This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
-#include "../web/swat_proto.h"
+#include "web/swat_proto.h"
#define MAX_VARIABLES 10000
extern void print_title(char *fmt, ...);
#endif
-struct var {
+struct cgi_var {
char *name;
char *value;
};
-static struct var variables[MAX_VARIABLES];
+static struct cgi_var variables[MAX_VARIABLES];
static int num_variables;
static int content_length;
static int request_post;
static const char *baseurl;
static char *pathinfo;
static char *C_user;
-static BOOL inetd_server;
-static BOOL got_request;
+static bool inetd_server;
+static bool got_request;
static char *grab_line(FILE *f, int *cl)
{
char *ret2;
if (len == 0) len = 1024;
else len *= 2;
- ret2 = (char *)Realloc(ret, len);
+ ret2 = (char *)SMB_REALLOC_KEEP_OLD_ON_ERROR(ret, len);
if (!ret2) return ret;
ret = ret2;
}
}
-
- ret[i] = 0;
+ if (ret) {
+ ret[i] = 0;
+ }
return ret;
}
+/**
+ URL encoded strings can have a '+', which should be replaced with a space
+
+ (This was in rfc1738_unescape(), but that broke the squid helper)
+**/
+
+static void plus_to_space_unescape(char *buf)
+{
+ char *p=buf;
+
+ while ((p=strchr_m(p,'+')))
+ *p = ' ';
+}
+
/***************************************************************************
load all the variables passed to the CGI program. May have multiple variables
with the same name and the same or different values. Takes a file parameter
*p = 0;
- variables[num_variables].name = strdup(line);
- variables[num_variables].value = strdup(p+1);
+ variables[num_variables].name = SMB_STRDUP(line);
+ variables[num_variables].value = SMB_STRDUP(p+1);
SAFE_FREE(line);
!variables[num_variables].value)
continue;
+ plus_to_space_unescape(variables[num_variables].value);
rfc1738_unescape(variables[num_variables].value);
+ plus_to_space_unescape(variables[num_variables].name);
rfc1738_unescape(variables[num_variables].name);
#ifdef DEBUG_COMMENTS
open("/dev/null", O_RDWR);
if ((s=query_string) || (s=getenv("QUERY_STRING"))) {
- for (tok=strtok(s,"&;");tok;tok=strtok(NULL,"&;")) {
+ char *saveptr;
+ for (tok=strtok_r(s, "&;", &saveptr); tok;
+ tok=strtok_r(NULL, "&;", &saveptr)) {
p = strchr_m(tok,'=');
if (!p) continue;
*p = 0;
- variables[num_variables].name = strdup(tok);
- variables[num_variables].value = strdup(p+1);
+ variables[num_variables].name = SMB_STRDUP(tok);
+ variables[num_variables].value = SMB_STRDUP(p+1);
- if (!variables[num_variables].name ||
+ if (!variables[num_variables].name ||
!variables[num_variables].value)
continue;
+ plus_to_space_unescape(variables[num_variables].value);
rfc1738_unescape(variables[num_variables].value);
+ plus_to_space_unescape(variables[num_variables].name);
rfc1738_unescape(variables[num_variables].name);
#ifdef DEBUG_COMMENTS
printf("<!== Commandline var %s has value \"%s\" ==>\n",
variables[num_variables].name,
variables[num_variables].value);
-#endif
+#endif
num_variables++;
if (num_variables == MAX_VARIABLES) break;
}
}
#ifdef DEBUG_COMMENTS
- printf("<!== End dump in cgi_load_variables() ==>\n");
+ printf("<!== End dump in cgi_load_variables() ==>\n");
#endif
- /* variables from the client are in display charset - convert them
- to our internal charset before use */
+ /* variables from the client are in UTF-8 - convert them
+ to our internal unix charset before use */
for (i=0;i<num_variables;i++) {
- pstring dest;
-
- convert_string(CH_DISPLAY, CH_UNIX,
- variables[i].name, -1,
- dest, sizeof(dest));
- free(variables[i].name);
- variables[i].name = strdup(dest);
-
- convert_string(CH_DISPLAY, CH_UNIX,
- variables[i].value, -1,
- dest, sizeof(dest));
- free(variables[i].value);
- variables[i].value = strdup(dest);
+ TALLOC_CTX *frame = talloc_stackframe();
+ char *dest = NULL;
+ size_t dest_len;
+
+ convert_string_allocate(frame, CH_UTF8, CH_UNIX,
+ variables[i].name, strlen(variables[i].name),
+ &dest, &dest_len, True);
+ SAFE_FREE(variables[i].name);
+ variables[i].name = SMB_STRDUP(dest ? dest : "");
+
+ dest = NULL;
+ convert_string_allocate(frame, CH_UTF8, CH_UNIX,
+ variables[i].value, strlen(variables[i].value),
+ &dest, &dest_len, True);
+ SAFE_FREE(variables[i].value);
+ variables[i].value = SMB_STRDUP(dest ? dest : "");
+ TALLOC_FREE(frame);
}
}
/***************************************************************************
find a variable passed via CGI
Doesn't quite do what you think in the case of POST text variables, because
- if they exist they might have a value of "" or even " ", depending on the
+ if they exist they might have a value of "" or even " ", depending on the
browser. Also doesn't allow for variables[] containing multiple variables
with the same name and the same or different values.
***************************************************************************/
+
const char *cgi_variable(const char *name)
{
int i;
return NULL;
}
+/***************************************************************************
+ Version of the above that can't return a NULL pointer.
+***************************************************************************/
+
+const char *cgi_variable_nonull(const char *name)
+{
+ const char *var = cgi_variable(name);
+ if (var) {
+ return var;
+ } else {
+ return "";
+ }
+}
+
/***************************************************************************
tell a browser about a fatal error in the http processing
***************************************************************************/
exit(0);
}
- pwd = getpwnam_alloc(user);
+ pwd = getpwnam_alloc(talloc_autofree_context(), user);
if (!pwd) {
printf("%sCannot find user %s<br>%s\n", head, user, tail);
exit(0);
head, user, (int)geteuid(), (int)getuid(), tail);
exit(0);
}
- passwd_free(&pwd);
+ TALLOC_FREE(pwd);
}
/***************************************************************************
handle a http authentication line
***************************************************************************/
-static BOOL cgi_handle_authorization(char *line)
+static bool cgi_handle_authorization(char *line)
{
char *p;
fstring user, user_pass;
}
*p = 0;
- convert_string(CH_DISPLAY, CH_UNIX,
+ convert_string(CH_UTF8, CH_UNIX,
line, -1,
- user, sizeof(user));
+ user, sizeof(user), True);
- convert_string(CH_DISPLAY, CH_UNIX,
+ convert_string(CH_UTF8, CH_UNIX,
p+1, -1,
- user_pass, sizeof(user_pass));
+ user_pass, sizeof(user_pass), True);
/*
* Try and get the user from the UNIX password file.
*/
- pass = getpwnam_alloc(user);
+ pass = getpwnam_alloc(talloc_autofree_context(), user);
/*
* Validate the password they have given.
become_user_permanently(pass->pw_uid, pass->pw_gid);
/* Save the users name */
- C_user = strdup(user);
- passwd_free(&pass);
+ C_user = SMB_STRDUP(user);
+ TALLOC_FREE(pass);
return True;
}
}
err:
- cgi_setup_error("401 Bad Authorization", "",
+ cgi_setup_error("401 Bad Authorization",
+ "WWW-Authenticate: Basic realm=\"SWAT\"\r\n",
"username or password incorrect");
- passwd_free(&pass);
+ TALLOC_FREE(pass);
return False;
}
/***************************************************************************
is this root?
***************************************************************************/
-BOOL am_root(void)
+bool am_root(void)
{
if (geteuid() == 0) {
return( True);
}
}
- if (!file_exist(file, &st)) {
+ if (sys_stat(file, &st) != 0)
+ {
+ cgi_setup_error("404 File Not Found","",
+ "The requested file was not found");
+ }
+
+ if (S_ISDIR(st.st_mode))
+ {
+ snprintf(buf, sizeof(buf), "%s/index.html", file);
+ if (!file_exist_stat(buf, &st) || !S_ISREG(st.st_mode))
+ {
+ cgi_setup_error("404 File Not Found","",
+ "The requested file was not found");
+ }
+ }
+ else if (S_ISREG(st.st_mode))
+ {
+ snprintf(buf, sizeof(buf), "%s", file);
+ }
+ else
+ {
cgi_setup_error("404 File Not Found","",
"The requested file was not found");
}
- fd = web_open(file,O_RDONLY,0);
+ fd = web_open(buf,O_RDONLY,0);
if (fd == -1) {
cgi_setup_error("404 File Not Found","",
"The requested file was not found");
}
printf("HTTP/1.0 200 OK\r\n");
- if ((p=strrchr_m(file,'.'))) {
+ if ((p=strrchr_m(buf, '.'))) {
if (strcmp(p,".gif")==0) {
printf("Content-Type: image/gif\r\n");
} else if (strcmp(p,".jpg")==0) {
printf("Content-Type: image/jpeg\r\n");
+ } else if (strcmp(p,".png")==0) {
+ printf("Content-Type: image/png\r\n");
+ } else if (strcmp(p,".css")==0) {
+ printf("Content-Type: text/css\r\n");
} else if (strcmp(p,".txt")==0) {
printf("Content-Type: text/plain\r\n");
} else {
printf("Content-Type: text/html\r\n");
}
}
- printf("Expires: %s\r\n", http_timestring(time(NULL)+EXPIRY_TIME));
+ printf("Expires: %s\r\n",
+ http_timestring(talloc_tos(), time(NULL)+EXPIRY_TIME));
lang = lang_tdb_current();
if (lang) {
**/
void cgi_setup(const char *rootdir, int auth_required)
{
- BOOL authenticated = False;
+ bool authenticated = False;
char line[1024];
char *url=NULL;
char *p;
if (line[0] == '\r' || line[0] == '\n') break;
if (strnequal(line,"GET ", 4)) {
got_request = True;
- url = strdup(&line[4]);
+ url = SMB_STRDUP(&line[4]);
} else if (strnequal(line,"POST ", 5)) {
got_request = True;
request_post = 1;
- url = strdup(&line[5]);
+ url = SMB_STRDUP(&line[5]);
} else if (strnequal(line,"PUT ", 4)) {
got_request = True;
cgi_setup_error("400 Bad Request", "",
string_sub(url, "/swat/", "", 0);
- if (url[0] != '/' && strstr(url,"..")==0 && file_exist(url, NULL)) {
+ if (url[0] != '/' && strstr(url,"..")==0) {
cgi_download(url);
}
printf("HTTP/1.0 200 OK\r\nConnection: close\r\n");
- printf("Date: %s\r\n", http_timestring(time(NULL)));
+ printf("Date: %s\r\n", http_timestring(talloc_tos(), time(NULL)));
baseurl = "";
pathinfo = url+1;
}
/***************************************************************************
return the hostname of the client
***************************************************************************/
-char *cgi_remote_host(void)
+const char *cgi_remote_host(void)
{
if (inetd_server) {
- return get_socket_name(1,False);
+ return get_peer_name(1,False);
}
return getenv("REMOTE_HOST");
}
/***************************************************************************
return the hostname of the client
***************************************************************************/
-char *cgi_remote_addr(void)
+const char *cgi_remote_addr(void)
{
if (inetd_server) {
- return get_socket_addr(1);
+ char addr[INET6_ADDRSTRLEN];
+ return get_peer_addr(1,addr,sizeof(addr));
}
return getenv("REMOTE_ADDR");
}
/***************************************************************************
return True if the request was a POST
***************************************************************************/
-BOOL cgi_waspost(void)
+bool cgi_waspost(void)
{
if (inetd_server) {
return request_post;
git.samba.org / sfrench / samba-autobuild / .git / blobdiff