liquid_feedback_frontend

changeset 39:06a6e5846536

Bugfixes in app/main/draft/diff.lua including missing encoding of diff output (security threat!)
author bsw
date Sun Mar 07 15:13:05 2010 +0100 (2010-03-07)
parents 2c7cc99c4e8e
children ca3a0552927f
files app/main/draft/diff.lua config/default.lua
line diff
     1.1 --- a/app/main/draft/diff.lua	Fri Mar 05 15:45:55 2010 +0100
     1.2 +++ b/app/main/draft/diff.lua	Sun Mar 07 15:13:05 2010 +0100
     1.3 @@ -47,11 +47,12 @@
     1.4  else
     1.5    slot.put('<table class="diff">')
     1.6    slot.put('<tr><th width="50%">' .. _"Old draft revision" .. '</th><th width="50%">' .. _"New draft revision" .. '</th></tr>')
     1.7 +
     1.8    local last_state = "unchanged"
     1.9    local lines = {}
    1.10    local removed_lines = nil
    1.11 -  output = output .. " "
    1.12 -  output = output:gsub("[^\n\r]+", function(line)
    1.13 +
    1.14 +  local function process_line(line)
    1.15      local state = "unchanged"
    1.16      local char = line:sub(1,1)
    1.17      line = line:sub(2)
    1.18 @@ -60,13 +61,15 @@
    1.19        state = "-"
    1.20      elseif char == "+" then
    1.21        state = "+"
    1.22 +    elseif char == "!" then
    1.23 +      state = "eof"
    1.24      end
    1.25      if last_state == "unchanged" then
    1.26        if state == "unchanged" then
    1.27          lines[#lines+1] = line
    1.28 -      elseif (state == "-") or (state == "+") then
    1.29 -        local text = table.concat(lines, "<br />")
    1.30 -        slot.put("<tr><td>", text, "</td><td>", text, "</td></tr>")
    1.31 +      elseif (state == "-") or (state == "+") or (state == "eof") then
    1.32 +        local text = table.concat(lines, "\n")
    1.33 +        slot.put("<tr><td>", text, "</td><td>", encode.html_newlines(encode.html(text)), "</td></tr>")
    1.34          lines = { line }
    1.35        end
    1.36      elseif last_state == "-" then
    1.37 @@ -75,29 +78,36 @@
    1.38        elseif state == "+" then
    1.39          removed_lines = lines
    1.40          lines = { line }
    1.41 -      elseif state == "unchanged" then
    1.42 -        local text = table.concat(lines,"<br />")
    1.43 -        slot.put('<tr><td class="removed">', text, "</td><td></td></tr>")
    1.44 +      elseif (state == "unchanged") or (state == "eof") then
    1.45 +        local text = table.concat(lines,"\n")
    1.46 +        slot.put('<tr><td class="removed">', encode.html_newlines(encode.html(text)), "</td><td></td></tr>")
    1.47          lines = { line }
    1.48        end
    1.49      elseif last_state == "+" then
    1.50        if state == "+" then
    1.51          lines[#lines+1] = line
    1.52 -      elseif (state == "-") or (state == "unchanged") then
    1.53 +      elseif (state == "-") or (state == "unchanged") or (state == "eof") then
    1.54          if removed_lines then
    1.55 -          local text = table.concat(lines, "<br />")
    1.56 -          local removed_text = table.concat(removed_lines, "<br />")
    1.57 -          slot.put('<tr><td class="removed">', removed_text, '</td><td class="added">', text, "</td></tr>")
    1.58 +          local text = table.concat(lines, "\n")
    1.59 +          local removed_text = table.concat(removed_lines, "\n")
    1.60 +          slot.put('<tr><td class="removed">', encode.html_newlines(encode.html(removed_text)), '</td><td class="added">', encode.html_newlines(encode.html(text)), "</td></tr>")
    1.61          else
    1.62 -          local text = table.concat(lines, "<br />")
    1.63 -          slot.put('<tr><td></td><td class="added">', text, "</td></tr>")
    1.64 +          local text = table.concat(lines, "\n")
    1.65 +          slot.put('<tr><td></td><td class="added">', encode.html_newlines(encode.html(text)), "</td></tr>")
    1.66          end
    1.67          removed_lines = nil
    1.68          lines = { line }
    1.69        end
    1.70      end
    1.71      last_state = state
    1.72 +  end
    1.73 +
    1.74 +  output = output .. " "
    1.75 +  output = output:gsub("[^\n\r]+", function(line)
    1.76 +    process_line(line)
    1.77    end)
    1.78 +  process_line("!")
    1.79 +
    1.80    slot.put("</table>")
    1.81  end 
    1.82  
     2.1 --- a/config/default.lua	Fri Mar 05 15:45:55 2010 +0100
     2.2 +++ b/config/default.lua	Sun Mar 07 15:13:05 2010 +0100
     2.3 @@ -1,5 +1,5 @@
     2.4  config.app_name = "LiquidFeedback"
     2.5 -config.app_version = "beta12.2"
     2.6 +config.app_version = "beta12.3"
     2.7  
     2.8  config.app_title = config.app_name .. " (" .. request.get_config_name() .. " environment)"
     2.9  

Impressum / About Us