=================================================================== RCS file: /cvs/cvsweb/cvsweb.cgi,v retrieving revision 4.3 retrieving revision 4.20 diff -u -p -r4.3 -r4.20 --- cvsweb/cvsweb.cgi 2019/11/09 09:11:55 4.3 +++ cvsweb/cvsweb.cgi 2019/11/11 15:46:39 4.20 @@ -1,5 +1,5 @@ -#!/usr/bin/perl -T -# $Id: cvsweb.cgi,v 4.3 2019/11/09 09:11:55 schwarze Exp $ +#!/usr/bin/perl +# $Id: cvsweb.cgi,v 4.20 2019/11/11 15:46:39 schwarze Exp $ # $knu: cvsweb.cgi,v 1.299 2010/11/13 16:37:18 simon # # cvsweb - a CGI interface to CVS trees. @@ -50,7 +50,6 @@ require 5.006; use strict; - use warnings; use filetest qw(access); @@ -63,20 +62,19 @@ use vars qw ( %alltags %fileinfo %tags @branchnames %nameprinted %symrev %revsym @allrevisions %date %author @revdisplayorder @revisions %state %difflines %log %branchpoint @revorder $keywordsubstitution - $prcgi @prcategories $re_prcategories $prkeyword $re_prkeyword $mancgi - $doCheckout $scriptname $scriptwhere + $mancgi $doCheckout $scriptname $scriptwhere $where $Browser $nofilelinks $maycompress @stickyvars $is_links $is_lynx $is_w3m $is_msie $is_mozilla3 $is_textbased %input $query $barequery $sortby $bydate $byrev $byauthor $bylog $byfile $defaultDiffType $logsort $cvstree $cvsroot $charset $output_filter - @command_path %CMD $allow_compress $backicon $diricon $fileicon $graphicon + @command_path %CMD $allow_compress $backicon $diricon $fileicon $fullname $cvstreedefault $logo $defaulttitle $address $binfileicon $long_intro $short_instruction $shortLogLen $show_author $tablepadding $hr_breakable $showfunc $hr_ignwhite $hr_ignkeysubst $inputTextSize $mime_types $allow_annotate $allow_markup $allow_mailtos $allow_log_extra $allow_dir_extra $allow_source_extra - $allow_cvsgraph $cvsgraph_config $use_java_script $edit_option_form + $edit_option_form $show_subdir_lastmod $show_log_in_markup $preformat_in_markup $tabstop $state $annTable $sel @ForbiddenFiles $use_descriptions %descriptions @mytz $dwhere @@ -84,11 +82,10 @@ use vars qw ( $allow_tar @tar_options @gzip_options @zip_options @cvs_options @annotate_options @rcsdiff_options $HTML_DOCTYPE $HTML_META $cssurl $CSS $cvshistory_url - $allow_enscript @enscript_options %enscript_types ); +require Compress::Zlib; use Cwd qw(abs_path); -use File::Basename qw(dirname); use File::Path qw(rmtree); use File::Spec::Functions qw(canonpath catdir catfile curdir devnull rootdir tmpdir updir); @@ -104,9 +101,6 @@ use constant CVSWEBMARKUP => qr{^text/(x-cvsweb|vnd\.v use constant LOG_FILESEPR => qr/^={77}$/o; use constant LOG_REVSEPR => qr/^-{28}$/o; -use constant HAS_ZLIB => eval { require Compress::Zlib; }; -use constant HAS_EDIFF => eval { require String::Ediff; }; - # ----------------------------------------------------------------------------- # All global initialization that can be done in compile time should go to @@ -115,7 +109,7 @@ use constant HAS_EDIFF => eval { require String::Ed BEGIN { - $VERSION = '3.0.6'; + $VERSION = '3.1'; $HTML_DOCTYPE = ' - - + EOM @@ -140,10 +133,10 @@ EOM # ----------------------------------------------------------------------------- -sub printDiffSelect($); +sub printDiffSelect(); sub printDiffSelectStickyVars(); sub getDiffLinks($$$); -sub printLogSortSelect($); +sub printLogSortSelect(); sub findLastModifiedSubdirs(@); sub htmlify_sub(&$); sub htmlify($;$); @@ -155,16 +148,12 @@ sub config_error($$); sub redirect($;$); sub safeglob($); sub search_path($); -sub getEnscriptHL($); sub getMimeType($;$); sub head($;$); sub scan_directives(@); sub openOutputFilter(); sub doAnnotate($$); sub doCheckout($$$); -sub doEnscript($$$;$); -sub doGraph(); -sub doGraphView(); sub cvswebMarkup($$$$$$;$); sub viewable($); sub doDiff($$$$$$); @@ -185,7 +174,6 @@ sub download_url($$;$); sub download_link($$$;$); sub display_url($$;$); sub display_link($$;$$); -sub graph_link($;$); sub history_link($$;$); sub toggleQuery($;$); sub htmlquote($); @@ -204,23 +192,9 @@ sub checkout_to_temp($$$); # (think mod_perl)... delete(@ENV{qw(PATH IFS CDPATH ENV BASH_ENV)}); -my ($mydir) = (dirname($0) =~ /(.*)/); # untaint +# Location of the configuration file inside the web server chroot: +$config = '/conf/cvsweb/cvsweb.conf'; -##### Start of Configuration Area ######## - -# == EDIT this == -# Locations to search for user configuration, in order: -for (catfile($mydir, 'cvsweb.conf'), '/usr/local/etc/cvsweb/cvsweb.conf') { - if (-r $_) { - $config = $_; - last; - } -} - -##### End of Configuration Area ######## - -undef $mydir; - ######## Configuration parameters ######### @CVSrepositories = @CVSROOT = %CVSROOT = %MIRRORS = %DEFAULTVALUE = %ICONS = @@ -230,10 +204,10 @@ $cvstreedefault = $logo = $defaulttitle = $address = $long_intro = $short_instruction = $shortLogLen = $show_author = $tablepadding = $hr_breakable = $showfunc = $hr_ignwhite = $hr_ignkeysubst = $inputTextSize = $mime_types = $allow_annotate = - $allow_markup = $allow_compress = $use_java_script = $edit_option_form = + $allow_markup = $allow_compress = $edit_option_form = $show_subdir_lastmod = $show_log_in_markup = $preformat_in_markup = - $tabstop = $use_moddate = $gzip_open = $DEBUG = $allow_cvsgraph = - $cvsgraph_config = $cvshistory_url = $allow_tar = undef; + $tabstop = $use_moddate = $gzip_open = $DEBUG = + $cvshistory_url = $allow_tar = undef; $allow_version_select = $allow_mailtos = $allow_log_extra = 1; @@ -333,7 +307,7 @@ $maycompress = ( && $ENV{HTTP_ACCEPT_ENCODING} =~ /gzip/) || $is_mozilla3) && !$is_msie - && !(defined($ENV{MOD_PERL}) && !HAS_ZLIB) + && !(defined($ENV{MOD_PERL})) ); # Parameters that will be sticky in all constructed links/query strings. @@ -374,9 +348,17 @@ if (defined($ENV{QUERY_STRING})) { $p =~ y/+/ /; my ($key, $val) = split(/=/, $p, 2); next unless defined($key); - $val = 1 unless defined($val); - ($key = uri_unescape($key)) =~ /[[:graph:]]/ or next; - ($val = uri_unescape($val)) =~ /[[:graph:]]/ or next; + $key = uri_unescape($key); + $key =~ /([^a-z_12-])/ and fatal('404 Not Found', + 'Invalid character "%s" in query parameter "%s"', $1, $key); + if (defined $val) { + $val = uri_unescape($val); + $val =~ /([^a-zA-Z_01-9.\/-])/ and fatal('404 Not Found', + 'Invalid character "%s" in the value "%s" of the query parameter "%s"', + $1, $val, $key); + } else { + $val = 1; + } $query{$key} = $val; } } @@ -384,8 +366,8 @@ if (defined($ENV{QUERY_STRING})) { undef %input; my $t; -for my $p (qw(graph hideattic hidecvsroot hidenonreadable ignorecase ln copt - makeimage options tarball)) { +for my $p (qw(hideattic hidecvsroot hidenonreadable ignorecase ln copt + options tarball)) { $t = $query{$p}; if (defined($t)) { ($input{$p}) = ($t =~ /^([01]|on)$/) @@ -548,27 +530,6 @@ foreach (@stickyvars) { } } -if ($allow_enscript) { - push(@DIFFTYPES, qw(uc cc)); - @DIFFTYPES{qw(uc cc)} = ( - { - 'descr' => 'unified, colored', - 'opts' => ['-u'], - 'colored' => 0, - }, - { - 'descr' => 'context, colored', - 'opts' => ['-c'], - 'colored' => 0, - }, - ); -} else { - # No Enscript -> respect difftype, but don't offer colorization. - if ($input{f} && $input{f} =~ /^([ucs])c$/) { - $input{f} = $1; - } -} - # is there any query ? if (@barequery) { $barequery = join (';', @barequery); @@ -641,10 +602,6 @@ if (-f $config_cvstree) { } undef $config_cvstree; -$re_prcategories = '(?:' . join ('|', @prcategories) . ')' if @prcategories; -$re_prkeyword = quotemeta($prkeyword) if defined($prkeyword); -$prcgi .= '%s' if defined($prcgi) && $prcgi !~ /%s/; - $fullname = catfile($cvsroot, $where); my $rewrite = 0; @@ -773,6 +730,7 @@ if ($input{tarball}) { } # Clean up. + chdir(".."); rmtree($tmpexportdir); &fatal(@fatal) if @fatal; @@ -1066,12 +1024,11 @@ EOF $filesfound++; printf "\n", ($dirrow % 2) ? 'even' : 'odd'; - printf '', $allow_cvsgraph ? '' : ' colspan="2"'; + printf ''; my $icon = $isbinary ? $binfileicon : $fileicon; print $nofilelinks ? $icon : &link($icon, $url); print ' ', &link(htmlquote($file), $url), $attic; - print '', graph_link($fileurl) if $allow_cvsgraph; print "\n", display_link($fileurl, $rev); my $ageclass = 'age'; my $age = ''; @@ -1136,10 +1093,10 @@ EOF || $input{$var} ne $DEFAULTVALUE{$var}) && $var ne 'only_with_tag'); } - printf(<