* lets start knit-picking on buffersizes.

[citadel.git] / webcit / webcit.c

diff --git a/webcit/webcit.c b/webcit/webcit.c
index 785d2287caaf82fec97fc798b4aa1f625c4067dc..54001abb39fc67d9516bc9393112b95e08906f04 100644 (file)
--- a/webcit/webcit.c
+++ b/webcit/webcit.c
@@ -13,6 +13,9 @@
 #include "webserver.h"
 #include "mime_parser.h"
 
+#include <stdio.h>
+#include <stdarg.h>
+
 /**
  * String to unset the cookie.
  * Any date "in the past" will work, so I chose my birthday, right down to
@@ -32,7 +35,7 @@ void unescape_input(char *buf)
 
        buflen = strlen(buf);
 
-       while ((isspace(buf[buflen - 1])) && (buflen > 0)){
+       while ((buflen > 0) && (isspace(buf[buflen - 1]))){
                buf[buflen - 1] = 0;
                buflen --;
        }
@@ -201,38 +204,68 @@ void wDumpContent(int print_standard_html_footer)
  * \param nbsp If nonzero, spaces are converted to non-breaking spaces.
  * \param nolinebreaks if set, linebreaks are removed from the string.
  */
-void stresc(char *target, char *strbuf, int nbsp, int nolinebreaks)
+long stresc(char *target, long tSize, char *strbuf, int nbsp, int nolinebreaks)
 {
-       int a, len;
-       strcpy(target, "");
+       char *aptr, *bptr, *eptr;
 
-       len = strlen(strbuf);
-       for (a = 0; a < len; ++a) {
-               if (strbuf[a] == '<')
-                       strcat(target, "&lt;");
-               else if (strbuf[a] == '>')
-                       strcat(target, "&gt;");
-               else if (strbuf[a] == '&')
-                       strcat(target, "&amp;");
-               else if (strbuf[a] == '\"')
-                       strcat(target, "&quot;");
-               else if (strbuf[a] == '\'') 
-                       strcat(target, "&#39;");
-               else if (strbuf[a] == LB)
-                       strcat(target, "<");
-               else if (strbuf[a] == RB)
-                       strcat(target, ">");
-               else if (strbuf[a] == QU)
-                       strcat(target, "\"");
-               else if ((strbuf[a] == 32) && (nbsp == 1))
-                       strcat(target, "&nbsp;");
-               else if ((strbuf[a] == '\n') && (nolinebreaks))
-                       strcat(target, "");     /* nothing */
-               else if ((strbuf[a] == '\r') && (nolinebreaks))
-                       strcat(target, "");     /* nothing */
-               else
-                       strncat(target, &strbuf[a], 1);
+       *target = '\0';
+       aptr = strbuf;
+       bptr = target;
+       eptr = target + tSize - 6; // our biggest unit to put in... 
+
+       while ((bptr < eptr) && !IsEmptyStr(aptr) ){
+               if (*aptr == '<') {
+                       memcpy(bptr, "&lt;", 4);
+                       bptr += 4;
+               }
+               else if (*aptr == '>') {
+                       memcpy(bptr, "&gt;", 4);
+                       bptr += 4;
+               }
+               else if (*aptr == '&') {
+                       memcpy(bptr, "&amp;", 5);
+                       bptr += 5;
+               }
+               else if (*aptr == '\"') {
+                       memcpy(bptr, "&quot;", 6);
+                       bptr += 6;
+               }
+               else if (*aptr == '\'') {
+                       memcpy(bptr, "&#39;", 5);
+                       bptr += 5;
+               }
+               else if (*aptr == LB) {
+                       *bptr = '<';
+                       bptr ++;
+               }
+               else if (*aptr == RB) {
+                       *bptr = '>';
+                       bptr ++;
+               }
+               else if (*aptr == QU) {
+                       *bptr ='"';
+                       bptr ++;
+               }
+               else if ((*aptr == 32) && (nbsp == 1)) {
+                       memcpy(bptr, "&nbsp;", 6);
+                       bptr += 6;
+               }
+               else if ((*aptr == '\n') && (nolinebreaks)) {
+                       *bptr='\0';     /* nothing */
+               }
+               else if ((*aptr == '\r') && (nolinebreaks)) {
+                       *bptr='\0';     /* nothing */
+               }
+               else{
+                       *bptr = *aptr;
+                       bptr++;
+               }
+               aptr ++;
        }
+       *bptr = '\0';
+       if ((bptr = eptr - 1 ) && !IsEmptyStr(aptr) )
+               return -1;
+       return (bptr - target);
 }
 
 /**
@@ -244,10 +277,12 @@ void stresc(char *target, char *strbuf, int nbsp, int nolinebreaks)
 void escputs1(char *strbuf, int nbsp, int nolinebreaks)
 {
        char *buf;
+       long Siz;
 
        if (strbuf == NULL) return;
-       buf = malloc( (3 * strlen(strbuf)) + SIZ );
-       stresc(buf, strbuf, nbsp, nolinebreaks);
+       Siz = (3 * strlen(strbuf)) + SIZ ;
+       buf = malloc(Siz);
+       stresc(buf, Siz, strbuf, nbsp, nolinebreaks);
        wprintf("%s", buf);
        free(buf);
 }
@@ -368,6 +403,27 @@ void msgesc(char *target, char *strbuf)
        }
 }
 
+/**
+ * \brief print a string to the client after cleaning it with msgesc() and stresc()
+ * \param strbuf string to be printed
+ */
+void msgescputs1( char *strbuf)
+{
+       char *outbuf;
+       char *outbuf2;
+       int buflen;
+
+       if (strbuf == NULL) return;
+       buflen = 3 * strlen(strbuf) + SIZ;
+       outbuf = malloc( buflen);
+       outbuf2 = malloc( buflen);
+       msgesc(outbuf, strbuf);
+       stresc(outbuf2, buflen, outbuf, 0, 0);
+       wprintf("%s", outbuf2);
+       free(outbuf);
+       free(outbuf2);
+}
+
 /**
  * \brief print a string to the client after cleaning it with msgesc()
  * \param strbuf string to be printed
@@ -424,6 +480,7 @@ void output_headers(        int do_httpheaders,     /**< 1 = output HTTP headers
        else {
                wprintf("Pragma: no-cache\r\n"
                        "Cache-Control: no-store\r\n"
+                       "Expires: -1\r\n"
                );
        }
 
@@ -549,6 +606,39 @@ void http_transmit_thing(char *thing, size_t length, char *content_type,
        client_write(thing, (size_t)length);
 }
 
+/**
+ * \brief print menu box like used in the floor view or admin interface.
+ * This function takes pair of strings as va_args, 
+ * \param Title Title string of the box
+ * \param Class CSS Class for the box
+ * \param nLines How many string pairs should we print? (URL, UrlText)
+ * \param ... Pairs of URL Strings and their Names
+ */
+void print_menu_box(char* Title, char *Class, int nLines, ...)
+{
+       va_list arg_list;
+       long i;
+       
+       svprintf("BOXTITLE", WCS_STRING, Title);
+       do_template("beginbox");
+       
+       wprintf("<ul class=\"%s\">", Class);
+       
+       va_start(arg_list, nLines);
+       for (i = 0; i < nLines; ++i)
+       { 
+               wprintf("<li><a href=\"%s\">", va_arg(arg_list, char *));
+               wprintf((char *) va_arg(arg_list, char *));
+               wprintf("</a></li>\n");
+       }
+       va_end (arg_list);
+       
+       wprintf("</a></li>\n");
+       
+       wprintf("</ul>");
+       
+       do_template("endbox");
+}
 
 
 /**
@@ -905,7 +995,9 @@ void begin_ajax_response(void) {
                 "Server: %s\r\n"
                 "Connection: close\r\n"
                 "Pragma: no-cache\r\n"
-                "Cache-Control: no-cache\r\n",
+                "Cache-Control: no-cache\r\n"
+               "Expires: -1\r\n"
+               ,
                 SERVER);
         begin_burst();
 }
@@ -1586,8 +1678,6 @@ void session_loop(struct httprequest *req)
                delete_node();
        } else if (!strcasecmp(action, "display_add_node")) {
                display_add_node();
-       } else if (!strcasecmp(action, "add_node")) {
-               add_node();
        } else if (!strcasecmp(action, "terminate_session")) {
                slrp_highest();
                terminate_session();