=================================================================== RCS file: /cvs/cvsweb/cvsweb.cgi,v retrieving revision 4.2 retrieving revision 4.14 diff -u -p -r4.2 -r4.14 --- cvsweb/cvsweb.cgi 2019/11/09 09:10:05 4.2 +++ cvsweb/cvsweb.cgi 2019/11/11 12:46:23 4.14 @@ -1,5 +1,5 @@ -#!/usr/bin/perl -T -# $Id: cvsweb.cgi,v 4.2 2019/11/09 09:10:05 schwarze Exp $ +#!/usr/bin/perl +# $Id: cvsweb.cgi,v 4.14 2019/11/11 12:46:23 schwarze Exp $ # $knu: cvsweb.cgi,v 1.299 2010/11/13 16:37:18 simon # # cvsweb - a CGI interface to CVS trees. @@ -50,7 +50,6 @@ require 5.006; use strict; - use warnings; use filetest qw(access); @@ -87,8 +86,8 @@ use vars qw ( $allow_enscript @enscript_options %enscript_types ); +require Compress::Zlib; use Cwd qw(abs_path); -use File::Basename qw(dirname); use File::Path qw(rmtree); use File::Spec::Functions qw(canonpath catdir catfile curdir devnull rootdir tmpdir updir); @@ -104,7 +103,6 @@ use constant CVSWEBMARKUP => qr{^text/(x-cvsweb|vnd\.v use constant LOG_FILESEPR => qr/^={77}$/o; use constant LOG_REVSEPR => qr/^-{28}$/o; -use constant HAS_ZLIB => eval { require Compress::Zlib; }; use constant HAS_EDIFF => eval { require String::Ediff; }; # ----------------------------------------------------------------------------- @@ -115,7 +113,7 @@ use constant HAS_EDIFF => eval { require String::Ed BEGIN { - $VERSION = '3.0.6'; + $VERSION = '3.1'; $HTML_DOCTYPE = 'General options EOF - for my $v qw(hidecvsroot hidenonreadable) { + for my $v (qw(hidecvsroot hidenonreadable)) { printf(qq{\n}, $v, $input{$v} || 0); } @@ -1556,7 +1549,7 @@ sub htmlify($;$) }{ my($text, $name, $section) = ($1, $2, defined($3) ? $3 : $4); ($name =~ /[A-Za-z]/ && $name !~ /\.(:|$)/) - ? &link($text, sprintf($mancgi, $section, uri_escape($name))) + ? &link($text, sprintf($mancgi, uri_escape($name), $section)) : $text; }egx; } $_; @@ -2934,7 +2927,7 @@ sub printLog($$$;$$) print "
\n"; print ''; - if (defined @mytz) { + if (@mytz) { my ($est) = $mytz[(localtime($date{$_}))[8]]; print scalar localtime($date{$_}), " $est ("; } else { @@ -4210,6 +4203,7 @@ sub htmlquote($) # Special Characters; RFC 1866 s/&/&/g; s/\"/"/g; + s/%22/"/g; s//>/g; return $_; @@ -4249,12 +4243,10 @@ sub http_header(;$$) push(@headers, 'Last-Modified: ' . scalar gmtime($moddate) . ' GMT') if $moddate; push(@headers, 'Content-Type: ' . $content_type); + push(@headers, "Content-Security-Policy: default-src 'none'; " . + "img-src 'self'; style-src 'unsafe-inline'"); if ($allow_compress && $maycompress) { - if (HAS_ZLIB - || (defined($CMD{gzip}) && open(GZIP, "| $CMD{gzip} -1 -c"))) - { - push(@headers, 'Content-Encoding: gzip'); push(@headers, 'Vary: Accept-Encoding'); # RFC 2616, 14.44 print join("\r\n", @headers) . "\r\n\r\n"; @@ -4262,18 +4254,9 @@ sub http_header(;$$) $| = 1; $| = 0; # Flush header output. - tie(*GZIP, __PACKAGE__, \*STDOUT) if HAS_ZLIB; + tie(*GZIP, __PACKAGE__, \*STDOUT); select(GZIP); $gzip_open = 1; - - } else { - - print join("\r\n", @headers) . "\r\n\r\n"; - printf - 'Unable to find gzip binary in the $command_path (%s) to compress output
', - htmlquote(join(':', @command_path)); - } - } else { print join("\r\n", @headers) . "\r\n\r\n"; } @@ -4441,7 +4424,7 @@ sub TIEHANDLE crc => 0, len => 0, }; - my ($header) = pack("c10", + my ($header) = pack("C10", MAGIC1, MAGIC2, Compress::Zlib::Z_DEFLATED(), 0, 0, 0, 0, 0, 0, OSCODE); print {$o->{handle}} $header;