Merge commit '9a10fd447c5646456421bc7c0107bf930f3acbf8'

diff --combined cgilite/cgilite.sh
index f766ee2a425591245926952a5b961dde86cac4ee,9fa56eef0633f22e7fa5d8f901ddf776143a6a55..9fa56eef0633f22e7fa5d8f901ddf776143a6a55
--- 1/cgilite/cgilite.sh
--- 2/cgilite.sh
+++ b/cgilite/cgilite.sh
@@@ -157,15 -157,15 +157,15 @@@ cgilite_keys()
    | sort -u
  }
  
- GET(){ cgilite_value "${QUERY_STRING}" $@; }
+ GET(){ cgilite_value "${QUERY_STRING}" "$@"; }
  GET_COUNT(){ cgilite_count "${QUERY_STRING}" $1; }
  GET_KEYS(){ cgilite_keys "${QUERY_STRING}"; }
  
- POST(){ cgilite_value "${cgilite_post}" $@; }
+ POST(){ cgilite_value "${cgilite_post}" "$@"; }
  POST_COUNT(){ cgilite_count "${cgilite_post}" $1; }
  POST_KEYS(){ cgilite_keys "${cgilite_post}"; }
  
- REF(){ cgilite_value "${HTTP_REFERER#*\?}" $@; }
+ REF(){ cgilite_value "${HTTP_REFERER#*\?}" "$@"; }
  REF_COUNT(){ cgilite_count "${HTTP_REFERER#*\?}" $1; }
  REF_KEYS(){ cgilite_keys "${HTTP_REFERER#*\?}"; }
  

diff --combined cgilite/file.sh
index 04a8ef617c9f755a4dcb7c3cf3adeeca69683f27,6f956dfeb5989a6b2542534d78134bc4633217de..6f956dfeb5989a6b2542534d78134bc4633217de
--- 1/cgilite/file.sh
--- 2/file.sh
+++ b/cgilite/file.sh
@@@ -58,8 -58,7 +58,7 @@@ FILE()
  
    file_size="$(stat -Lc %s "$file")"
    file_date="$(stat -Lc %Y "$file")"
-   http_date="$(date -uRd @$file_date)"
-   http_date="${http_date%+0000}GMT"
+   http_date="$(date -ud "@$file_date" +"%a, %d %b %Y %T GMT")"
    cachedate="$(
      # Parse the allowable date formats from Section 3.3.1 of
      # https://www.w3.org/Protocols/rfc2616/rfc2616-sec3.html

diff --combined cgilite/markdown.awk
index 512be5d5723da1f9a049bb1ba31241d813dba5ac,361e6005c3fc42fa5e1f81859d69ec59d0c0a138..361e6005c3fc42fa5e1f81859d69ec59d0c0a138
--- 1/cgilite/markdown.awk
--- 2/markdown.awk
+++ b/cgilite/markdown.awk
@@@ -274,11 -274,6 +274,6 @@@ function _block( block, LOCAL, st, len
    } else if ( AllowHTML && match( block, /^ ? ? ?(<\/[A-Za-z][A-Za-z0-9-]*[[:space:]]*>|<[A-Za-z][A-Za-z0-9-]*([[:space:]]+[A-Za-z_:][A-Za-z0-9_\.:-]*([[:space:]]*=[[:space:]]*([[:space:]"'=<>`]+|"[^"]*"|'[^']*'))?)*[[:space:]]*\/?>)([[:space:]]*\n)([^\n]|\n[ \t]*[^\n])*(\n[[:space:]]*\n|$)/) ) {
      len = RLENGTH; st = RSTART;
      return substr(block, st, len) _block(substr(block, st + len));
- 
-   # Horizontal rule
-   } else if ( match( block, /(^|\n) ? ? ?((\* *){3,}|(- *){3,}|(_ *){3,})($|\n)/) ) {
-     len = RLENGTH; st = RSTART;
-     return _block(substr(block, 1, st - 1)) "<hr />\n" _block(substr(block, st + len));
   
    # Blockquote (leading >)
    } else if ( match( block, /^> /) ) {
@@@ -369,6 -364,11 +364,11 @@@
      return "<h" hlvl " id=\"" hid " - " HTML(htxt) "\">" inline( htxt ) "</h" hlvl ">\n\n" \
             _block( substr( block, len + 1) );
  
+   # Horizontal rule
+   } else if ( match( block, /(^|\n) ? ? ?((\* *){3,}|(- *){3,}|(_ *){3,})($|\n)/) ) {
+     len = RLENGTH; st = RSTART;
+     return _block(substr(block, 1, st - 1)) "<hr />\n" _block(substr(block, st + len));
+ 
    # Plain paragraph
    } else {
      match( block, /(^|\n)[[:space:]]*(\n|$)/ ) || match( block, /$/ );

diff --combined cgilite/session.sh
index b9cef4d3dc2cdfd544b5499754bb9f489010f9b4,ca931fad9aa662ec338820bdc88be9f5018aba24..ca931fad9aa662ec338820bdc88be9f5018aba24
--- 1/cgilite/session.sh
--- 2/session.sh
+++ b/cgilite/session.sh
@@@ -3,6 -3,9 +3,9 @@@
  [ -n "$include_session" ] && return 0
  include_session="$0"
  
+ _DATE="$(date +%s)"
+ SESSION_TIMEOUT="${SESSION_TIMEOUT:-7200}"
+ 
  if ! which uuencode >/dev/null; then
    uuencode() { busybox uuencode "$@"; }
  fi
@@@ -10,8 -13,20 +13,20 @@@ if ! which sha256sum >/dev/null; the
    sha256sum() { busybox sha256sum "$@"; }
  fi
  
- _DATE="$(date +%s)"
- SESSION_TIMEOUT="${SESSION_TIMEOUT:-7200}"
+ if which openssl >/dev/null; then
+   session_mac(){ { [ $# -gt 0 ] && printf %s "$*" || cat; } | openssl dgst -sha1 -hmac "$(server_key)" -binary |slopecode; }
+ else
+   # Gonzo MAC if openssl is unavailable
+   session_mac(){
+     { server_key | dd status=none bs=256 count=1 skip=1
+       { server_key | dd status=none bs=256 count=1
+         [ $# -gt 0 ] && printf %s "$*" || cat
+       } \
+       | sha256sum -;
+     } \
+     | sha256sum | cut -d\  -f1
+   }
+ fi
  
  server_key(){
    IDFILE="${IDFILE:-${_DATA:-.}/serverkey}"
@@@ -25,23 -40,13 +40,13 @@@ slopecode()
    # 6-Bit Code that retains sort order of input data, while beeing safe to use
    # in ascii transmissions, unix file names, HTTP URLs, and HTML attributes
  
-   uuencode -m - | sed '
+   { [ $# -gt 0 ] && printf %s "$*" || cat; } \
+   | uuencode -m - | sed '
      1d;$d; 
      y;ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/;0123456789:=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz;
    '
  }
  
- session_mac(){
-   local info
-   [ $# -eq 0 ] && info="$(cat)" || info="$*"
- 
-   if which openssl >/dev/null; then
-     printf %s "$info" |openssl dgst -sha1 -hmac "$(server_key)" -binary |slopecode
-   else
-     { printf %s "$info"; server_key; } |sha256sum |cut -d\  -f1
-   fi
- }
- 
  randomid(){
    dd bs=12 count=1 if=/dev/urandom 2>&- \
    | slopecode
@@@ -60,14 -65,14 +65,14 @@@ timeid()
    } | slopecode
  }
  
- checkid(){ grep -m 1 -xE '[0-9a-zA-Z:=]{16}'; }
- 
  transid(){
    # transaction ID to modify a given file
    local file="$1"
    session_mac "$(stat -c %F%i%n%N%s%Y "$file" 2>&-)" "$SESSION_ID"
  }
  
+ checkid(){ { [ $# -gt 0 ] && printf %s "$*" || cat; } | grep -m 1 -xE '[0-9a-zA-Z:=]{16}'; }
+ 
  update_session(){
    local session sid time sig checksig
  
@@@ -90,18 -95,16 +95,16 @@@
    printf %s\\n "${sid} ${time} ${sig}"
  }
  
- SESSION_KEY="$(update_session)"
- SET_COOKIE 0 session="$SESSION_KEY" Path=/ SameSite=Strict HttpOnly
- SESSION_ID="${SESSION_KEY%% *}"
- 
  SESSION_BIND() {
+   # Set tamper-proof authenticated cookie
    local key="$1" value="$2"
    SET_COOKIE session "$key"="${value} $(session_mac "$value" "$SESSION_ID")"
  }
  
  SESSION_VAR() {
-   local key="$1"
-   local value sig
+   # read authenticated cookie
+   # fail if value has been tampered with
+   local key="$1" value sig
    value="$(COOKIE "$key")"
    sig="${value##* }" value="${value% *}"
    if [ "$sig" = "$(session_mac "$value" "$SESSION_ID")" ]; then
@@@ -110,3 -113,7 +113,7 @@@
      return 1
    fi
  }
+ 
+ SESSION_KEY="$(update_session)"
+ SET_COOKIE 0 session="$SESSION_KEY" Path=/ SameSite=Strict HttpOnly
+ SESSION_ID="${SESSION_KEY%% *}"

diff --combined cgilite/storage.sh
index 355bd569e40779602381612c36fafe6b839f418d,61eec88fb2cee63f706a634eaa48c85a09ef1967..61eec88fb2cee63f706a634eaa48c85a09ef1967
--- 1/cgilite/storage.sh
--- 2/storage.sh
+++ b/cgilite/storage.sh
@@@ -161,7 -161,7 +161,7 @@@ DBM() 
      update|replace)
        k="$1" key="$(STRING "$1")" value="$(STRING "$2")"
        LOCK "$file" || return 1
-       if ! DBM check "$k"; then
+       if ! DBM "$file" check "$k"; then
          RELEASE "$file"
          return 1
        fi
@@@ -178,7 -178,7 +178,7 @@@
      append)
        key="$(STRING "$1")" value="$(STRING "$2")"
        LOCK "$file" || return 1
-       if ! DBM check "$1"; then
+       if ! DBM "$file" check "$1"; then
          RELEASE "$file"
          return 1
        fi