1.1 --- a/s4-cgi.sh	Mon Jun 20 00:02:52 2016 +0859
     1.2 +++ b/s4-cgi.sh	Fri Jun 08 09:36:21 2018 +0900
     1.3 @@ -43,21 +43,24 @@
     1.4  EOF
     1.5  }
     1.6  cgi_text() {
     1.7 -  echo "<input type=\"text\" name=\"$1\" value=\"$2\" $3>"
     1.8 +  _v=`echo "$2"|htmlescape`
     1.9 +  echo "<input type=\"text\" name=\"$1\" value=\"$_v\" $3>"
    1.10  }
    1.11  cgi_textarea() {
    1.12 +  _v=`echo "$2"|htmlescape`
    1.13    cat<<EOF
    1.14 -<textarea name="$1" $3>$2</textarea>
    1.15 +<textarea name="$1" $3>$_v</textarea>
    1.16  EOF
    1.17  }
    1.18  cgi_file() (			# In a subshell
    1.19    # $1=name $2=val(as filename) $3=args(if any)
    1.20 +  ## err cgi_file: \$1=$1 \$2=$2 \$3="[$3]"
    1.21    # Using global variable $dir
    1.22 -  if [ -s $dir/$2 -a -s $dir/$2.content-type ]; then
    1.23 +  if [ -n "$2" -a -s "$dir/$2" ]; then
    1.24      file=$dir/$2
    1.25      bn=${file##*/}
    1.26 -    ct=`cat $dir/$2.content-type`
    1.27 -    data=`percenthex $file`
    1.28 +    ct=`file --mime-type - < "$dir/$2" | cut -d' ' -f2`
    1.29 +    data=`percenthex "$file"`
    1.30      icon="<img src=\"data:$ct,$data\">"
    1.31    fi
    1.32    cat<<EOF
    1.33 @@ -72,17 +75,9 @@
    1.34    n=`cat $dir/$name.count`
    1.35    echo '<table class="text">'
    1.36    while [ $i -le $n ]; do
    1.37 -    file=$name.$i	ctf=$dir/$name.content-type
    1.38 -    vname=$file.`cat $dir/$file.rowid`
    1.39 -    if [ -s $ctf ]; then
    1.40 -      case `cat $ctf` in
    1.41 -	*:[Ii]mage:*)
    1.42 -	  
    1.43 -	;;
    1.44 -	
    1.45 -      esac
    1.46 -    fi
    1.47 -    val="`cat $dir/$file|htmlescape`"
    1.48 +    file=$name.$i
    1.49 +    vname=$file.`cat "$dir/$file.rowid"`
    1.50 +    val="`cat $dir/$file`"
    1.51      cat<<EOF
    1.52   <tr><td>($i)</td><td>
    1.53  <input class="action" type="radio" name="action.$vname" id="keep.$vname"
    1.54 @@ -119,7 +114,7 @@
    1.55    echo "<datalist id=\"$1\">"
    1.56    shift
    1.57    for i; do
    1.58 -    echo "<option value=\"`echo "$i"|unhexize`\"></option>"
    1.59 +    echo "<option value=\"`echo "$i"|unhexize|htmlescape`\"></option>"
    1.60    done
    1.61    echo "</datalist>"
    1.62  }