path sanitizing for card parameter

[confetti] / cards / edit_card.sh

diff --git a/cards/edit_card.sh b/cards/edit_card.sh
index f90b326d2cca3a38dfa6b668fe3bc689c7556a9b..61c58fe815c10cb456f5f9e3c73c4bd8d52c9c00 100755 (executable)
--- a/cards/edit_card.sh
+++ b/cards/edit_card.sh
@@ -1,6 +1,6 @@
 #!/bin/zsh
 
-# Copyright 2014 Paul Hänsch
+# Copyright 2019 Paul Hänsch
 #
 # This file is part of Confetti.
 # 
@@ -17,11 +17,20 @@
 # You should have received a copy of the GNU Affero General Public License
 # along with Confetti.  If not, see <http://www.gnu.org/licenses/>. 
 
-cgi_refdata
+locktimeout=900
+. "$_EXEC"/session_lock.sh
 
-card="${_GET[card]}"
-filter="&filter=${_REF[filter]}"
-filtertype="&filtertype=${_REF[filtertype]}"
-order="&order=${_REF[order]}"
+card="$(GET card |PATH)"
+cardfile="$_DATA/vcard/${card##*/}"
+filter="$(REF f)"
+order="$(REF o)"
 
-echo -n "Location: ?p=cards${filter}${filtertype}${order}&edit=$card\n\n"
+if tempfile="$(SLOCK "$cardfile" "$locktimeout")"; then
+  REDIRECT "/cards/?o=${order}&f=${filter}&e=${card}"
+elif [ -f "$tempfile" ]; then
+  SET_COOKIE session message="SESSLOCK"
+  REDIRECT "/cards/?o=${order}&f=${filter}#${card}"
+else
+  SET_COOKIE session message="EDITLOCK"
+  REDIRECT "/cards/?o=${order}&f=${filter}#${card}"
+fi