February 2008 - 389-commits - Fedora Mailing-Lists

[Fedora-directory-commits] dsgw/tests/edit testget.13,1.1,1.2

by Doctor Conrad

Author: rmeggins Update of /cvs/dirsec/dsgw/tests/edit In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv30811/dsgw/tests/edit Modified Files: testget.13 Log Message: 1) There were several places where DSGW would output and eval arbitrary javascript code passed in a CGI parameter. These have been replaced with resource strings. In all cases the values were output escaped, but still, we shouldn't be passing around bits of javascript code to execute. 2) ICU provides a function which can parse the HTTP_ACCEPT_LANGUAGE string and return the most appropriate locale, so we should use that for date calculation. 3) Found a couple of places where uninitialized values could be used, and fixed them. 4) Used PR_smprintf to simplify some strlen+malloc+strcpy+strcat code. 5) dsgw_get_cgi_var will check for NULL input 6) Do not pass in the ldap host and port in form parameters. Always just use the values from the config file. 7) Added many new tests and valgrind suppressions (almost all from ICU) Index: testget.13 =================================================================== RCS file: /cvs/dirsec/dsgw/tests/edit/testget.13,v retrieving revision 1.1 retrieving revision 1.2 diff -u -r1.1 -r1.2 --- testget.13 7 Feb 2008 22:46:57 -0000 1.1 +++ testget.13 27 Feb 2008 03:36:53 -0000 1.2 @@ -1 +1 @@ -info=&dn=uid=newuser,ou=people,dc=example,dc=com&dnattr=uid&dndesc=u i d&add=1&tmplname=person \ No newline at end of file +info=<SCRIPT language=JavaScript>You've just been p0wned!</SCRIPT>&dn=uid=newuser,ou=people,dc=example,dc=com&dnattr=uid&dndesc=u i d&add=1&tmplname=person \ No newline at end of file

16 years, 1 month

1
0
0 / 0

[Fedora-directory-commits] dsgw/tests/dosearch testget.1, NONE, 1.1 testget.10, NONE, 1.1 testget.2, NONE, 1.1 testget.3, NONE, 1.1 testget.4, NONE, 1.1 testget.5, NONE, 1.1 testget.6, NONE, 1.1 testget.7, NONE, 1.1 testget.8, NONE, 1.1 testget.9, NONE, 1.1 testpost.1, NONE, 1.1 testpost.2, NONE, 1.1 testpost.3, NONE, 1.1 testpost.4, NONE, 1.1 testpost.5, NONE, 1.1 testpost.6, NONE, 1.1 testpost.7, NONE, 1.1 testpost.8, NONE, 1.1

by Doctor Conrad

Author: rmeggins Update of /cvs/dirsec/dsgw/tests/dosearch In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv30811/dsgw/tests/dosearch Added Files: testget.1 testget.10 testget.2 testget.3 testget.4 testget.5 testget.6 testget.7 testget.8 testget.9 testpost.1 testpost.2 testpost.3 testpost.4 testpost.5 testpost.6 testpost.7 testpost.8 Log Message: 1) There were several places where DSGW would output and eval arbitrary javascript code passed in a CGI parameter. These have been replaced with resource strings. In all cases the values were output escaped, but still, we shouldn't be passing around bits of javascript code to execute. 2) ICU provides a function which can parse the HTTP_ACCEPT_LANGUAGE string and return the most appropriate locale, so we should use that for date calculation. 3) Found a couple of places where uninitialized values could be used, and fixed them. 4) Used PR_smprintf to simplify some strlen+malloc+strcpy+strcat code. 5) dsgw_get_cgi_var will check for NULL input 6) Do not pass in the ldap host and port in form parameters. Always just use the values from the config file. 7) Added many new tests and valgrind suppressions (almost all from ICU) --- NEW FILE testget.1 --- --- NEW FILE testget.10 --- dn=cn=monitor&displaytemplate=person --- NEW FILE testget.2 --- ldq=foo?bar?baz?biff --- NEW FILE testget.3 --- ldq=objectclass --- NEW FILE testget.4 --- dn=cn=config --- NEW FILE testget.5 --- dn=entrydoesnotexist --- NEW FILE testget.6 --- dn=cn=config&ldq=?sub?(objectclass=nsbackendinstance) --- NEW FILE testget.7 --- dn=cn=config&ldq=?&sub=?(&objectclass=%3Dnsbackendinstance) --- NEW FILE testget.8 --- dn=cn=config&ldq=objectclass,cn,modifyTimestamp --- NEW FILE testget.9 --- dn=cn=monitor&displaytemplate=doesnotexist --- NEW FILE testpost.1 --- --- NEW FILE testpost.2 --- mode=unknownmode&searchstring=searchstring&type=type&base=cn=config&listifone=true&editable=true&link2edit=true&dnlist_js=true --- NEW FILE testpost.3 --- mode=auth&searchstring=scarter&type=type&base=cn=config&listifone=true&editable=true&link2edit=true&dnlist_js=true --- NEW FILE testpost.4 --- mode=pattern&searchstring=scarter&type=person&base=dc=example,dc=com&listifone=true&editable=true&link2edit=true&dnlist_js=true&attr=objectclass&filterpattern=* --- NEW FILE testpost.5 --- mode=pattern&searchstring=scarter&type=People&base=dc=example,dc=com&listifone=true&editable=true&link2edit=true&dnlist_js=true&attr=objectclass&filterpattern=* --- NEW FILE testpost.6 --- mode=pattern&searchstring=scarter&type=People&base=dc=example,dc=com&listifone=true&editable=true&link2edit=true&dnlist_js=true&attr=user id&filterpattern=uid=scarter&filterprefix=(|(&filtersuffix=)(objectclass=top))&searchdesc=This is the searchdesc field --- NEW FILE testpost.7 --- mode=smart&searchstring=scarter&type=People&base=dc=example,dc=com&listifone=true&editable=true&link2edit=true&dnlist_js=true --- NEW FILE testpost.8 --- mode=complex&searchstring=scarter&type=People&base=dc=example,dc=com&listifone=true&editable=true&link2edit=true&dnlist_js=true&attr=user id&match=is&searchdesc=This is the searchdesc field

16 years, 1 month

1
0
0 / 0

[Fedora-directory-commits] dsgw/tests/doauth testpost.4,1.1,1.2

by Doctor Conrad

Author: rmeggins Update of /cvs/dirsec/dsgw/tests/doauth In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv30811/dsgw/tests/doauth Modified Files: testpost.4 Log Message: 1) There were several places where DSGW would output and eval arbitrary javascript code passed in a CGI parameter. These have been replaced with resource strings. In all cases the values were output escaped, but still, we shouldn't be passing around bits of javascript code to execute. 2) ICU provides a function which can parse the HTTP_ACCEPT_LANGUAGE string and return the most appropriate locale, so we should use that for date calculation. 3) Found a couple of places where uninitialized values could be used, and fixed them. 4) Used PR_smprintf to simplify some strlen+malloc+strcpy+strcat code. 5) dsgw_get_cgi_var will check for NULL input 6) Do not pass in the ldap host and port in form parameters. Always just use the values from the config file. 7) Added many new tests and valgrind suppressions (almost all from ICU) Index: testpost.4 =================================================================== RCS file: /cvs/dirsec/dsgw/tests/doauth/testpost.4,v retrieving revision 1.1 retrieving revision 1.2 diff -u -r1.1 -r1.2 --- testpost.4 7 Feb 2008 22:46:57 -0000 1.1 +++ testpost.4 27 Feb 2008 03:36:51 -0000 1.2 @@ -1 +1 @@ -authdesturl=_authdesturl_param_ \ No newline at end of file +authdesturl=http://badhost \ No newline at end of file

16 years, 1 month

1
0
0 / 0

[Fedora-directory-commits] dsgw/tests setup.sh, 1.4, 1.5 valgrind.supp, 1.1, 1.2

by Doctor Conrad

Author: rmeggins Update of /cvs/dirsec/dsgw/tests In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv30811/dsgw/tests Modified Files: setup.sh valgrind.supp Log Message: 1) There were several places where DSGW would output and eval arbitrary javascript code passed in a CGI parameter. These have been replaced with resource strings. In all cases the values were output escaped, but still, we shouldn't be passing around bits of javascript code to execute. 2) ICU provides a function which can parse the HTTP_ACCEPT_LANGUAGE string and return the most appropriate locale, so we should use that for date calculation. 3) Found a couple of places where uninitialized values could be used, and fixed them. 4) Used PR_smprintf to simplify some strlen+malloc+strcpy+strcat code. 5) dsgw_get_cgi_var will check for NULL input 6) Do not pass in the ldap host and port in form parameters. Always just use the values from the config file. 7) Added many new tests and valgrind suppressions (almost all from ICU) Index: setup.sh =================================================================== RCS file: /cvs/dirsec/dsgw/tests/setup.sh,v retrieving revision 1.4 retrieving revision 1.5 diff -u -r1.4 -r1.5 --- setup.sh 19 Feb 2008 15:20:22 -0000 1.4 +++ setup.sh 27 Feb 2008 03:36:51 -0000 1.5 @@ -1,7 +1,7 @@ #!/bin/sh testdir="$1" -sroot=/NotBackedUp/$USER/11srv +sroot=/home/$USER/11srv port=1100 secport=1101 rootdn="cn=directory manager" @@ -32,7 +32,7 @@ fi if [ "$needdata" ] ; then -$sroot/lib/dirsrv/slapd-localhost/ldif2db.pl -D "$rootdn" -w "$rootpw" -n userRoot -i $sroot/share/dirsrv/data/Example.ldif +$sroot/lib/dirsrv/slapd-vmhost/ldif2db.pl -D "$rootdn" -w "$rootpw" -n userRoot -i $sroot/share/dirsrv/data/Example.ldif sleep 10 fi @@ -81,8 +81,6 @@ #export ADMSERV_CONF_DIR #ADMSERV_LOG_DIR=$dir/testtmp #export ADMSERV_LOG_DIR -HTTP_ACCEPT_LANGUAGE=en -export HTTP_ACCEPT_LANGUAGE SERVER_URL=http://localhost export SERVER_URL @@ -98,17 +96,19 @@ #VGPREFIX="valgrind --tool=memcheck --leak-check=yes --suppressions=$HOME/valgrind.supp --num-callers=40 --suppressions=$testdir/valgrind.supp " # These are CGI programs - they assume they will run for a very short period of time - they use exit() instead of free() :P VGPREFIX="valgrind --tool=memcheck --leak-check=no --suppressions=$HOME/valgrind.supp --num-callers=40 --suppressions=$testdir/valgrind.supp " -#GDB="gdb -x .gdbinit " +GDB="gdb -x .gdbinit " DEBUGCMD=VALGRIND #DEBUGCMD="$GDB" -PROGS="dnedit" +PROGS="lang" # use scripts for orgchart perl scripts SCRIPTS="" #ClientLanguage=en_US ; export ClientLanguage HTTP_ACCEPT_LANGUAGE=en_US ; export HTTP_ACCEPT_LANGUAGE +#HTTP_COOKIE='nsdsgwauth=rndstr:cn=directory manager' ; export HTTP_COOKIE + runATest() { prog="$1" shift @@ -146,6 +146,7 @@ if [ -f /tmp/$prog.debug.$basetest ] ; then echo "break main" > .gdbinit else + echo no match /tmp/$prog.debug.$basetest rm -f .gdbinit fi if [ $type = "POST" ] ; then @@ -192,9 +193,9 @@ ctxnum=1 for ctx in "" "/" "." "../../../" "somebogusvalue" "pb" "dsgw" ; do if [ -s "$test" ] ; then - runATest "$prog" GET "$test" .$ctxnum "&context=$ctx&binddn=$rootdn&passwd=$rootpw" + runATest "$prog" GET "$test" .$ctxnum "&context=$ctx&binddn=$rootdn&passwd=$rootpw&password=$rootpw" else - runATest "$prog" GET "$test" .$ctxnum "context=$ctx&binddn=$rootdn&passwd=$rootpw" + runATest "$prog" GET "$test" .$ctxnum "context=$ctx&binddn=$rootdn&passwd=$rootpw&password=$rootpw" fi ctxnum=`expr $ctxnum + 1` done @@ -211,7 +212,7 @@ runATest "$prog" POST "$test" ctxnum=1 for ctx in "" "/" "." "../../../" "somebogusvalue" "pb" "dsgw" ; do - runATest "$prog" POST "$test" .$ctxnum "&context=$ctx&binddn=$rootdn&passwd=$rootpw" + runATest "$prog" POST "$test" .$ctxnum "&context=$ctx&binddn=$rootdn&passwd=$rootpw&password=$rootpw" ctxnum=`expr $ctxnum + 1` done done Index: valgrind.supp =================================================================== RCS file: /cvs/dirsec/dsgw/tests/valgrind.supp,v retrieving revision 1.1 retrieving revision 1.2 diff -u -r1.1 -r1.2 --- valgrind.supp 9 Feb 2008 18:24:23 -0000 1.1 +++ valgrind.supp 27 Feb 2008 03:36:51 -0000 1.2 @@ -4,7 +4,13 @@ fun:__strcpy_chk fun:entryOpen fun:ures_open_3_6 - fun:res_getstring +} +{ + Problem with ICU + Memcheck:Cond + fun:__strcpy_chk + obj:/usr/lib64/libicuuc.so.36.0 + fun:ures_open_3_6 } { Problem with ICU @@ -14,7 +20,6 @@ fun:findFirstExisting fun:entryOpen fun:ures_open_3_6 - fun:res_getstring } { Problem with ICU @@ -23,7 +28,6 @@ fun:init_entry fun:entryOpen fun:ures_open_3_6 - fun:res_getstring } { Problem with ICU @@ -31,7 +35,6 @@ fun:dsgw_vxprintf fun:dsgw_emitfv fun:dsgw_emitf - fun:dsgw_html_begin } { Problem with sasl @@ -40,3 +43,60 @@ fun:_sasl_load_plugins fun:sasl_client_init } +{ + Problem with ICU + Memcheck:Cond + fun:__strcpy_chk + fun:entryOpen + fun:ures_open_3_6 + fun:ucol_open_internal_3_6 + fun:ucol_open_3_6 +} +{ + Problem with ICU + Memcheck:Cond + fun:u_strlen_3_6 + fun:dsgw_strkeygen + fun:dsgw_keygen +} +{ + Problem with ICU + Memcheck:Cond + fun:__strcpy_chk + fun:init_entry + fun:findFirstExisting + fun:entryOpen + fun:ures_openDirect_3_6 +} +{ + Problem with ICU + Memcheck:Cond + fun:__strcpy_chk + obj:/usr/lib64/libicuuc.so.36.0 + obj:/usr/lib64/libicuuc.so.36.0 + obj:/usr/lib64/libicuuc.so.36.0 + fun:ures_openDirect_3_6 +} +{ + Problem with ICU + Memcheck:Cond + fun:__strcpy_chk + fun:ures_getFunctionalEquivalent_3_6 +} +{ + Problem with ICU + Memcheck:Cond + fun:__strcpy_chk + obj:/usr/lib64/libicuuc.so.36.0 + obj:/usr/lib64/libicuuc.so.36.0 + obj:/usr/lib64/libicuuc.so.36.0 + fun:ures_open_3_6 +} +{ + Problem with ICU + Memcheck:Cond + fun:__strcpy_chk + obj:/usr/lib64/libicuuc.so.36.0 + obj:/usr/lib64/libicuuc.so.36.0 + fun:ures_open_3_6 +}

16 years, 1 month

1
0
0 / 0

[Fedora-directory-commits] dsgw/pbconfig list-Auth.html.in,1.1,1.2

by Doctor Conrad

Author: rmeggins Update of /cvs/dirsec/dsgw/pbconfig In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv30811/dsgw/pbconfig Modified Files: list-Auth.html.in Log Message: 1) There were several places where DSGW would output and eval arbitrary javascript code passed in a CGI parameter. These have been replaced with resource strings. In all cases the values were output escaped, but still, we shouldn't be passing around bits of javascript code to execute. 2) ICU provides a function which can parse the HTTP_ACCEPT_LANGUAGE string and return the most appropriate locale, so we should use that for date calculation. 3) Found a couple of places where uninitialized values could be used, and fixed them. 4) Used PR_smprintf to simplify some strlen+malloc+strcpy+strcat code. 5) dsgw_get_cgi_var will check for NULL input 6) Do not pass in the ldap host and port in form parameters. Always just use the values from the config file. 7) Added many new tests and valgrind suppressions (almost all from ICU) Index: list-Auth.html.in =================================================================== RCS file: /cvs/dirsec/dsgw/pbconfig/list-Auth.html.in,v retrieving revision 1.1 retrieving revision 1.2 diff -u -r1.1 -r1.2 --- list-Auth.html.in 14 Jan 2008 22:31:23 -0000 1.1 +++ list-Auth.html.in 27 Feb 2008 03:36:50 -0000 1.2 @@ -76,6 +76,9 @@ <INPUT TYPE="hidden" NAME="authdesturl"  > +<INPUT TYPE="hidden" NAME="authdestdn" + +>  </FORM>

16 years, 1 month

1
0
0 / 0

[Fedora-directory-commits] dsgw/tests/dnedit testget.4,NONE,1.1

by Doctor Conrad

Author: rmeggins Update of /cvs/dirsec/dsgw/tests/dnedit In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv30811/dsgw/tests/dnedit Added Files: testget.4 Log Message: 1) There were several places where DSGW would output and eval arbitrary javascript code passed in a CGI parameter. These have been replaced with resource strings. In all cases the values were output escaped, but still, we shouldn't be passing around bits of javascript code to execute. 2) ICU provides a function which can parse the HTTP_ACCEPT_LANGUAGE string and return the most appropriate locale, so we should use that for date calculation. 3) Found a couple of places where uninitialized values could be used, and fixed them. 4) Used PR_smprintf to simplify some strlen+malloc+strcpy+strcat code. 5) dsgw_get_cgi_var will check for NULL input 6) Do not pass in the ldap host and port in form parameters. Always just use the values from the config file. 7) Added many new tests and valgrind suppressions (almost all from ICU) --- NEW FILE testget.4 --- dn=uid=scarter,ou=people,dc=example,dc=com&template=template&attr=ou&desc=Description of OU attribute

16 years, 1 month

1
0
0 / 0

[Fedora-directory-commits] dsgw cgiutil.c, 1.4, 1.5 csearch.c, 1.4, 1.5 dbtdsgw.h, 1.2, 1.3 dnedit.c, 1.4, 1.5 doauth.c, 1.3, 1.4 dosearch.c, 1.4, 1.5 dsgw.h, 1.7, 1.8 dsgwgetlang.c, 1.5, 1.6 dsgwi18n.h, 1.1.1.1, 1.2 dsgwutil.c, 1.9, 1.10 emitauth.c, 1.2, 1.3 entrydisplay.c, 1.6, 1.7 htmlout.c, 1.3, 1.4 htmlparse.c, 1.2, 1.3 lang.c, 1.3, 1.4 ldaputil.c, 1.3, 1.4 newentry.c, 1.2, 1.3 search.c, 1.2, 1.3

by Doctor Conrad

Author: rmeggins Update of /cvs/dirsec/dsgw In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv30811/dsgw Modified Files: cgiutil.c csearch.c dbtdsgw.h dnedit.c doauth.c dosearch.c dsgw.h dsgwgetlang.c dsgwi18n.h dsgwutil.c emitauth.c entrydisplay.c htmlout.c htmlparse.c lang.c ldaputil.c newentry.c search.c Log Message: 1) There were several places where DSGW would output and eval arbitrary javascript code passed in a CGI parameter. These have been replaced with resource strings. In all cases the values were output escaped, but still, we shouldn't be passing around bits of javascript code to execute. 2) ICU provides a function which can parse the HTTP_ACCEPT_LANGUAGE string and return the most appropriate locale, so we should use that for date calculation. 3) Found a couple of places where uninitialized values could be used, and fixed them. 4) Used PR_smprintf to simplify some strlen+malloc+strcpy+strcat code. 5) dsgw_get_cgi_var will check for NULL input 6) Do not pass in the ldap host and port in form parameters. Always just use the values from the config file. 7) Added many new tests and valgrind suppressions (almost all from ICU) Index: cgiutil.c =================================================================== RCS file: /cvs/dirsec/dsgw/cgiutil.c,v retrieving revision 1.4 retrieving revision 1.5 diff -u -r1.4 -r1.5 --- cgiutil.c 30 Jan 2008 17:16:45 -0000 1.4 +++ cgiutil.c 27 Feb 2008 03:36:50 -0000 1.5 @@ -202,7 +202,14 @@ char * dsgw_get_cgi_var(char *varname, int required) { - char *ans = get_cgi_var(varname, NULL, NULL); + char **vars = get_input_ptr(); + char *ans = NULL; + + if (!vars) { + return ans; + } + + ans = get_cgi_var(varname, NULL, NULL); if (!ans) { /* try all uppercase varname */ char *upvarname = dsgw_utf8StrToUpper(varname); ans = get_cgi_var(upvarname, NULL, NULL); Index: csearch.c =================================================================== RCS file: /cvs/dirsec/dsgw/csearch.c,v retrieving revision 1.4 retrieving revision 1.5 diff -u -r1.4 -r1.5 --- csearch.c 30 Jan 2008 02:22:46 -0000 1.4 +++ csearch.c 27 Feb 2008 03:36:50 -0000 1.5 @@ -285,13 +285,11 @@ dsgw_emitf ("\n" "<INPUT TYPE=hidden NAME=mode VALUE=\"complex\">\n" "<INPUT TYPE=hidden NAME=base VALUE=\"%s\">\n" - "<INPUT TYPE=hidden NAME=ldapserver VALUE=\"%s\">\n" - "<INPUT TYPE=hidden NAME=ldapport VALUE=\"%d\">\n" "<INPUT TYPE=hidden NAME=type>\n" "<INPUT TYPE=hidden NAME=attr>\n" "<INPUT TYPE=hidden NAME=match>\n" "<INPUT TYPE=hidden NAME=context VALUE=\"%s\">\n", - gc->gc_ldapsearchbase, gc->gc_ldapserver, gc->gc_ldapport, context); + gc->gc_ldapsearchbase, context); } else if ( dsgw_directive_is( line, "DS_CSEARCH_TYPE_SELECT" )) { dsgw_emitf ("<SELECT NAME=searchType " Index: dbtdsgw.h =================================================================== RCS file: /cvs/dirsec/dsgw/dbtdsgw.h,v retrieving revision 1.2 retrieving revision 1.3 diff -u -r1.2 -r1.3 --- dbtdsgw.h 19 Feb 2008 15:20:21 -0000 1.2 +++ dbtdsgw.h 27 Feb 2008 03:36:50 -0000 1.3 @@ -474,10 +474,20 @@ "&context=%s&dn=\\' + dsmodify_dn + \\'&info=\\' + escape(dsmodify_info)\n" ) ResDef( DBT_completionJavascriptCu, 418, - "var comp_js = 'var cu=\\\\\\\'edit?context=%s&dn=%s\\\\\\\'; this.document.location.href=cu;'\n" + "this.document.location.href='edit?context=%s&dn=%s';\n" ) ResDef( DBT_unknownValueForCompletionJavascript, 419, "Invalid value '%s' for variable completion_javascript" ) + ResDef( DBT_confirmValue1, 420, + "opener.document.location.href = opener.completion_url;" ) + ResDef( DBT_confirmValue2, 421, + "opener.submitModify(opener.changetype);" ) + ResDef( DBT_confirmValue3, 422, + "opener.location.href = opener.DNEditURL;" ) + ResDef( DBT_confirmValue4, 423, + "opener.top.close();" ) + ResDef( DBT_confirmValue5, 424, + "opener.confirmedForm.submit();" ) END_STR(dsgw) Index: dnedit.c =================================================================== RCS file: /cvs/dirsec/dsgw/dnedit.c,v retrieving revision 1.4 retrieving revision 1.5 diff -u -r1.4 -r1.5 --- dnedit.c 19 Feb 2008 15:20:21 -0000 1.4 +++ dnedit.c 27 Feb 2008 03:36:50 -0000 1.5 @@ -333,7 +333,7 @@ " document.location = completion_url;\n" " } else {\n"); dsgw_emit_confirm ("controlFrame", - "opener.document.location.href = opener.completion_url;", + "CONFIRMVALUE1", NULL /* no */, XP_GetClientStr(DBT_discardChangesWindow_), 1, XP_GetClientStr(DBT_discardChanges_)); Index: doauth.c =================================================================== RCS file: /cvs/dirsec/dsgw/doauth.c,v retrieving revision 1.3 retrieving revision 1.4 diff -u -r1.3 -r1.4 --- doauth.c 28 Jan 2008 21:22:47 -0000 1.3 +++ doauth.c 27 Feb 2008 03:36:50 -0000 1.4 @@ -195,7 +195,10 @@ "\n" + "</SCRIPT>\n"); + + return; +} + /* emacs settings Local Variables: Index: htmlparse.c =================================================================== RCS file: /cvs/dirsec/dsgw/htmlparse.c,v retrieving revision 1.2 retrieving revision 1.3 diff -u -r1.2 -r1.3 --- htmlparse.c 14 Jan 2008 22:58:30 -0000 1.2 +++ htmlparse.c 27 Feb 2008 03:36:50 -0000 1.3 @@ -439,7 +439,7 @@ dsgw_emits ("<SCRIPT language=JavaScript>\n" - "</SCRIPT>\n"); - } - + dsgw_emit_confirm_script(); } else if ( dsgw_directive_is( line, "DS_CONFIRM_BUTTON_OK" )) { dsgw_emitf ("<INPUT TYPE=BUTTON VALUE=\"%s\" onClick=\"parent.OK()\">\n", XP_GetClientStr(DBT_ok_2)); Index: ldaputil.c =================================================================== RCS file: /cvs/dirsec/dsgw/ldaputil.c,v retrieving revision 1.3 retrieving revision 1.4 diff -u -r1.3 -r1.4 --- ldaputil.c 19 Feb 2008 15:20:21 -0000 1.3 +++ ldaputil.c 27 Feb 2008 03:36:50 -0000 1.4 @@ -535,10 +535,9 @@ void dsgw_ldapurl_search( LDAP *ld, char *ldapurl ) { - int rc, ec, saveport, did_init_ldap; + int rc, ec, did_init_ldap; LDAPMessage *msgp; LDAPURLDesc *ludp; - char *saveserver; unsigned long no_options = 0; int one_attr = 0; @@ -562,10 +561,6 @@ } if ( ld == NULL ) { - saveserver = gc->gc_ldapserver; - gc->gc_ldapserver = ludp->lud_host; - saveport = gc->gc_ldapport; - gc->gc_ldapport = ludp->lud_port; one_attr = ( ludp->lud_attrs != NULL && ludp->lud_attrs[ 0 ] != NULL && ludp->lud_attrs[ 1 ] == NULL ); (void)dsgw_init_ldap( &ld, NULL, 0, one_attr ); did_init_ldap = 1; @@ -593,8 +588,6 @@ if ( did_init_ldap ) { ldap_unbind( ld ); - gc->gc_ldapserver = saveserver; - gc->gc_ldapport = saveport; } } Index: newentry.c =================================================================== RCS file: /cvs/dirsec/dsgw/newentry.c,v retrieving revision 1.2 retrieving revision 1.3 diff -u -r1.2 -r1.3 --- newentry.c 14 Jan 2008 22:58:30 -0000 1.2 +++ newentry.c 27 Feb 2008 03:36:50 -0000 1.3 @@ -251,57 +251,29 @@ static char* compute_newurl() { - char *tmplname = "tmplname="; - size_t tmplnamelen = strlen(tmplname); - auto char* entryType = dsgw_get_cgi_var( "entrytype", DSGW_CGIVAR_REQUIRED ); - auto char* entryName = dsgw_get_cgi_var( "entryname", DSGW_CGIVAR_REQUIRED ); - auto char* rdnTag = dsgw_get_cgi_var( "rdntag", DSGW_CGIVAR_REQUIRED ); - auto char* dnSuffix = dsgw_get_cgi_var( "selectLocation", DSGW_CGIVAR_OPTIONAL ); - auto size_t entryTypeLen = strlen (entryType); - auto size_t entryNameLen = strlen (entryName); - auto size_t rdnTagLen = strlen (rdnTag); - auto size_t dnSuffixLen; - auto char* dn; - auto char* newurl = NULL; + char* entryType = dsgw_get_cgi_var( "entrytype", DSGW_CGIVAR_REQUIRED ); + char* entryName = dsgw_get_cgi_var( "entryname", DSGW_CGIVAR_REQUIRED ); + char* rdnTag = dsgw_get_cgi_var( "rdntag", DSGW_CGIVAR_REQUIRED ); + char* dnSuffix = dsgw_get_cgi_var( "selectLocation", DSGW_CGIVAR_OPTIONAL ); + char* dn; + char* edn; + char* newurl = NULL; + int escapeName = (strchr (entryName, ',') || strchr (entryName, ';')); if (!dnSuffix || !*dnSuffix) { dnSuffix = dsgw_get_cgi_var( "dnsuffix", DSGW_CGIVAR_REQUIRED ); } - dnSuffixLen = strlen (dnSuffix); - dn = dsgw_ch_malloc (rdnTagLen + 1 + entryNameLen + 2 + 1 + dnSuffixLen + 1); - memcpy (dn, rdnTag, rdnTagLen + 1); - strcat (dn, "="); - if ( strchr (entryName, ',') || strchr (entryName, ';') ) { - strcat (dn, "\""); - strcat (dn, entryName); - strcat (dn, "\""); - } else { - strcat (dn, entryName); - } - strcat (dn, ","); - strcat (dn, dnSuffix); - { - auto char* edn = dsgw_strdup_escaped (dn); - auto const char* const prefix = DSGW_URLPREFIX_CGI_HTTP "edit?"; - auto const char* const suffix = "&ADD=1"; - auto const size_t ednLen = strlen (edn); - auto const size_t prefixLen = strlen (prefix); - auto const size_t suffixLen = strlen (suffix); - auto const size_t contextLen = strlen (context) + 9; - - newurl = dsgw_ch_malloc (prefixLen + tmplnamelen + entryTypeLen + contextLen + suffixLen + 4 + ednLen + 1); - - memcpy (newurl, prefix, prefixLen + 1); - strcat (newurl, tmplname); - strcat (newurl, entryType); - strcat (newurl, "&context="); - strcat (newurl, context); - strcat (newurl, suffix); - strcat (newurl, "&dn="); - strcat (newurl, edn); - free (edn); - } - free (dn); + dn = PR_smprintf("%s=%s%s%s,%s", + rdnTag, escapeName ? "\"" : "", + entryName, escapeName ? "\"" : "", + dnSuffix); + edn = dsgw_strdup_escaped (dn); + free(dn); + + newurl = PR_smprintf(DSGW_URLPREFIX_CGI_HTTP "%s?tmplname=%s&context=%s&ADD=1&dn=%s", + dsgw_getvp( DSGW_CGINUM_EDIT ), entryType, context, edn); + free(edn); + return newurl; } @@ -357,7 +329,7 @@ static void post_request() { - auto char* newurl = compute_newurl(); + char* newurl = compute_newurl(); if (client_is_authenticated()) { /* Direct the client to GET newurl */ dsgw_emits ("<HTML>" ); @@ -416,3 +388,11 @@ } exit( 0 ); } + +/* + emacs settings + Local Variables: + indent-tabs-mode: t + tab-width: 8 + End: +*/ Index: search.c =================================================================== RCS file: /cvs/dirsec/dsgw/search.c,v retrieving revision 1.2 retrieving revision 1.3 diff -u -r1.2 -r1.3 --- search.c 14 Jan 2008 22:58:30 -0000 1.2 +++ search.c 27 Feb 2008 03:36:50 -0000 1.3 @@ -150,10 +150,8 @@ argc > 0 ? argv[0] : ""); dsgw_emitf ("\n" "<INPUT TYPE=hidden NAME=\"mode\" VALUE=\"smart\">\n" - "<INPUT TYPE=hidden NAME=\"base\" VALUE=\"%s\">\n" - "<INPUT TYPE=hidden NAME=\"ldapserver\" VALUE=\"%s\">\n" - "<INPUT TYPE=hidden NAME=\"ldapport\" VALUE=\"%d\">\n", - gc->gc_ldapsearchbase, gc->gc_ldapserver, gc->gc_ldapport ); + "<INPUT TYPE=hidden NAME=\"base\" VALUE=\"%s\">\n", + gc->gc_ldapsearchbase ); } else if ( dsgw_directive_is( line, "DS_SEARCH_BASE" )) { #ifdef NOTFORNOW /* ldap_dn2ufn currently gobbles up 'dc' so don't use */ @@ -201,3 +199,11 @@ } dsgw_emits( "</SELECT>\n" ); } + +/* + emacs settings + Local Variables: + indent-tabs-mode: t + tab-width: 8 + End: +*/

16 years, 1 month

1
0
0 / 0

[Fedora-directory-commits] dsgw/config list-Auth.html.in,1.1,1.2

by Doctor Conrad

Author: rmeggins Update of /cvs/dirsec/dsgw/config In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv30811/dsgw/config Modified Files: list-Auth.html.in Log Message: 1) There were several places where DSGW would output and eval arbitrary javascript code passed in a CGI parameter. These have been replaced with resource strings. In all cases the values were output escaped, but still, we shouldn't be passing around bits of javascript code to execute. 2) ICU provides a function which can parse the HTTP_ACCEPT_LANGUAGE string and return the most appropriate locale, so we should use that for date calculation. 3) Found a couple of places where uninitialized values could be used, and fixed them. 4) Used PR_smprintf to simplify some strlen+malloc+strcpy+strcat code. 5) dsgw_get_cgi_var will check for NULL input 6) Do not pass in the ldap host and port in form parameters. Always just use the values from the config file. 7) Added many new tests and valgrind suppressions (almost all from ICU) Index: list-Auth.html.in =================================================================== RCS file: /cvs/dirsec/dsgw/config/list-Auth.html.in,v retrieving revision 1.1 retrieving revision 1.2 diff -u -r1.1 -r1.2 --- list-Auth.html.in 14 Jan 2008 22:31:17 -0000 1.1 +++ list-Auth.html.in 27 Feb 2008 03:36:50 -0000 1.2 @@ -54,6 +54,9 @@ <INPUT TYPE="hidden" NAME="authdesturl"  > +<INPUT TYPE="hidden" NAME="authdestdn" + +>  </FORM>

16 years, 1 month

1
0
0 / 0

[Fedora-directory-commits] dsgw/tests/search - New directory

by Doctor Conrad

Author: rmeggins Update of /cvs/dirsec/dsgw/tests/search In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv26411/search Log Message: Directory /cvs/dirsec/dsgw/tests/search added to the repository

16 years, 1 month

1
0
0 / 0

[Fedora-directory-commits] dsgw/tests/dosearch - New directory

by Doctor Conrad

Author: rmeggins Update of /cvs/dirsec/dsgw/tests/dosearch In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv26411/dosearch Log Message: Directory /cvs/dirsec/dsgw/tests/dosearch added to the repository

16 years, 1 month

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-commits February 2008