X-Git-Url: https://git.p6c8.net/devedit.git/blobdiff_plain/7526dfcc57f8e86a90878078eacaf729072db49a..d63f55f3d737aa05e3a1496168c7b4979cbed782:/modules/Command.pm?ds=inline diff --git a/modules/Command.pm b/modules/Command.pm index 9e11f16..c1b8989 100644 --- a/modules/Command.pm +++ b/modules/Command.pm @@ -6,7 +6,15 @@ package Command; # Execute Dev-Editor's commands # # Author: Patrick Canterino -# Last modified: 2005-04-15 +# Last modified: 2005-05-11 +# +# Copyright (C) 1999-2000 Roland Bluethgen, Frank Schoenmann +# Copyright (C) 2003-2009 Patrick Canterino +# All Rights Reserved. +# +# This file can be distributed and/or modified under the terms of +# of the Artistic License 1.0 (see also the LICENSE file found at +# the top level of the Dev-Editor distribution). # use strict; @@ -25,24 +33,24 @@ use Tool; use CGI qw(header escape); -use HTML::Entities; use Output; use Template; -my $script = encode_entities($ENV{'SCRIPT_NAME'}); +my $script = encode_html($ENV{'SCRIPT_NAME'}); my $users = eval('getpwuid(0)') && eval('getgrgid(0)'); -my %dispatch = ('show' => \&exec_show, - 'beginedit' => \&exec_beginedit, - 'endedit' => \&exec_endedit, - 'mkdir' => \&exec_mkdir, - 'mkfile' => \&exec_mkfile, - 'upload' => \&exec_upload, - 'copy' => \&exec_copy, - 'rename' => \&exec_rename, - 'remove' => \&exec_remove, - 'chprop' => \&exec_chprop, - 'about' => \&exec_about +my %dispatch = ('show' => \&exec_show, + 'beginedit' => \&exec_beginedit, + 'endedit' => \&exec_endedit, + 'mkdir' => \&exec_mkdir, + 'mkfile' => \&exec_mkfile, + 'upload' => \&exec_upload, + 'copy' => \&exec_copy, + 'rename' => \&exec_rename, + 'remove' => \&exec_remove, + 'remove_multi' => \&exec_remove_multi, + 'chprop' => \&exec_chprop, + 'about' => \&exec_about ); ### Export ### @@ -74,7 +82,7 @@ sub exec_command($$$) } } - return error($config->{'errors'}->{'command_unknown'},'/',{COMMAND => encode_entities($command)}); + return error($config->{'errors'}->{'command_unknown'},'/',{COMMAND => encode_html($command)}); } # exec_show() @@ -91,7 +99,7 @@ sub exec_show($$) my ($data,$config) = @_; my $physical = $data->{'physical'}; my $virtual = $data->{'virtual'}; - my $upper_path = encode_entities(upper_path($virtual)); + my $upper_path = multi_string(upper_path($virtual)); my $tpl = new Template; @@ -99,16 +107,18 @@ sub exec_show($$) { # Create directory listing - return error($config->{'errors'}->{'no_dir_access'},$upper_path) unless(-r $physical && -x $physical); + return error($config->{'errors'}->{'no_dir_access'},$upper_path->{'normal'}) unless(-r $physical && -x $physical); my $direntries = dir_read($physical); - return error($config->{'errors'}->{'dir_read_fail'},$upper_path,{DIR => encode_entities($virtual)}) unless($direntries); + return error($config->{'errors'}->{'dir_read_failed'},$upper_path->{'normal'},{DIR => encode_html($virtual)}) unless($direntries); my $files = $direntries->{'files'}; my $dirs = $direntries->{'dirs'}; my $dirlist = ''; + my $count = 0; + my $filter1 = $data->{'cgi'}->param('filter') || '*'; # The real wildcard my $filter2 = ($filter1 && $filter1 ne '*') ? $filter1 : ''; # Wildcard for output @@ -117,13 +127,16 @@ sub exec_show($$) unless($virtual eq '/') { + $count++; + my @stat = stat($physical.'/..'); my $udtpl = new Template; $udtpl->read_file($config->{'templates'}->{'dirlist_up'}); - $udtpl->fillin('UPPER_DIR',$upper_path); - $udtpl->fillin('DATE',encode_entities(strftime($config->{'timeformat'},($config->{'use_gmt'}) ? gmtime($stat[9]) : localtime($stat[9])))); + $udtpl->fillin('UPPER_DIR',$upper_path->{'html'}); + $udtpl->fillin('UPPER_DIR_URL',$upper_path->{'url'}); + $udtpl->fillin('DATE',encode_html(strftime($config->{'timeformat'},($config->{'use_gmt'}) ? gmtime($stat[9]) : localtime($stat[9])))); $dirlist .= $udtpl->get_template; } @@ -132,23 +145,29 @@ sub exec_show($$) foreach my $dir(@$dirs) { + next if($config->{'hide_dot_files'} && substr($dir,0,1) eq '.'); next unless(dos_wildcard_match($filter1,$dir)); + $count++; + my $phys_path = $physical.'/'.$dir; - my $virt_path = encode_entities($virtual.$dir.'/'); + my $virt_path = multi_string($virtual.$dir.'/'); my @stat = stat($phys_path); my $dtpl = new Template; $dtpl->read_file($config->{'templates'}->{'dirlist_dir'}); - $dtpl->fillin('DIR',$virt_path); - $dtpl->fillin('DIR_NAME',encode_entities($dir)); - $dtpl->fillin('DATE',encode_entities(strftime($config->{'timeformat'},($config->{'use_gmt'}) ? gmtime($stat[9]) : localtime($stat[9])))); - $dtpl->fillin('URL',equal_url(encode_entities($config->{'httproot'}),$virt_path)); + $dtpl->fillin('DIR',$virt_path->{'html'}); + $dtpl->fillin('DIR_URL',$virt_path->{'url'}); + $dtpl->fillin('DIR_NAME',encode_html($dir)); + $dtpl->fillin('DATE',encode_html(strftime($config->{'timeformat'},($config->{'use_gmt'}) ? gmtime($stat[9]) : localtime($stat[9])))); + $dtpl->fillin('URL',equal_url(encode_html($config->{'httproot'}),$virt_path->{'html'})); + $dtpl->parse_if_block('forbidden',is_forbidden_file($config->{'forbidden'},$virt_path->{'normal'})); $dtpl->parse_if_block('readable',-r $phys_path && -x $phys_path); $dtpl->parse_if_block('users',$users && -o $phys_path); + $dtpl->parse_if_block('even',($count % 2) == 0); $dirlist .= $dtpl->get_template; } @@ -157,10 +176,13 @@ sub exec_show($$) foreach my $file(@$files) { + next if($config->{'hide_dot_files'} && substr($file,0,1) eq '.'); next unless(dos_wildcard_match($filter1,$file)); + $count++; + my $phys_path = $physical.'/'.$file; - my $virt_path = encode_entities($virtual.$file); + my $virt_path = multi_string($virtual.$file); my @stat = lstat($phys_path); my $too_large = $config->{'max_file_size'} && $stat[7] > $config->{'max_file_size'}; @@ -168,18 +190,20 @@ sub exec_show($$) my $ftpl = new Template; $ftpl->read_file($config->{'templates'}->{'dirlist_file'}); - $ftpl->fillin('FILE',$virt_path); - $ftpl->fillin('FILE_NAME',encode_entities($file)); + $ftpl->fillin('FILE',$virt_path->{'html'}); + $ftpl->fillin('FILE_URL',$virt_path->{'url'}); + $ftpl->fillin('FILE_NAME',encode_html($file)); + $ftpl->fillin('FILE_URL',$virt_path->{'url'}); $ftpl->fillin('SIZE',$stat[7]); - $ftpl->fillin('DATE',encode_entities(strftime($config->{'timeformat'},($config->{'use_gmt'}) ? gmtime($stat[9]) : localtime($stat[9])))); - $ftpl->fillin('URL',equal_url(encode_entities($config->{'httproot'}),$virt_path)); + $ftpl->fillin('DATE',encode_html(strftime($config->{'timeformat'},($config->{'use_gmt'}) ? gmtime($stat[9]) : localtime($stat[9])))); + $ftpl->fillin('URL',equal_url(encode_html($config->{'httproot'}),$virt_path->{'html'})); $ftpl->parse_if_block('link',-l $phys_path); - $ftpl->parse_if_block('no_link',not -l $phys_path); - $ftpl->parse_if_block('not_readable',not -r $phys_path); + $ftpl->parse_if_block('readable',-r $phys_path); + $ftpl->parse_if_block('writeable',-w $phys_path); $ftpl->parse_if_block('binary',-B $phys_path); - $ftpl->parse_if_block('readonly',not -w $phys_path); + $ftpl->parse_if_block('forbidden',is_forbidden_file($config->{'forbidden'},$virt_path->{'normal'})); $ftpl->parse_if_block('viewable',(-r $phys_path && -T $phys_path && not $too_large) || -l $phys_path); $ftpl->parse_if_block('editable',(-r $phys_path && -w $phys_path && -T $phys_path && not $too_large) && not -l $phys_path); @@ -187,17 +211,20 @@ sub exec_show($$) $ftpl->parse_if_block('users',$users && -o $phys_path); + $ftpl->parse_if_block('even',($count % 2) == 0); + $dirlist .= $ftpl->get_template; } $tpl->read_file($config->{'templates'}->{'dirlist'}); $tpl->fillin('DIRLIST',$dirlist); - $tpl->fillin('DIR',encode_entities($virtual)); + $tpl->fillin('DIR',encode_html($virtual)); + $tpl->fillin('DIR_URL',escape($virtual)); $tpl->fillin('SCRIPT',$script); - $tpl->fillin('URL',encode_entities(equal_url($config->{'httproot'},$virtual))); + $tpl->fillin('URL',encode_html(equal_url($config->{'httproot'},$virtual))); - $tpl->fillin('FILTER',encode_entities($filter2)); + $tpl->fillin('FILTER',encode_html($filter2)); $tpl->fillin('FILTER_URL',escape($filter2)); $tpl->parse_if_block('empty',$dirlist eq ''); @@ -213,28 +240,29 @@ sub exec_show($$) $tpl->read_file($config->{'templates'}->{'viewlink'}); - $tpl->fillin('FILE',encode_entities($virtual)); - $tpl->fillin('DIR',$upper_path); - $tpl->fillin('URL',encode_entities(equal_url($config->{'httproot'},$virtual))); + $tpl->fillin('FILE',encode_html($virtual)); + $tpl->fillin('DIR',$upper_path->{'html'}); + $tpl->fillin('DIR_URL',$upper_path->{'url'}); + $tpl->fillin('URL',encode_html(equal_url($config->{'httproot'},$virtual))); $tpl->fillin('SCRIPT',$script); - $tpl->fillin('LINK_TARGET',encode_entities($link_target)); + $tpl->fillin('LINK_TARGET',encode_html($link_target)); } else { # View a file - return error($config->{'errors'}->{'no_view'},$upper_path) unless(-r $physical); + return error($config->{'errors'}->{'no_view'},$upper_path->{'normal'}) unless(-r $physical); # Check on binary files # We have to do it in this way or empty files will be recognized # as binary files - return error($config->{'errors'}->{'binary_file'},$upper_path) unless(-T $physical); + return error($config->{'errors'}->{'binary_file'},$upper_path->{'normal'}) unless(-T $physical); # Is the file too large? - return error($config->{'errors'}->{'file_too_large'},$upper_path,{SIZE => $config->{'max_file_size'}}) if($config->{'max_file_size'} && -s $physical > $config->{'max_file_size'}); + return error($config->{'errors'}->{'file_too_large'},$upper_path->{'normal'},{SIZE => $config->{'max_file_size'}}) if($config->{'max_file_size'} && -s $physical > $config->{'max_file_size'}); # View the file @@ -243,14 +271,16 @@ sub exec_show($$) $tpl->read_file($config->{'templates'}->{'viewfile'}); - $tpl->fillin('FILE',encode_entities($virtual)); - $tpl->fillin('DIR',$upper_path); - $tpl->fillin('URL',encode_entities(equal_url($config->{'httproot'},$virtual))); + $tpl->fillin('FILE',encode_html($virtual)); + $tpl->fillin('FILE_URL',escape($virtual)); + $tpl->fillin('DIR',$upper_path->{'html'}); + $tpl->fillin('DIR_URL',$upper_path->{'url'}); + $tpl->fillin('URL',encode_html(equal_url($config->{'httproot'},$virtual))); $tpl->fillin('SCRIPT',$script); $tpl->parse_if_block('editable',-w $physical); - $tpl->fillin('CONTENT',encode_entities($$content)); + $tpl->fillin('CONTENT',encode_html($$content)); } my $output = header(-type => 'text/html'); @@ -274,7 +304,6 @@ sub exec_beginedit($$) my $physical = $data->{'physical'}; my $virtual = $data->{'virtual'}; my $dir = upper_path($virtual); - my $cgi = $data->{'cgi'}; return error($config->{'errors'}->{'link_edit'},$dir) if(-l $physical); return error($config->{'errors'}->{'dir_edit'}, $dir) if(-d $physical); @@ -288,7 +317,7 @@ sub exec_beginedit($$) return error($config->{'errors'}->{'file_too_large'},$dir,{SIZE => $config->{'max_file_size'}}) if($config->{'max_file_size'} && -s $physical > $config->{'max_file_size'}); - # ... and show the editing form + # Show the editing form my $content = file_read($physical); my $md5sum = md5_hex($$content); @@ -297,12 +326,14 @@ sub exec_beginedit($$) my $tpl = new Template; $tpl->read_file($config->{'templates'}->{'editfile'}); - $tpl->fillin('FILE',$virtual); - $tpl->fillin('DIR',$dir); - $tpl->fillin('URL',equal_url($config->{'httproot'},$virtual)); + $tpl->fillin('FILE',encode_html($virtual)); + $tpl->fillin('FILE_URL',escape($virtual)); + $tpl->fillin('DIR',encode_html($dir)); + $tpl->fillin('DIR_URL',escape($dir)); + $tpl->fillin('URL',encode_html(equal_url($config->{'httproot'},$virtual))); $tpl->fillin('SCRIPT',$script); $tpl->fillin('MD5SUM',$md5sum); - $tpl->fillin('CONTENT',encode_entities($$content)); + $tpl->fillin('CONTENT',encode_html($$content)); $tpl->parse_if_block('error',0); @@ -356,8 +387,8 @@ sub exec_endedit($$) local *FILE; - sysopen(FILE,$physical,O_RDWR | O_CREAT) or return error($config->{'errors'}->{'edit_failed'},$dir,{FILE => $virtual}); - file_lock(*FILE,LOCK_EX) or do { close(FILE); return error($config->{'errors'}->{'edit_failed'},$dir,{FILE => $virtual}) }; + sysopen(FILE,$physical,O_RDWR | O_CREAT) or return error($config->{'errors'}->{'edit_failed'},$dir,{FILE => encode_html($virtual)}); + file_lock(*FILE,LOCK_EX) or do { close(FILE); return error($config->{'errors'}->{'edit_failed'},$dir,{FILE => encode_html($virtual)}) }; my $md5 = new Digest::MD5; $md5->addfile(*FILE); @@ -374,12 +405,14 @@ sub exec_endedit($$) $tpl->fillin('ERROR',$config->{'errors'}->{'edit_file_changed'}); - $tpl->fillin('FILE',$virtual); - $tpl->fillin('DIR',$dir); - $tpl->fillin('URL',equal_url($config->{'httproot'},$virtual)); + $tpl->fillin('FILE',encode_html($virtual)); + $tpl->fillin('FILE_URL',escape($virtual)); + $tpl->fillin('DIR',encode_html($dir)); + $tpl->fillin('DIR_URL',escape($dir)); + $tpl->fillin('URL',encode_html(equal_url($config->{'httproot'},$virtual))); $tpl->fillin('SCRIPT',$script); $tpl->fillin('MD5SUM',$md5file); - $tpl->fillin('CONTENT',encode_entities($content)); + $tpl->fillin('CONTENT',encode_html($content)); $tpl->parse_if_block('error',1); @@ -398,7 +431,9 @@ sub exec_endedit($$) print FILE $content; } - $output = devedit_reload({command => 'show', file => $dir}); + $output = ($cgi->param('continue')) + ? devedit_reload({command => 'beginedit', file => $virtual}) + : devedit_reload({command => 'show', file => $dir}); } close(FILE); @@ -424,7 +459,7 @@ sub exec_mkfile($$) my $new_physical = $data->{'new_physical'}; my $new_virtual = $data->{'new_virtual'}; my $dir = upper_path($new_virtual); - $new_virtual = encode_entities($new_virtual); + $new_virtual = encode_html($new_virtual); if($new_physical) { @@ -463,7 +498,7 @@ sub exec_mkdir($$) my $new_physical = $data->{'new_physical'}; my $new_virtual = $data->{'new_virtual'}; my $dir = upper_path($new_virtual); - $new_virtual = encode_entities($new_virtual); + $new_virtual = encode_html($new_virtual); if($new_physical) { @@ -503,16 +538,24 @@ sub exec_upload($$) my $virtual = $data->{'virtual'}; my $cgi = $data->{'cgi'}; - return error($config->{'errors'}->{'no_directory'},upper_path($virtual),{FILE => $virtual}) unless(-d $physical && not -l $physical); - return error($config->{'errors'}->{'dir_no_create'},$virtual,{DIR => $virtual}) unless(-w $physical); + return error($config->{'errors'}->{'no_directory'},upper_path($virtual),{FILE => encode_html($virtual)}) unless(-d $physical && not -l $physical); + return error($config->{'errors'}->{'dir_no_create'},$virtual,{DIR => encode_html($virtual)}) unless(-w $physical); if(my $uploaded_file = $cgi->param('uploaded_file')) { + if($cgi->param('remote_file')) + { + $uploaded_file = $cgi->param('remote_file'); + + $uploaded_file =~ s!/!!g; + $uploaded_file =~ s!\\!!g; + } + # Process file upload my $filename = file_name($uploaded_file); my $file_phys = $physical.'/'.$filename; - my $file_virt = $virtual.$filename; + my $file_virt = encode_html($virtual.$filename); if(-e $file_phys) { @@ -540,8 +583,9 @@ sub exec_upload($$) my $tpl = new Template; $tpl->read_file($config->{'templates'}->{'upload'}); - $tpl->fillin('DIR',$virtual); - $tpl->fillin('URL',equal_url($config->{'httproot'},$virtual)); + $tpl->fillin('DIR',encode_html($virtual)); + $tpl->fillin('DIR_URL',escape($virtual)); + $tpl->fillin('URL',encode_html(equal_url($config->{'httproot'},$virtual))); $tpl->fillin('SCRIPT',$script); my $output = header(-type => 'text/html'); @@ -564,65 +608,96 @@ sub exec_copy($$) { my ($data,$config) = @_; my $physical = $data->{'physical'}; - my $virtual = encode_entities($data->{'virtual'}); + my $virtual = $data->{'virtual'}; my $dir = upper_path($virtual); my $new_physical = $data->{'new_physical'}; return error($config->{'errors'}->{'link_copy'},$dir) if(-l $physical); - return error($config->{'errors'}->{'dir_copy'},$dir) if(-d $physical); return error($config->{'errors'}->{'no_copy'},$dir) unless(-r $physical); if($new_physical) { - my $new_virtual = $data->{'new_virtual'}; - my $new_dir = upper_path($new_virtual); - $new_virtual = encode_entities($new_virtual); + my $new_virtual = multi_string($data->{'new_virtual'}); + my $new_dir = upper_path($new_virtual->{'normal'}); - if(-e $new_physical) + if(-d $physical) { - return error($config->{'errors'}->{'link_replace'},$new_dir) if(-l $new_physical); - return error($config->{'errors'}->{'dir_replace'},$new_dir) if(-d $new_physical); - return error($config->{'errors'}->{'exist_no_write'},$new_dir,{FILE => $new_virtual}) unless(-w $new_physical); + return error($config->{'errors'}->{'no_copy'},$dir) unless(-x $physical); + return error($config->{'errors'}->{'file_exists'},$dir,{FILE => $new_virtual->{'html'}}) if(-e $new_physical); + return error($config->{'errors'}->{'dir_copy_self'},$dir) if(index($new_virtual->{'normal'},$virtual) == 0); - if(not $data->{'cgi'}->param('confirmed')) + dir_copy($physical,$new_physical) or return error($config->{'errors'}->{'copy_failed'},$dir,{FILE => encode_html($virtual), NEW_FILE => $new_virtual->{'html'}}); + return devedit_reload({command => 'show', file => $new_dir}); + } + else + { + if(-e $new_physical) { - my $tpl = new Template; - $tpl->read_file($config->{'templates'}->{'confirm_replace'}); - - $tpl->fillin('FILE',$virtual); - $tpl->fillin('NEW_FILE',$new_virtual); - $tpl->fillin('NEW_FILENAME',file_name($new_virtual)); - $tpl->fillin('NEW_DIR',$new_dir); - $tpl->fillin('DIR',$dir); - - $tpl->fillin('COMMAND','copy'); - $tpl->fillin('URL',equal_url($config->{'httproot'},$virtual)); - $tpl->fillin('SCRIPT',$script); - - my $output = header(-type => 'text/html'); - $output .= $tpl->get_template; - - return \$output; + return error($config->{'errors'}->{'link_replace'},$new_dir) if(-l $new_physical); + return error($config->{'errors'}->{'dir_replace'},$new_dir) if(-d $new_physical); + return error($config->{'errors'}->{'exist_no_write'},$new_dir,{FILE => $new_virtual->{'html'}}) unless(-w $new_physical); + + if(not $data->{'cgi'}->param('confirmed')) + { + my $tpl = new Template; + $tpl->read_file($config->{'templates'}->{'confirm_replace'}); + + $tpl->fillin('FILE',encode_html($virtual)); + $tpl->fillin('NEW_FILE',$new_virtual->{'html'}); + $tpl->fillin('NEW_FILENAME',file_name($new_virtual->{'html'})); + $tpl->fillin('NEW_DIR',encode_html($new_dir)); + $tpl->fillin('DIR',encode_html($dir)); + $tpl->fillin('DIR_URL',escape($dir)); + + $tpl->fillin('COMMAND','copy'); + $tpl->fillin('URL',encode_html(equal_url($config->{'httproot'},$virtual))); + $tpl->fillin('SCRIPT',$script); + + my $output = header(-type => 'text/html'); + $output .= $tpl->get_template; + + return \$output; + } } - } - copy($physical,$new_physical) or return error($config->{'errors'}->{'copy_failed'},$dir,{FILE => $virtual, NEW_FILE => $new_virtual}); - return devedit_reload({command => 'show', file => $new_dir}); + copy($physical,$new_physical) or return error($config->{'errors'}->{'copy_failed'},$dir,{FILE => encode_html($virtual), NEW_FILE => $new_virtual->{'html'}}); + return devedit_reload({command => 'show', file => $new_dir}); + } } else { - my $tpl = new Template; - $tpl->read_file($config->{'templates'}->{'copyfile'}); + if(-d $physical) + { + my $tpl = new Template; + $tpl->read_file($config->{'templates'}->{'copydir'}); - $tpl->fillin('FILE',$virtual); - $tpl->fillin('DIR',$dir); - $tpl->fillin('URL',equal_url($config->{'httproot'},$virtual)); - $tpl->fillin('SCRIPT',$script); + $tpl->fillin('FILE',encode_html($virtual)); + $tpl->fillin('DIR',encode_html($dir)); + $tpl->fillin('DIR_URL',escape($dir)); + $tpl->fillin('URL',encode_html(equal_url($config->{'httproot'},$virtual))); + $tpl->fillin('SCRIPT',$script); - my $output = header(-type => 'text/html'); - $output .= $tpl->get_template; + my $output = header(-type => 'text/html'); + $output .= $tpl->get_template; - return \$output; + return \$output; + } + else + { + my $tpl = new Template; + $tpl->read_file($config->{'templates'}->{'copyfile'}); + + $tpl->fillin('FILE',encode_html($virtual)); + $tpl->fillin('DIR',encode_html($dir)); + $tpl->fillin('DIR_URL',escape($dir)); + $tpl->fillin('URL',encode_html(equal_url($config->{'httproot'},$virtual))); + $tpl->fillin('SCRIPT',$script); + + my $output = header(-type => 'text/html'); + $output .= $tpl->get_template; + + return \$output; + } } } @@ -648,9 +723,8 @@ sub exec_rename($$) if($new_physical) { - my $new_virtual = $data->{'new_virtual'}; - my $new_dir = upper_path($new_virtual); - $new_virtual = encode_entities($new_virtual); + my $new_virtual = multi_string($data->{'new_virtual'}); + my $new_dir = upper_path($new_virtual->{'normal'}); if(-e $new_physical) { @@ -662,14 +736,14 @@ sub exec_rename($$) my $tpl = new Template; $tpl->read_file($config->{'templates'}->{'confirm_replace'}); - $tpl->fillin('FILE',$virtual); - $tpl->fillin('NEW_FILE',$new_virtual); - $tpl->fillin('NEW_FILENAME',file_name($new_virtual)); - $tpl->fillin('NEW_DIR',$new_dir); - $tpl->fillin('DIR',$dir); + $tpl->fillin('FILE',encode_html($virtual)); + $tpl->fillin('NEW_FILE',$new_virtual->{'html'}); + $tpl->fillin('NEW_FILENAME',file_name($new_virtual->{'html'})); + $tpl->fillin('NEW_DIR',encode_html($new_dir)); + $tpl->fillin('DIR',encode_html($dir)); $tpl->fillin('COMMAND','rename'); - $tpl->fillin('URL',equal_url($config->{'httproot'},$virtual)); + $tpl->fillin('URL',encode_html(equal_url($config->{'httproot'},$virtual))); $tpl->fillin('SCRIPT',$script); my $output = header(-type => 'text/html'); @@ -679,7 +753,7 @@ sub exec_rename($$) } } - move($physical,$new_physical) or return error($config->{'errors'}->{'rename_failed'},$dir,{FILE => $virtual, NEW_FILE => $new_virtual}); + move($physical,$new_physical) or return error($config->{'errors'}->{'rename_failed'},$dir,{FILE => encode_html($virtual), NEW_FILE => $new_virtual->{'html'}}); return devedit_reload({command => 'show', file => $new_dir}); } else @@ -687,9 +761,10 @@ sub exec_rename($$) my $tpl = new Template; $tpl->read_file($config->{'templates'}->{'renamefile'}); - $tpl->fillin('FILE',$virtual); - $tpl->fillin('DIR',$dir); - $tpl->fillin('URL',equal_url($config->{'httproot'},$virtual)); + $tpl->fillin('FILE',encode_html($virtual)); + $tpl->fillin('DIR',encode_html($dir)); + $tpl->fillin('DIR_URL',escape($dir)); + $tpl->fillin('URL',encode_html(equal_url($config->{'httproot'},$virtual))); $tpl->fillin('SCRIPT',$script); my $output = header(-type => 'text/html'); @@ -732,9 +807,11 @@ sub exec_remove($$) my $tpl = new Template; $tpl->read_file($config->{'templates'}->{'confirm_rmdir'}); - $tpl->fillin('DIR',$virtual); - $tpl->fillin('UPPER_DIR',$dir); - $tpl->fillin('URL',equal_url($config->{'httproot'},$virtual)); + $tpl->fillin('DIR',encode_html($virtual)); + $tpl->fillin('DIR_URL',escape($virtual)); + $tpl->fillin('UPPER_DIR',encode_html($dir)); + $tpl->fillin('UPPER_DIR_URL',escape($dir)); + $tpl->fillin('URL',encode_html(equal_url($config->{'httproot'},$virtual))); $tpl->fillin('SCRIPT',$script); my $output = header(-type => 'text/html'); @@ -757,9 +834,11 @@ sub exec_remove($$) my $tpl = new Template; $tpl->read_file($config->{'templates'}->{'confirm_rmfile'}); - $tpl->fillin('FILE',$virtual); - $tpl->fillin('DIR',$dir); - $tpl->fillin('URL',equal_url($config->{'httproot'},$virtual)); + $tpl->fillin('FILE',encode_html($virtual)); + $tpl->fillin('FILE_URL',escape($virtual)); + $tpl->fillin('DIR',encode_html($dir)); + $tpl->fillin('DIR_URL',escape($dir)); + $tpl->fillin('URL',encode_html(equal_url($config->{'httproot'},$virtual))); $tpl->fillin('SCRIPT',$script); my $output = header(-type => 'text/html'); @@ -770,6 +849,170 @@ sub exec_remove($$) } } +# exec_remove_multi() +# +# Remove a file or a directory and return to directory view +# +# Params: 1. Reference to user input hash +# 2. Reference to config hash +# +# Return: Output of the command (Scalar Reference) + +sub exec_remove_multi($$) +{ + my ($data,$config) = @_; + my $physical = $data->{'physical'}; + my $virtual = $data->{'virtual'}; + my $cgi = $data->{'cgi'}; + + my @files = $cgi->param('files');# + my @new_files; + + if(@files) + { + foreach my $file(@files) + { + # Filter out some "bad" files (e.g. files going up in the + # directory hierarchy or files containing slashes (it's too + # dangerous...) + + next if($file =~ m!^\.+$!); + next if($file =~ m!/!); + next if($file =~ m!\\!); + + push(@new_files,$file); + } + } + + if(@new_files) + { + if($cgi->param('confirmed')) + { + my @success; + my @failed; + + foreach my $file(@new_files) + { + my $file_path = clean_path($physical.'/'.$file); + + if(-e $file_path) + { + if(-d $file_path && not -l $file_path) + { + # Remove a directory + + if(rmtree($file_path)) + { + push(@success,clean_path($file)); + } + else + { + push(@failed,clean_path($file)); + } + } + else + { + # Remove a file + + if(unlink($file_path)) + { + push(@success,clean_path($file)); + } + else + { + push(@failed,clean_path($file)); + } + } + } + else + { + push(@failed,clean_path($file)); + } + } + + my $tpl = new Template; + $tpl->read_file($config->{'templates'}->{'rmmulti'}); + + if(scalar(@success) > 0) + { + if(scalar(@success) == scalar(@new_files) && scalar(@failed) == 0) + { + return devedit_reload({command => 'show', file => $virtual}); + } + else + { + $tpl->parse_if_block('success',1); + + foreach my $file_success(@success) + { + $tpl->add_loop_data('SUCCESS',{FILE => encode_html($file_success), + FILE_PATH => encode_html(clean_path($virtual.'/'.$file_success))}); + } + + $tpl->parse_loop('SUCCESS'); + } + } + else + { + $tpl->parse_if_block('success',0); + } + + if(scalar(@failed) > 0) + { + $tpl->parse_if_block('failed',1); + + foreach my $file_failed(@failed) + { + $tpl->add_loop_data('FAILED',{FILE => encode_html($file_failed), + FILE_PATH => encode_html(clean_path($virtual.'/'.$file_failed))}); + } + + $tpl->parse_loop('FAILED'); + } + else + { + $tpl->parse_if_block('failed',0); + } + + + $tpl->fillin('DIR',encode_html($virtual)); + $tpl->fillin('SCRIPT',$script); + + my $output = header(-type => 'text/html'); + $output .= $tpl->get_template; + + return \$output; + } + else + { + my $tpl = new Template; + $tpl->read_file($config->{'templates'}->{'confirm_rmmulti'}); + + foreach my $file(@new_files) + { + $tpl->add_loop_data('FILES',{FILE => encode_html($file), + FILE_PATH => encode_html(clean_path($virtual.'/'.$file))}); + } + + $tpl->parse_loop('FILES'); + + $tpl->fillin('COUNT',scalar(@new_files)); + + $tpl->fillin('DIR',encode_html($virtual)); + $tpl->fillin('SCRIPT',$script); + + my $output = header(-type => 'text/html'); + $output .= $tpl->get_template; + + return \$output; + } + } + else + { + return devedit_reload({command => 'show', file => $virtual}); + } +} + # exec_chprop() # # Change the mode and the group of a file or a directory @@ -786,10 +1029,10 @@ sub exec_chprop($$) my $virtual = $data->{'virtual'}; my $dir = upper_path($virtual); - return error($config->{'errors'}->{'no_users'},$dir,{FILE => $virtual}) unless($users); - return error($config->{'errors'}->{'chprop_root'},'/') if($virtual eq '/'); - return error($config->{'errors'}->{'not_owner'},$dir,{FILE => $virtual}) unless(-o $physical); - return error($config->{'errors'}->{'chprop_link'},$dir) if(-l $physical); + return error($config->{'errors'}->{'no_users'},$dir,{FILE => encode_html($virtual)}) unless($users); + return error($config->{'errors'}->{'chprop_root'},'/') if($virtual eq '/'); + return error($config->{'errors'}->{'not_owner'},$dir,{FILE => encode_html($virtual)}) unless(-o $physical); + return error($config->{'errors'}->{'chprop_link'},$dir) if(-l $physical); my $cgi = $data->{'cgi'}; my $mode = $cgi->param('mode'); @@ -801,6 +1044,7 @@ sub exec_chprop($$) { # Change the mode + return error($config->{'errors'}->{'invalid_mode'},$dir) unless($mode =~ /^[0-7]{3,}$/); chmod(oct($mode),$physical); } @@ -808,7 +1052,7 @@ sub exec_chprop($$) { # Change the group using the `chgrp` system command - return error($config->{'errors'}->{'invalid_group'},$dir,{GROUP => encode_entities($group)}) unless($group =~ /^[a-z0-9_]+[a-z0-9_-]*$/i); + return error($config->{'errors'}->{'invalid_group'},$dir,{GROUP => encode_html($group)}) unless($group =~ /^[a-z0-9_]+[a-z0-9_-]*$/i); system('chgrp',$group,$physical); } @@ -833,7 +1077,7 @@ sub exec_chprop($$) if(my $group = getgrgid($gid)) { - $tpl->fillin('GROUP',encode_entities($group)); + $tpl->fillin('GROUP',encode_html($group)); $tpl->parse_if_block('group_detected',1); } else @@ -843,9 +1087,11 @@ sub exec_chprop($$) # Insert other information - $tpl->fillin('FILE',$virtual); - $tpl->fillin('DIR',$dir); - $tpl->fillin('URL',equal_url($config->{'httproot'},$virtual)); + $tpl->fillin('FILE',encode_html($virtual)); + $tpl->fillin('FILE_URL',escape($virtual)); + $tpl->fillin('DIR',encode_html($dir)); + $tpl->fillin('DIR_URL',escape($dir)); + $tpl->fillin('URL',encode_html(equal_url($config->{'httproot'},$virtual))); $tpl->fillin('SCRIPT',$script); my $output = header(-type => 'text/html'); @@ -879,21 +1125,21 @@ sub exec_about($$) # Some path information - $tpl->fillin('SCRIPT_PHYS',encode_entities($ENV{'SCRIPT_FILENAME'})); - $tpl->fillin('CONFIG_PATH',encode_entities($data->{'configfile'})); - $tpl->fillin('FILE_ROOT', encode_entities($config->{'fileroot'})); - $tpl->fillin('HTTP_ROOT', encode_entities($config->{'httproot'})); + $tpl->fillin('SCRIPT_PHYS',encode_html($ENV{'SCRIPT_FILENAME'})); + $tpl->fillin('CONFIG_PATH',encode_html($data->{'configfile'})); + $tpl->fillin('FILE_ROOT', encode_html($config->{'fileroot'})); + $tpl->fillin('HTTP_ROOT', encode_html($config->{'httproot'})); # Perl - $tpl->fillin('PERL_PROG',encode_entities($^X)); + $tpl->fillin('PERL_PROG',encode_html($^X)); $tpl->fillin('PERL_VER', sprintf('%vd',$^V)); # Information about the server - $tpl->fillin('HTTPD',encode_entities($ENV{'SERVER_SOFTWARE'})); - $tpl->fillin('OS', encode_entities($^O)); - $tpl->fillin('TIME', encode_entities(strftime($config->{'timeformat'},($config->{'use_gmt'}) ? gmtime : localtime))); + $tpl->fillin('HTTPD',encode_html($ENV{'SERVER_SOFTWARE'})); + $tpl->fillin('OS', encode_html($^O)); + $tpl->fillin('TIME', encode_html(strftime($config->{'timeformat'},($config->{'use_gmt'}) ? gmtime : localtime))); $tpl->parse_if_block('gmt',$config->{'use_gmt'}); @@ -914,7 +1160,7 @@ sub exec_about($$) $tpl->parse_if_block('users',1); - # ID's of user and group + # IDs of user and group $tpl->fillin('UID',$uid); $tpl->fillin('GID',$gid); @@ -923,7 +1169,7 @@ sub exec_about($$) if(my $user = getpwuid($uid)) { - $tpl->fillin('USER',encode_entities($user)); + $tpl->fillin('USER',encode_html($user)); $tpl->parse_if_block('user_detected',1); } else @@ -933,7 +1179,7 @@ sub exec_about($$) if(my $group = getgrgid($gid)) { - $tpl->fillin('GROUP',encode_entities($group)); + $tpl->fillin('GROUP',encode_html($group)); $tpl->parse_if_block('group_detected',1); } else