1.1 --- a/mpsplit.rb	Sun Jul 19 17:02:46 2015 +0900
     1.2 +++ b/mpsplit.rb	Mon Jul 20 11:30:39 2015 +0900
     1.3 @@ -5,8 +5,9 @@
     1.4  Encoding.default_internal = Encoding::BINARY
     1.5  
     1.6  boundary="--"+ARGV[0] # +"\r\n"
     1.7 -tmpdir=(ARGV[1] || "tmp")
     1.8 -test(?d, tmpdir) || Dir.mkdir("tmp")
     1.9 +tmpdir=(ARGV[1] || "tmp").dup
    1.10 +tmpdir.untaint
    1.11 +test(?d, tmpdir) or Dir.mkdir(tmpdir)
    1.12  stream=STDIN.readlines.join
    1.13  stream.split(boundary)[1..-2].each do |x|
    1.14    header = x.sub(/\r\n\r\n.*/, "")
    1.15 @@ -15,7 +16,8 @@
    1.16  STDERR.printf("body[%s]=[%s]\n", name, body.length)
    1.17    if /filename=(['\"]?)(.*?)\1/ =~ header && $2 > ""
    1.18      fn = $2
    1.19 -    open(File.expand_path(fn, tmpdir), "w") do |out|
    1.20 +    fn.untaint if File.dirname(fn)=="."
    1.21 +    open(File.expand_path(fn, tmpdir).untaint, "w") do |out|
    1.22        out.write body
    1.23      end
    1.24      printf("%s:filename=%s\n", name, fn)

     2.1 --- a/y4-blog.sh	Sun Jul 19 17:02:46 2015 +0900
     2.2 +++ b/y4-blog.sh	Mon Jul 20 11:30:39 2015 +0900
     2.3 @@ -252,7 +252,7 @@
     2.4  	  dir=`printf $bd/%03d $i`
     2.5  	  mkdir $dir
     2.6  	  query "select quote(bin) from article_m where rowid=$rowid;" \
     2.7 -	      | xxd -r -p > $dir/$filename
     2.8 +	      | unhexize > $dir/$filename
     2.9  	done
    2.10    if [ ! -d $bd/001 ]; then
    2.11      contenttype; echo

     3.1 --- a/y4-funcs.sh	Sun Jul 19 17:02:46 2015 +0900
     3.2 +++ b/y4-funcs.sh	Mon Jul 20 11:30:39 2015 +0900
     3.3 @@ -6,7 +6,7 @@
     3.4  myargs="$@"
     3.5  #bindir=`(cd $mydir/bin; pwd)`
     3.6  # :$bindir
     3.7 -PATH=/usr/local/sqlite3/bin:/usr/local/vim7/bin:/usr/local/ImageMagick/bin:$PATH
     3.8 +PATH=/usr/local/sqlite3/bin:/usr/local/vim7/bin:/usr/iekei/ImageMagick/bin:/usr/local/ImageMagick/bin:$PATH
     3.9  tmpdir=${TMPDIR:-tmp}
    3.10  dbdir=${DBDIR:-db}
    3.11  tmpfiles=""
    3.12 @@ -517,7 +517,7 @@
    3.13  		 #file=$td/$val
    3.14  		 file=$td/`query "select val from $cond $slice;"`
    3.15  ####tmp		 [ -s $file -a -s $td/$fn.rowid ] && continue
    3.16 -		 sq $db<<EOF | xxd -r -p > $file
    3.17 +		 sq $db<<EOF | unhexize > $file
    3.18  .output $td/$fn.rowid
    3.19  select rowid from $cond $slice;
    3.20  .output $td/$fn
    3.21 @@ -559,7 +559,7 @@
    3.22  		       if [ ! -s $file ]; then
    3.23  			## sq $db "select quote(bin) from $cond and val=\"$fn\"" \
    3.24  			 query "select quote(bin) from $cond and val=\"$fn\";" \
    3.25 -			     | xxd -r -p > $file
    3.26 +			     | unhexize > $file
    3.27  			 echo ${type#file:} > $file.content-type
    3.28  # err TTTTTTTTTTTTTTTT: $type
    3.29  			 case $type in
    3.30 @@ -631,11 +631,31 @@
    3.31      if type xxd >/dev/null 2>&1; then
    3.32        hexize="xxd -p"
    3.33      else
    3.34 -      hexize="hexdump -ve '1/1 \"%.2x\"'"
    3.35 +      hexize_hd() {
    3.36 +	hexdump -ve '1/1 "%.2x"'
    3.37 +      }
    3.38 +      hexize="hexize_hd"
    3.39      fi
    3.40    fi
    3.41    cat $1 | $hexize | tr -d '\n'
    3.42  }
    3.43 +unhexize() {
    3.44 +  if [ -z "$unhex" ]; then
    3.45 +    if type xxd >/dev/null 2>&1; then
    3.46 +      unhex="xxd -p -r"
    3.47 +    elif type perl >/dev/null 2>&1; then
    3.48 +      cat >$tmpd/unhex.pl<<EOF
    3.49 +s/([0-9a-f]{2})/print chr hex \$1/gie
    3.50 +EOF
    3.51 +      # Perl refuses -e in setuid circumstances, which can be absurdly
    3.52 +      # avoided by creating scripts in a file where its parent directory is
    3.53 +      # world writable...:)
    3.54 +      unhex="perl -n $tmpd/unhex.pl"
    3.55 +    fi
    3.56 +  fi
    3.57 +  cat $1 | $unhex
    3.58 +#  cat $1 | tee /tmp/uh.in| $unhex | tee /tmp/uh.out
    3.59 +}
    3.60  percenthex() {
    3.61    hexize $1 | sed 's/\(..\)/%\1/g'
    3.62  }
    3.63 @@ -1400,6 +1420,7 @@
    3.64    # $1=definition-file
    3.65    # Using $user and $session
    3.66    rowid=`getpar rowid`
    3.67 +err ...........rowid=$rowid
    3.68    if [ ! -e $1 ]; then
    3.69      echo "<p>テーブル定義ファイルが見付かりません</p>"
    3.70      exit 1
    3.71 @@ -1785,7 +1806,7 @@
    3.72   <table class="b $2">
    3.73  $forms
    3.74   </table>$hiddens
    3.75 - ${rowid:+<input type=\"hidden\" name=\"rowid\" value=\"$rowid\">}
    3.76 + ${rowid:+<input type="hidden" name="rowid" value="$rowid">}
    3.77  EOF
    3.78    if [ -z $GF_VIEWONLY ]; then
    3.79      cat<<EOF

     4.1 --- a/y4-init.sh	Sun Jul 19 17:02:46 2015 +0900
     4.2 +++ b/y4-init.sh	Mon Jul 20 11:30:39 2015 +0900
     4.3 @@ -42,12 +42,12 @@
     4.4  	 case $keytype in
     4.5  	   *p*|*f*)
     4.6  	     addcol=$col
     4.7 -	     pkey="$pkey${pkey:+, }$col"
     4.8  	     case $keytype in
     4.9  	       *pf*|*fp*)
    4.10  		 fkey="${fkey}, foreign key($col) references $objtype on delete cascade on update cascade"
    4.11  		 fkey2="${fkey2}, foreign key($col) references $objtype on delete cascade on update cascade" ;;
    4.12  	       *p*)
    4.13 +		 pkey="$pkey${pkey:+, }$col"
    4.14  		 fkey2="${fkey2}, foreign key($col) references $tmain($col) on delete cascade on update cascade" ;; 
    4.15  	     esac
    4.16  	     ;;

     5.1 --- a/y4.cgi	Sun Jul 19 17:02:46 2015 +0900
     5.2 +++ b/y4.cgi	Mon Jul 20 11:30:39 2015 +0900
     5.3 @@ -26,31 +26,32 @@
     5.4  stage=`getpar stage`
     5.5  stage=${stage:-$1}
     5.6  case ${stage} in
     5.7 -  "")
     5.8 +  # "")
     5.9 +  #   contenttype; echo
    5.10 +  #   m4 -D_SITE_="S System" $layout/welcome.m4.html
    5.11 +  #   # echo "<pre>"; gencookie "user=$user" "skey=$skey"; echo "</pre>"
    5.12 +  #   # echo "<pre>`env|sort -u`</pre>"
    5.13 +  #   ;;
    5.14 +  "home"|"")
    5.15      contenttype; echo
    5.16 -    m4 -D_SITE_="S System" $layout/welcome.m4.html
    5.17 -    # echo "<pre>"; gencookie "user=$user" "skey=$skey"; echo "</pre>"
    5.18 -    # echo "<pre>`env|sort -u`</pre>"
    5.19 +err HOME: just in rowid=`getpar rowid`
    5.20 +    [ -n "`getpar rowid`" ] && par2table $formdir/user.def
    5.21 +    showhome ${2:-$user}
    5.22      ;;
    5.23 -  "diary")
    5.24 -    contenttype; echo
    5.25 -    title=`getpar title` #diary=`getpar diary` wday=`getpar wday`
    5.26 -    [ -n "$title" ] && par2table $formdir/diary.def
    5.27 -    m4 -D_TITLE_="$title" -D_DIARY_="$diary" \
    5.28 -       -D_FORM_="`genform templ/form/diary.def`" \
    5.29 -       -D_FORM2_="syscmd(\`genform templ/form/diary.def')" \
    5.30 -       -D_DUMPTABLE_="`dumptable html diary title,wday,diary`" \
    5.31 -       $layout/html.m4.html $layout/diary.m4.html
    5.32 -    ;;
    5.33 +  # "diary")
    5.34 +  #   contenttype; echo
    5.35 +  #   title=`getpar title` #diary=`getpar diary` wday=`getpar wday`
    5.36 +  #   [ -n "$title" ] && par2table $formdir/diary.def
    5.37 +  #   m4 -D_TITLE_="$title" -D_DIARY_="$diary" \
    5.38 +  #      -D_FORM_="`genform templ/form/diary.def`" \
    5.39 +  #      -D_FORM2_="syscmd(\`genform templ/form/diary.def')" \
    5.40 +  #      -D_DUMPTABLE_="`dumptable html diary title,wday,diary`" \
    5.41 +  #      $layout/html.m4.html $layout/diary.m4.html
    5.42 +  #   ;;
    5.43    "invite")
    5.44      contenttype; echo
    5.45      invite
    5.46      ;;
    5.47 -  "home")
    5.48 -    contenttype; echo
    5.49 -    [ -n "`getpar rowid`" ] && par2table $formdir/user.def
    5.50 -    showhome ${2:-$user}
    5.51 -    ;;
    5.52    "groupman")
    5.53      contenttype; echo
    5.54      gname=`getpar gname`