bagder: curl-www/dl mod_entry.cgi,1.5,1.6

Update of /cvsroot/curl/curl-www/dl
In directory labb:/tmp/cvs-serv18343

Modified Files:
	mod_entry.cgi 
Log Message:
detect unescaped HTML data and escape it before printing, clean up the HTML -
this HTML now validates fine on w3.org!


Index: mod_entry.cgi
===================================================================
RCS file: /cvsroot/curl/curl-www/dl/mod_entry.cgi,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -d -r1.5 -r1.6
--- mod_entry.cgi	10 May 2005 11:16:07 -0000	1.5
+++ mod_entry.cgi	10 May 2005 22:10:11 -0000	1.6
@@ -99,6 +99,17 @@
                 $found=1;
             }
             my $val = $_;#CGI::escapeHTML($_);
+
+            # while we continue to have a few unescaped things in the
+            # database, we scan for a few known villain and run escape on the
+            # string then.
+            if($val =~ /[<>]/) {
+                $val = CGI::escapeHTML($val);
+            }
+            elsif(($val =~ /&/) && ($val !~ /&(lt|gt|amp|quot)\;/)) {
+                $val = CGI::escapeHTML($val);
+            }
+
             print "<option$s>$val</option>\n";
         }
         print "</select>\n";
@@ -120,9 +131,7 @@
 {
 #####################################################3
 ##### Visa formuläret
-    print "<table class=\"mod_entry\">";
-    print "<form action=\"$cgi\" method=post>\n";
-
+    print "<form action=\"$cgi\" method=\"post\">\n";
 ##### Dolda saker
     if ($id ne "") {
         print "<input type=hidden name=\"__id\" value=\"$id\">\n";
@@ -130,6 +139,8 @@
         print $$ref{"modify_time"},"\">\n";
     }
 
+    print "<table class=\"mod_entry\">";
+
 ##### Textinmatning
 
     alternative("Operating System", "os",

_______________________________________________
http://cool.haxx.se/mailman/listinfo/curl-www-commits