Fossil SCM

The auto-hyperlink setting now also applies of the fossil-client-ok cookie is present and valid.

drh 2026-08-06 12:46 UTC trunk
Commit fc8cefb6419d288e92e897f3b568b10fa52df05f14c6b5d2d9c2fa251a9385d4
Parent 35a09aea15efbe5…
3 files changed +20 -2 +1 -1 +10 -8
~ src/robot.c ~ src/security_audit.c ~ src/setup.c
M src/robot.c
+20 -2
--- src/robot.c
+++ src/robot.c
@@ -90,10 +90,28 @@
9090
 }
9191
 }
9292
 robot.h1 = (h1 % 900000000) + 100000000;
9393
 robot.h2 = (h2 % 900000000) + 100000000;
9494
 }
95
+
96
+/*
97
+** Remember that the client is human, as evidenced by the presence of
98
+** the fossil-client-ok or similar proof of work. Enable hyperlinks if
99
+** auto-hyperlink is turned on.
100
+*/
101
+static void remember_is_human(void){
102
+ robot.resultCache = KNOWN_NOT_ROBOT;
103
+ if( g.perm.Hyperlink==0 ){
104
+ int autoLink = db_get_int("auto-hyperlink",1);
105
+ if( autoLink==1 ){
106
+ g.jsHref = 1;
107
+ g.perm.Hyperlink = 1;
108
+ }else if( autoLink==2 ){
109
+ g.perm.Hyperlink = 1;
110
+ }
111
+ }
112
+}
95113
96114
 /*
97115
 ** Return true if the HTTP client has not demonstrated that it is
98116
 ** human interactive. Return false is the HTTP client might be
99117
 ** a non-interactive robot.
@@ -140,11 +158,11 @@
140158
 z = P(ROBOT_COOKIE);
141159
 if( z ){
142160
 unsigned h = atoi(z);
143161
 robot_pow_hash();
144162
 if( (h==robot.h1 || h==robot.h2) && !cgi_is_qp(ROBOT_COOKIE) ){
145
- robot.resultCache = KNOWN_NOT_ROBOT;
163
+ remember_is_human();
146164
 return 0;
147165
 }
148166
 }
149167
150168
 /* Condition 3: There is a "proof=VALUE" query parameter with a valid
@@ -155,11 +173,11 @@
155173
 if( z ){
156174
 unsigned h = atoi(z);
157175
 robot_pow_hash();
158176
 if( h==robot.h1 || h==robot.h2 ){
159177
 cgi_set_cookie(ROBOT_COOKIE,z,"/",900);
160
- robot.resultCache = KNOWN_NOT_ROBOT;
178
+ remember_is_human();
161179
 return 0;
162180
 }
163181
 cgi_tag_query_parameter("proof");
164182
 }
165183
166184
--- src/robot.c
+++ src/robot.c
@@ -90,10 +90,28 @@
90 }
91 }
92 robot.h1 = (h1 % 900000000) + 100000000;
93 robot.h2 = (h2 % 900000000) + 100000000;
94 }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
95
96 /*
97 ** Return true if the HTTP client has not demonstrated that it is
98 ** human interactive. Return false is the HTTP client might be
99 ** a non-interactive robot.
@@ -140,11 +158,11 @@
140 z = P(ROBOT_COOKIE);
141 if( z ){
142 unsigned h = atoi(z);
143 robot_pow_hash();
144 if( (h==robot.h1 || h==robot.h2) && !cgi_is_qp(ROBOT_COOKIE) ){
145 robot.resultCache = KNOWN_NOT_ROBOT;
146 return 0;
147 }
148 }
149
150 /* Condition 3: There is a "proof=VALUE" query parameter with a valid
@@ -155,11 +173,11 @@
155 if( z ){
156 unsigned h = atoi(z);
157 robot_pow_hash();
158 if( h==robot.h1 || h==robot.h2 ){
159 cgi_set_cookie(ROBOT_COOKIE,z,"/",900);
160 robot.resultCache = KNOWN_NOT_ROBOT;
161 return 0;
162 }
163 cgi_tag_query_parameter("proof");
164 }
165
166
--- src/robot.c
+++ src/robot.c
@@ -90,10 +90,28 @@
90 }
91 }
92 robot.h1 = (h1 % 900000000) + 100000000;
93 robot.h2 = (h2 % 900000000) + 100000000;
94 }
95
96 /*
97 ** Remember that the client is human, as evidenced by the presence of
98 ** the fossil-client-ok or similar proof of work. Enable hyperlinks if
99 ** auto-hyperlink is turned on.
100 */
101 static void remember_is_human(void){
102 robot.resultCache = KNOWN_NOT_ROBOT;
103 if( g.perm.Hyperlink==0 ){
104 int autoLink = db_get_int("auto-hyperlink",1);
105 if( autoLink==1 ){
106 g.jsHref = 1;
107 g.perm.Hyperlink = 1;
108 }else if( autoLink==2 ){
109 g.perm.Hyperlink = 1;
110 }
111 }
112 }
113
114 /*
115 ** Return true if the HTTP client has not demonstrated that it is
116 ** human interactive. Return false is the HTTP client might be
117 ** a non-interactive robot.
@@ -140,11 +158,11 @@
158 z = P(ROBOT_COOKIE);
159 if( z ){
160 unsigned h = atoi(z);
161 robot_pow_hash();
162 if( (h==robot.h1 || h==robot.h2) && !cgi_is_qp(ROBOT_COOKIE) ){
163 remember_is_human();
164 return 0;
165 }
166 }
167
168 /* Condition 3: There is a "proof=VALUE" query parameter with a valid
@@ -155,11 +173,11 @@
173 if( z ){
174 unsigned h = atoi(z);
175 robot_pow_hash();
176 if( h==robot.h1 || h==robot.h2 ){
177 cgi_set_cookie(ROBOT_COOKIE,z,"/",900);
178 remember_is_human();
179 return 0;
180 }
181 cgi_tag_query_parameter("proof");
182 }
183
184
M src/security_audit.c
+1 -1
--- src/security_audit.c
+++ src/security_audit.c
@@ -531,11 +531,11 @@
531531
 @ Suggested remediation:
532532
 @ <ol type="a">
533533
 @ <li>Remove the 'h' privilege from the
534534
 @ <a href="%R/setup_uedit?id=%d(nobodyId)">'nobody' user</a> so that
535535
 @ robots cannot see hyperlinks.
536
- @ <li>Activate <a href="%R/setup_robot">autohyperlink</a> so that
536
+ @ <li>Activate <a href="%R/setup_robot">auto-hyperlink</a> so that
537537
 @ human readers can still see hyperlinks even if they are not logged in.
538538
 @ Set the delay to at least 50 milliseconds and require a mouse
539539
 @ event for maximum robot defense.
540540
 if( anonId>0 ){
541541
 @ <li>Perhaps set the 'h' privilege on the
542542
--- src/security_audit.c
+++ src/security_audit.c
@@ -531,11 +531,11 @@
531 @ Suggested remediation:
532 @ <ol type="a">
533 @ <li>Remove the 'h' privilege from the
534 @ <a href="%R/setup_uedit?id=%d(nobodyId)">'nobody' user</a> so that
535 @ robots cannot see hyperlinks.
536 @ <li>Activate <a href="%R/setup_robot">autohyperlink</a> so that
537 @ human readers can still see hyperlinks even if they are not logged in.
538 @ Set the delay to at least 50 milliseconds and require a mouse
539 @ event for maximum robot defense.
540 if( anonId>0 ){
541 @ <li>Perhaps set the 'h' privilege on the
542
--- src/security_audit.c
+++ src/security_audit.c
@@ -531,11 +531,11 @@
531 @ Suggested remediation:
532 @ <ol type="a">
533 @ <li>Remove the 'h' privilege from the
534 @ <a href="%R/setup_uedit?id=%d(nobodyId)">'nobody' user</a> so that
535 @ robots cannot see hyperlinks.
536 @ <li>Activate <a href="%R/setup_robot">auto-hyperlink</a> so that
537 @ human readers can still see hyperlinks even if they are not logged in.
538 @ Set the delay to at least 50 milliseconds and require a mouse
539 @ event for maximum robot defense.
540 if( anonId>0 ){
541 @ <li>Perhaps set the 'h' privilege on the
542
M src/setup.c
+10 -8
--- src/setup.c
+++ src/setup.c
@@ -418,15 +418,15 @@
418418
 ** auto-hyperlink related robot defense settings.
419419
 */
420420
 static void addAutoHyperlinkSettings(void){
421421
 static const char *const azDefenseOpts[] = {
422422
 "0", "Off",
423
- "2", "UserAgent only",
424
- "1", "UserAgent and Javascript",
423
+ "2", "HTTP Header Only",
424
+ "1", "HTTP Header And Javascript",
425425
 };
426426
 multiple_choice_attribute(
427
- "Enable hyperlinks base on User-Agent and/or Javascript",
427
+ "Enable hyperlinks base on HTTP Header and/or Javascript",
428428
 "auto-hyperlink", "autohyperlink", "1",
429429
 count(azDefenseOpts)/2, azDefenseOpts);
430430
 @ <br>
431431
 entry_attribute("Delay in milliseconds before enabling hyperlinks", 5,
432432
 "auto-hyperlink-delay", "ah-delay", "50", 0);
@@ -435,16 +435,18 @@
435435
 "auto-hyperlink-mouseover", "ahmo", 0, 0);
436436
 @ <p>Enable hyperlinks (the equivalent of the "h" permission) for all users,
437437
 @ including user "nobody" if the request appears to be from a human.
438438
 @ Disabling hyperlinks helps prevent robots from walking your site and
439439
 @ soaking up all your CPU and bandwidth.
440
- @ If this setting is "UserAgent only" (2) then the
441
- @ UserAgent string is the only factor considered. If the value of this
442
- @ setting is "UserAgent And Javascript" (1) then Javascript is added that
440
+ @ If this setting is "HTTP Header Only" (2) then only the HTTP header
441
+ @ content (including the UserAgent string and the fossil-client-ok cookie)
442
+ @ is considered when enabling hyperlinks. If the value of this
443
+ @ setting is "HTTP Header And Javascript" (1) then Javascript is added that
443444
 @ runs after the page loads and fills in the href= values of &lt;a&gt;
444
- @ elements. In either case, &lt;a&gt; tags are not generated if the
445
- @ UserAgent string indicates that the client is a robot.
445
+ @ elements. In either case, &lt;a&gt; tags are not generated unless the
446
+ @ UserAgent string and/or the fossil-client-ok cookie indicate that the
447
+ @ client is likely human.
446448
 @ (Property: "auto-hyperlink")</p>
447449
 @
448450
 @ <p>For maximum robot defense, "Delay" should be at least 50 milliseconds
449451
 @ and "require a mouse event" should be turned on. These values only come
450452
 @ into play when the main auto-hyperlink settings is 2 ("UserAgent and
451453
--- src/setup.c
+++ src/setup.c
@@ -418,15 +418,15 @@
418 ** auto-hyperlink related robot defense settings.
419 */
420 static void addAutoHyperlinkSettings(void){
421 static const char *const azDefenseOpts[] = {
422 "0", "Off",
423 "2", "UserAgent only",
424 "1", "UserAgent and Javascript",
425 };
426 multiple_choice_attribute(
427 "Enable hyperlinks base on User-Agent and/or Javascript",
428 "auto-hyperlink", "autohyperlink", "1",
429 count(azDefenseOpts)/2, azDefenseOpts);
430 @ <br>
431 entry_attribute("Delay in milliseconds before enabling hyperlinks", 5,
432 "auto-hyperlink-delay", "ah-delay", "50", 0);
@@ -435,16 +435,18 @@
435 "auto-hyperlink-mouseover", "ahmo", 0, 0);
436 @ <p>Enable hyperlinks (the equivalent of the "h" permission) for all users,
437 @ including user "nobody" if the request appears to be from a human.
438 @ Disabling hyperlinks helps prevent robots from walking your site and
439 @ soaking up all your CPU and bandwidth.
440 @ If this setting is "UserAgent only" (2) then the
441 @ UserAgent string is the only factor considered. If the value of this
442 @ setting is "UserAgent And Javascript" (1) then Javascript is added that
 
443 @ runs after the page loads and fills in the href= values of &lt;a&gt;
444 @ elements. In either case, &lt;a&gt; tags are not generated if the
445 @ UserAgent string indicates that the client is a robot.
 
446 @ (Property: "auto-hyperlink")</p>
447 @
448 @ <p>For maximum robot defense, "Delay" should be at least 50 milliseconds
449 @ and "require a mouse event" should be turned on. These values only come
450 @ into play when the main auto-hyperlink settings is 2 ("UserAgent and
451
--- src/setup.c
+++ src/setup.c
@@ -418,15 +418,15 @@
418 ** auto-hyperlink related robot defense settings.
419 */
420 static void addAutoHyperlinkSettings(void){
421 static const char *const azDefenseOpts[] = {
422 "0", "Off",
423 "2", "HTTP Header Only",
424 "1", "HTTP Header And Javascript",
425 };
426 multiple_choice_attribute(
427 "Enable hyperlinks base on HTTP Header and/or Javascript",
428 "auto-hyperlink", "autohyperlink", "1",
429 count(azDefenseOpts)/2, azDefenseOpts);
430 @ <br>
431 entry_attribute("Delay in milliseconds before enabling hyperlinks", 5,
432 "auto-hyperlink-delay", "ah-delay", "50", 0);
@@ -435,16 +435,18 @@
435 "auto-hyperlink-mouseover", "ahmo", 0, 0);
436 @ <p>Enable hyperlinks (the equivalent of the "h" permission) for all users,
437 @ including user "nobody" if the request appears to be from a human.
438 @ Disabling hyperlinks helps prevent robots from walking your site and
439 @ soaking up all your CPU and bandwidth.
440 @ If this setting is "HTTP Header Only" (2) then only the HTTP header
441 @ content (including the UserAgent string and the fossil-client-ok cookie)
442 @ is considered when enabling hyperlinks. If the value of this
443 @ setting is "HTTP Header And Javascript" (1) then Javascript is added that
444 @ runs after the page loads and fills in the href= values of &lt;a&gt;
445 @ elements. In either case, &lt;a&gt; tags are not generated unless the
446 @ UserAgent string and/or the fossil-client-ok cookie indicate that the
447 @ client is likely human.
448 @ (Property: "auto-hyperlink")</p>
449 @
450 @ <p>For maximum robot defense, "Delay" should be at least 50 milliseconds
451 @ and "require a mouse event" should be turned on. These values only come
452 @ into play when the main auto-hyperlink settings is 2 ("UserAgent and
453

Keyboard Shortcuts

Open search /
Next entry (timeline) j
Previous entry (timeline) k
Open focused entry Enter
Show this help ?
Toggle theme Top nav button