Fossil

Differences From Artifact [c91e372bfe]:

• File src/style.c — part of check-in [d97752f30b] at 2022-02-14 22:43:26 on branch base-href-fix — Make <code>style_set_base_href_suffix()</code> safe for misuse: if the resulting suffix contains unescaped quotes then escape them. <var>$base_href_suffix</var> is intended for interpolation inside of the quoted href attribute. This check-in should address the case when a user of malfunctioning browser (which mishandles quoting) is tricked by an adversary to visit a specially crafted hyperlink. (user: george size: 54566)

To Artifact [b5a2c04229]:

• File src/style.c — part of check-in [ff4c7ed609] at 2022-02-14 23:06:12 on branch base-href-fix — Do not export <var>g.zRelReqURI</var> to TH1 interpreter because <code>getParameter</code> proc can retrieve <code>PATH_INFO</code> and <code>QUERY_STRING</code>. Instead export <var>g.zPath</var> (as <var>$webpagename</var>) since that is typically needed in the TH1 headers/footers of custom skins. (user: george size: 54479)

791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810

  if( zTitle ) Th_Store("title", zTitle);
  Th_Store("baseurl", g.zBaseURL);
  Th_Store("secureurl", fossil_wants_https(1)? g.zHttpsURL: g.zBaseURL);
  Th_Store("home", g.zTop);
  Th_Store("index_page", db_get("index-page","/home"));
  if( local_zCurrentPage==0 ) style_set_current_page("%T", g.zPath);
  Th_Store("current_page", local_zCurrentPage);
  if( local_zBaseHrefSuffix==0 ){
    style_set_base_href_suffix("%s",g.zRelReqURI);
    /* %s because g.zRelReqURI is already encoded (FIXME: really so?) */
  }
  Th_Store("base_href_suffix", local_zBaseHrefSuffix);
  Th_Store("relrequri", g.zRelReqURI);
  Th_Store("csrf_token", g.zCsrfToken);
  Th_Store("release_version", RELEASE_VERSION);
  Th_Store("manifest_version", MANIFEST_VERSION);
  Th_Store("manifest_date", MANIFEST_DATE);
  Th_Store("compiler_name", COMPILER_NAME);
  Th_Store("mainmenu", style_get_mainmenu());
  stylesheet_url_var();

<
|
<
<

|

791
792
793
794
795
796
797

798


799
800
801
802
803
804
805
806
807

  if( zTitle ) Th_Store("title", zTitle);
  Th_Store("baseurl", g.zBaseURL);
  Th_Store("secureurl", fossil_wants_https(1)? g.zHttpsURL: g.zBaseURL);
  Th_Store("home", g.zTop);
  Th_Store("index_page", db_get("index-page","/home"));
  if( local_zCurrentPage==0 ) style_set_current_page("%T", g.zPath);
  Th_Store("current_page", local_zCurrentPage);

  if( !local_zBaseHrefSuffix ) style_set_base_href_suffix("%s",g.zRelReqURI);


  Th_Store("base_href_suffix", local_zBaseHrefSuffix);
  Th_Store("webpagename", g.zPath);
  Th_Store("csrf_token", g.zCsrfToken);
  Th_Store("release_version", RELEASE_VERSION);
  Th_Store("manifest_version", MANIFEST_VERSION);
  Th_Store("manifest_date", MANIFEST_DATE);
  Th_Store("compiler_name", COMPILER_NAME);
  Th_Store("mainmenu", style_get_mainmenu());
  stylesheet_url_var();