safer handling of file names

[serve0] / pages / common.sh

diff --git a/pages/common.sh b/pages/common.sh
index 377e5f54b3f9f69450911a7d4f5312e2024dacf2..6257aad6e3fba469e17f8143c2cd05dcae9ab5fb 100755 (executable)
--- a/pages/common.sh
+++ b/pages/common.sh
@@ -19,17 +19,17 @@
 
 filter="${_GET[f]}"
 search="${_GET[s]}"
-order=$(echo -E "${_GET[o]}" |egrep '^(Name|Date|Length)$')
-page=$(echo -E "${_GET[pn]}" |egrep '^[0-9]+$')
-[ -z "$page" ] && page=0
+order="${_GET[o]}" #validated
+page="${_GET[pn]}" #validated
+pagesize="${_COOKIE[pagesize]}" #validated
 
 page_link=''
-[ -n "$info" ]   && page_link="i=$(urlsave "$info")&"
+[ -n "$info" ]   && page_link="i=$(urlsafe "$info")&"
 [ -n "$order" ]  && page_link="${page_link}o=${order}&"
 [ -n "$search" ] && page_link="${page_link}s=${search}&"
 [ -n "$filter" ] && page_link="${page_link}f=${filter}&"
-page_prev="${page_link}pn=$([ "$page" = 0 ] && echo 0 || echo $(($page - 1)) )"
-page_next="${page_link}pn=$(($page + 1))"
+page_prev="${page_link}pn=$([ "$page" -le "$pagesize" ] && echo 1 || echo $(($page - $pagesize)) )"
+page_next="${page_link}pn=$(($page + $pagesize))"
 page_this="${page_link}pn=$page"
 
 taglist=$(
@@ -49,8 +49,8 @@ _printVideo(){
   else
     videofile="${_DATA}/videos/$info"
     thumb="${_DATA}/thumbs/$info.jpg"
-    [ -r "$meta"  ] || ${_EXEC}/helpers/genmeta.sh "$videofile" "$meta"
-    [ -r "$thumb" ] || ${_EXEC}/helpers/genthumb.sh "$videofile" "$thumb"
+    [ -r "$meta"  ] || ${_EXEC}/helpers/genmeta.sh "$videofile" "$meta" >/dev/null
+    [ -r "$thumb" ] || ${_EXEC}/helpers/genthumb.sh "$videofile" "$thumb" >/dev/null
 
     head -n1 "$meta" |read length width height filename
     [ -z "$length" ] && length=0
@@ -58,9 +58,10 @@ _printVideo(){
     [ -z "$height" ] && height=0
 
     tags="$(sed -n 2p "$meta")"
-    video="$(urlsave "videos/$info")"
-    thumb="$(urlsave "thumbs/$info.jpg")"
-    linkinfo="$(urlsave "$info")"
+    video="$(urlsafe "videos/$info")"
+    thumb="$(urlsafe "thumbs/$info.jpg")"
+    linkinfo="$(urlsafe "$info")"
+    htmlinfo="$(htmlsafe "$info")"
 
     [ "$(($length % 60))" -lt 10 ] && minutes="$(($length / 60)):0$(($length % 60))" \
                                    || minutes="$(($length / 60)):$(($length % 60))"
@@ -70,12 +71,12 @@ _printVideo(){
         <a class="watchlink" name="${linkinfo}" href="?action=watch&i=${linkinfo}">
           <img src="$thumb" alt="Preview not yet available">
         </a>
-        <h2>$info</h2>
+        <h2>${htmlinfo}</h2>
         
-        <input type="checkbox" name="tagsel" value="$info">
+        <input type="checkbox" name="tagsel" value="${htmlinfo}">
         <span class="info property">${minutes}min</span>
         <span class="info property">${width}x${height}</span>
-       $(printf %s "$tags" |sed -r 's:\|*([^|]+)\|*:<span class="info tag">\1</span>:g')
+       $(printf %s "$tags" |sed -r 's:\|*([^|]+)\|*: <span class="info tag">\1</span>:g')
       </li>
 VIDEOend
   fi
@@ -85,12 +86,12 @@ genlist(){
   case "$order" in
     Date)   ls -c ${_DATA}/videos/ |egrep -i "$file_pattern";;
     Length) sed -sn 1p "${_DATA}/meta/"*.meta |sort -n |sed -r 's;^[0-9\t]+\t;;';;
-    *)      printf '%s\n' "${_DATA}/meta/"*meta |sed -r 's;^.*/;;;s;\.meta$;;';;
+    Name)   printf '%s\n' "${_DATA}/meta/"*meta |sed -r 's;^.*/;;;s;\.meta$;;';;
   esac
 }
 
 thumblist() {
-  cache="${_DATA}/cache/?o=${order}&s=${search}&f=${filter}&pn=${page}"
+  cache="${_DATA}/cache/${pagesize}?o=${order}&s=${search}&f=${filter}&pn=${page}"
   if [ "$cache" -nt ${_DATA}/videos -a "$cache" -nt ${_DATA}/meta ]; then
     cat "$cache"
   else
@@ -112,7 +113,7 @@ thumblist() {
     else
       cat
     fi \
-    | sed -n "$(($page * $pagesize + 1)),$(($page * $pagesize + $pagesize))p" \
+    | sed -n "$page,$(($page + $pagesize - 1))p" \
     | tee "$cache"
   fi \
   | while read line; do