X-Git-Url: https://git.p6c8.net/devedit.git/blobdiff_plain/75c789857e82f326c9f1948f4c04ba266ab511c2..8e187e4f2ec51c2306c5d69755db1cc04e5e2cee:/modules/Command.pm diff --git a/modules/Command.pm b/modules/Command.pm index d62643d..96dbf52 100644 --- a/modules/Command.pm +++ b/modules/Command.pm @@ -6,7 +6,7 @@ package Command; # Execute Dev-Editor's commands # # Author: Patrick Canterino -# Last modified: 2004-12-10 +# Last modified: 2005-01-01 # use strict; @@ -20,14 +20,14 @@ use File::Path; use POSIX qw(strftime); use Tool; -use CGI qw(header); +use CGI qw(header + escape); + use HTML::Entities; use Output; use Template; -use Data::Dumper; - -my $script = $ENV{'SCRIPT_NAME'}; +my $script = encode_entities($ENV{'SCRIPT_NAME'}); my $users = eval("getpwuid(0)") && eval("getgrgid(0)"); my %dispatch = ('show' => \&exec_show, @@ -74,7 +74,7 @@ sub exec_command($$$) } } - return error($config->{'errors'}->{'cmd_unknown'},'/',{COMMAND => $command}); + return error($config->{'errors'}->{'cmd_unknown'},'/',{COMMAND => encode_entities($command)}); } # exec_show() @@ -91,7 +91,7 @@ sub exec_show($$) my ($data,$config) = @_; my $physical = $data->{'physical'}; my $virtual = $data->{'virtual'}; - my $upper_path = upper_path($virtual); + my $upper_path = encode_entities(upper_path($virtual)); my $uselist = $data->{'uselist'}; my $tpl = new Template; @@ -103,7 +103,7 @@ sub exec_show($$) return error($config->{'errors'}->{'no_dir_access'},$upper_path) unless(-r $physical && -x $physical); my $direntries = dir_read($physical); - return error($config->{'dir_read_fail'},$upper_path,{DIR => $virtual}) unless($direntries); + return error($config->{'dir_read_fail'},$upper_path,{DIR => encode_entities($virtual)}) unless($direntries); my $files = $direntries->{'files'}; my $dirs = $direntries->{'dirs'}; @@ -112,6 +112,9 @@ sub exec_show($$) my $dirlist = ""; + my $filter1 = $data->{'cgi'}->param('filter') || '*'; # The real wildcard + my $filter2 = ($filter1 && $filter1 ne '*') ? $filter1 : ''; # Wildcard for output + # Create the link to the upper directory # (only if we are not in the root directory) @@ -122,7 +125,7 @@ sub exec_show($$) my $udtpl = new Template; $udtpl->read_file($config->{'templates'}->{'dirlist_up'}); - $udtpl->fillin("UPPER_DIR",encode_entities($upper_path)); + $udtpl->fillin("UPPER_DIR",$upper_path); $udtpl->fillin("DATE",encode_entities(strftime($config->{'timeformat'},localtime($stat[9])))); $dirlist .= $udtpl->get_template; @@ -132,6 +135,8 @@ sub exec_show($$) foreach my $dir(@$dirs) { + next unless(dos_wildcard_match($filter1,$dir)); + my $phys_path = $physical."/".$dir; my $virt_path = encode_entities($virtual.$dir."/"); @@ -141,9 +146,9 @@ sub exec_show($$) $dtpl->read_file($config->{'templates'}->{'dirlist_dir'}); $dtpl->fillin("DIR",$virt_path); - $dtpl->fillin("DIR_NAME",$dir); + $dtpl->fillin("DIR_NAME",encode_entities($dir)); $dtpl->fillin("DATE",encode_entities(strftime($config->{'timeformat'},localtime($stat[9])))); - $dtpl->fillin("URL",equal_url($config->{'httproot'},$virt_path)); + $dtpl->fillin("URL",equal_url(encode_entities($config->{'httproot'}),$virt_path)); $dtpl->parse_if_block("readable",-r $phys_path && -x $phys_path); $dtpl->parse_if_block("users",$users && -o $phys_path); @@ -155,6 +160,8 @@ sub exec_show($$) foreach my $file(@$files) { + next unless(dos_wildcard_match($filter1,$file)); + my $phys_path = $physical."/".$file; my $virt_path = encode_entities($virtual.$file); @@ -166,10 +173,10 @@ sub exec_show($$) $ftpl->read_file($config->{'templates'}->{'dirlist_file'}); $ftpl->fillin("FILE",$virt_path); - $ftpl->fillin("FILE_NAME",$file); + $ftpl->fillin("FILE_NAME",encode_entities($file)); $ftpl->fillin("SIZE",$stat[7]); $ftpl->fillin("DATE",encode_entities(strftime($config->{'timeformat'},localtime($stat[9])))); - $ftpl->fillin("URL",equal_url($config->{'httproot'},$virt_path)); + $ftpl->fillin("URL",equal_url(encode_entities($config->{'httproot'}),$virt_path)); $ftpl->parse_if_block("not_readable",not -r $phys_path); $ftpl->parse_if_block("binary",-B $phys_path); @@ -191,11 +198,15 @@ sub exec_show($$) $tpl->read_file($config->{'templates'}->{'dirlist'}); $tpl->fillin("DIRLIST",$dirlist); - $tpl->fillin("DIR",$virtual); + $tpl->fillin("DIR",encode_entities($virtual)); $tpl->fillin("SCRIPT",$script); - $tpl->fillin("URL",equal_url($config->{'httproot'},$virtual)); + $tpl->fillin("URL",encode_entities(equal_url($config->{'httproot'},$virtual))); + + $tpl->fillin("FILTER",encode_entities($filter2)); + $tpl->fillin("FILTER_URL",escape($filter2)); $tpl->parse_if_block("dir_writeable",$dir_writeable); + $tpl->parse_if_block("filter",$filter2); } else { @@ -204,40 +215,30 @@ sub exec_show($$) return error($config->{'errors'}->{'no_view'},$upper_path) unless(-r $physical); # Check on binary files - # We have to do it in this way, or empty files - # will be recognized as binary files + # We have to do it in this way or empty files will be recognized + # as binary files - unless(-T $physical) - { - # Binary file + return error($config->{'errors'}->{'binary'},$upper_path) unless(-T $physical); - return error($config->{'errors'}->{'binary'},$upper_path); - } - else - { - # Text file + # Is the file too large? - if($config->{'max_file_size'} && -s $physical > $config->{'max_file_size'}) - { - return error($config->{'errors'}->{'file_too_large'},$upper_path,{SIZE => $config->{'max_file_size'}}) - } - else - { - my $content = file_read($physical); - $$content =~ s/\015\012|\012|\015/\n/g; + return error($config->{'errors'}->{'file_too_large'},$upper_path,{SIZE => $config->{'max_file_size'}}) if($config->{'max_file_size'} && -s $physical > $config->{'max_file_size'}); - $tpl->read_file($config->{'templates'}->{'viewfile'}); + # View the file - $tpl->fillin("FILE",$virtual); - $tpl->fillin("DIR",$upper_path); - $tpl->fillin("URL",equal_url($config->{'httproot'},$virtual)); - $tpl->fillin("SCRIPT",$script); + my $content = file_read($physical); + $$content =~ s/\015\012|\012|\015/\n/g; - $tpl->parse_if_block("editable",-w $physical && $uselist->unused($virtual)); + $tpl->read_file($config->{'templates'}->{'viewfile'}); - $tpl->fillin("CONTENT",encode_entities($$content)); - } - } + $tpl->fillin("FILE",encode_entities($virtual)); + $tpl->fillin("DIR",$upper_path); + $tpl->fillin("URL",encode_entities(equal_url($config->{'httproot'},$virtual))); + $tpl->fillin("SCRIPT",$script); + + $tpl->parse_if_block("editable",-w $physical && $uselist->unused($virtual)); + + $tpl->fillin("CONTENT",encode_entities($$content)); } my $output = header(-type => "text/html"); @@ -269,43 +270,35 @@ sub exec_beginedit($$) # Check on binary files - unless(-T $physical) - { - # Binary file + return error($config->{'errors'}->{'binary'},$dir) unless(-T $physical); - return error($config->{'errors'}->{'binary'},$dir); - } - else - { - if($config->{'max_file_size'} && -s $physical > $config->{'max_file_size'}) - { - return error($config->{'errors'}->{'file_too_large'},$dir,{SIZE => $config->{'max_file_size'}}) - } - else - { - # Text file + # Is the file too large? - $uselist->add_file($virtual); - $uselist->save; + return error($config->{'errors'}->{'file_too_large'},$dir,{SIZE => $config->{'max_file_size'}}) if($config->{'max_file_size'} && -s $physical > $config->{'max_file_size'}); - my $content = file_read($physical); - $$content =~ s/\015\012|\012|\015/\n/g; + # Lock the file... - my $tpl = new Template; - $tpl->read_file($config->{'templates'}->{'editfile'}); + $uselist->add_file($virtual); + $uselist->save; - $tpl->fillin("FILE",$virtual); - $tpl->fillin("DIR",$dir); - $tpl->fillin("URL",equal_url($config->{'httproot'},$virtual)); - $tpl->fillin("SCRIPT",$script); - $tpl->fillin("CONTENT",encode_entities($$content)); + # ... and show the editing form - my $output = header(-type => "text/html"); - $output .= $tpl->get_template; + my $content = file_read($physical); + $$content =~ s/\015\012|\012|\015/\n/g; - return \$output; - } - } + my $tpl = new Template; + $tpl->read_file($config->{'templates'}->{'editfile'}); + + $tpl->fillin("FILE",$virtual); + $tpl->fillin("DIR",$dir); + $tpl->fillin("URL",equal_url($config->{'httproot'},$virtual)); + $tpl->fillin("SCRIPT",$script); + $tpl->fillin("CONTENT",encode_entities($$content)); + + my $output = header(-type => "text/html"); + $output .= $tpl->get_template; + + return \$output; } # exec_canceledit() @@ -495,23 +488,25 @@ sub exec_upload($$) my $file_phys = $physical."/".$filename; my $file_virt = $virtual.$filename; - return error($config->{'errors'}->{'file_exists'},$virtual,{FILE => $file_virt}) if(-e $file_phys && not $cgi->param('overwrite')); + return error($config->{'errors'}->{'in_use'},$virtual,{FILE => $file_virt}) if($data->{'uselist'}->in_use($file_virt)); + + if(-e $file_phys) + { + return error($config->{'errors'}->{'dir_replace'},$virtual) if(-d $file_phys); + return error($config->{'errors'}->{'exist_no_write'},$virtual,{FILE => $file_virt}) unless(-w $file_phys); + return error($config->{'errors'}->{'file_exists'},$virtual,{FILE => $file_virt}) unless($cgi->param('overwrite')); + } my $ascii = $cgi->param('ascii'); my $handle = $cgi->upload('uploaded_file'); - local *FILE; - - open(FILE,">".$file_phys) or return error($config->{'errors'}->{'mkfile_failed'},$virtual,{FILE => $file_virt}); - binmode(FILE) unless($ascii); + return error($config->{'errors'}->{'invalid_upload'},$virtual) unless($handle); # Read transferred file and write it to disk read($handle, my $data, -s $handle); $data =~ s/\015\012|\012|\015/\n/g if($ascii); # Replace line separators if transferring in ASCII mode - print FILE $data; - - close(FILE); + file_save($file_phys,\$data,not $ascii) or return error($config->{'errors'}->{'mkfile_failed'},$virtual,{FILE => $file_virt}); return devedit_reload({command => "show", file => $virtual}); } @@ -548,8 +543,8 @@ sub exec_copy($$) my $dir = upper_path($virtual); my $new_physical = $data->{'new_physical'}; - return error($config->{'errors'}->{'dircopy'},upper_path($virtual)) if(-d $physical); - return error($config->{'errors'}->{'no_copy'},upper_path($virtual)) unless(-r $physical); + return error($config->{'errors'}->{'dircopy'},$dir) if(-d $physical); + return error($config->{'errors'}->{'no_copy'},$dir) unless(-r $physical); if($new_physical) { @@ -559,13 +554,11 @@ sub exec_copy($$) if(-e $new_physical) { - return error($config->{'errors'}->{'exist_edited'},$new_dir,{FILE => $new_virtual}) if($data->{'uselist'}->in_use($data->{'new_virtual'})); + return error($config->{'errors'}->{'exist_edited'},$new_dir,{FILE => $new_virtual}) if($data->{'uselist'}->in_use($data->{'new_virtual'})); + return error($config->{'errors'}->{'dir_replace'},$new_dir) if(-d $new_physical); + return error($config->{'errors'}->{'exist_no_write'},$new_dir,{FILE => $new_virtual}) unless(-w $new_physical); - if(-d $new_physical) - { - return error($config->{'errors'}->{'dir_replace'},$new_dir); - } - elsif(not $data->{'cgi'}->param('confirmed')) + if(not $data->{'cgi'}->param('confirmed')) { my $tpl = new Template; $tpl->read_file($config->{'templates'}->{'confirm_replace'}); @@ -624,8 +617,8 @@ sub exec_rename($$) my $dir = upper_path($virtual); my $new_physical = $data->{'new_physical'}; - return error($config->{'errors'}->{'rename_root'},"/") if($virtual eq "/"); - return error($config->{'errors'}->{'no_rename'},$dir) unless(-w upper_path($physical)); + return error($config->{'errors'}->{'rename_root'},"/") if($virtual eq "/"); + return error($config->{'errors'}->{'no_rename'},$dir) unless(-w upper_path($physical)); return error($config->{'errors'}->{'in_use'},$dir,{FILE => $virtual}) if($data->{'uselist'}->in_use($virtual)); if($new_physical) @@ -636,13 +629,11 @@ sub exec_rename($$) if(-e $new_physical) { - return error($config->{'errors'}->{'exist_edited'},$new_dir,{FILE => $new_virtual}) if($data->{'uselist'}->in_use($data->{'new_virtual'})); + return error($config->{'errors'}->{'exist_edited'},$new_dir,{FILE => $new_virtual}) if($data->{'uselist'}->in_use($data->{'new_virtual'})); + return error($config->{'errors'}->{'dir_replace'},$new_dir) if(-d $new_physical); + return error($config->{'errors'}->{'exist_no_write'},$new_dir,{FILE => $new_virtual}) unless(-w $new_physical); - if(-d $new_physical) - { - return error($config->{'errors'}->{'dir_replace'},$new_dir); - } - elsif(not $data->{'cgi'}->param('confirmed')) + if(not $data->{'cgi'}->param('confirmed')) { my $tpl = new Template; $tpl->read_file($config->{'templates'}->{'confirm_replace'}); @@ -772,94 +763,73 @@ sub exec_chprop($$) my $physical = $data->{'physical'}; my $virtual = $data->{'virtual'}; my $dir = upper_path($virtual); - my $cgi = $data->{'cgi'}; - my $mode = $cgi->param('mode'); - my $group = $cgi->param('group'); - if($users) - { - # System supports user and groups + return error($config->{'errors'}->{'no_users'},$dir,{FILE => $virtual}) unless($users); + return error($config->{'errors'}->{'chprop_root'},"/") if($virtual eq "/"); + return error($config->{'errors'}->{'not_owner'},$dir,{FILE => $virtual}) unless(-o $physical); + return error($config->{'errors'}->{'in_use'},$dir,{FILE => $virtual}) if($data->{'uselist'}->in_use($virtual)); + + my $cgi = $data->{'cgi'}; + my $mode = $cgi->param('mode'); + my $group = $cgi->param('group'); - if($virtual ne "/") + if($mode || $group) + { + if($mode) { - # Not the root directory + # Change the mode - if(-o $physical) - { - # We own this file - - if($mode || $group) - { - if($mode) - { - # Change the mode - - chmod(oct($mode),$physical); - } - - if($group) - { - # Change the group using the `chgrp` system command - - return error($config->{'errors'}->{'invalid_group'},$dir,{GROUP => encode_entities($group)}) unless($group =~ /^[a-z0-9_]+[a-z0-9_-]*$/i); - system("chgrp",$group,$physical); - } - - return devedit_reload({command => 'show', file => $dir}); - } - else - { - # Display the form - - my @stat = stat($physical); - my $mode = $stat[2]; - my $gid = $stat[5]; - - my $tpl = new Template; - $tpl->read_file($config->{'templates'}->{'chprop'}); - - # Insert file properties into the template - - $tpl->fillin("MODE_OCTAL",substr(sprintf("%04o",$mode),-4)); - $tpl->fillin("MODE_STRING",mode_string($mode)); - $tpl->fillin("GID",$gid); - - if(my $group = getgrgid($gid)) - { - $tpl->fillin("GROUP",encode_entities($group)); - $tpl->parse_if_block("group_detected",1); - } - else - { - $tpl->parse_if_block("group_detected",0); - } - - # Insert other information - - $tpl->fillin("FILE",$virtual); - $tpl->fillin("DIR",$dir); - $tpl->fillin("URL",equal_url($config->{'httproot'},$virtual)); - $tpl->fillin("SCRIPT",$script); - - my $output = header(-type => "text/html"); - $output .= $tpl->get_template; - - return \$output; - } - } - else - { - return error($config->{'errors'}->{'not_owner'},$dir,{FILE => $virtual}); - } + chmod(oct($mode),$physical); } - else + + if($group) { - return error($config->{'errors'}->{'chprop_root'},"/"); + # Change the group using the `chgrp` system command + + return error($config->{'errors'}->{'invalid_group'},$dir,{GROUP => encode_entities($group)}) unless($group =~ /^[a-z0-9_]+[a-z0-9_-]*$/i); + system("chgrp",$group,$physical); } + + return devedit_reload({command => 'show', file => $dir}); } else { - return error($config->{'errors'}->{'no_users'},$dir,{FILE => $virtual}); + # Display the form + + my @stat = stat($physical); + my $mode = $stat[2]; + my $gid = $stat[5]; + + my $tpl = new Template; + $tpl->read_file($config->{'templates'}->{'chprop'}); + + # Insert file properties into the template + + $tpl->fillin("MODE_OCTAL",substr(sprintf("%04o",$mode),-4)); + $tpl->fillin("MODE_STRING",mode_string($mode)); + $tpl->fillin("GID",$gid); + + if(my $group = getgrgid($gid)) + { + $tpl->fillin("GROUP",encode_entities($group)); + $tpl->parse_if_block("group_detected",1); + } + else + { + $tpl->parse_if_block("group_detected",0); + } + + # Insert other information + + $tpl->fillin("FILE",$virtual); + $tpl->fillin("DIR",$dir); + $tpl->fillin("URL",equal_url($config->{'httproot'},$virtual)); + $tpl->fillin("SCRIPT",$script); + + my $output = header(-type => "text/html"); + $output .= $tpl->get_template; + + return \$output; } } @@ -936,13 +906,13 @@ sub exec_about($$) # Perl $tpl->fillin("PERL_PROG",encode_entities($^X)); - $tpl->fillin("PERL_VER",sprintf("%vd",$^V)); + $tpl->fillin("PERL_VER", sprintf("%vd",$^V)); # Information about the server $tpl->fillin("HTTPD",encode_entities($ENV{'SERVER_SOFTWARE'})); - $tpl->fillin("OS",$^O); - $tpl->fillin("TIME",encode_entities(strftime($config->{'timeformat'},localtime))); + $tpl->fillin("OS", encode_entities($^O)); + $tpl->fillin("TIME", encode_entities(strftime($config->{'timeformat'},localtime))); # Process information