current cgi.c, 1.166, 1.167 cgisimple.c, 1.143, 1.144 cgisimple.h, 1.21, 1.22

Update of /cvsroot/ijbswa/current
In directory sfp-cvs-1.v30.ch3.sourceforge.com:/tmp/cvs-serv16094

Modified Files:
	cgi.c cgisimple.c cgisimple.h 
Log Message:
Use a dedicated cgi handler to deal with tag-toggle requests

As a result the /client-tags page is now safe to reach without
trusted Referer header which makes bookmarking or linking to
it more convenient.

Finally, refreshing the /client-tags page to show the
current state can no longer unintentionally repeat the
previous toggle request.


Index: cgi.c
===================================================================
RCS file: /cvsroot/ijbswa/current/cgi.c,v
retrieving revision 1.166
retrieving revision 1.167
diff -C2 -d -r1.166 -r1.167
*** cgi.c	23 Jan 2017 13:02:45 -0000	1.166
--- cgi.c	23 Jan 2017 13:04:57 -0000	1.167
***************
*** 102,109 ****
            TRUE },
  #ifdef FEATURE_CLIENT_TAGS
     { "client-tags",
           cgi_show_client_tags,
           "View or toggle the tags that can be set based on the clients address",
!           FALSE },
  #endif
     { "show-request",
--- 102,114 ----
            TRUE },
  #ifdef FEATURE_CLIENT_TAGS
+    /*
+     * This is marked as harmless because despite the description
+     * used in the menu the actual toggling is done through another
+     * path ("/toggle-client-tag").
+     */
     { "client-tags",
           cgi_show_client_tags,
           "View or toggle the tags that can be set based on the clients address",
!          TRUE },
  #endif
     { "show-request",
***************
*** 121,124 ****
--- 126,135 ----
           FALSE },
  #endif /* def FEATURE_TOGGLE */
+ #ifdef FEATURE_CLIENT_TAGS
+    { "toggle-client-tag",
+          cgi_toggle_client_tag,
+          NULL,
+          FALSE },
+ #endif
  #ifdef FEATURE_CGI_EDIT_ACTIONS
     { "edit-actions", /* Edit the actions list */

Index: cgisimple.h
===================================================================
RCS file: /cvsroot/ijbswa/current/cgisimple.h,v
retrieving revision 1.21
retrieving revision 1.22
diff -C2 -d -r1.21 -r1.22
*** cgisimple.h	23 Jan 2017 13:02:45 -0000	1.21
--- cgisimple.h	23 Jan 2017 13:04:58 -0000	1.22
***************
*** 73,76 ****
--- 73,79 ----
                                     struct http_response *rsp,
                                     const struct map *parameters);
+ extern jb_err cgi_toggle_client_tag(struct client_state *csp,
+                                     struct http_response *rsp,
+                                     const struct map *parameters);
  #endif
  extern jb_err cgi_transparent_image (struct client_state *csp,

Index: cgisimple.c
===================================================================
RCS file: /cvsroot/ijbswa/current/cgisimple.c,v
retrieving revision 1.143
retrieving revision 1.144
diff -C2 -d -r1.143 -r1.144
*** cgisimple.c	27 Sep 2016 22:48:28 -0000	1.143
--- cgisimple.c	23 Jan 2017 13:04:57 -0000	1.144
***************
*** 311,315 ****
  
     snprintf(form, size,
!       "<form method=\"GET\" action=\"client-tags\" style=\"display: inline\">\n"
        " <input type=\"hidden\" name=\"tag\" value=\"%s\">\n"
        " <input type=\"hidden\" name=\"toggle-state\" value=\"%u\">\n"
--- 311,315 ----
  
     snprintf(form, size,
!       "<form method=\"GET\" action=\"toggle-client-tag\" style=\"display: inline\">\n"
        " <input type=\"hidden\" name=\"tag\" value=\"%s\">\n"
        " <input type=\"hidden\" name=\"toggle-state\" value=\"%u\">\n"
***************
*** 344,351 ****
     struct client_tag_spec *this_tag;
     jb_err err = JB_ERR_OK;
-    const char *toggled_tag;
-    const char *toggle_state;
-    const char *tag_expires;
-    time_t time_to_live;
     char *client_tag_status;
     char buf[1000];
--- 344,347 ----
***************
*** 360,385 ****
     }
     assert(csp->client_address != NULL);
!    toggled_tag = lookup(parameters, "tag");
!    if (*toggled_tag != '\0')
!    {
!       tag_expires = lookup(parameters, "expires");
!       if (*tag_expires == '0')
!       {
!          time_to_live = 0;
!       }
!       else
!       {
!          time_to_live = csp->config->client_tag_lifetime;
!       }
!       toggle_state = lookup(parameters, "toggle-state");
!       if (*toggle_state == '1')
!       {
!          enable_client_specific_tag(csp, toggled_tag, time_to_live);
!       }
!       else
!       {
!          disable_client_specific_tag(csp, toggled_tag);
!       }
!    }
     this_tag = csp->config->client_tags;
     if (this_tag->name == NULL)
--- 356,360 ----
     }
     assert(csp->client_address != NULL);
! 
     this_tag = csp->config->client_tags;
     if (this_tag->name == NULL)
***************
*** 438,441 ****
--- 413,488 ----
     return template_fill_for_cgi(csp, "client-tags", exports, rsp);
  }
+ 
+ 
+ /*********************************************************************
+  *
+  * Function    :  cgi_toggle_client_tag
+  *
+  * Description :  Toggles a client tag and redirects to the show-tags
+  *                page
+  *
+  * Parameters  :
+  *          1  :  csp = Current client state (buffers, headers, etc...)
+  *          2  :  rsp = http_response data structure for output
+  *          3  :  parameters = map of cgi parameters
+  *
+  * CGI Parameters : none
+  *          1  :  tag = Name of the tag to enable or disable
+  *          2  :  toggle-state = How to toggle the tag (0/1)
+  *          3  :  expires = Set to 1 if the tag should be enabled
+  *                          temporarily, otherwise set to 0
+  *
+  * Returns     :  JB_ERR_OK on success
+  *                JB_ERR_MEMORY on out-of-memory error.
+  *
+  *********************************************************************/
+ jb_err cgi_toggle_client_tag(struct client_state *csp,
+                              struct http_response *rsp,
+                              const struct map *parameters)
+ {
+    const char *toggled_tag;
+    const char *toggle_state;
+    const char *tag_expires;
+    time_t time_to_live;
+ 
+    assert(csp);
+    assert(rsp);
+    assert(parameters);
+ 
+    toggled_tag = lookup(parameters, "tag");
+    if (*toggled_tag == '\0')
+    {
+       log_error(LOG_LEVEL_ERROR, "Received tag toggle request without tag");
+    }
+    else
+    {
+       tag_expires = lookup(parameters, "expires");
+       if (*tag_expires == '0')
+       {
+          time_to_live = 0;
+       }
+       else
+       {
+          time_to_live = csp->config->client_tag_lifetime;
+       }
+       toggle_state = lookup(parameters, "toggle-state");
+       if (*toggle_state == '1')
+       {
+          enable_client_specific_tag(csp, toggled_tag, time_to_live);
+       }
+       else
+       {
+          disable_client_specific_tag(csp, toggled_tag);
+       }
+    }
+    rsp->status = strdup_or_die("302 Done dealing with toggle request");
+    if (enlist_unique_header(rsp->headers,
+          "Location", CGI_PREFIX "client-tags"))
+    {
+          return JB_ERR_MEMORY;
+    }
+    return JB_ERR_OK;
+ 
+ }
  #endif /* def FEATURE_CLIENT_TAGS */
  


------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot