Melissa
Deleted
Feb 15, 2000, 7:52 AM
Post #4 of 6
(323 views)
|
|
Re: Cert Advisory 2000-02/Filtering Code HOW
[In reply to]
|
Can't Post
|
|
Now I'm really confused.....
kencl, I would really love to see your script when you are finished!!
Jasmine,I see what you mean by the subroutines that you posted for me, but I think the real problem is where they go, or what they are called, etc. in my script.
I tried using the code that I put under Example 2 in my first post, but all it did was strip out everything, completely.
I tried another version, using the subroutine named FilterNeg I have in Example 1 in my first post, but it doesn't do anything, because I can still submit those characters.
Here's the majority of my script, I'll try leave out the html part that gets displayed, or the part that prints to the database/flatfile.
I've left them in this script, they are commented out. Please look for the sub FilterNeg routine OR the part right under the read(STDIN) in the beginning that does the $OK_CHARS because those are the two that I've been trying to get to work, one or the other, I don't care at this point...
Please don't hate me!!!!!
#!/usr/bin/perl
#
# Program: dummy.cgi
#
#
# Main
#
{
&init;
&show_standard_html_heading;
&get_form_data;
# &FilterNeg;
&check_form;
if ($incomplete_form eq FALSE) {
&store_form;
# Include the user's email in the e-mail list.
if ($fields{'email'}) {
push(@mail_user, $fields{'email'});
}
&send_email;
¬ify_sender;
}
else {
&redisplay_page;
}
&show_standard_html_ending;
}
#
# End of Main
#
sub get_form_data {
# This function grabs the information from the browser and
# crams it into a $fields associated array.
# get the env variable and store it to the @prompts array
read(STDIN, $save_string, $ENV{CONTENT_LENGTH});
# $_=$save_string = $ENV{'QUERY_STRING'};
# print "$save_string\n";
# $OK_CHARS='-a-zA-Z0-9_.@';
# s/[^$OK_CHARS]/_/g;
# $save_string = $_;
# print "$save_string\n";
@prompts = split(/&/,$save_string);
# step through each variable, clean up the garbage, and store
# it to the @fields variable.
foreach (@prompts) {
($tmp1, $tmp2) = split(/=/,$_);
$tmp2 =~ s/\x2b/\x20/g;
$tmp2 =~ s/%2C/\x2c/g;
$tmp2 =~ s/%28/\x28/g;
$tmp2 =~ s/%29/\x29/g;
$tmp2 =~ s/%3A/:/g; #convert 3A to colon
$tmp2 =~ s/%40/\@/g; #at symbol
$fields{$tmp1} = &remove_escape_codes($tmp2);
}
} #end get_form_data
sub show_standard_html_heading {
print "Content-TYPE: text/html\n\n";
print <<EOM
<HTML>
<HEAD>
<TITLE>Conference</TITLE>
</HEAD>
<BODY BGCOLOR="#FFFFFF" LINK=blue>
EOM
} #end show_standard_html_heading
sub show_standard_html_ending {
print "</FORM>";
print "</BODY>";
print "</HTML>";
} #end show_standard_html_ending
sub init {
$server_root = "/usr/netscape/suitespot/https-server/logs/";
# Push to as many users as necessary.
push(@mail_user, "user\@domain.com");
$registration_file = $server_root."regtest.db";
$date_string = &get_date;
$incomplete_form = FALSE;
} #end init
sub FilterNeg {
local($fd) = @_;
$fd =~ s/[\<\>\"\'\%\;\)\(\=\!\&\+]//g;
return $fd;
} #end FilterNeg
sub check_form {
if (($fields{'conference'} eq "")
and ($fields{'tour'} eq "")
and ($fields{'icebreaker'} eq "")
and ($fields{'dinner'} eq "")
and ($fields{'golf'} eq ""))
{
$incomplete_form = TRUE;
}
} # end check_form
-----------------I didn't includee this part that is the HTML display and the form that gets submitted to a flatfile database and emails the users--------------
sub remove_escape_codes {
# Take out all of the goofy escape codes that
# the server likes to put in.
local($variable, $keep_colon) = @_;
$variable =~ s/\x2b/\x20/g;
$variable =~ s/%2C/\x2c/g;
$variable =~ s/%28/\x28/g; #convert 28 to left paren
$variable =~ s/%29/\)/g; #convert 29 to righ paren
$variable =~ s/%3A/\x3a/g; #convert 3A to colon
$variable =~ s/\+/ /g;
$variable =~ s/%26/\&/g;
$variable =~ s/%27/\'/g;
$variable =~ s/%2F/\//g; # slash (erased)
$variable =~ s/%3F/\?/g; # question mark
$variable =~ s/%21/!/g; # exclamation mark
$variable =~ s/%23/#/g; # pound sign
$variable =~ s/%24/\$/g; # dollar sign
$variable =~ s/%25/\%/g; # percent sign
$variable =~ s/%5E/^/g; # carrot
$variable =~ s/%2B/+/g; # plus
$variable =~ s/%3D/=/g; # equal
$variable =~ s/%7C/\|/g; # pipe
$variable =~ s/%60/\`/g; # aprostrophe
$variable =~ s/%7E/\~/g; # tilde
$variable =~ s/%3C/\</g; # less than symbol
$variable =~ s/%3E/\>/g; # greater than symbol
$variable =~ s/%3B/\;/g; # semi colon
$variable =~ s/%22/\"/g; # quote
$variable =~ s/%5B/[/g; # left bracket
$variable =~ s/%5D/]/g; # right bracket
$variable =~ s/%7B/\{/g; # left brace
$variable =~ s/%7D/\}/g; # right brace
$variable =~ s/%09/\t/g; # tab
$variable =~ s/:/-/g; # colon
$variable =~ s/%0D%0A/\n\t/g; # Carriage Return/Line Feed
return $variable;
}
sub get_date {
($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime(time);
if ($min < 10) {
$min = "0".$min;
}
if ($sec < 10) {
$sec = "0".$sec;
}
# Increment the month by one because PERL's months
# are in the range of 0..11. Weird, huh?
$mon++;
$year %=100;
$ydate_string = "$year$mon$mday";
$xdate_string = "$mon$mday$year";
$date_string = sprintf("%02d:%02d:%02d %02d/%02d/%02d",$hour,$min,$sec,$mon,$mday,$year);
return $date_string;
return $xdate_string;
} #end get_date
# End of file #
|
MAIN
SEARCH
WHO'S 
LOG 