If the user wants to view/edit a file larger than a defined size, Dev-Editor

denies file access

diff --git a/devedit.dat b/devedit.dat
index 05837ece861057c4afd8dad567318261ce9f01bc..cc56311dba536511d03a80fa23f6f85e5e16ccda 100644 (file)
--- a/devedit.dat
+++ b/devedit.dat
@@ -10,6 +10,8 @@ uselist_file  = uselist
 lock_file     = uselist.lock
 lock_timeout  = 10
 
 lock_file     = uselist.lock
 lock_timeout  = 10
 

+max_file_size = 100000
+

 error_file    = D:/WWW/cgi-bin/devedit/errors.dat
 template_file = D:/WWW/cgi-bin/devedit/templates.dat
 
 error_file    = D:/WWW/cgi-bin/devedit/errors.dat
 template_file = D:/WWW/cgi-bin/devedit/templates.dat
 

diff --git a/errors.dat b/errors.dat
index 7a66dee5075a56e1c74529520affdebd24d98fba..4a703a570718f597cfd385be95847772fad5a57d 100644 (file)
--- a/errors.dat
+++ b/errors.dat
@@ -1,27 +1,28 @@
 # This file contains the error messages of Dev-Editor
 
 # This file contains the error messages of Dev-Editor
 

-binary        = This editor is not able to view/edit binary files.
-editdir       = You cannot edit directories.
-noedit        = You have not enough permissions to edit this file.
-file_in_use   = The file '{FILE}' is currently edited by someone else.
-edit_failed   = Saving of file '{FILE}' failed. The file could be damaged, please check its integrity.
-delete_failed = Could not delete file '{FILE}'.
-dir_read_fail = Reading of directory '{DIR}' failed.
-mkfile_failed = Could not create file '{FILE}'.
-mkdir_failed  = Could not create directory '{DIR}'.
-copy_failed   = Could not copy '{FILE}' to '{NEW_FILE}'.
-rename_failed = Could not move/rename '{FILE}' to '{NEW_FILE}'.
-above_root    = Accessing files and directories above the virtual root directory is forbidden.
-create_ar     = You aren't allowed to create files and directories above the virtual root directory.
-file_exists   = A file or directory called '{FILE}' already exists.
-exist_edited  = The target file '{FILE}' already exists and is edited by someone else.
-in_use        = The file '{FILE}' is currently edited by someone else.
-noview        = You have not enough permissions to view this file.
-nocopy        = You have not enough permissions to copy this file.
-dircopy       = This editor is not able to copy directories.
-cmd_unknown   = Unknown command: {COMMAND}
-lock_failed   = Locking of '{USELIST}' failed. Try it again in a moment. If the problem persists, ask someone to recreate the lock file ('{LOCK_FILE}').
-not_exist     = File/directory does not exist.
-dir_not_exist = The directory where you want to create this file or directory doesn't exist.
+binary         = This editor is not able to view/edit binary files.
+editdir        = You cannot edit directories.
+noedit         = You have not enough permissions to edit this file.
+file_in_use    = The file '{FILE}' is currently edited by someone else.
+edit_failed    = Saving of file '{FILE}' failed. The file could be damaged, please check its integrity.
+delete_failed  = Could not delete file '{FILE}'.
+dir_read_fail  = Reading of directory '{DIR}' failed.
+mkfile_failed  = Could not create file '{FILE}'.
+mkdir_failed   = Could not create directory '{DIR}'.
+copy_failed    = Could not copy '{FILE}' to '{NEW_FILE}'.
+rename_failed  = Could not move/rename '{FILE}' to '{NEW_FILE}'.
+above_root     = Accessing files and directories above the virtual root directory is forbidden.
+create_ar      = You aren't allowed to create files and directories above the virtual root directory.
+file_exists    = A file or directory called '{FILE}' already exists.
+exist_edited   = The target file '{FILE}' already exists and is edited by someone else.
+in_use         = The file '{FILE}' is currently edited by someone else.
+noview         = You have not enough permissions to view this file.
+nocopy         = You have not enough permissions to copy this file.
+dircopy        = This editor is not able to copy directories.
+cmd_unknown    = Unknown command: {COMMAND}
+lock_failed    = Locking of '{USELIST}' failed. Try it again in a moment. If the problem persists, ask someone to recreate the lock file ('{LOCK_FILE}').
+not_exist      = File/directory does not exist.
+dir_not_exist  = The directory where you want to create this file or directory doesn't exist.
+file_too_large = The file you want to view or edit is too large (max. {SIZE} Bytes).

 
 # End of configuration file
\ No newline at end of file
 
 # End of configuration file
\ No newline at end of file

diff --git a/modules/Command.pm b/modules/Command.pm
index e0bcb7cf5e02df9a4c456bdd90859ba48bd5b479..64f49008c29f371a611a3bd3f11bbcc99542c17a 100644 (file)
--- a/modules/Command.pm
+++ b/modules/Command.pm
@@ -6,7 +6,7 @@ package Command;
 # Execute Dev-Editor's commands
 #
 # Author:        Patrick Canterino <patshaping@gmx.net>
 # Execute Dev-Editor's commands
 #
 # Author:        Patrick Canterino <patshaping@gmx.net>

-# Last modified: 2004-04-25
+# Last modified: 2004-07-03

 #
 
 use strict;
 #
 
 use strict;


@@ -25,6 +25,8 @@ use HTML::Entities;
 use Output;
 use Template;
 
 use Output;
 use Template;
 

+use Data::Dumper;
+

 my $script = $ENV{'SCRIPT_NAME'};
 
 my %dispatch = ('show'       => \&exec_show,
 my $script = $ENV{'SCRIPT_NAME'};
 
 my %dispatch = ('show'       => \&exec_show,


@@ -153,12 +155,15 @@ sub exec_show($$)
    $ftpl->parse_if_block("binary",-B $phys_path);
    $ftpl->parse_if_block("readonly",not -w $phys_path);
 
    $ftpl->parse_if_block("binary",-B $phys_path);
    $ftpl->parse_if_block("readonly",not -w $phys_path);
 

-   $ftpl->parse_if_block("viewable",-r $phys_path && -T $phys_path);
-   $ftpl->parse_if_block("editable",-w $phys_path && -r $phys_path && -T $phys_path && not $in_use);
+   $ftpl->parse_if_block("viewable",-r $phys_path && -T $phys_path && not ($config->{'max_file_size'} && $stat[7] > $config->{'max_file_size'}));
+
+   $ftpl->parse_if_block("editable",-r $phys_path && -w $phys_path && -T $phys_path && not ($config->{'max_file_size'} && $stat[7] > $config->{'max_file_size'}) && not $in_use);

 
    $ftpl->parse_if_block("in_use",$in_use);
    $ftpl->parse_if_block("unused",not $in_use);
 
 
    $ftpl->parse_if_block("in_use",$in_use);
    $ftpl->parse_if_block("unused",not $in_use);
 

+   $ftpl->parse_if_block("too_large",$config->{'max_file_size'} && $stat[7] > $config->{'max_file_size'});
+

    $dirlist .= $ftpl->get_template;
   }
 
    $dirlist .= $ftpl->get_template;
   }
 


@@ -189,16 +194,23 @@ sub exec_show($$)
   {
    # Text file
 
   {
    # Text file
 

-   my $content =  file_read($physical);
-   $$content   =~ s/\015\012|\012|\015/\n/g;
+   if($config->{'max_file_size'} && (stat($physical))[7] > $config->{'max_file_size'})
+   {
+    return error($config->{'errors'}->{'file_too_large'},upper_path($virtual),{SIZE => $config->{'max_file_size'}})
+   }
+   else
+   {
+    my $content =  file_read($physical);
+    $$content   =~ s/\015\012|\012|\015/\n/g;

 
 

-   $tpl->read_file($config->{'templates'}->{'viewfile'});
+    $tpl->read_file($config->{'templates'}->{'viewfile'});

 
 

-   $tpl->fillin("FILE",$virtual);
-   $tpl->fillin("DIR",upper_path($virtual));
-   $tpl->fillin("URL",equal_url($config->{'httproot'},$virtual));
-   $tpl->fillin("SCRIPT",$script);
-   $tpl->fillin("CONTENT",encode_entities($$content));
+    $tpl->fillin("FILE",$virtual);
+    $tpl->fillin("DIR",upper_path($virtual));
+    $tpl->fillin("URL",equal_url($config->{'httproot'},$virtual));
+    $tpl->fillin("SCRIPT",$script);
+    $tpl->fillin("CONTENT",encode_entities($$content));
+   }

   }
  }
 
   }
  }
 


@@ -238,27 +250,34 @@ sub exec_beginedit($$)
  }
  else
  {
  }
  else
  {

-  # Text file
+  if($config->{'max_file_size'} && (stat($physical))[7] > $config->{'max_file_size'})
+  {
+   return error($config->{'errors'}->{'file_too_large'},upper_path($virtual),{SIZE => $config->{'max_file_size'}})
+  }
+  else
+   {
+   # Text file

 
 

-  $uselist->add_file($virtual);
-  $uselist->save;
+   $uselist->add_file($virtual);
+   $uselist->save;

 
 

-  my $content =  file_read($physical);
-  $$content   =~ s/\015\012|\012|\015/\n/g;
+   my $content =  file_read($physical);
+   $$content   =~ s/\015\012|\012|\015/\n/g;

 
 

-  my $tpl = new Template;
-  $tpl->read_file($config->{'templates'}->{'editfile'});
+   my $tpl = new Template;
+   $tpl->read_file($config->{'templates'}->{'editfile'});

 
 

-  $tpl->fillin("FILE",$virtual);
-  $tpl->fillin("DIR",upper_path($virtual));
-  $tpl->fillin("URL",equal_url($config->{'httproot'},$virtual));
-  $tpl->fillin("SCRIPT",$script);
-  $tpl->fillin("CONTENT",encode_entities($$content));
+   $tpl->fillin("FILE",$virtual);
+   $tpl->fillin("DIR",upper_path($virtual));
+   $tpl->fillin("URL",equal_url($config->{'httproot'},$virtual));
+   $tpl->fillin("SCRIPT",$script);
+   $tpl->fillin("CONTENT",encode_entities($$content));

 
 

-  my $output = header(-type => "text/html");
-  $output   .= $tpl->get_template;
+   my $output = header(-type => "text/html");
+   $output   .= $tpl->get_template;

 
 

-  return \$output;
+   return \$output;
+  }

  }
 }
 
  }
 }
 


@@ -420,13 +439,11 @@ sub exec_upload($$)
   open(FILE,">$file_phys") or return error($config->{'errors'}->{'mkfile_failed'},$virtual,{FILE => $file_virt});
   binmode(FILE) unless($ascii);
 
   open(FILE,">$file_phys") or return error($config->{'errors'}->{'mkfile_failed'},$virtual,{FILE => $file_virt});
   binmode(FILE) unless($ascii);
 

-  my $data;
+  # Read transferred file and write it to disk

 
 

-  while(read($handle,$data,1024))
-  {
-   $data =~ s/\015\012|\012|\015/\n/g if($ascii);
-   print FILE $data;
-  }
+  read($handle, my $data, -s $handle);
+  $data =~ s/\015\012|\012|\015/\n/g if($ascii); # Replace line separators if transferring in ASCII mode
+  print FILE $data;

 
   close(FILE);
 
 
   close(FILE);
 

diff --git a/templates/dirlist_file.htm b/templates/dirlist_file.htm
index a9f2a62cc1a46986744280d5f9a929bf42f653bc..4e29e5022bd8d48eb4eae9fdc6144b9642a320ba 100644 (file)
--- a/templates/dirlist_file.htm
+++ b/templates/dirlist_file.htm
@@ -2,5 +2,5 @@
 <td align="right">{SIZE}</td>
 <td style="padding-left:15pt">{DATE}</td>
 <td style="padding-left:15pt">{FILE_NAME}</td>
 <td align="right">{SIZE}</td>
 <td style="padding-left:15pt">{DATE}</td>
 <td style="padding-left:15pt">{FILE_NAME}</td>

-<td style="padding-left:15pt">({IF viewable}<a href="{SCRIPT}?command=show&file={FILE}">View</a>{ELSE}<span style="color:#C0C0C0" title="{IF not_readable}Not readable{ELSE}{IF binary}Binary file{ENDIF}{ENDIF}">View</span>{ENDIF} | {IF editable}<a href="{SCRIPT}?command=beginedit&file={FILE}">Edit</a>{ELSE}<span style="color:#C0C0C0" title="{IF not_readable}Not readable{ELSE}{IF readonly}Read only{ELSE}{IF binary}Binary file{ELSE}{IF in_use}In use{ENDIF}{ENDIF}{ENDIF}{ENDIF}">Edit</span>{ENDIF} | <a href="{SCRIPT}?command=copy&file={FILE}">Copy</a>{IF unused} | <a href="{SCRIPT}?command=rename&file={FILE}">Rename</a> | <a href="{SCRIPT}?command=remove&file={FILE}">Delete</a>{ENDIF}{IF in_use} | <a href="{SCRIPT}?command=unlock&file={FILE}">Unlock</a>{ENDIF} | <a href="{URL}" target="_blank">View in Browser</a>)</td>
-</tr>
\ No newline at end of file
+<td style="padding-left:15pt">({IF viewable}<a href="{SCRIPT}?command=show&file={FILE}">View</a>{ELSE}<span style="color:#C0C0C0" title="{IF not_readable}Not readable{ELSE}{IF binary}Binary file{ELSE}{IF too_large}File too large{ENDIF}{ENDIF}{ENDIF}">View</span>{ENDIF} | {IF editable}<a href="{SCRIPT}?command=beginedit&file={FILE}">Edit</a>{ELSE}<span style="color:#C0C0C0" title="{IF not_readable}Not readable{ELSE}{IF readonly}Read only{ELSE}{IF binary}Binary file{ELSE}{IF too_large}File too large{ENDIF}{IF in_use}In use{ENDIF}{ENDIF}{ENDIF}{ENDIF}">Edit</span>{ENDIF} | <a href="{SCRIPT}?command=copy&file={FILE}">Copy</a>{IF unused} | <a href="{SCRIPT}?command=rename&file={FILE}">Rename</a> | <a href="{SCRIPT}?command=remove&file={FILE}">Delete</a>{ENDIF}{IF in_use} | <a href="{SCRIPT}?command=unlock&file={FILE}">Unlock</a>{ENDIF} | <a href="{URL}" target="_blank">View in Browser</a>)</td>
+</tr>