Log changes of the Debian packages from 3.0.2-2 to 3.0.2-5.

[privoxy.git] / cgi.c

diff --git a/cgi.c b/cgi.c
index 803d98a..dcf5bf6 100644 (file)
--- a/cgi.c
+++ b/cgi.c
@@ -1,4 +1,4 @@
-const char cgi_rcs[] = "$Id: cgi.c,v 1.70.2.4 2003/03/07 03:41:03 david__schmidt Exp $";
+const char cgi_rcs[] = "$Id: cgi.c,v 1.70.2.10 2003/06/06 07:54:25 oes Exp $";
 /*********************************************************************
  *
  * File        :  $Source: /cvsroot/ijbswa/current/Attic/cgi.c,v $
@@ -38,6 +38,31 @@ const char cgi_rcs[] = "$Id: cgi.c,v 1.70.2.4 2003/03/07 03:41:03 david__schmidt
  *
  * Revisions   :
  *    $Log: cgi.c,v $
+ *    Revision 1.70.2.10  2003/06/06 07:54:25  oes
+ *    Security fix: dspatch_known_cgi no longer considers an empty
+ *    referrer safe for critical CGIs, since malicious links could
+ *    reside on https:// locations which browsers don't advertize as
+ *    referrers. Closes bug #749916, thanks to Jeff Epler for the
+ *    hint. Goodbye One-Click[tm] toggling :-(
+ *
+ *    Revision 1.70.2.9  2003/05/08 15:11:31  oes
+ *    Nit
+ *
+ *    Revision 1.70.2.8  2003/04/29 13:33:51  oes
+ *    Killed a compiler warning on OSX
+ *
+ *    Revision 1.70.2.7  2003/04/03 13:50:58  oes
+ *    - Don't call cgi_error_disabled ifndef FEATURE_CGI_EDIT_ACTIONS
+ *      (fixes bug #710056)
+ *    - Show toggle info only if we have it
+ *
+ *    Revision 1.70.2.6  2003/03/12 01:26:25  david__schmidt
+ *    Move declaration of struct tm dummy outside of a control block so it is
+ *    accessible later on during snprintf in get_http_time.
+ *
+ *    Revision 1.70.2.5  2003/03/11 11:53:58  oes
+ *    Cosmetic: Renamed cryptic variable
+ *
  *    Revision 1.70.2.4  2003/03/07 03:41:03  david__schmidt
  *    Wrapping all *_r functions (the non-_r versions of them) with mutex semaphores for OSX.  Hopefully this will take care of all of those pesky crash reports.
  *
@@ -464,7 +489,11 @@ static const struct cgi_dispatcher cgi_dispatchers[] = {
 #endif
    { "show-status", 
          cgi_show_status,  
+#ifdef FEATURE_CGI_EDIT_ACTIONS
         "View & change the current configuration",
+#else
+        "View the current configuration",
+#endif
          TRUE }, 
    { "show-version", 
          cgi_show_version,  
@@ -566,7 +595,7 @@ static const struct cgi_dispatcher cgi_dispatchers[] = {
 
 
 /*
- * Bulit-in images for ad replacement
+ * Built-in images for ad replacement
  *
  * Hint: You can encode your own images like this:
  * cat your-image | perl -e 'while (read STDIN, $c, 1) { printf("\\%.3o", unpack("C", $c)); }'
@@ -591,13 +620,11 @@ const char image_pattern_data[] =
  */
 const char image_blank_data[] =
  "\211\120\116\107\015\012\032\012\000\000\000\015\111\110\104\122"
- "\000\000\000\004\000\000\000\004\010\006\000\000\000\251\361\236"
- "\176\000\000\000\007\164\111\115\105\007\322\003\013\020\073\070"
- "\013\025\036\203\000\000\000\011\160\110\131\163\000\000\013\022"
- "\000\000\013\022\001\322\335\176\374\000\000\000\004\147\101\115"
- "\101\000\000\261\217\013\374\141\005\000\000\000\033\111\104\101"
- "\124\170\332\143\070\161\342\304\207\377\377\377\347\302\150\006"
- "\144\016\210\146\040\250\002\000\042\305\065\221\270\027\131\110"
+ "\000\000\000\001\000\000\000\001\001\003\000\000\000\045\333\126"
+ "\312\000\000\000\003\120\114\124\105\377\377\377\247\304\033\310"
+ "\000\000\000\001\164\122\116\123\000\100\346\330\146\000\000\000"
+ "\001\142\113\107\104\000\210\005\035\110\000\000\000\012\111\104"
+ "\101\124\170\001\143\140\000\000\000\002\000\001\163\165\001\030"
  "\000\000\000\000\111\105\116\104\256\102\140\202";
 #else
 
@@ -817,12 +844,12 @@ static struct http_response *dispatch_known_cgi(struct client_state * csp,
       if ((d->name == NULL) || (strcmp(path_copy, d->name) == 0))
       {
          /*
-          * If the called CGI is either harmless, or not referred
-          * from an untrusted source, start it.
+          * If the called CGI is either harmless, or referred
+          * from a trusted source, start it.
           */
          if (d->harmless
-             || (NULL == (referrer = grep_cgi_referrer(csp)))
-             || (0 == strncmp(referrer, "http://config.privoxy.org/", 26))
+             || ((NULL != (referrer = grep_cgi_referrer(csp)))
+                 && (0 == strncmp(referrer, "http://config.privoxy.org/", 26)))
              )
          {
             err = (d->handler)(csp, rsp, param_list);
@@ -840,7 +867,7 @@ static struct http_response *dispatch_known_cgi(struct client_state * csp,
             }
             else
             {
-               err = cgi_error_disabled(csp, rsp);
+               err = cgi_error_404(csp, rsp, param_list);
             }
          }
 
@@ -1515,6 +1542,15 @@ void get_http_time(int time_offset, char *buf)
 
    struct tm *t;
    time_t current_time;
+#if defined(HAVE_GMTIME_R) && !defined(OSX_DARWIN)
+   /*
+    * Declare dummy up here (instead of inside get/set gmt block) so it
+    * doesn't go out of scope before it's potentially used in snprintf later.
+    * Wrapping declaration inside HAVE_GMTIME_R keeps the compiler quiet when
+    * !defined HAVE_GMTIME_R.
+    */
+   struct tm dummy; 
+#endif
 
    assert(buf);
 
@@ -1529,7 +1565,6 @@ void get_http_time(int time_offset, char *buf)
       t = gmtime(&current_time);
       pthread_mutex_unlock(&gmtime_mutex);
 #elif HAVE_GMTIME_R
-      struct tm dummy;
       t = gmtime_r(&current_time, &dummy);
 #else
       t = gmtime(&current_time);
@@ -2047,6 +2082,8 @@ struct map *default_exports(const struct client_state *csp, const char *caller)
    if (!err) err = map(exports, "actions-help-prefix", 1, ACTIONS_HELP_PREFIX ,1);
 #ifdef FEATURE_TOGGLE
    if (!err) err = map_conditional(exports, "enabled-display", global_toggle_state);
+#else
+   if (!err) err = map_block_killer(exports, "can-toggle");
 #endif
 
    snprintf(buf, 20, "%d", csp->config->hport);