Mercurial > hgrepos > hgweb.cgi > s4
comparison s4-blog.sh @ 579:6e727ab07c98
Sanitize argument from cgi with numericalize()
| author | HIROSE Yuuji <yuuji@gentei.org> |
|---|---|
| date | Sat, 15 Jun 2019 14:33:39 +0900 |
| parents | e4e207222ee9 |
| children | dfa90fbc05bd |
comparison
equal
deleted
inserted
replaced
| 578:c064c7d357dc | 579:6e727ab07c98 |
|---|---|
| 647 err ishandoutsub: sql="$sql" | 647 err ishandoutsub: sql="$sql" |
| 648 echo "$sql" | lshandout_ulink_table | 648 echo "$sql" | lshandout_ulink_table |
| 649 } | 649 } |
| 650 gethandout() { | 650 gethandout() { |
| 651 # $1=rowid of blog | 651 # $1=rowid of blog |
| 652 blog_writable $1 $user | 652 rid=`numericalize "$1"` |
| 653 blog_writable $rid $user | |
| 653 rc=$? # =0: writable, $BLOG_NOTMEM bit set => not member | 654 rc=$? # =0: writable, $BLOG_NOTMEM bit set => not member |
| 654 if [ $((rc & $BLOG_NOTMEM)) -gt 0 ] ; then | 655 if [ $((rc & $BLOG_NOTMEM)) -gt 0 ] ; then |
| 655 echo "メンバー以外は利用できません。" | html p; return | 656 echo "メンバー以外は利用できません。" | html p; return |
| 656 fi | 657 fi |
| 657 i=0 | 658 i=0 |
| 658 bd=$tmpd/archive.$$ | 659 bd=$tmpd/archive.$$ |
| 659 mkdir $bd | 660 mkdir $bd |
| 660 query "select m.rowid,author,m.val from article a join article_m m\ | 661 query "select m.rowid,author,m.val from article a join article_m m\ |
| 661 on a.id=m.id where blogid=(select id from blog where rowid=$1)\ | 662 on a.id=m.id where blogid=(select id from blog where rowid=$rid)\ |
| 662 and m.key in ('image', 'document', 'binary');" \ | 663 and m.key in ('image', 'document', 'binary');" \ |
| 663 | while IFS='|' read rowid author filename; do | 664 | while IFS='|' read rowid author filename; do |
| 664 err isfilereadable $user article_m $rowid | 665 err isfilereadable $user article_m $rowid |
| 665 isfilereadable $user article_m $rowid || continue | 666 isfilereadable $user article_m $rowid || continue |
| 666 err ok | 667 err ok |
| 984 dumptable html blog 'ctime title heading' "$cond" | 985 dumptable html blog 'ctime title heading' "$cond" |
| 985 ) | 986 ) |
| 986 | 987 |
| 987 blog_addentry() { | 988 blog_addentry() { |
| 988 # $1=GRPname(if it is a group) | 989 # $1=GRPname(if it is a group) |
| 989 grprowid=$1 | 990 grprowid=`numericalize $1` |
| 990 rowid=`getpar rowid` | 991 rowid=`getpar rowid` |
| 991 ## err blog_addentry0: rowid=$rowid | 992 ## err blog_addentry0: rowid=$rowid |
| 992 if [ -n "$grprowid" ]; then | 993 if [ -n "$grprowid" ]; then |
| 993 owner=`getgroupbyid $grprowid` | 994 owner=`getgroupbyid $grprowid` |
| 994 else | 995 else |
| 995 owner=`getpar owner` | 996 owner=`getpar owner` |
| 996 fi | 997 fi |
| 997 err blog-add: \$1=$1 rowid=$rowid owner=$owner | 998 err blog-add: \$1=$grprowid rowid=$rowid owner=$owner |
| 998 if isgroup "$owner"; then | 999 if isgroup "$owner"; then |
| 999 groupmode=1 listing=$owner guide="[${owner}]" GF_OWNER=$owner | 1000 groupmode=1 listing=$owner guide="[${owner}]" GF_OWNER=$owner |
| 1000 else | 1001 else |
| 1001 usermode=1 listing=$user guide="[個人]" | 1002 usermode=1 listing=$user guide="[個人]" |
| 1002 fi | 1003 fi |
| 1045 $layout/html.m4.html \ | 1046 $layout/html.m4.html \ |
| 1046 $layout/form+dump-whead.m4.html | 1047 $layout/form+dump-whead.m4.html |
| 1047 } | 1048 } |
| 1048 | 1049 |
| 1049 blog_reply() { # Posting to blog article | 1050 blog_reply() { # Posting to blog article |
| 1050 rowid=$1 | 1051 rowid=`numericalize $1` # Ensure (already purified in s4.cgi) |
| 1051 | 1052 |
| 1052 if [ -z "$rowid" ]; then | 1053 if [ -z "$rowid" ]; then |
| 1053 echo "表示する日記番号が未指定です。" | html p | 1054 echo "表示する日記番号が未指定です。" | html p |
| 1054 return | 1055 return |
| 1055 fi | 1056 fi |
