exists("SELECT 1 FROM user WHERE login=%B", &login) ){
1460 /* Here lies the reason I don't use zErrMsg - it would not substitute
1461 * this %s(zUsername), or at least I don't know how to force it to.*/
1462 @ <p><span class="loginError">
1463 @ %s(zUsername) already exists.
1464 @ </span></p>
1465 }else{
1466 char *zPw = sha1_shared_secret(blob_str(&passwd), blob_str(&login), 0);
1467 int uid;
1468 db_multi_exec(
1469
--- src/login.c
+++ src/login.c
@@ -1458,11 +1458,11 @@
1458
1459 if( db_exists("SELECT 1 FROM user WHERE login=%B", &login) ){
1460 /* Here lies the reason I don't use zErrMsg - it would not substitute
1461 * this %s(zUsername), or at least I don't know how to force it to.*/
1462 @ <p><span class="loginError">
1463 @ %h(zUsername) already exists.
1464 @ </span></p>
1465 }else{
1466 char *zPw = sha1_shared_secret(blob_str(&passwd), blob_str(&login), 0);
1467 int uid;
1468 db_multi_exec(
1469
M src/name.c
+1 -1
--- src/name.c
+++ src/name.c
@@ -467,11 +467,11 @@
467467
 @ <li><p><a href="%R/%T(zSrc)/%!S(zUuid)">
468468
 @ %s(zUuid)</a> -
469469
 @ <ul></ul>
470470
 @ Ticket
471471
 hyperlink_to_uuid(zUuid);
472
- @ - %s(zTitle).
472
+ @ - %h(zTitle).
473473
 @ <ul><li>
474474
 object_description(rid, 0, 0);
475475
 @ </li></ul>
476476
 @ </p></li>
477477
 }
478478
--- src/name.c
+++ src/name.c
@@ -467,11 +467,11 @@
467 @ <li><p><a href="%R/%T(zSrc)/%!S(zUuid)">
468 @ %s(zUuid)</a> -
469 @ <ul></ul>
470 @ Ticket
471 hyperlink_to_uuid(zUuid);
472 @ - %s(zTitle).
473 @ <ul><li>
474 object_description(rid, 0, 0);
475 @ </li></ul>
476 @ </p></li>
477 }
478
--- src/name.c
+++ src/name.c
@@ -467,11 +467,11 @@
467 @ <li><p><a href="%R/%T(zSrc)/%!S(zUuid)">
468 @ %s(zUuid)</a> -
469 @ <ul></ul>
470 @ Ticket
471 hyperlink_to_uuid(zUuid);
472 @ - %h(zTitle).
473 @ <ul><li>
474 object_description(rid, 0, 0);
475 @ </li></ul>
476 @ </p></li>
477 }
478
M src/name.c
+1 -1
--- src/name.c
+++ src/name.c
@@ -467,11 +467,11 @@
467467
 @ <li><p><a href="%R/%T(zSrc)/%!S(zUuid)">
468468
 @ %s(zUuid)</a> -
469469
 @ <ul></ul>
470470
 @ Ticket
471471
 hyperlink_to_uuid(zUuid);
472
- @ - %s(zTitle).
472
+ @ - %h(zTitle).
473473
 @ <ul><li>
474474
 object_description(rid, 0, 0);
475475
 @ </li></ul>
476476
 @ </p></li>
477477
 }
478478
--- src/name.c
+++ src/name.c
@@ -467,11 +467,11 @@
467 @ <li><p><a href="%R/%T(zSrc)/%!S(zUuid)">
468 @ %s(zUuid)</a> -
469 @ <ul></ul>
470 @ Ticket
471 hyperlink_to_uuid(zUuid);
472 @ - %s(zTitle).
473 @ <ul><li>
474 object_description(rid, 0, 0);
475 @ </li></ul>
476 @ </p></li>
477 }
478
--- src/name.c
+++ src/name.c
@@ -467,11 +467,11 @@
467 @ <li><p><a href="%R/%T(zSrc)/%!S(zUuid)">
468 @ %s(zUuid)</a> -
469 @ <ul></ul>
470 @ Ticket
471 hyperlink_to_uuid(zUuid);
472 @ - %h(zTitle).
473 @ <ul><li>
474 object_description(rid, 0, 0);
475 @ </li></ul>
476 @ </p></li>
477 }
478
M src/search.c
+1 -1
--- src/search.c
+++ src/search.c
@@ -597,11 +597,11 @@
597597
 }else{
598598
 width = -1;
599599
 }
600600
601601
 db_find_and_open_repository(0, 0);
602
- if( g.argc<2 ) return;
602
+ if( g.argc<3 ) return;
603603
 blob_init(&pattern, g.argv[2], -1);
604604
 for(i=3; i<g.argc; i++){
605605
 blob_appendf(&pattern, " %s", g.argv[i]);
606606
 }
607607
 (void)search_init(blob_str(&pattern),"*","*","...",SRCHFLG_STATIC);
608608
--- src/search.c
+++ src/search.c
@@ -597,11 +597,11 @@
597 }else{
598 width = -1;
599 }
600
601 db_find_and_open_repository(0, 0);
602 if( g.argc<2 ) return;
603 blob_init(&pattern, g.argv[2], -1);
604 for(i=3; i<g.argc; i++){
605 blob_appendf(&pattern, " %s", g.argv[i]);
606 }
607 (void)search_init(blob_str(&pattern),"*","*","...",SRCHFLG_STATIC);
608
--- src/search.c
+++ src/search.c
@@ -597,11 +597,11 @@
597 }else{
598 width = -1;
599 }
600
601 db_find_and_open_repository(0, 0);
602 if( g.argc<3 ) return;
603 blob_init(&pattern, g.argv[2], -1);
604 for(i=3; i<g.argc; i++){
605 blob_appendf(&pattern, " %s", g.argv[i]);
606 }
607 (void)search_init(blob_str(&pattern),"*","*","...",SRCHFLG_STATIC);
608

Keyboard Shortcuts

Open search /
Next entry (timeline) j
Previous entry (timeline) k
Open focused entry Enter
Show this help ?
Toggle theme Top nav button