← Back to branch summary

~ubuntu-branches/ubuntu/quantal/apt-cacher-ng/quantal-backports

« back to all changes in this revision

Viewing changes to source/showinfo.cc

  • Committer: Bazaar Package Importer
  • Author(s): Eduard Bloch
  • Date: 2011-08-01 23:40:11 UTC
  • mfrom: (1.1.29 upstream) (29.1.13 sid)
  • Revision ID: james.westby@ubuntu.com-20110801234011-2ouft5pay71773vs
Tags: 0.6.4-1
http://bugs.debian.org/628995
http://bugs.debian.org/616091
* New upstream version
  + fixes potential pipeline freeze (closes: #628995)
  + supports "soft" blacklisting of bad hosts when important files are
    missing (see keyfile in documentation, closes: #616091)

Show diffs side-by-side

added added

removed removed

Lines of Context:
source/showinfo.cc
4
4
#include "meta.h"
5
5
#include "acfg.h"
6
6
#include "filereader.h"
 
7
#include "fileio.h"
7
8
 
8
9
using namespace MYSTD;
9
10
 
24
25
{
25
26
}
26
27
 
27
 
/// Not used, Run is overriden instead
28
 
void tStaticFileSend::Action(const MYSTD::string & src)
 
28
void tStaticFileSend::ModContents(mstring & contents, cmstring &cmd)
29
29
{
 
30
        StrSubst(contents, "$SERVERIP", GetHostname());
 
31
        StrSubst(contents, "$SERVERPORT", acfg::port.c_str());
 
32
        StrSubst(contents, "$REPAGE", SZPATHSEPUNIX + acfg::reportpage);
 
33
 
 
34
        tSS footer;
 
35
        _AddFooter(footer);
 
36
        StrSubst(contents, "$FOOTER", footer);
 
37
 
 
38
        if (contents.find("@") != stmiss)
 
39
        {
 
40
                char buf[1024];
 
41
                // ok, needs a set of advanced variables
 
42
                gethostname(buf, _countof(buf));
 
43
                StrSubst(contents, "@H", buf);
 
44
                if (acfg::exfailabort)
 
45
                        StrSubst(contents, "@A", "checked");
 
46
                if (contents.find("@T") != stmiss)
 
47
                {
 
48
                        StrSubst(contents, "@T", cmd.find("doCount") != stmiss
 
49
                                        ? aclog::GetStatReport()
 
50
                                        : szReportButton);
 
51
                }
 
52
        }
 
53
 
30
54
}
31
55
 
32
56
void tStaticFileSend::Run(const string &cmd)
33
57
{
34
58
        LOGSTART2("tStaticFileSend::Run", cmd);
35
 
        tSS buf(1023);
 
59
 
36
60
        string contents;
37
61
        filereader fr;
38
62
        if(!fr.OpenFile(acfg::confdir+SZPATHSEP+m_sFileName))
41
65
        else
42
66
        {
43
67
                contents.assign(fr.GetBuffer(), fr.GetSize());
44
 
                StrSubst(contents, "$SERVERIP", GetHostname());
45
 
                StrSubst(contents, "$SERVERPORT", acfg::port.c_str());
46
 
                StrSubst(contents, "$REPAGE", SZPATHSEPUNIX + acfg::reportpage);
47
 
 
48
 
                tSS footer;
49
 
                _AddFooter(footer);
50
 
                StrSubst(contents, "$FOOTER", footer);
51
 
 
52
 
                if(contents.find("@") != stmiss)
53
 
                {
54
 
                        // ok, needs a set of advanced variables
55
 
                        gethostname(buf.wptr(), buf.freecapa());
56
 
                        StrSubst(contents, "@H",buf.rptr());
57
 
                        if(acfg::exfailabort)
58
 
                                StrSubst(contents, "@A", "checked");
59
 
                        if(contents.find("@T") != stmiss)
60
 
                        {
61
 
                                StrSubst(contents, "@T",
62
 
                                                cmd.find("doCount")!=stmiss ? aclog::GetStatReport() : szReportButton);
63
 
                        }
64
 
                }
 
68
                ModContents(contents, cmd);
65
69
        }
66
 
        buf.clear();
 
70
        tSS buf(1023);
67
71
        buf << "HTTP/1.1 " << (m_sHttpCode ? m_sHttpCode : "200")
68
72
                        << " OK\r\nConnection: close\r\nContent-Type: "
69
73
                        << (m_sMimeType?m_sMimeType:"text/html")
71
75
        SendRawData(buf.rptr(), buf.size(), MSG_MORE);
72
76
        SendRawData(contents.data(), contents.length(), 0);
73
77
}
 
78
 
 
79
 
 
80
void tDeleter::ModContents(mstring & contents, cmstring &cmd)
 
81
{
 
82
#define BADCHARS "<>\"'|\t"
 
83
        tStrPos qpos=cmd.find("?");
 
84
 
 
85
        if(cmd.find_first_of(BADCHARS)!=stmiss // what the f..., XSS attempt?
 
86
                        || qpos==stmiss)
 
87
        {
 
88
                contents.clear();
 
89
                return;
 
90
        }
 
91
        tStrVec toks, files;
 
92
        bool bConfirmMode(stmiss==cmd.find("doDeleteYes"));
 
93
        tSS sHidParms;
 
94
 
 
95
        Tokenize(cmd.substr(qpos+1), "&", toks);
 
96
        for(tStrVecIterConst it=toks.begin(); it!=toks.end(); it++)
 
97
        {
 
98
                char *sep(0);
 
99
                if(startsWithSz(*it, "kf")
 
100
                                && strtoul(it->c_str()+2, &sep, 10)>0
 
101
                                && sep && '=' == *sep)
 
102
                {
 
103
                        files.push_back(UrlDecode(sep+1));
 
104
                }
 
105
        }
 
106
 
 
107
        // do stricter path checks and prepare the query page data
 
108
 
 
109
        unsigned int lfd(1);
 
110
        for(tStrVecIterConst it=files.begin(); it!=files.end(); it++)
 
111
        {
 
112
                if(it->find_first_of(BADCHARS)!=stmiss  // what the f..., XSS attempt?
 
113
                                || stmiss != it->find("..") )
 
114
                {
 
115
                        contents.clear();
 
116
                        return;
 
117
                }
 
118
                if(bConfirmMode)
 
119
                {
 
120
                        sHidParms << "<input type=\"hidden\" name=\"kf" << ++lfd << "\" value=\""
 
121
                                        << *it <<"\">\n";
 
122
                }
 
123
                else
 
124
                {
 
125
                        sHidParms<<"Deleting " << *it<<"<br>\n";
 
126
                        ::unlink((acfg::cacheDirSlash+*it).c_str());
 
127
                        ::unlink((acfg::cacheDirSlash+*it+".head").c_str());
 
128
                }
 
129
 
 
130
        }
 
131
        StrSubst(contents, "$COUNT", ltos(files.size()));
 
132
        StrSubst(contents, "$STUFF", sHidParms);
 
133
 
 
134
        if(!bConfirmMode)
 
135
        {
 
136
                StrSubst(contents, "$VISACTION", "visible");
 
137
                StrSubst(contents, "$VISQUESTION", "hidden");
 
138
        }
 
139
        else // just confirm
 
140
        {
 
141
                StrSubst(contents, "$VISACTION", "hidden");
 
142
                StrSubst(contents, "$VISQUESTION", "visible");
 
143
        }
 
144
}
 
145