From be46cb408291275363ad49a025bb6bf1667fc929 Mon Sep 17 00:00:00 2001 From: Stefan Ritt Date: Wed, 27 Sep 2006 21:02:24 +0000 Subject: [PATCH] Implemented 'allowed encoding' option SVN revision: 1719 --- doc/config.html | 19 ++++++++++ src/elogd.c | 94 +++++++++++++++++++++++++++++++++++++------------ 2 files changed, 91 insertions(+), 22 deletions(-) diff --git a/doc/config.html b/doc/config.html index 1295c025..b26c9838 100755 --- a/doc/config.html +++ b/doc/config.html @@ -2152,6 +2152,25 @@ Options Location = Main Building{a}, New Building{b}, Old Building{c} "http://midas.psi.ch/elog/elcode_en.html">ELCode encoding, to 2 for HTML encoding. The default is 0. +
  • + Allowed encoding = <n>
    + Allowed encoding options. <n> can be the sum of + following flags: + + To allow plain and HTML encoding for example, set + <n> to 5. Default is 3. Note that + allowing HTML encoding may cause some security risk, since an elog + entry may contain malicious scripting code. It should therefor only + be allowed for installations where it is really needed and with not + public write access. +
  • Suppress default = 0|1|2|3
    This specifies the default state of the "Suppress Email diff --git a/src/elogd.c b/src/elogd.c index 0c8d8b3f..865aa369 100755 --- a/src/elogd.c +++ b/src/elogd.c @@ -8444,7 +8444,8 @@ void show_edit_form(LOGBOOK * lbs, int message_id, BOOL breply, BOOL bedit, BOOL { int i, j, n, index, aindex, size, width, height, fh, length, input_size, input_maxlen, format_flags[MAX_N_ATTR], year, month, day, hour, min, sec, n_attr, n_disp_attr, n_lines, - attr_index[MAX_N_ATTR], enc_selected, show_smileys, show_text, n_moptions, display_inline; + attr_index[MAX_N_ATTR], enc_selected, show_smileys, show_text, n_moptions, display_inline, + allowed_encoding; char str[2 * NAME_LENGTH], preset[2 * NAME_LENGTH], *p, *pend, star[80], comment[10000], reply_string[256], list[MAX_N_ATTR][NAME_LENGTH], file_name[256], *buffer, format[256], date[80], script[256], attrib[MAX_N_ATTR][NAME_LENGTH], *text, orig_tag[80], reply_tag[MAX_REPLY_TO * 10], @@ -9965,29 +9966,56 @@ void show_edit_form(LOGBOOK * lbs, int message_id, BOOL breply, BOOL bedit, BOOL /* Encoding radio buttons */ - rsprintf("%s: ", loc("Encoding")); - - if (enc_selected == 0) - rsprintf(""); + if (getcfg(lbs->name, "Allowed encoding", str, sizeof(str))) + allowed_encoding = atoi(str); else - rsprintf - (""); - rsprintf - ("\n"); + allowed_encoding = 3; - if (enc_selected == 1) - rsprintf(""); - else - rsprintf - (""); - rsprintf("\n"); + if (allowed_encoding < 1 || allowed_encoding > 7) { + rsprintf("

    Invalid \"Allowed encoding\" in configuration file, value must be between 1 and 7

    \n"); + rsprintf("\n"); + show_bottom_text(lbs); + rsprintf("\r\n"); + return; + } - if (enc_selected == 2) - rsprintf(""); - else - rsprintf - (""); - rsprintf("\n"); + if (allowed_encoding == 1) + rsprintf("\n"); + else if (allowed_encoding == 2) + rsprintf("\n"); + else if (allowed_encoding == 4) + rsprintf("\n"); + else { + rsprintf("%s: ", loc("Encoding")); + + if (allowed_encoding & 2) { + if (enc_selected == 0) + rsprintf(""); + else + rsprintf + (""); + rsprintf + ("\n"); + } + + if (allowed_encoding & 1) { + if (enc_selected == 1) + rsprintf(""); + else + rsprintf + (""); + rsprintf("\n"); + } + + if (allowed_encoding & 4) { + if (enc_selected == 2) + rsprintf(""); + else + rsprintf + (""); + rsprintf("\n"); + } + } rsprintf("
    \n"); } @@ -19155,7 +19183,8 @@ void submit_elog(LOGBOOK * lbs) mail_param[1000], *mail_to, *rcpt_to, full_name[256], att_file[MAX_ATTACHMENTS][256], slist[MAX_N_ATTR + 10][NAME_LENGTH], svalue[MAX_N_ATTR + 10][NAME_LENGTH], ua[NAME_LENGTH]; int i, j, n, missing, first, index, mindex, suppress, message_id, resubmit_orig, - mail_to_size, rcpt_to_size, ltime, year, month, day, hour, min, sec, n_attr, email_notify[1000]; + mail_to_size, rcpt_to_size, ltime, year, month, day, hour, min, sec, n_attr, email_notify[1000], + allowed_encoding; BOOL bedit; struct tm tms; @@ -19316,6 +19345,27 @@ void submit_elog(LOGBOOK * lbs) } } + /* check if allowed encoding */ + if (getcfg(lbs->name, "Allowed encoding", str, sizeof(str))) + allowed_encoding = atoi(str); + else + allowed_encoding = 3; + + strcpy(str, isparam("encoding") ? getparam("encoding") : "plain"); + + if (strieq(str, "plain") && (allowed_encoding & 1) == 0) { + show_error("Plain encoding not allowed"); + return; + } + if (strieq(str, "ELCode") && (allowed_encoding & 2) == 0) { + show_error("ELCode encoding not allowed"); + return; + } + if (strieq(str, "HTML") && (allowed_encoding & 4) == 0) { + show_error("HTML encoding not allowed"); + return; + } + /* get attachments */ for (i = 0; i < MAX_ATTACHMENTS; i++) { sprintf(str, "attachment%d", i);