Changeset 173 for trunk/dns.cgi

Timestamp:

11/30/11 15:43:31 (13 years ago)

Author:

Kris Deugau

Message:

/trunk

Security audit (see #30)

• remove a stale global
• catch and handle bad page parameter

File:

• trunk/dns.cgi (modified) (3 diffs)

trunk/dns.cgi

@@ -102 +102 @@
 my $logingroup = ($session->param('logingroup') ? $session->param('logingroup') : 1);
 my $curgroup = ($session->param('curgroup') ? $session->param('curgroup') : $logingroup);
-my $group = ($webvar{group} ? $webvar{group} : 1);
 
 # per-page startwith, filter, searchsubs
@@ -182 +181 @@
 push @viewablegroups, $logingroup;
 
-my $page = HTML::Template->new(filename => "$templatedir/$webvar{page}.tmpl");
+my $page;
+eval {
+  $page = HTML::Template->new(filename => "$templatedir/$webvar{page}.tmpl");
+};
+if ($@) {
+  warn "Bad page $webvar{page} requested";
+  $page = HTML::Template->new(filename => "$templatedir/badpage.tmpl");
+  $page->param(badpage => $q->escapeHTML($webvar{page}));
+  $webvar{page} = 'badpage';
+}
 
 # handle login redirect
@@ -1407 +1415 @@
 
 ##common bits
-if ($webvar{page} ne 'login') {
+if ($webvar{page} ne 'login' && $webvar{page} ne 'badpage') {
   $page->param(username => $session->param("username"));