upgraded to fit new shcgi revision, slightly better input validation, switched to...

svn path=/trunk/; revision=71

diff --git a/actions/introedit.sh b/actions/introedit.sh
index d629a1642071ababd4625d77f0341633c6a94620..3c6e69843220b896124f309eeba846c2a1cb09e4 100755 (executable)
--- a/actions/introedit.sh
+++ b/actions/introedit.sh
@@ -16,7 +16,7 @@
 # along with Busy.  If not, see <http://www.gnu.org/licenses/>.
 
 
-info="$(echo -E "$_GET[\"i\"]" |grep -Ex 'intro|news|[0-9]{10}_[0-9]{3}')"
+info="$(printf %s\\n "${_GET[i]}" |grep -Ex 'intro|news|[0-9]{10}_[0-9]{3}')"
 
 case "$info" in
   news)
@@ -39,6 +39,6 @@ esac
 
 cgi_post
 
-[ -z "$_POST[\"cancel\"]" ] && echo -E "$_POST[\"text\"]" >"$_DATA/Home/${file}"
+[ -z "${_POST[cancel]}" ] && echo -E "${_POST[text]}" >"$_DATA/Home/${file}"
 
 echo -n "Location: ${HTTP_REFERER}#news_${info}\n\n"

diff --git a/actions/lock.sh b/actions/lock.sh
index ea27764ad17226516fd066d6988fa5753b1b3559..e66f29cc100b44b31d67ad0fba459259443d3be5 100755 (executable)
--- a/actions/lock.sh
+++ b/actions/lock.sh
@@ -18,8 +18,8 @@
 $ACL_WIKIEDIT || echo "Location: ?p=Error&i=noaccess\n\n"
 $ACL_WIKIEDIT || exit 0 
 
-page="$(echo -E "$_GET[\"p\"]" |egrep -Ex 'Wiki')"
-edit="$(echo -E "$_GET[\"e\"]" |egrep -Ex '[0-9]{10}_[0-9]{3}(_[0-9]{1,4})?')"
+page="$(printf %s\\n "${_GET[p]}" |egrep -Ex 'Wiki')"
+edit="$(printf %s\\n "${_GET[e]}" |egrep -Ex '[0-9]{10}_[0-9]{3}(_[0-9]{1,4})?')"
 
 case "$page" in
   Wiki)        [ -f "$_DATA/Wiki/${edit}" ] && echo "${USER}:$(($(date +%s)+600))" >"$_DATA/Wiki/${edit}.lock"

diff --git a/actions/login.sh b/actions/login.sh
index 8cd9e74af2153cf6f5cf1b41d8a3e503892a2a63..62f96b62aabacdcc58c41f9e8e7d70a4a0f5e594 100755 (executable)
--- a/actions/login.sh
+++ b/actions/login.sh
@@ -17,22 +17,22 @@
 
 cgi_post
 
-user="$(echo -E "$_POST[\"user\"]" |sed -rn '1{/^[a-zA-Z0-9_+@.-]+$/p}')"
-pass="$_POST[\"pass\"]"
-userfile="$_DATA/auth/user$(echo -E "$user" |sha1sum |cut -c1-40)"
+user="$(printf %s\\n "${_POST[user]}" |sed -rn '1{/^[a-zA-Z0-9_+@.-]+$/p}')"
+pass="${_POST[pass]}"
+userfile="$_DATA/auth/user$(printf %s\\n "$user" |sha1sum |cut -c1-40)"
 
 if [ -r "$userfile" ]; then
   salt=$(sed -nr 's:^salt=(.+)$:\1:p' "$userfile")
   ssum=$(sed -nr 's:^auth=(.+)$:\1:p' "$userfile")
-  rsum=$(echo -E "$salt$pass" |sha1sum |cut -c1-40)
+  rsum=$(printf %s\\n "$salt$pass" |sha1sum |cut -c1-40)
 fi
 if [ -n "$ssum" -a  "$ssum" = "$rsum" ]; then
   sid="$(apg -n1 -a1 -m32 -x32 -M CLN)"
   sessionfile="$_DATA/auth/session$sid"
-  echo -E "$user $(($(date +%s) + 1800))" >"$sessionfile" 
-  echo -E "Location: $HTTP_REFERER"
-  echo -E "Set-Cookie: session=$sid; HttpOnly"
+  printf %s\\n "$user $(($(date +%s) + 1800))" >"$sessionfile" 
+  printf %s\\n "Location: $HTTP_REFERER"
+  printf %s\\n "Set-Cookie: session=$sid; HttpOnly"
 else
-  echo -E "Location: $HTTP_REFERER"
+  printf %s\\n "Location: $HTTP_REFERER"
 fi
 echo ''

diff --git a/actions/projectmeta.sh b/actions/projectmeta.sh
index 9ee642f3f34a1c5e592d53ce95fac77a72a90582..1375e6c371e80cfa2ceb49856749b1e7260c438b 100755 (executable)
--- a/actions/projectmeta.sh
+++ b/actions/projectmeta.sh
@@ -23,26 +23,26 @@ $ACL_ADMIN || exit 0
 
 cgi_post
 
-[ "$_POST[\"btcAdGamble\"]"  = yes -a "$_POST[\"btcAdErotic\"]" = yes ] && btcAdContent=1
-[ "$_POST[\"btcAdGamble\"]" != yes -a "$_POST[\"btcAdErotic\"]" = yes ] && btcAdContent=2
-[ "$_POST[\"btcAdGamble\"]"  = yes -a "$_POST[\"btcAdErotic\"]" != yes ] && btcAdContent=3
-[ "$_POST[\"btcAdGamble\"]" != yes -a "$_POST[\"btcAdErotic\"]" != yes ] && btcAdContent=4
+[ "${_POST[btcAdGamble]}"  = yes -a "${_POST[btcAdErotic]}" = yes ] && btcAdContent=1
+[ "${_POST[btcAdGamble]}" != yes -a "${_POST[btcAdErotic]}" = yes ] && btcAdContent=2
+[ "${_POST[btcAdGamble]}"  = yes -a "${_POST[btcAdErotic]}" != yes ] && btcAdContent=3
+[ "${_POST[btcAdGamble]}" != yes -a "${_POST[btcAdErotic]}" != yes ] && btcAdContent=4
 
 echo -E "\
-name=$_POST[\"appName\"]
-slogan=$_POST[\"appSlogan\"]
-repoType=$(echo -E "$_POST[\"repoType\"]" |grep -Ex 'svn|git')
-svnRepo=$_POST[\"svnRepo\"]
-gitRepo=$_POST[\"gitRepo\"]
-useFlattr=$(echo -E "$_POST[\"useFlattr\"]" |grep -Ex 'yes')
-flattrThingURL=$_POST[\"flattrThingURL\"]
-usePaypal=$(echo -E "$_POST[\"usePaypal\"]" |grep -Ex 'yes')
-paypalAddress=$_POST[\"paypalAddress\"]
-useBitcoin=$(echo -E "$_POST[\"useBitcoin\"]" |grep -Ex 'yes')
-btcAddress=$_POST[\"btcAddress\"]
-advertise=$(echo -E "$_POST[\"advertise\"]" |grep -Ex 'btcAd|no')
-btcAdAddress=$_POST[\"btcAdAddress\"]
-btcAdContent=$btcAdContent
+name="${_POST[appName]}"
+slogan="${_POST[appSlogan]}"
+repoType=$(printf %s\\n "$_POST[\"repoType\"]" |grep -Ex 'svn|git')
+svnRepo="${_POST[svnRepo]}"
+gitRepo="${_POST[gitRepo]}"
+useFlattr="$(printf %s\\n "${_POST[useFlattr]}" |grep -Ex 'yes')"
+flattrThingURL="${_POST[flattrThingURL]}"
+usePaypal="$(printf %s\\n "${_POST[usePaypal]}" |grep -Ex 'yes')"
+paypalAddress="${_POST[paypalAddress]}"
+useBitcoin="$(printf %s\\n "${_POST[useBitcoin]}" |grep -Ex 'yes')"
+btcAddress="${_POST[btcAddress]}"
+advertise="$(printf %s\\n "${_POST[advertise]}" |grep -Ex 'btcAd|no')"
+btcAdAddress="${_POST[btcAdAddress]}"
+btcAdContent="$btcAdContent"
 " >"$metafile"
 
 echo -n "Location: ${HTTP_REFERER}\n\n"

diff --git a/actions/taskmeta.sh b/actions/taskmeta.sh
index cd4e900c7d765a060a6ae0d6a058a8ffb3028ed0..5c5b01dfc486c3e394bb85e301250bfb8c05918d 100755 (executable)
--- a/actions/taskmeta.sh
+++ b/actions/taskmeta.sh
@@ -18,7 +18,7 @@
 $ACL_CREATETASK || echo "Location: ?p=Error&i=noaccess\n\n"
 $ACL_CREATETASK || exit 0
 
-info="$_GET[\"i\"]"
+info="${_GET[i]}"
 
 [ -z "$info" ] && info="$(date +%s)_$(apg -M N -a 1 -n 1 -m 3 -x 3)"
 descfile="$_DATA/Tasks/$info.meta"
@@ -28,13 +28,13 @@ commfile="$_DATA/Tasks/$info.comment.$(date +%s)_$(apg -M N -a 1 -n 1 -m 3 -x 3)
 anchor=$(ls $_DATA/Tasks |grep -A2 $info |grep '.meta$' |tail -n1 |cut -d. -f1)
 
 cgi_post
-headline="$_POST[\"headline\"]"
-taskstatus="$_POST[\"status\"]"
-section="$_POST[\"section\"]"
-description="$_POST[\"description\"]"
-comment="$_POST[\"comm\"]"
-[ -n "$_POST[\"cancel\"]" ] && cancel=true
-[ "$_POST[\"submit\"]" = "Robots click here" ] && cancel=true
+headline="${_POST[headline]}"
+taskstatus="${_POST[status]}"
+section="${_POST[section]}"
+description="${_POST[description]}"
+comment="${_POST[comm]}"
+[ -n "${_POST[cancel]}" ] && cancel=true
+[ "${_POST[submit]}" = "Robots click here" ] && cancel=true
 
 if [ -z "$cancel" -a -n "$comment" ]; then
   touch "$_DATA/Tasks/$info"

diff --git a/actions/wikiedit.sh b/actions/wikiedit.sh
index 12b9874083b0fea5f3fc197eea6a07f9bf716fdd..6033604bbcae4f375dd8912974a37cf662fcdfca 100755 (executable)
--- a/actions/wikiedit.sh
+++ b/actions/wikiedit.sh
@@ -18,12 +18,12 @@
 $ACL_WIKIEDIT || echo "Location: ?p=Error&i=noaccess\n\n"
 $ACL_WIKIEDIT || exit 0
 
-info="$(echo "$_GET[\"i\"]" |grep -Ex '[0-9]{10}_[0-9]{3}')"
+info="$(printf %s\\n "${_GET[i]}" |grep -Ex '[0-9]{10}_[0-9]{3}')"
 [ -f "$_DATA/Wiki/$info.lock" ] && rm "$_DATA/Wiki/$info.lock"
 
 cgi_post
-page="$_POST[\"page\"]"
-[ -n "$_POST[\"cancel\"]" ] && cancel=true
+page="${_POST[page]}"
+[ -n "${_POST[cancel]}" ] && cancel=true
 
 [ -z "$cancel" -a -f "$_DATA/Wiki/$info" ] && mv "$_DATA/Wiki/$info" "$_DATA/Wiki/$info.$(date +%s)"
 [ -z "$cancel" ] && echo -e "${page}" >"$_DATA/Wiki/$info"

diff --git a/actions/wikimeta.sh b/actions/wikimeta.sh
index 51236c9135599d7bc5fc61511016f61dc7f4415b..0a197192fa221f13ff671f288cf77ab5671295a1 100755 (executable)
--- a/actions/wikimeta.sh
+++ b/actions/wikimeta.sh
@@ -19,7 +19,7 @@ $ACL_WIKIEDIT || echo "Location: ?p=Error&i=noaccess\n\n"
 $ACL_WIKIEDIT || exit 0 
 
 info="$(egrep -o '(^|&)i=[0-9]{10}_[0-9]{3}(&|$)' <<<"${QUERY_STRING}" |tr -d '&i=')"
-info="$(echo -E "$_GET[\"i\"]" |grep -Ex '[0-9]{10}_[0-9]{3}')"
+info="$(printf %s\\n "${_GET[i]}" |grep -Ex '[0-9]{10}_[0-9]{3}')"
 
 [ -z "$info" ] && info="$(date +%s)_$(apg -M N -a 1 -n 1 -m 3 -x 3)"
 descfile="$_DATA/Wiki/$info.meta"
@@ -29,10 +29,10 @@ commfile="$_DATA/Wiki/$info.comment.$(date +%s)_$(apg -M N -a 1 -n 1 -m 3 -x 3)"
 anchor=$(ls "$_DATA/Wiki" |grep -A2 $info |grep '.meta$' |tail -n1 |cut -d. -f1)
 
 cgi_post
-title="$_POST[\"title\"]"
-description="$_POST[\"desc\"]"
-comment="$_POST[\"comm\"]"
-[ -n "$_POST[\"cancel\"]" ] && cancel=true
+title="${_POST[title]}"
+description="${_POST[desc]}"
+comment="${_POST[comm]}"
+[ -n "${_POST[cancel]}" ] && cancel=true
 
 if [ -z "$cancel" -a -n "$comment" ]; then
   touch "$_DATA/Wiki/$info"

diff --git a/constants.sh b/constants.sh
index 590c968e9941b06ecae54248d72fe6c056c8447f..76129395f75e1e28e8dc6a59de4f4978d9b7ef99 100755 (executable)
--- a/constants.sh
+++ b/constants.sh
@@ -22,12 +22,13 @@ data_dirs Home Tasks Wiki QRcodes
 umask=002
 #alias _wiki="stx2any --no-template --link-abbrevs --quote -T html"
 _wiki(){
-  markdown $* |sed -r 's:<(h[1-6])>(.+)</h[1-6]>:<\1><a name="\2">\2</a></\1>:g'
+  #markdown $* |sed -r 's:<(h[1-6])>(.+)</h[1-6]>:<\1><a name="\2">\2</a></\1>:g'
+  pandoc -f markdown -t html "$@" |sed -r 's:<(h[1-6])>(.+)</h[1-6]>:<\1><a name="\2">\2</a></\1>:g'
 }
 
 LOGIN=false
 USER="#NONE#"
-[ -z "$_GET[\"p\"]" ] && _GET["p"]=Home
+[ -z "${_GET[p]}" ] && _GET[p]=Home
 
 sessfile="$_DATA/auth/session$(sed -rn 's:^.*session=([a-zA-Z0-9]{32}).*$:\1:p' <<<"$HTTP_COOKIE")"
 if [ -r "$sessfile" ]; then

diff --git a/pages/Home.sh b/pages/Home.sh
index eea431657acb47c333c8c39b19082918a62132d2..2dd2ccc1174bdf1046c5c1e9de2123c520cdd25c 100755 (executable)
--- a/pages/Home.sh
+++ b/pages/Home.sh
@@ -19,7 +19,7 @@
 
 
 searchresults() {
-  search="$(echo "$_GET[\"s\"]" |sed 's:\t: :g;s:\r::g;s:\\:\\\\:g')"
+  search="$(echo "${_GET[s]}" |sed 's:\t: :g;s:\r::g;s:\\:\\\\:g')"
 
   if [ -n "$search" ]; then
     echo "<h1>News search results for: $search</h1>"

diff --git a/pages/Subversion.sh b/pages/Subversion.sh
index 642f43dbab2f187508196965f7bc049aa0ed57e2..6f93ff2956737870bf0c440e697ac0569c00f9cb 100755 (executable)
--- a/pages/Subversion.sh
+++ b/pages/Subversion.sh
@@ -17,8 +17,8 @@
 # You should have received a copy of the GNU Affero General Public License
 # along with Busy. If not, see <http://www.gnu.org/licenses/>. 
 
-url="$(echo "$_GET[\"i\"]" |sed -rn '1{s:\t: :g;s:\r::g;s:\\:\\\\:g;s:/+:/:g;p}')"
-rev="$(echo "$_GET[\"r\"]" |sed -rn '1{/^[0-9]+$/p}')"
+url="$(echo "${_GET[i]}" |sed -rn '1{s:\t: :g;s:\r::g;s:\\:\\\\:g;s:/+:/:g;p}')"
+rev="$(echo "${_GET[r]}" |sed -rn '1{/^[0-9]+$/p}')"
 url="${url:-/}"
 
 baseuri=$(sed -rn 's:^svnRepo=(.*)$:\1:p' project.meta)

diff --git a/pages/Tasks.sh b/pages/Tasks.sh
index 0950be0a6d560fe92111fb53fdddefd63e941fbb..34aef4d14c3b19fcce7dc4a07ef18fb9fb567c29 100755 (executable)
--- a/pages/Tasks.sh
+++ b/pages/Tasks.sh
@@ -17,10 +17,10 @@
 # You should have received a copy of the GNU Affero General Public License
 # along with Busy. If not, see <http://www.gnu.org/licenses/>. 
 
-info="$(echo "$_GET[\"i\"]" |sed -rn '1{/^[0-9]{10}_[0-9]{3}$/p}')"
-edit="$(echo "$_GET[\"e\"]" |sed -rn '1{/^[0-9]{10}_[0-9]{3}$/p}')"
-search="$(echo "$_GET[\"s\"]" |sed -rn '1{s:\t: :g;s:\r::g;s:\\:\\\\:g;p}')"
-new="$(echo -e "$_GET[\"n\"]" |sed -rn '1{s:\t: :g;s:\r::g;s:\\:\\\\:g;p}')"
+info="$(printf %s\\n   "${_GET[i]}" |sed -rn '1{/^[0-9]{10}_[0-9]{3}$/p}')"
+edit="$(printf %s\\n   "${_GET[e]}" |sed -rn '1{/^[0-9]{10}_[0-9]{3}$/p}')"
+search="$(printf %s\\n "${_GET[s]}" |sed -rn '1{s:\t: :g;s:\r::g;s:\\:\\\\:g;p}')"
+new="$(echo -e "${_GET[n]}" |sed -rn '1{s:\t: :g;s:\r::g;s:\\:\\\\:g;p}')"
 
 [ -z "$ACL_CREATETASK" ] && ACL_CREATETASK=false
 

diff --git a/pages/Wiki.sh b/pages/Wiki.sh
index b9215f9281d04808da57624c2291d309f3e0d742..e433b656ebc4023575b26c3d302ab360853926da 100755 (executable)
--- a/pages/Wiki.sh
+++ b/pages/Wiki.sh
@@ -17,10 +17,10 @@
 # You should have received a copy of the GNU Affero General Public License
 # along with Busy. If not, see <http://www.gnu.org/licenses/>. 
 
-info="$(egrep -o '[0-9]{10}_[0-9]{3}' <<<"$_GET[\"i\"]")"
-edit="$(egrep -o '[0-9]{10}_[0-9]{3}' <<<"$_GET[\"e\"]")"
- rev="$(egrep -o '[0-9]{10}' <<<"$_GET[\"r\"]")"
-search="$(sed 's:\t: :g;s:\r::g;s:\\:\\\\:g' <<<"$_GET[\"s\"]")"
+info="$(egrep -o '[0-9]{10}_[0-9]{3}' <<<"${_GET[i]}")"
+edit="$(egrep -o '[0-9]{10}_[0-9]{3}' <<<"${_GET[e]}")"
+ rev="$(egrep -o '[0-9]{10}' <<<"${_GET[r]}")"
+search="$(sed 's:\t: :g;s:\r::g;s:\\:\\\\:g' <<<"${_GET[s]}")"
 
 [ -n "$rev" ] && rev=".$rev"
 if [ -n "$search" ]; then