From 20c3606135d8d94dd3695abc02a948c6be0cdc16 Mon Sep 17 00:00:00 2001 From: Wolfram Schneider Date: Thu, 2 Aug 2007 18:28:26 +0000 Subject: [PATCH] print output in XHTML 1.0 escape HTML output --- en/cgi/ports.cgi | 137 +++++++++++++++++++++++++++-------------------- 1 file changed, 78 insertions(+), 59 deletions(-) diff --git a/en/cgi/ports.cgi b/en/cgi/ports.cgi index e4ee5b4b62..d1e82b83ab 100755 --- a/en/cgi/ports.cgi +++ b/en/cgi/ports.cgi @@ -1,6 +1,6 @@ #!/usr/bin/perl -T # -# Copyright (c) 1996-2005 Wolfram Schneider +# Copyright (c) 1996-2007 Wolfram Schneider # All rights reserved. # # Redistribution and use in source and binary forms, with or without @@ -24,7 +24,7 @@ # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF # SUCH DAMAGE. # -# $FreeBSD: www/en/cgi/ports.cgi,v 1.93 2005/12/05 21:16:19 fenner Exp $ +# $FreeBSD: www/en/cgi/ports.cgi,v 1.94 2006/08/19 21:40:25 simon Exp $ # # ports.cgi - search engine for FreeBSD ports # o search for a port by name or description @@ -120,7 +120,7 @@ sub init_variables { $portsDesc = "$hsty_base/ports/"; # location of the tiny BSD daemon - $daemonGif = "Really small BSD Daemon"; + $daemonGif = "Really small BSD Daemon"; # visible E-Mail address, plain text $mailto = 'www@FreeBSD.org'; @@ -161,7 +161,7 @@ sub packages_exist { return 1; }; - while(

) { + while(

) { chop; $p{$_} = 1; } @@ -186,7 +186,7 @@ sub last_update { } sub last_update_message { - return "

Last database update: " . &last_update . "
\n"; + return "

Last database update: " . &last_update . "

\n"; } sub dec { @@ -217,8 +217,18 @@ sub decode_form { } } +sub escapeHTML { + my $toencode = shift; + return "" unless defined($toencode); -# encode unknown data for use in a URL + $toencode =~ s{&}{&}gso; + $toencode =~ s{<}{<}gso; + $toencode =~ s{>}{>}gso; + $toencode =~ s{"}{"}gso; + return $toencode; +} + +# encode unknown data for use in a URL sub encode_url { local($_) = @_; s/([\000-\032\;\/\?\:\@\&\=\%\'\"\`\<\>\177-\377 ])/sprintf('%%%02x',ord($1))/eg; @@ -311,10 +321,10 @@ sub out { if ($path =~ m%^$localPrefix/([^/]+)%o) { if (!$out_sec || $1 ne $out_sec) { - print "\n" if $counter > 0; - print qq{\n

} . + print "\n" if $counter > 0; + print qq{\n

} . qq{Category $1} . - "

\n
\n"; + "\n
\n"; $out_sec = $1; } } @@ -335,44 +345,45 @@ sub out { } } $descfile =~ s/^$localPrefix/$remotePrefixFtp/o; - $comment =~ s//\>/g; + $version = &encode_url($version); + #$version =~ s/[\+,]/X/g; local($l) = $path; $l =~ s%^$remotePrefixFtp%$remotePrefixCvs%o; - print qq{
$version\n}; - print qq{
$comment
\n}; + print qq{
$version
\n}; + print qq{
}, &escapeHTML($comment), qq{
\n}; - print qq[Long description :\n]; - print qq[Sources :\n]; + print qq[Long description :\n]; + print qq[Sources :\n]; # Link package in "default" arch/release. Verify it's existence on ftp-master. if ($packages{"$version.$packageExt"}) { - print qq[Package :\n]; + print qq[Package :\n]; } - print qq[Changes : Download
\n]; + print qq[Changes :\n]; + print qq[Download
\n]; - print qq{Maintained by: $email
}; + &encode_url($version) : '') . qq{">$email
\n}; local(@s) = split(/\s+/, $sections); if ($#s > 0) { - print qq{Also listed in: }; + print qq{Also listed in: }; foreach (@s) { - print qq{$_ } + print qq{$_ } if $_ ne $out_sec; } - print "
\n"; + print "
\n"; } if ($bdepends || $rdepends) { local($flag) = 0; local($last) = ''; - print qq{Requires: }; + print qq{Requires: }; foreach (sort split(/\s+/, "$bdepends $rdepends")) { # delete double entries next if $_ eq $last; @@ -380,12 +391,16 @@ sub out { print ", " if $flag; $flag++; - print qq{$_}; + print qq{$_}; } - print "
\n"; + print "
\n"; } - print q[

]; + print qq[

]; + + # XXX: should be done in a CSS + print qq[
 
]; + print qq[\n\n]; }; @@ -425,23 +440,23 @@ sub search_ports { sub forms { - print qq{

+ print qq{

FreeBSD Ports [short description followed ...] FAQ -

+

}; - print qq{ + print qq{

"Package Name" searches for the name of a port or distribution. "Description" searches case-insensitive in a short comment about the port. "All" searches case-insensitive for the package name and in the description about the port. -

+

-
+ Search for: - - + + print qq{ - + }; foreach (@sec) { - print "$_\n}; + print "$_\n}; } - print q{ - - -
+ print q{ + + +
}; } @@ -481,17 +496,17 @@ Search for: sub footer { print qq{ -Powered by FreeBSD -© 1996-2005 by Wolfram Schneider. All rights reserved.
+Powered by FreeBSD +© 1996-2007 by Wolfram Schneider. All rights reserved.
}; - #print q{$FreeBSD: www/en/cgi/ports.cgi,v 1.93 2005/12/05 21:16:19 fenner Exp $} . "
\n"; + #print q{$FreeBSD: www/en/cgi/ports.cgi,v 1.94 2006/08/19 21:40:25 simon Exp $} . "
\n"; print qq{Please direct questions about this service to -$mailto
\n}; +$mailto
\n}; print qq{General questions about FreeBSD ports should be sent to } . qq{} . - qq{$mailtoList
\n}; + qq{$mailtoList
\n}; print &last_update_message; - print "
\n

\n"; + print qq{

\n

\n}; } @@ -524,19 +539,23 @@ sub faq {

Misc

+

Package download links point to the FreeBSD 6-STABLE -version and not to the latest releases.

+version and not to the latest releases.

+

The script ports.cgi use the file $ports_database as database for it's operations. $ports_database is updated automatically every -two hours.

+two hours.

+

You may also search the -ports manual pages.

+ports manual pages.

-Back to the search engine

-

+

+Back to the search engine

+
}; } @@ -574,12 +593,12 @@ if ($stype eq 'pkgdescr') { } if ($stype eq "faq") { - print &short_html_header("FreeBSD Ports Search FAQ", 0); + print &short_html_header("FreeBSD Ports Search FAQ", 1); &faq; &footer; print &html_footer; &exit(0); } -print &html_header("FreeBSD Ports Search", 0); +print &html_header("FreeBSD Ports Search", 1); # allow `/ports.cgi?netscape' where 'netscape' is the query port to search # this make links to this script shorter @@ -616,6 +635,6 @@ if (!$counter) { print "
\n"; } -print "
\n"; +print qq{
\n}; &footer; print &html_footer;