Changeset 173

Timestamp:

11/30/11 15:43:31 (13 years ago)

Author:

Kris Deugau

Message:

/trunk

Security audit (see #30)

• remove a stale global
• catch and handle bad page parameter

Location:

trunk

Files:

• dns.cgi (modified) (3 diffs)
• templates/badpage.tmpl (added)
• templates/dns.css (modified) (2 diffs)

trunk/dns.cgi

@@ -102 +102 @@
 my $logingroup = ($session->param('logingroup') ? $session->param('logingroup') : 1);
 my $curgroup = ($session->param('curgroup') ? $session->param('curgroup') : $logingroup);
-my $group = ($webvar{group} ? $webvar{group} : 1);
 
 # per-page startwith, filter, searchsubs
@@ -182 +181 @@
 push @viewablegroups, $logingroup;
 
-my $page = HTML::Template->new(filename => "$templatedir/$webvar{page}.tmpl");
+my $page;
+eval {
+  $page = HTML::Template->new(filename => "$templatedir/$webvar{page}.tmpl");
+};
+if ($@) {
+  warn "Bad page $webvar{page} requested";
+  $page = HTML::Template->new(filename => "$templatedir/badpage.tmpl");
+  $page->param(badpage => $q->escapeHTML($webvar{page}));
+  $webvar{page} = 'badpage';
+}
 
 # handle login redirect
@@ -1407 +1415 @@
 
 ##common bits
-if ($webvar{page} ne 'login') {
+if ($webvar{page} ne 'login' && $webvar{page} ne 'badpage') {
   $page->param(username => $session->param("username"));
 

trunk/templates/dns.css

@@ -185 +185 @@
         padding: 5px;
         width: 70%;
+        margin: 1% auto;
 }
 .right {
@@ -238 +239 @@
 #soadetail {
         text-align: left;
+}
+#badpage {
+        margin: 5% auto;
+        border: solid 2px #FFFF00;
+        color: #333300;
+        background-color: #e0e0e0;
+        text-align: center;
+        padding: 5px;
+        width: 70%;
 }
 /* somewhat generic/reusable */