* All OS-level includes are now included from webcit.h instead of from
[citadel.git] / webcit / webcit.c
index d1f0df8e94ab0ec3a529163095adb9ba08b732d6..fd74ae10e1cf6851dfbbd520a9714fc9ce0ad57a 100644 (file)
@@ -1,34 +1,14 @@
 /*
- * webcit.c
+ * $Id$
  *
- * This is the actual program called by the webserver.  It maintains a
+ * This is the main transaction loop of the web service.  It maintains a
  * persistent session to the Citadel server, handling HTTP WebCit requests as
  * they arrive and presenting a user interface.
  *
- * $Id$
  */
 
-#include <ctype.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <stdio.h>
-#include <fcntl.h>
-#include <signal.h>
-#include <sys/types.h>
-#include <sys/wait.h>
-#include <sys/socket.h>
-#include <sys/time.h>
-#include <sys/stat.h>
-#include <limits.h>
-#include <netinet/in.h>
-#include <netdb.h>
-#include <string.h>
-#include <pwd.h>
-#include <errno.h>
-#include <stdarg.h>
-#include <pthread.h>
-#include <signal.h>
 #include "webcit.h"
+#include "groupdav.h"
 #include "webserver.h"
 #include "mime_parser.h"
 
@@ -54,6 +34,7 @@ void unescape_input(char *buf)
                        hex[0] = buf[a + 1];
                        hex[1] = buf[a + 2];
                        hex[2] = 0;
+                       b = 0;
                        sscanf(hex, "%02x", &b);
                        buf[a] = (char) b;
                        strcpy(&buf[a + 1], &buf[a + 3]);
@@ -86,7 +67,7 @@ void addurls(char *url)
                u = (struct urlcontent *) malloc(sizeof(struct urlcontent));
                u->next = WC->urlstrings;
                WC->urlstrings = u;
-               strcpy(u->url_key, buf);
+               safestrncpy(u->url_key, buf, sizeof u->url_key);
 
                /* now chop that part off */
                for (a = 0; a <= b; ++a)
@@ -108,7 +89,7 @@ void addurls(char *url)
                strcpy(ptr, "");
 
                u->url_data = malloc(strlen(up) + 2);
-               strcpy(u->url_data, up);
+               safestrncpy(u->url_data, up, strlen(up) + 1);
                u->url_data[b] = 0;
                unescape_input(u->url_data);
                up = ptr;
@@ -175,10 +156,14 @@ void wprintf(const char *format,...)
 void wDumpContent(int print_standard_html_footer)
 {
        if (print_standard_html_footer) {
-               wprintf("</DIV>\n");    /* end of "text" div */
+               wprintf("</div>\n");    /* end of "text" div */
                do_template("trailing");
        }
 
+       /* If we've been saving it all up for one big output burst,
+        * go ahead and do that now.
+        */
+       end_burst();
 }
 
 
@@ -344,7 +329,7 @@ void output_headers(        int do_httpheaders,     /* 1 = output HTTP headers
 
                        int do_room_banner,     /* 0=no, 1=yes,                                     */
                                                /* 2 = I'm going to embed my own, so don't open the */
-                                               /*     <div id="text"> either.                      */
+                                               /*     <div id="content"> either.                   */
 
                        int unset_cookies,      /* 1 = session is terminating, so unset the cookies */
                        int refresh30,          /* 1 = automatically refresh page every 30 seconds  */
@@ -358,30 +343,41 @@ void output_headers(      int do_httpheaders,     /* 1 = output HTTP headers
        httpdate(httpnow, time(NULL));
 
        if (do_httpheaders) {
-               wprintf("Content-type: text/html\n"
-                       "Server: %s\n", SERVER
+               wprintf("Content-type: text/html; charset=utf-8\r\n"
+                       "Server: %s / %s\n"
+                       "Connection: close\r\n",
+                       SERVER, serv_info.serv_software
+               );
+       }
+
+       if (cache) {
+               wprintf("Pragma: public\r\n"
+                       "Cache-Control: max-age=3600, must-revalidate\r\n"
+                       "Last-modified: %s\r\n",
+                       httpnow
+               );
+       }
+       else {
+               wprintf("Pragma: no-cache\r\n"
+                       "Cache-Control: no-store\r\n"
                );
-               if (!cache)
-                       wprintf("Connection: close\n"
-                               "Pragma: no-cache\n"
-                               "Cache-Control: no-store\n"
-                       );
        }
 
        stuff_to_cookie(cookie, WC->wc_session, WC->wc_username,
                        WC->wc_password, WC->wc_roomname);
 
        if (unset_cookies) {
-               wprintf("Set-cookie: webcit=%s; path=/\n", unset);
+               wprintf("Set-cookie: webcit=%s; path=/\r\n", unset);
        } else {
-               wprintf("Set-cookie: webcit=%s; path=/\n", cookie);
+               wprintf("Set-cookie: webcit=%s; path=/\r\n", cookie);
                if (server_cookie != NULL) {
                        wprintf("%s\n", server_cookie);
                }
        }
 
        if (do_htmlhead) {
-               wprintf("\n");
+               /* wprintf("\n"); */
+               begin_burst();
 
                if (refresh30) {
                        svprintf("REFRESHTAG", WCS_STRING, "%s",
@@ -398,12 +394,21 @@ void output_headers(      int do_httpheaders,     /* 1 = output HTTP headers
        /* ICONBAR */
        if (do_htmlhead) {
 
-               if (WC->HaveExpressMessages) {
-                       wprintf("<div style=\"position:absolute; width=600px; height=400px; "
-                               "background-color: #880000; z-index: 2; >\n");
+               if (WC->HaveInstantMessages) {
+                       wprintf("<div id=\"page_popup\">\n");
                        page_popup();
                        wprintf("</div>\n");
                }
+               if (strlen(WC->ImportantMessage) > 0) {
+                       wprintf("<div id=\"important_message\">\n");
+                       wprintf("<SPAN CLASS=\"imsg\">"
+                               "%s</SPAN><br />\n", WC->ImportantMessage);
+                       wprintf("</div>\n");
+                       wprintf("<script type=\"text/javascript\">\n"
+                               "        setTimeout('hide_imsg_popup()', 2000); \n"
+                               "</script>\n");
+                       safestrncpy(WC->ImportantMessage, "", sizeof WC->ImportantMessage);
+               }
                if ( (WC->logged_in) && (!unset_cookies) ) {
                        wprintf("<div id=\"iconbar\">");
                        do_iconbar();
@@ -416,18 +421,8 @@ void output_headers(       int do_httpheaders,     /* 1 = output HTTP headers
                }
        }
 
-       if (do_room_banner != 2) {
+       if (do_room_banner == 1) {
                wprintf("<div id=\"content\">\n");
-
-
-               if (strlen(WC->ImportantMessage) > 0) {
-                       do_template("beginbox_nt");
-                       wprintf("<SPAN CLASS=\"errormsg\">"
-                               "%s</SPAN><br />\n", WC->ImportantMessage);
-                       do_template("endbox");
-                       strcpy(WC->ImportantMessage, "");
-               }
-
        }
 }
 
@@ -437,9 +432,9 @@ void output_headers(        int do_httpheaders,     /* 1 = output HTTP headers
  */
 void http_redirect(char *whichpage) {
        wprintf("HTTP/1.0 302 Moved Temporarily\n");
-       wprintf("Location: %s\n", whichpage);
-       wprintf("URI: %s\n", whichpage);
-       wprintf("Content-type: text/html\n\n");
+       wprintf("Location: %s\r\n", whichpage);
+       wprintf("URI: %s\r\n", whichpage);
+       wprintf("Content-type: text/html; charset=utf-8\r\n\r\n");
        wprintf("<html><body>\n");
        wprintf("you really want to be <A HREF=\"%s\">here</A> now\n",
                whichpage);
@@ -448,13 +443,13 @@ void http_redirect(char *whichpage) {
 
 
 
-void check_for_express_messages()
+void check_for_instant_messages()
 {
        char buf[SIZ];
 
        serv_puts("NOOP");
-       serv_gets(buf);
-       if (buf[3] == '*') WC->HaveExpressMessages = 1;
+       serv_getln(buf, sizeof buf);
+       if (buf[3] == '*') WC->HaveInstantMessages = 1;
 }
 
 
@@ -465,20 +460,44 @@ void check_for_express_messages()
  */
 void http_transmit_thing(char *thing, size_t length, char *content_type,
                         int is_static) {
-       if (is_static) {
-               output_headers(0, 0, 0, 0, 0, 0, 1);
-       }
-       else {
-               output_headers(0, 0, 0, 0, 0, 0, 0);
-       }
-       wprintf("Content-type: %s\n"
-               "Content-length: %ld\n"
-               "Server: %s\n"
-               "Connection: close\n"
-               "\n",
+
+       output_headers(0, 0, 0, 0, 0, 0, is_static);
+
+       wprintf("Content-type: %s\r\n"
+               "Server: %s\r\n"
+               "Connection: close\r\n",
                content_type,
-               (long) length,
-               SERVER
+               SERVER);
+
+#ifdef HAVE_ZLIB
+       /* If we can send the data out compressed, please do so. */
+       if (WC->gzip_ok) {
+               char *compressed_data = NULL;
+               uLongf compressed_len;
+
+               compressed_len = (uLongf) ((length * 101) / 100) + 100;
+               compressed_data = malloc(compressed_len);
+
+               if (compress_gzip((Bytef *) compressed_data,
+                                 &compressed_len,
+                                 (Bytef *) thing,
+                                 (uLongf) length, Z_BEST_SPEED) == Z_OK) {
+                       wprintf("Content-encoding: gzip\r\n"
+                               "Content-length: %ld\r\n"
+                               "\r\n",
+                               (long) compressed_len
+                       );
+                       client_write(compressed_data, (size_t)compressed_len);
+                       free(compressed_data);
+                       return;
+               }
+       }
+#endif
+
+       /* No compression ... just send it out as-is */
+       wprintf("Content-length: %ld\r\n"
+               "\r\n",
+               (long) length
        );
        client_write(thing, (size_t)length);
 }
@@ -488,55 +507,54 @@ void http_transmit_thing(char *thing, size_t length, char *content_type,
 
 void output_static(char *what)
 {
-       char buf[4096];
+       char buf[256];
        FILE *fp;
        struct stat statbuf;
        off_t bytes;
        char *bigbuffer;
-       char content_type[SIZ];
+       char content_type[128];
 
        sprintf(buf, "static/%s", what);
        fp = fopen(buf, "rb");
        if (fp == NULL) {
                wprintf("HTTP/1.0 404 %s\n", strerror(errno));
-               wprintf("Content-Type: text/plain\n");
-               wprintf("\n");
+               wprintf("Content-Type: text/plain\r\n");
+               wprintf("\r\n");
                wprintf("Cannot open %s: %s\n", what, strerror(errno));
        } else {
                if (!strncasecmp(&what[strlen(what) - 4], ".gif", 4))
-                       strcpy(content_type, "image/gif");
+                       safestrncpy(content_type, "image/gif", sizeof content_type);
                else if (!strncasecmp(&what[strlen(what) - 4], ".txt", 4))
-                       strcpy(content_type, "text/plain");
+                       safestrncpy(content_type, "text/plain", sizeof content_type);
                else if (!strncasecmp(&what[strlen(what) - 4], ".css", 4))
-                       strcpy(content_type, "text/css");
+                       safestrncpy(content_type, "text/css", sizeof content_type);
                else if (!strncasecmp(&what[strlen(what) - 4], ".jpg", 4))
-                       strcpy(content_type, "image/jpeg");
+                       safestrncpy(content_type, "image/jpeg", sizeof content_type);
                else if (!strncasecmp(&what[strlen(what) - 4], ".png", 4))
-                       strcpy(content_type, "image/png");
+                       safestrncpy(content_type, "image/png", sizeof content_type);
                else if (!strncasecmp(&what[strlen(what) - 4], ".ico", 4))
-                       strcpy(content_type, "image/x-icon");
+                       safestrncpy(content_type, "image/x-icon", sizeof content_type);
                else if (!strncasecmp(&what[strlen(what) - 5], ".html", 5))
-                       strcpy(content_type, "text/html");
+                       safestrncpy(content_type, "text/html", sizeof content_type);
                else if (!strncasecmp(&what[strlen(what) - 4], ".htm", 4))
-                       strcpy(content_type, "text/html");
+                       safestrncpy(content_type, "text/html", sizeof content_type);
                else if (!strncasecmp(&what[strlen(what) - 4], ".wml", 4))
-                       strcpy(content_type, "text/vnd.wap.wml");
+                       safestrncpy(content_type, "text/vnd.wap.wml", sizeof content_type);
                else if (!strncasecmp(&what[strlen(what) - 5], ".wmls", 5))
-                       strcpy(content_type, "text/vnd.wap.wmlscript");
+                       safestrncpy(content_type, "text/vnd.wap.wmlscript", sizeof content_type);
                else if (!strncasecmp(&what[strlen(what) - 5], ".wmlc", 5))
-                       strcpy(content_type, "application/vnd.wap.wmlc");
+                       safestrncpy(content_type, "application/vnd.wap.wmlc", sizeof content_type);
                else if (!strncasecmp(&what[strlen(what) - 6], ".wmlsc", 6))
-                       strcpy(content_type, "application/vnd.wap.wmlscriptc");
+                       safestrncpy(content_type, "application/vnd.wap.wmlscriptc", sizeof content_type);
                else if (!strncasecmp(&what[strlen(what) - 5], ".wbmp", 5))
-                       strcpy(content_type, "image/vnd.wap.wbmp");
+                       safestrncpy(content_type, "image/vnd.wap.wbmp", sizeof content_type);
                else if (!strncasecmp(&what[strlen(what) - 3], ".js", 3))
-                       strcpy(content_type, "text/javascript");
+                       safestrncpy(content_type, "text/javascript", sizeof content_type);
                else
-                       strcpy(content_type, "application/octet-stream");
+                       safestrncpy(content_type, "application/octet-stream", sizeof content_type);
 
                fstat(fileno(fp), &statbuf);
                bytes = statbuf.st_size;
-               lprintf(3, "Static: %s, (%s; %ld bytes)\n", what, content_type, bytes);
                bigbuffer = malloc(bytes + 2);
                fread(bigbuffer, bytes, 1, fp);
                fclose(fp);
@@ -561,7 +579,7 @@ void output_image()
        off_t bytes;
 
        serv_printf("OIMG %s|%s", bstr("name"), bstr("parm"));
-       serv_gets(buf);
+       serv_getln(buf, sizeof buf);
        if (buf[0] == '2') {
                bytes = extract_long(&buf[4], 0);
                xferbuf = malloc(bytes + 2);
@@ -569,7 +587,7 @@ void output_image()
                /* Read it from the server */
                read_server_binary(xferbuf, bytes);
                serv_puts("CLOS");
-               serv_gets(buf);
+               serv_getln(buf, sizeof buf);
 
                /* Write it to the browser */
                http_transmit_thing(xferbuf, (size_t)bytes, "image/gif", 0);
@@ -585,8 +603,8 @@ void output_image()
                /*
                wprintf("HTTP/1.0 404 %s\n", &buf[4]);
                output_headers(0, 0, 0, 0, 0, 0, 0);
-               wprintf("Content-Type: text/plain\n"
-                       "\n"
+               wprintf("Content-Type: text/plain\r\n"
+                       "\r\n"
                        "Error retrieving image: %s\n",
                        &buf[4]
                );
@@ -608,22 +626,22 @@ void output_mimepart()
        char *content = NULL;
        
        serv_printf("OPNA %s|%s", bstr("msgnum"), bstr("partnum"));
-       serv_gets(buf);
+       serv_getln(buf, sizeof buf);
        if (buf[0] == '2') {
                bytes = extract_long(&buf[4], 0);
                content = malloc(bytes + 2);
-               extract(content_type, &buf[4], 3);
+               extract_token(content_type, &buf[4], 3, '|', sizeof content_type);
                output_headers(0, 0, 0, 0, 0, 0, 0);
                read_server_binary(content, bytes);
                serv_puts("CLOS");
-               serv_gets(buf);
+               serv_getln(buf, sizeof buf);
                http_transmit_thing(content, bytes, content_type, 0);
                free(content);
        } else {
                wprintf("HTTP/1.0 404 %s\n", &buf[4]);
                output_headers(0, 0, 0, 0, 0, 0, 0);
-               wprintf("Content-Type: text/plain\n");
-               wprintf("\n");
+               wprintf("Content-Type: text/plain\r\n");
+               wprintf("\r\n");
                wprintf("Error retrieving part: %s\n", &buf[4]);
        }
 
@@ -640,16 +658,16 @@ char *load_mimepart(long msgnum, char *partnum)
        char *content;
        
        serv_printf("OPNA %ld|%s", msgnum, partnum);
-       serv_gets(buf);
+       serv_getln(buf, sizeof buf);
        if (buf[0] == '2') {
                bytes = extract_long(&buf[4], 0);
-               extract(content_type, &buf[4], 3);
+               extract_token(content_type, &buf[4], 3, '|', sizeof content_type);
 
                content = malloc(bytes + 2);
                read_server_binary(content, bytes);
 
                serv_puts("CLOS");
-               serv_gets(buf);
+               serv_getln(buf, sizeof buf);
                content[bytes] = 0;     /* null terminate for good measure */
                return(content);
        }
@@ -716,13 +734,14 @@ void offer_start_page(void) {
 void change_start_page(void) {
 
        if (bstr("startpage") == NULL) {
-               strcpy(WC->ImportantMessage,
-                       "startpage set to null");
+               safestrncpy(WC->ImportantMessage,
+                       "startpage set to null",
+                       sizeof WC->ImportantMessage);
                display_main_menu();
                return;
        }
 
-       set_preference("startpage", bstr("startpage"));
+       set_preference("startpage", bstr("startpage"), 1);
 
        output_headers(1, 1, 0, 0, 0, 0, 0);
        do_template("newstartpage");
@@ -739,45 +758,15 @@ void display_success(char *successmessage)
 
 
 
-void extract_action(char *actbuf, char *cmdbuf)
-{
-       int i;
-
-       strcpy(actbuf, cmdbuf);
-       if (!strncasecmp(actbuf, "GET /", 5))
-               strcpy(actbuf, &actbuf[5]);
-       if (!strncasecmp(actbuf, "PUT /", 5))
-               strcpy(actbuf, &actbuf[5]);
-       if (!strncasecmp(actbuf, "POST /", 6))
-               strcpy(actbuf, &actbuf[6]);
-
-       for (i = 0; i < strlen(actbuf); ++i) {
-               if (actbuf[i] == ' ') {
-                       actbuf[i] = 0;
-                       i = 0;
-               }
-               if (actbuf[i] == '/') {
-                       actbuf[i] = 0;
-                       i = 0;
-               }
-               if (actbuf[i] == '?') {
-                       actbuf[i] = 0;
-                       i = 0;
-               }
-               if (actbuf[i] == '&') {
-                       actbuf[i] = 0;
-                       i = 0;
-               }
-       }
-}
-
-
 void upload_handler(char *name, char *filename, char *partnum, char *disp,
-                       void *content, char *cbtype, size_t length,
-                       char *encoding, void *userdata)
+                       void *content, char *cbtype, char *cbcharset,
+                       size_t length, char *encoding, void *userdata)
 {
        struct urlcontent *u;
 
+       lprintf(9, "upload_handler() name=%s, type=%s, len=%d\n",
+               name, cbtype, length);
+
        /* Form fields */
        if ( (length > 0) && (strlen(cbtype) == 0) ) {
                u = (struct urlcontent *) malloc(sizeof(struct urlcontent));
@@ -815,19 +804,23 @@ void upload_handler(char *name, char *filename, char *partnum, char *disp,
  */
 void session_loop(struct httprequest *req)
 {
-       char cmd[SIZ];
-       char action[SIZ];
+       char cmd[1024];
+       char method[128];
+       char action[128];
+       char arg1[128];
+       char arg2[128];
+       char arg3[128];
        char buf[SIZ];
        int a, b;
        int ContentLength = 0;
        int BytesRead = 0;
        char ContentType[512];
-       char *content;
-       char *content_end;
+       char *content = NULL;
+       char *content_end = NULL;
        struct httprequest *hptr;
        char browser_host[SIZ];
        char user_agent[SIZ];
-       int body_start;
+       int body_start = 0;
 
        /* We stuff these with the values coming from the client cookies,
         * so we can use them to reconnect a timed out session if we have to.
@@ -835,11 +828,17 @@ void session_loop(struct httprequest *req)
        char c_username[SIZ];
        char c_password[SIZ];
        char c_roomname[SIZ];
+       char c_httpauth_string[SIZ];
+       char c_httpauth_user[SIZ];
+       char c_httpauth_pass[SIZ];
        char cookie[SIZ];
 
-       strcpy(c_username, "");
-       strcpy(c_password, "");
-       strcpy(c_roomname, "");
+       safestrncpy(c_username, "", sizeof c_username);
+       safestrncpy(c_password, "", sizeof c_password);
+       safestrncpy(c_roomname, "", sizeof c_roomname);
+       safestrncpy(c_httpauth_string, "", sizeof c_httpauth_string);
+       safestrncpy(c_httpauth_user, DEFAULT_HTTPAUTH_USER, sizeof c_httpauth_user);
+       safestrncpy(c_httpauth_pass, DEFAULT_HTTPAUTH_PASS, sizeof c_httpauth_pass);
 
        WC->upload_length = 0;
        WC->upload = NULL;
@@ -850,18 +849,46 @@ void session_loop(struct httprequest *req)
        hptr = req;
        if (hptr == NULL) return;
 
-       strcpy(cmd, hptr->line);
+       safestrncpy(cmd, hptr->line, sizeof cmd);
        hptr = hptr->next;
-       extract_action(action, cmd);
+       extract_token(method, cmd, 0, ' ', sizeof method);
+
+       /* Figure out the action */
+       extract_token(action, cmd, 1, '/', sizeof action);
+       if (strstr(action, "?")) *strstr(action, "?") = 0;
+       if (strstr(action, "&")) *strstr(action, "&") = 0;
+       if (strstr(action, " ")) *strstr(action, " ") = 0;
+
+       extract_token(arg1, cmd, 2, '/', sizeof arg1);
+       if (strstr(arg1, "?")) *strstr(arg1, "?") = 0;
+       if (strstr(arg1, "&")) *strstr(arg1, "&") = 0;
+       if (strstr(arg1, " ")) *strstr(arg1, " ") = 0;
+
+       extract_token(arg2, cmd, 3, '/', sizeof arg2);
+       if (strstr(arg2, "?")) *strstr(arg2, "?") = 0;
+       if (strstr(arg2, "&")) *strstr(arg2, "&") = 0;
+       if (strstr(arg2, " ")) *strstr(arg2, " ") = 0;
+
+       extract_token(arg3, cmd, 4, '/', sizeof arg3);
+       if (strstr(arg3, "?")) *strstr(arg3, "?") = 0;
+       if (strstr(arg3, "&")) *strstr(arg3, "&") = 0;
+       if (strstr(arg3, " ")) *strstr(arg3, " ") = 0;
 
        while (hptr != NULL) {
-               strcpy(buf, hptr->line);
+               safestrncpy(buf, hptr->line, sizeof buf);
                hptr = hptr->next;
 
                if (!strncasecmp(buf, "Cookie: webcit=", 15)) {
                        safestrncpy(cookie, &buf[15], sizeof cookie);
                        cookie_to_stuff(cookie, NULL,
-                                     c_username, c_password, c_roomname);
+                                       c_username, sizeof c_username,
+                                       c_password, sizeof c_password,
+                                       c_roomname, sizeof c_roomname);
+               }
+               else if (!strncasecmp(buf, "Authorization: Basic ", 21)) {
+                       CtdlDecodeBase64(c_httpauth_string, &buf[21], strlen(&buf[21]));
+                       extract_token(c_httpauth_user, c_httpauth_string, 0, ':', sizeof c_httpauth_user);
+                       extract_token(c_httpauth_pass, c_httpauth_string, 1, ':', sizeof c_httpauth_pass);
                }
                else if (!strncasecmp(buf, "Content-length: ", 16)) {
                        ContentLength = atoi(&buf[16]);
@@ -889,18 +916,9 @@ void session_loop(struct httprequest *req)
                                ContentType, ContentLength);
                body_start = strlen(content);
 
-/***** old version
-               BytesRead = 0;
-               while (BytesRead < ContentLength) {
-                       a=read(WC->http_sock, &content[BytesRead+body_start],
-                               ContentLength - BytesRead);
-                       if (a <= 0) BytesRead = ContentLength;
-                       else BytesRead += a;
-               }
-*******/
-
-               /* Now we're daring and read it all at once. */
-               client_read(WC->http_sock, &content[BytesRead+body_start], ContentLength);
+               /* Read the entire input data at once. */
+               client_read(WC->http_sock, &content[BytesRead+body_start],
+                       ContentLength);
 
                if (!strncasecmp(ContentType,
                              "application/x-www-form-urlencoded", 33)) {
@@ -930,9 +948,10 @@ void session_loop(struct httprequest *req)
                }
        }
 
+
        /* Static content can be sent without connecting to Citadel. */
        if (!strcasecmp(action, "static")) {
-               strcpy(buf, &cmd[12]);
+               safestrncpy(buf, arg1, sizeof buf);
                for (a = 0; a < strlen(buf); ++a)
                        if (isspace(buf[a]))
                                buf[a] = 0;
@@ -961,7 +980,7 @@ void session_loop(struct httprequest *req)
                }
                else {
                        WC->connected = 1;
-                       serv_gets(buf); /* get the server welcome message */
+                       serv_getln(buf, sizeof buf);    /* get the server welcome message */
                        locate_host(browser_host, WC->http_sock);
                        get_serv_info(browser_host, user_agent);
                        if (serv_info.serv_rev_level < MINIMUM_CIT_VERSION) {
@@ -995,18 +1014,66 @@ void session_loop(struct httprequest *req)
        }
 #endif
 
-       check_for_express_messages();
+       /*
+        * If we're not logged in, but we have HTTP Authentication data,
+        * try logging in to Citadel using that.
+        */
+       if ((!WC->logged_in)
+          && (strlen(c_httpauth_user) > 0)
+          && (strlen(c_httpauth_pass) > 0)) {
+               serv_printf("USER %s", c_httpauth_user);
+               serv_getln(buf, sizeof buf);
+               if (buf[0] == '3') {
+                       serv_printf("PASS %s", c_httpauth_pass);
+                       serv_getln(buf, sizeof buf);
+                       if (buf[0] == '2') {
+                               become_logged_in(c_httpauth_user,
+                                               c_httpauth_pass, buf);
+                               safestrncpy(WC->httpauth_user, c_httpauth_user, sizeof WC->httpauth_user);
+                               safestrncpy(WC->httpauth_pass, c_httpauth_pass, sizeof WC->httpauth_pass);
+                       }
+               }
+       }
+
+       /* 
+        * The GroupDAV stuff relies on HTTP authentication instead of
+        * our session's authentication.
+        */
+       if (!strncasecmp(action, "groupdav", 8)) {
+               groupdav_main(req, ContentType, /* do GroupDAV methods */
+                       ContentLength, content+body_start);
+               if (!WC->logged_in) {
+                       WC->killthis = 1;       /* If not logged in, don't */
+               }                               /* keep the session active */
+               goto SKIP_ALL_THIS_CRAP;
+       }
+
+
+       /*
+        * Automatically send requests with any method other than GET or
+        * POST to the GroupDAV code as well.
+        */
+       if ((strcasecmp(method, "GET")) && (strcasecmp(method, "POST"))) {
+               groupdav_main(req, ContentType, /* do GroupDAV methods */
+                       ContentLength, content+body_start);
+               if (!WC->logged_in) {
+                       WC->killthis = 1;       /* If not logged in, don't */
+               }                               /* keep the session active */
+               goto SKIP_ALL_THIS_CRAP;
+       }
 
        /*
         * If we're not logged in, but we have username and password cookies
         * supplied by the browser, try using them to log in.
         */
-       if ((!WC->logged_in) && (strlen(c_username) > 0) && (strlen(c_password) > 0)) {
+       if ((!WC->logged_in)
+          && (strlen(c_username) > 0)
+          && (strlen(c_password) > 0)) {
                serv_printf("USER %s", c_username);
-               serv_gets(buf);
+               serv_getln(buf, sizeof buf);
                if (buf[0] == '3') {
                        serv_printf("PASS %s", c_password);
-                       serv_gets(buf);
+                       serv_getln(buf, sizeof buf);
                        if (buf[0] == '2') {
                                become_logged_in(c_username, c_password, buf);
                        }
@@ -1018,12 +1085,17 @@ void session_loop(struct httprequest *req)
         */
        if ((strlen(WC->wc_roomname) == 0) && (strlen(c_roomname) > 0)) {
                serv_printf("GOTO %s", c_roomname);
-               serv_gets(buf);
+               serv_getln(buf, sizeof buf);
                if (buf[0] == '2') {
-                       strcpy(WC->wc_roomname, c_roomname);
+                       safestrncpy(WC->wc_roomname, c_roomname, sizeof WC->wc_roomname);
                }
        }
 
+       /*
+        * If there are instant messages waiting, retrieve them for display.
+        */
+       check_for_instant_messages();
+
        if (!strcasecmp(action, "image")) {
                output_image();
 
@@ -1047,10 +1119,14 @@ void session_loop(struct httprequest *req)
                blank_page();
        } else if (!strcasecmp(action, "do_template")) {
                url_do_template();
+       } else if (!strcasecmp(action, "display_aide_menu")) {
+               display_aide_menu();
        } else if (!strcasecmp(action, "display_main_menu")) {
                display_main_menu();
-       } else if (!strcasecmp(action, "whobbs")) {
-               whobbs();
+       } else if (!strcasecmp(action, "who")) {
+               who();
+       } else if (!strcasecmp(action, "who_inner_html")) {
+               who_inner_html();
        } else if (!strcasecmp(action, "knrooms")) {
                knrooms();
        } else if (!strcasecmp(action, "gotonext")) {
@@ -1061,7 +1137,9 @@ void session_loop(struct httprequest *req)
        } else if (!strcasecmp(action, "ungoto")) {
                ungoto();
        } else if (!strcasecmp(action, "dotgoto")) {
-               slrp_highest();
+               if (WC->wc_view != VIEW_MAILBOX) {      /* dotgoto acts like dotskip when we're in a mailbox view */
+                       slrp_highest();
+               }
                smart_goto(bstr("room"));
        } else if (!strcasecmp(action, "dotskip")) {
                smart_goto(bstr("room"));
@@ -1075,14 +1153,16 @@ void session_loop(struct httprequest *req)
                readloop("readfwd");
        } else if (!strcasecmp(action, "headers")) {
                readloop("headers");
+       } else if (!strcasecmp(action, "msg")) {
+               embed_message();
        } else if (!strcasecmp(action, "display_enter")) {
                display_enter();
        } else if (!strcasecmp(action, "post")) {
                post_message();
-       } else if (!strcasecmp(action, "do_stuff_to_one_msg")) {
-               do_stuff_to_one_msg();
        } else if (!strcasecmp(action, "move_msg")) {
                move_msg();
+       } else if (!strcasecmp(action, "delete_msg")) {
+               delete_msg();
        } else if (!strcasecmp(action, "userlist")) {
                userlist();
        } else if (!strcasecmp(action, "showuser")) {
@@ -1107,14 +1187,16 @@ void session_loop(struct httprequest *req)
                display_entroom();
        } else if (!strcasecmp(action, "entroom")) {
                entroom();
+       } else if (!strcasecmp(action, "display_whok")) {
+               display_whok();
+       } else if (!strcasecmp(action, "do_invt_kick")) {
+               do_invt_kick();
        } else if (!strcasecmp(action, "display_editroom")) {
                display_editroom();
        } else if (!strcasecmp(action, "netedit")) {
                netedit();
        } else if (!strcasecmp(action, "editroom")) {
                editroom();
-        } else if (!strcasecmp(action, "display_whok")) {
-                display_whok();
        } else if (!strcasecmp(action, "display_editinfo")) {
                display_edit("Room info", "EINF 0", "RINF", "/editinfo", 1);
        } else if (!strcasecmp(action, "editinfo")) {
@@ -1124,8 +1206,8 @@ void session_loop(struct httprequest *req)
                display_edit("Your bio", "NOOP", buf, "editbio", 3);
        } else if (!strcasecmp(action, "editbio")) {
                save_edit("Your bio", "EBIO", 0);
-       } else if (!strcasecmp(action, "confirm_delete_room")) {
-               confirm_delete_room();
+       } else if (!strcasecmp(action, "confirm_move_msg")) {
+               confirm_move_msg();
        } else if (!strcasecmp(action, "delete_room")) {
                delete_room();
        } else if (!strcasecmp(action, "validate")) {
@@ -1137,7 +1219,7 @@ void session_loop(struct httprequest *req)
        } else if (!strcasecmp(action, "editpic")) {
                do_graphics_upload("UIMG 1|_userpic_");
        } else if (!strcasecmp(action, "display_editroompic")) {
-               display_graphics_upload("the graphic for this room",
+               display_graphics_upload("the icon for this room",
                                        "UIMG 0|_roompic_",
                                        "/editroompic");
        } else if (!strcasecmp(action, "editroompic")) {
@@ -1151,7 +1233,7 @@ void session_loop(struct httprequest *req)
        } else if (!strcasecmp(action, "display_editfloorpic")) {
                sprintf(buf, "UIMG 0|_floorpic_|%s",
                        bstr("which_floor"));
-               display_graphics_upload("the graphic for this floor",
+               display_graphics_upload("the icon for this floor",
                                        buf,
                                        "/editfloorpic");
        } else if (!strcasecmp(action, "editfloorpic")) {
@@ -1249,6 +1331,12 @@ void session_loop(struct httprequest *req)
                display_inetconf();
        } else if (!strcasecmp(action, "save_inetconf")) {
                save_inetconf();
+       } else if (!strcasecmp(action, "setup_wizard")) {
+               do_setup_wizard();
+       } else if (!strcasecmp(action, "display_preferences")) {
+               display_preferences();
+       } else if (!strcasecmp(action, "set_preferences")) {
+               set_preferences();
        } else if (!strcasecmp(action, "diagnostics")) {
                output_headers(1, 1, 1, 0, 0, 0, 0);