danf: curl-www/auto log.cgi,1.17,1.18

Update of /cvsroot/curl/curl-www/auto
In directory labb:/tmp/cvs-serv1277

Modified Files:
	log.cgi 
Log Message:
Sanitize and escape input and output parameters.


Index: log.cgi
===================================================================
RCS file: /cvsroot/curl/curl-www/auto/log.cgi,v
retrieving revision 1.17
retrieving revision 1.18
diff -u -d -r1.17 -r1.18
--- log.cgi	16 Oct 2004 19:17:48 -0000	1.17
+++ log.cgi	5 May 2005 19:19:57 -0000	1.18
@@ -15,6 +15,9 @@
 my $indate=$req->param('date');
 
 my $id=$req->param('id');
+# Strip any unsafe log name characters
+$id =~ s/[^-0-9_a-zA-Z]//g;
+
 my @out;
 
 if($id =~ /^(\d\d\d\d)(\d\d)(\d\d)(\d\d)(\d\d)(\d\d)-(\d+)/) {
@@ -25,7 +28,7 @@
 
 print "Content-Type: text/html\n\n";
 
-header("Autobuilds - singe log");
+header("Autobuilds - single log");
 where("Autobuilds", "/auto", "Log From $year-$month-$day");
 title("Log from $year-$month-$day");
 
@@ -64,7 +67,7 @@
     push @present, $_;
 }
 
-push @out, "<div class=\"mini\">\n";
+push @out, "\n<div class=\"mini\">\n";
 for(@present) {
     chomp;
     if(checkwarn($_) || ($_ =~ /FAILED/)) {
@@ -72,7 +75,7 @@
         push @out, "<a name=\"prob$num\"></a><div class=\"warning\">$_</div>\n";
     }
     else {
-        push @out, "$_<br>\n";
+        push @out, CGI::escapeHTML($_) . "<br>\n";
     }
 }
 push @out, "</div>\n"; # end of mini-div

_______________________________________________
http://cool.haxx.se/mailman/listinfo/curl-www-commits