--- web/cgi-bin/docs.cgi 2000/11/02 20:59:43 1.2 +++ web/cgi-bin/docs.cgi 2001/05/06 19:16:40 1.5 @@ -19,11 +19,26 @@ my ($bottom) = "../bottom.inc"; my ($query) = new CGI; -my ($doc) = ($query->param('doc') =~ /^\s*(.*?\.txt)\s*$/); -$doc = "../documentation/".$doc; +# Note filenames may only have one dot in them, in the ".txt". +# This prevents malicious users using "../" to view files. +my ($doc) = ($query->param('doc') =~ /^\s*([^\.]*?\.txt)\s*$/); + print "Content-type: text/html\n\n"; +unless (defined $doc) { + print "The link to this page was broken - it must specify a .txt file."; + exit; +} + +# Prevent hackers from supplying a malformed document string. +# I.e. only allow normal characters, slashes and dots. +unless ($doc =~ /^[a-zA-Z_\-0-9\.\/]+$/) { + print "Go Away, you nasty hax0r!"; + exit; +} +$doc = "../documentation/".$doc; + print <<"END"; @@ -77,6 +92,20 @@ exit 0; # Print a file, whilst escaping HTML: - sub print_file ($) { + my ($urls) = '(' . join ('|', qw{ + http + telnet + gopher + file + wais + ftp + } ) + . ')'; + + my ($ltrs) = '\w'; + my ($gunk) = '/#~:.?+=&%@!\-'; + my ($punc) = '.:?\-'; + my ($any) = "${ltrs}${gunk}${punc}"; my ($filename) = @_; open(FILE, $filename) or die "Cannot open $filename: $!\n"; print "
\n";
@@ -87,6 +116,7 @@ sub print_file ($) {
         s//>/g;
         s/"/"/g;
+        s/\b($urls:[$any]+?)(?=[$punc]*[^$any]|$)/$1<\/a>/igox;
         print;
     }
     print "
"; @@ -95,5 +125,5 @@ sub print_file ($) { # Print a file without escaping HTML: - sub print_html ($) { my ($filename) = @_; - print `cat $filename`; + print `cat $filename 2>&1`; }