Fixed bug 301. /listsub operations do not require a

security nonce because they do not maintain an ongoing session
with the server.  Also cleaned this screen up visually.

diff --git a/webcit/listsub.c b/webcit/listsub.c
index f219ffcb832991a5dab979442b4fb72dfbd4b01e..ef7d93b743f858b6d0e31593a675491980aa8832 100644 (file)
--- a/webcit/listsub.c
+++ b/webcit/listsub.c
@@ -1,18 +1,13 @@
 /*
  * $Id$
- */
-/**
- * \defgroup ListSubForms Web forms for handling mailing list subscribe/unsubscribe requests.
- * \ingroup WebcitDisplayItems
+ *
+ * Web forms for handling mailing list subscribe/unsubscribe requests.
  */
 
-/*@{*/
 #include "webcit.h"
 
-
-
-/**
- * \brief List subscription handling
+/*
+ * List subscription handling
  */
 void do_listsub(void)
 {
@@ -50,13 +45,14 @@ void do_listsub(void)
        strcpy(email, bstr("email"));
        strcpy(subtype, bstr("subtype"));
 
-       wprintf("<CENTER>"
-               "<TABLE class=\"listsub_banner\"><TR><TD>"
-               "<SPAN CLASS=\"titlebar\">");
-       wprintf(_("List subscribe/unsubscribe"));
-       wprintf("</SPAN></TD></TR></TABLE><br />\n");
+       wprintf("<div align=center>");
+       wprintf("<table border=0 width=75%%><tr><td>");
+
+       svprintf("BOXTITLE", WCS_STRING, _("List subscribe/unsubscribe"));
+       do_template("beginbox");
+       wprintf("<div align=center><br>");
 
-       /**
+       /*
         * Subscribe command
         */
        if (!strcasecmp(cmd, "subscribe")) {
@@ -98,7 +94,7 @@ void do_listsub(void)
                }
        }
 
-       /**
+       /*
         * Unsubscribe command
         */
        else if (!strcasecmp(cmd, "unsubscribe")) {
@@ -136,7 +132,7 @@ void do_listsub(void)
                }
        }
 
-       /**
+       /*
         * Confirm command
         */
        else if (!strcasecmp(cmd, "confirm")) {
@@ -164,16 +160,14 @@ void do_listsub(void)
                wprintf("%s</CENTER><br />\n", &buf[4]);
        }
 
-       /**
+       /*
         * Any other (invalid) command causes the form to be displayed
         */
        else {
-FORM:          wprintf("<FORM METHOD=\"POST\" action=\"listsub\">\n");
-               wprintf("<input type=\"hidden\" name=\"nonce\" value=\"%ld\">\n", WC->nonce);
-               wprintf("<TABLE BORDER=0>\n");
+FORM:          wprintf("<form method=\"POST\" action=\"listsub\">\n");
 
-               wprintf("<TR><TD>Name of list</TD><TD>"
-                       "<SELECT NAME=\"room\" SIZE=1>\n");
+               wprintf("Name of list: "
+                       "<select name=\"room\" size=1>\n");
 
                serv_puts("LPRM");
                serv_getln(buf, sizeof buf);
@@ -182,39 +176,37 @@ FORM:             wprintf("<FORM METHOD=\"POST\" action=\"listsub\">\n");
                                extract_token(sroom, buf, 0, '|', sizeof sroom);
                                self = extract_int(buf, 4) & QR2_SELFLIST ;
                                if (self) {
-                                       wprintf("<OPTION VALUE=\"");
+                                       wprintf("<option value=\"");
                                        escputs(sroom);
                                        wprintf("\">");
                                        escputs(sroom);
-                                       wprintf("</OPTION>\n");
+                                       wprintf("</option>\n");
                                }
                        }
                }
-               wprintf("</SELECT>"
-                       "</TD></TR>\n");
+               wprintf("</select><br><br>\n");
 
-               wprintf("<TR><TD>Your e-mail address</TD><TD>"
+               wprintf("Your e-mail address: "
                        "<INPUT TYPE=\"text\" NAME=\"email\" "
                        "VALUE=\""
                );
                escputs(email);
-               wprintf("\" MAXLENGTH=128></TD></TR>\n");
+               wprintf("\" maxlength=128 size=60><br><br>\n");
 
-               wprintf("</TABLE>"
-                       "(If subscribing) preferred format: "
+               wprintf("(If subscribing) preferred format: "
                        "<INPUT TYPE=\"radio\" NAME=\"subtype\" "
                        "VALUE=\"list\" CHECKED>One message at a time&nbsp; "
                        "<INPUT TYPE=\"radio\" NAME=\"subtype\" "
                        "VALUE=\"digest\">Digest format&nbsp; "
-                       "<br />\n"
+                       "<br><br>\n"
                        "<INPUT TYPE=\"submit\" NAME=\"cmd\""
                        " VALUE=\"subscribe\">\n"
                        "<INPUT TYPE=\"submit\" NAME=\"cmd\""
-                       " VALUE=\"unsubscribe\">\n"
+                       " VALUE=\"unsubscribe\"><br><br>\n"
                        "</FORM>\n"
                );
 
-               wprintf("<br />When you attempt to subscribe or unsubscribe to "
+               wprintf("<hr>When you attempt to subscribe or unsubscribe to "
                        "a mailing list, you will receive an e-mail containing"
                        " one additional web link to click on for final "
                        "confirmation.  This extra step is for your "
@@ -224,11 +216,11 @@ FORM:             wprintf("<FORM METHOD=\"POST\" action=\"listsub\">\n");
 
        }
 
+       wprintf("</div>");
+       do_template("endbox");
+       wprintf("</td></tr></table></div>");
+
        wprintf("</BODY></HTML>\n");
        wDumpContent(0);
        end_webcit_session();
 }
-
-
-
-/*@}*/

diff --git a/webcit/webcit.c b/webcit/webcit.c
index 28cb08a1bcc2c5720c2085584b74fc6247db0f9f..c65fd7f3ddeaea800ab6dd787f16c3032216c3c7 100644 (file)
--- a/webcit/webcit.c
+++ b/webcit/webcit.c
@@ -1310,7 +1310,7 @@ void session_loop(struct httprequest *req)
                        wprintf("HTTP/1.1 404 Security check failed\r\n");
                        wprintf("Content-Type: text/plain\r\n");
                        wprintf("\r\n");
-                       wprintf("Security check failed.\r\n");
+                       wprintf("You have sent a malformed or invalid request.\r\n");
                }
                goto SKIP_ALL_THIS_CRAP;        /* Don't try to connect */
        }