fixed a bug in the base64 hanlding that led to auth failures for some

[samba.git] / source / web / cgi.c

diff --git a/source/web/cgi.c b/source/web/cgi.c
index a1aa4d753dc96e79b0a36ada7d6dba54d167dbf6..ce1038231b173bf746c01ca473fda7f898780e9d 100644 (file)
--- a/source/web/cgi.c
+++ b/source/web/cgi.c
@@ -296,17 +296,17 @@ char *quotedup(char *s)
        for (i=0;i<len;i++) {
                switch (s[i]) {
                case '<':
-                       strcpy(d, "&lt;");
+                       safe_strcpy(d, "&lt;", len + n*6 - (d - ret));
                        d += 4;
                        break;
 
                case '>':
-                       strcpy(d, "&gt;");
+                       safe_strcpy(d, "&gt;", len + n*6 - (d - ret));
                        d += 4;
                        break;
 
                case '&':
-                       strcpy(d, "&amp;");
+                       safe_strcpy(d, "&amp;", len + n*6 - (d - ret));
                        d += 5;
                        break;
 
@@ -347,7 +347,7 @@ char *urlquote(char *s)
 
        for (i=0;i<len;i++) {
                if (strchr(qlist,s[i])) {
-                       sprintf(d, "%%%02X", (int)s[i]);
+                       slprintf(d, len + n*2 - (d - ret), "%%%02X", (int)s[i]);
                        d += 3;
                } else {
                        *d++ = s[i];
@@ -387,7 +387,7 @@ char *quotequotes(char *s)
        for (i=0;i<len;i++) {
                switch (s[i]) {
                case '"':
-                       strcpy(d, "&quot;");
+                       safe_strcpy(d, "&quot;", len + n*6 - (d - ret));
                        d += 6;
                        break;
 
@@ -431,11 +431,11 @@ decode a base64 string in-place - simple and slow algorithm
 static void base64_decode(char *s)
 {
        char *b64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
-       int bit_offset, byte_offset, idx, i;
+       int bit_offset, byte_offset, idx, i, n;
        unsigned char *d = (unsigned char *)s;
        char *p;
 
-       i=0;
+       n=i=0;
 
        while (*s && (p=strchr(b64,*s))) {
                idx = (int)(p - b64);
@@ -444,13 +444,17 @@ static void base64_decode(char *s)
                d[byte_offset] &= ~((1<<(8-bit_offset))-1);
                if (bit_offset < 3) {
                        d[byte_offset] |= (idx << (2-bit_offset));
+                       n = byte_offset+1;
                } else {
                        d[byte_offset] |= (idx >> (bit_offset-2));
                        d[byte_offset+1] = 0;
                        d[byte_offset+1] |= (idx << (8-(bit_offset-2))) & 0xFF;
+                       n = byte_offset+2;
                }
                s++; i++;
        }
+       /* null terminate */
+       d[n] = 0;
 }
 
 
@@ -483,7 +487,7 @@ static int cgi_handle_authorization(char *line)
        }
 
 
-       return password_ok(user, pass, strlen(pass), NULL);
+       return pass_check(user, pass, strlen(pass), NULL, NULL);
 }
 
 
@@ -499,7 +503,7 @@ static void cgi_download(char *file)
 
        /* sanitise the filename */
        for (i=0;file[i];i++) {
-               if (!isalnum(file[i]) && !strchr("/.-_", file[i])) {
+               if (!isalnum((int)file[i]) && !strchr("/.-_", file[i])) {
                        cgi_setup_error("404 File Not Found","",
                                        "Illegal character in filename");
                }