Changeset 839 for trunk/dns.cgi

Timestamp:

04/21/22 17:55:49 (3 years ago)

Author:

Kris Deugau

Message:

/trunk

Update dns.cgi include path finder - see #80
Allow more characters through from the web layer to the back end for the

record search and record list filter, building on r838

File:

• trunk/dns.cgi (modified) (3 diffs)

trunk/dns.cgi

@@ -35 +35 @@
 #  return ! eval { eval("#" . substr(join("", @_), 0, 0)); 1 };
 #}
-#use Cwd 'abs_path';
-#use File::Basename;
-#use lib dirname( abs_path $0 );
-#die "argh!  tainted!" if is_tainted($0);
-#die "argh! \@INC got tainted!" if is_tainted(@INC);
-
-# push "the directory the script is in" into @INC
-use FindBin;
-use lib "$FindBin::RealBin/";
+
+# Taint-safe (ish) voodoo to push "the directory the script is in" into @INC.
+# See https://secure.deepnet.cx/trac/dnsadmin/ticket/80 for more gory details on how we got here.
+use File::Spec ();
+use File::Basename ();
+my $path;
+BEGIN {
+    $path = File::Basename::dirname(File::Spec->rel2abs($0));
+    if ($path =~ /(.*)/) {
+        $path = $1;
+    }
+}
+use lib $path;
 
 use DNSDB;
@@ -121 +125 @@
 $webvar{startwith} =~ s/^(0-9|[a-z]).*/$1/ if $webvar{startwith};
 # not much call for chars not allowed in domain names
-$webvar{filter} =~ s/[^a-zA-Z0-9_.:\@%-]//g if $webvar{filter};
+# allow <>= so searches can use the Postgres CIDR operators
+# allow , for things like DMARC records
+$webvar{filter} =~ s{[^a-zA-Z0-9_.,:\@%<>=/-]}{}g if $webvar{filter};
 ## only set 'y' if box is checked, no other values legal
 ## however, see https://secure.deepnet.cx/trac/dnsadmin/ticket/31
@@ -1898 +1904 @@
   # need to search on characters outside this set until we get into IDNs
   # note this is a little larger due to template records
-  $webvar{searchfor} =~ s/[^a-zA-Z0-9_.:\@%-]//g if $webvar{searchfor};
+  # allow <>= so searches can use the Postgres CIDR operators
+  # allow , for things like DMARC records
+  $webvar{searchfor} =~ s{[^a-zA-Z0-9_.,:\@%<>=/-]}{}g if $webvar{searchfor};
 
   # save the search in the session, same as the "filter" in various other lists...