From 180a9479b49361d68a684d4f0452f6f32bd79121 Mon Sep 17 00:00:00 2001
From: paul <paul@plutz.net>
Date: Wed, 25 May 2016 11:01:11 +0000
Subject: [PATCH] submit page locators via post instead of relying on referrer

svn path=/trunk/; revision=133
---
 actions/multitag.sh    |  8 ++++----
 actions/watch.sh       | 20 +++++++++++---------
 pages/list.sh          |  4 ++--
 static/common.css      | 12 +++++++-----
 templates/list.html.sh |  7 ++++++-
 5 files changed, 30 insertions(+), 21 deletions(-)

diff --git a/actions/multitag.sh b/actions/multitag.sh
index 767f289..91a787b 100755
--- a/actions/multitag.sh
+++ b/actions/multitag.sh
@@ -16,10 +16,10 @@
 # You should have received a copy of the GNU Affero General Public License
 # along with Serve0  If not, see <http://www.gnu.org/licenses/>.
 
-filter="${_GET[f]}"
-search="${_GET[s]}"
-order=$(validate "${_GET[o]}" 'Name|Date|Length' Name)
-page=$(validate "${_GET[pn]}" '[0-9]+' 1)
+filter="${_POST[f]}"
+search="${_POST[s]}"
+order=$(validate "${_POST[o]}" 'Name|Date|Length' Name)
+page=$(validate "${_POST[pn]}" '[0-9]+' 1)
 
 addtag(){
   meta="$1"
diff --git a/actions/watch.sh b/actions/watch.sh
index 01de7d5..60d29db 100755
--- a/actions/watch.sh
+++ b/actions/watch.sh
@@ -3,10 +3,10 @@
 cgi_refdata
 info="${_GET[i]}"
 location="$(invalidate "${_GET[l]}" '(.*/)?\.\.(/.*)?|' /)"
-order="${_REF[o]}"
-search="${_REF[s]}"
-filter="${_REF[f]}"
-page="${_REF[pn]}"
+order="${_POST[o]}"
+search="${_POST[s]}"
+filter="${_POST[f]}"
+page="${_POST[pn]}"
 
 watch_link=''
 [ -n "$location" ] && watch_link="l=$(urlsafe "${location}")&"
@@ -71,18 +71,20 @@ case "${_COOKIE[watch]}" in
       "${_EXEC}"/helpers/genmeta.sh "$playuri" "$playmeta" >/dev/null
     fi
 
-    DISPLAY=:0 XDG_RUNTIME_DIR=/run/user/1006 \
-      nohup /usr/bin/mplayer -ao pulse \
+    export DISPLAY=":0"
+    uid="$(id |sed -rn '1s;.*uid=([0-9]+)[^0-9].*;1;p')"
+    export XDG_RUNTIME_DIR="/run/user/$uid"  # required for Pulseaudio
+
+    nohup /usr/bin/mplayer -ao pulse \
       -slave -input file="$fifofile" \
       -volume "$volume" \
       "$playuri" >"$statusfile" 2>/dev/null &
 
     # # MPlayer2:
-    # DISPLAY=:0 XDG_RUNTIME_DIR=/run/user/1006 \
-    #   nohup /usr/bin/mplayer -ao pulse --quiet \
+    # nohup /usr/bin/mplayer -ao pulse \
     #   --slave --input=file="$fifofile" \
     #   --volume="$volume" \
-    #   "$playuri" >/dev/null 2>/dev/null &
+    #   "$playuri" >"$statusfile" 2>/dev/null &
 
     redirect "?p=playctl&${watch_link}"
   ;;
diff --git a/pages/list.sh b/pages/list.sh
index 0ee2282..7b68f29 100755
--- a/pages/list.sh
+++ b/pages/list.sh
@@ -78,9 +78,9 @@ _printVideo(){
 
     tee "$cache" <<VIDEOend
       <li class="thumb">
-        <a class="watchlink" name="${linkinfo}" href="?action=watch&i=${linkinfo}">
+        <button class="watchlink" name="${linkinfo}" formaction="?action=watch&i=${linkinfo}">
           <img src="$thumb" alt="Preview not yet available">
-        </a>
+        </button>
         <h2>${htmlinfo}</h2>
         
         <input type="checkbox" name="tagsel" value="${htmlinfo}">
diff --git a/static/common.css b/static/common.css
index 9b32b52..f0912f8 100644
--- a/static/common.css
+++ b/static/common.css
@@ -292,18 +292,20 @@ p.quicklinks input:checked + a { display: none;}
 
 #thumblist .thumb img {
   width: 100%;
+  margin: 0; padding: 0;
 }
 #thumblist .thumb h2 {
   font-size: 1em;
   font-weight: normal;
   margin: 0;
 }
-#thumblist .thumb a {
+#thumblist .thumb button {
   display: block;
-}
-#thumblist .thumb a.alt {
-  display: inline-block;
-  margin-top: .3em;
+  width: 100%;
+  margin: 0; padding: 0;
+  border: none;
+  line-height: 0;
+  background-color: transparent;
 }
 #thumblist input {
   margin: .75em .5em;
diff --git a/templates/list.html.sh b/templates/list.html.sh
index 0d6d654..b5b1ef6 100755
--- a/templates/list.html.sh
+++ b/templates/list.html.sh
@@ -56,7 +56,12 @@ cat <<EOF
     </div>
   </form>
 
-  <form action="?action=multitag&${page_this}" method="post" accept-charset="UTF-8">
+  <form action="?action=multitag" method="post" accept-charset="UTF-8">
+    <input type="hidden" name="o" value="${order}">
+    <input type="hidden" name="s" value="${search}">
+    <input type="hidden" name="f" value="${filter}">
+    <input type="hidden" name="pn" value="${page}">
+
     <ul id="thumblist">
 EOF
 
-- 
2.39.2