Changeset 177

Timestamp:

12/01/11 15:37:37 (13 years ago)

Author:

Kris Deugau

Message:

/trunk

Security review (see #30)

• convert resultmsg and warnmsg message-passing to use the session as a data store

File:

• trunk/dns.cgi (modified) (5 diffs)

trunk/dns.cgi

@@ -292 +292 @@
   }
 
-  $page->param(resultmsg => $webvar{resultmsg}) if $webvar{resultmsg};
+  if ($session->param('resultmsg')) {
+    $page->param(resultmsg => $session->param('resultmsg'));
+    $session->clear('resultmsg');
+  }
   if ($session->param('errmsg')) {
     $page->param(errmsg => $session->param('errmsg'));
@@ -439 +442 @@
     }
 
-    $page->param(resultmsg => $webvar{resultmsg}) if $webvar{resultmsg};
+    if ($session->param('resultmsg')) {
+      $page->param(resultmsg => $session->param('resultmsg'));
+      $session->clear('resultmsg');
+    }
     if ($session->param('errmsg')) {
       $page->param(errmsg => $session->param('errmsg'));
@@ -744 +750 @@
   $page->param(delgrp => $permissions{admin} || $permissions{group_delete});
 
-  $page->param(resultmsg => $webvar{resultmsg}) if $webvar{resultmsg};
+  if ($session->param('resultmsg')) {
+    $page->param(resultmsg => $session->param('resultmsg'));
+    $session->clear('resultmsg');
+  }
   if ($session->param('errmsg')) {
     $page->param(errmsg => $session->param('errmsg'));
@@ -1028 +1037 @@
   $page->param(deluser => $permissions{admin} || $permissions{user_delete});
 
-  $page->param(resultmsg => $webvar{resultmsg}) if $webvar{resultmsg};
-  $page->param(warnmsg => $webvar{warnmsg}) if $webvar{warnmsg};
+  if ($session->param('resultmsg')) {
+    $page->param(resultmsg => $session->param('resultmsg'));
+    $session->clear('resultmsg');
+  }
+  if ($session->param('warnmsg')) {
+    $page->param(warnmsg => $session->param('warnmsg'));
+    $session->clear('warnmsg');
+  }
   if ($session->param('errmsg')) {
     $page->param(errmsg => $session->param('errmsg'));
@@ -1526 +1541 @@
   # cross-site scripting fixup.  instead of passing error messages by URL/form
   # variable, put them in the session where the nasty user can't meddle.
-  if ($params{errmsg}) {
-    $session->param('errmsg', $params{errmsg});
-    delete $params{errmsg};
+  # these are done here since it's far simpler to pass them in from wherever
+  # than set them locally everywhere.
+  foreach my $sessme ('resultmsg','warnmsg','errmsg') {
+    if ($params{$sessme}) {
+      $session->param($sessme, $params{$sessme});
+      delete $params{$sessme};
+    }
   }