s3 swat: Fix possible XSS attack (bug #8289)

[samba.git] / source3 / web / swat.c

diff --git a/source3/web/swat.c b/source3/web/swat.c
index 3e14d2d0980bde824f2f30dbb2bfcc688b8459d6..ac5787bf1fcfb1cc35a3c423cbe50d6277040355 100644 (file)
--- a/source3/web/swat.c
+++ b/source3/web/swat.c
@@ -86,13 +86,14 @@ static const char *fix_quotes(TALLOC_CTX *ctx, const char *str)
 
        /* Count the number of quotes. */
        newstring_len = 1;
-       while (*str) {
-               if ( *str == '\"') {
+       p = (char *) str;
+       while (*p) {
+               if ( *p == '\"') {
                        newstring_len += quote_len;
                } else {
                        newstring_len++;
                }
-               ++str;
+               ++p;
        }
        newstring = TALLOC_ARRAY(ctx, char, newstring_len);
        if (!newstring) {
@@ -105,7 +106,6 @@ static const char *fix_quotes(TALLOC_CTX *ctx, const char *str)
                } else {
                        *p++ = *str;
                }
-               ++str;
        }
        *p = '\0';
        return newstring;
@@ -156,7 +156,9 @@ static int include_html(const char *fname)
        }
 
        while ((ret = read(fd, buf, sizeof(buf))) > 0) {
-               write(1, buf, ret);
+               if (write(1, buf, ret) == -1) {
+                       break;
+               }
        }
 
        close(fd);
@@ -232,7 +234,7 @@ static void show_parameter(int snum, struct parm_struct *parm)
        TALLOC_CTX *ctx = talloc_stackframe();
 
        if (parm->p_class == P_LOCAL && snum >= 0) {
-               ptr = lp_local_ptr(snum, ptr);
+               ptr = lp_local_ptr_by_snum(snum, ptr);
        }
 
        printf("<tr><td>%s</td><td>", get_parm_translated(ctx,
@@ -375,7 +377,7 @@ static void show_parameters(int snum, int allparameters, unsigned int parm_filte
                                        void *ptr = parm->ptr;
 
                                if (parm->p_class == P_LOCAL && snum >= 0) {
-                                       ptr = lp_local_ptr(snum, ptr);
+                                       ptr = lp_local_ptr_by_snum(snum, ptr);
                                }
 
                                switch (parm->type) {
@@ -384,7 +386,8 @@ static void show_parameters(int snum, int allparameters, unsigned int parm_filte
                                        break;
 
                                case P_LIST:
-                                       if (!str_list_compare(*(char ***)ptr, (char **)(parm->def.lvalue))) continue;
+                                       if (!str_list_equal(*(const char ***)ptr, 
+                                                           (const char **)(parm->def.lvalue))) continue;
                                        break;
 
                                case P_STRING:
@@ -430,7 +433,6 @@ static void show_parameters(int snum, int allparameters, unsigned int parm_filte
 ****************************************************************************/
 static bool load_config(bool save_def)
 {
-       lp_resetnumservices();
        return lp_load(get_dyn_CONFIGFILE(),False,save_def,False,True);
 }
 
@@ -476,7 +478,7 @@ static int save_reload(int snum)
        }
 
        write_config(f, False);
-       if (snum)
+       if (snum >= 0)
                lp_dump_one(f, False, snum);
        fclose(f);
 
@@ -596,7 +598,7 @@ static void ViewModeBoxes(int mode)
 ****************************************************************************/
 static void welcome_page(void)
 {
-       if (file_exist("help/welcome.html", NULL)) {
+       if (file_exist("help/welcome.html")) {
                include_html("help/welcome.html");
        } else {
                include_html("help/welcome-no-samba-doc.html");
@@ -740,12 +742,12 @@ static void wizard_page(void)
 
                        load_config(False);
                        lp_copy_service(GLOBAL_SECTION_SNUM, unix_share);
-                       iNumNonAutoPrintServices = lp_numservices();
                        have_home = lp_servicenumber(HOMES_NAME);
                        lp_do_parameter( have_home, "read only", "No");
                        lp_do_parameter( have_home, "valid users", "%S");
                        lp_do_parameter( have_home, "browseable", "No");
                        commit_parameters(have_home);
+                       save_reload(have_home);
                }
 
                /* Need to Delete Homes share? */
@@ -908,6 +910,7 @@ static void shares_page(void)
        if (cgi_variable("Commit") && snum >= 0) {
                commit_parameters(snum);
                save_reload(0);
+               snum = lp_servicenumber(share);
        }
 
        if (cgi_variable("Delete") && snum >= 0) {
@@ -918,11 +921,14 @@ static void shares_page(void)
        }
 
        if (cgi_variable("createshare") && (share=cgi_variable("newshare"))) {
-               load_config(False);
-               lp_copy_service(GLOBAL_SECTION_SNUM, share);
-               iNumNonAutoPrintServices = lp_numservices();
-               save_reload(0);
                snum = lp_servicenumber(share);
+               if (snum < 0) {
+                       load_config(False);
+                       lp_copy_service(GLOBAL_SECTION_SNUM, share);
+                       snum = lp_servicenumber(share);
+                       save_reload(snum);
+                       snum = lp_servicenumber(share);
+               }
        }
 
        printf("<FORM name=\"swatform\" method=post>\n");
@@ -958,7 +964,6 @@ static void shares_page(void)
                               (share && strcmp(share,s)==0)?"SELECTED":"",
                               utf8_s, utf8_s);
                        SAFE_FREE(utf8_s);
-                       
                }
        }
        printf("</select></td>\n");
@@ -1116,11 +1121,9 @@ static void chg_passwd(void)
        if(cgi_variable(CHG_S_PASSWD_FLAG)) {
                printf("<p>");
                if (rslt == True) {
-                       printf(_(" The passwd for '%s' has been changed."), cgi_variable_nonull(SWAT_USER));
-                       printf("\n");
+                       printf("%s\n", _(" The passwd has been changed."));
                } else {
-                       printf(_(" The passwd for '%s' has NOT been changed."), cgi_variable_nonull(SWAT_USER));
-                       printf("\n");
+                       printf("%s\n", _(" The passwd for has NOT been changed."));
                }
        }
        
@@ -1134,14 +1137,6 @@ static void passwd_page(void)
 {
        const char *new_name = cgi_user_name();
 
-       /* 
-        * After the first time through here be nice. If the user
-        * changed the User box text to another users name, remember it.
-        */
-       if (cgi_variable(SWAT_USER)) {
-               new_name = cgi_variable_nonull(SWAT_USER);
-       } 
-
        if (!new_name) new_name = "";
 
        printf("<H2>%s</H2>\n", _("Server Password Management"));
@@ -1250,8 +1245,8 @@ static void printers_page(void)
         printf("<H2>%s</H2>\n", _("Printer Parameters"));
  
         printf("<H3>%s</H3>\n", _("Important Note:"));
-        printf(_("Printer names marked with [*] in the Choose Printer drop-down box "));
-        printf(_("are autoloaded printers from "));
+        printf("%s",_("Printer names marked with [*] in the Choose Printer drop-down box "));
+        printf("%s",_("are autoloaded printers from "));
         printf("<A HREF=\"/swat/help/smb.conf.5.html#printcapname\" target=\"docs\">%s</A>\n", _("Printcap Name"));
         printf("%s\n", _("Attempting to delete these printers from SWAT will have no effect."));
 
@@ -1261,6 +1256,7 @@ static void printers_page(void)
                    save_reload(snum);
                else
                    save_reload(0);
+               snum = lp_servicenumber(share);
        }
 
        if (cgi_variable("Delete") && snum >= 0) {
@@ -1271,13 +1267,15 @@ static void printers_page(void)
        }
 
        if (cgi_variable("createshare") && (share=cgi_variable("newshare"))) {
-               load_config(False);
-               lp_copy_service(GLOBAL_SECTION_SNUM, share);
-               iNumNonAutoPrintServices = lp_numservices();
-               snum = lp_servicenumber(share);
-               lp_do_parameter(snum, "print ok", "Yes");
-               save_reload(0);
                snum = lp_servicenumber(share);
+               if (snum < 0 || snum >= iNumNonAutoPrintServices) {
+                       load_config(False);
+                       lp_copy_service(GLOBAL_SECTION_SNUM, share);
+                       snum = lp_servicenumber(share);
+                       lp_do_parameter(snum, "print ok", "Yes");
+                       save_reload(snum);
+                       snum = lp_servicenumber(share);
+               }
        }
 
        printf("<FORM name=\"swatform\" method=post>\n");
@@ -1434,7 +1432,7 @@ const char *lang_msg_rotate(TALLOC_CTX *ctx, const char *msgid)
 
        cgi_load_variables();
 
-       if (!file_exist(get_dyn_CONFIGFILE(), NULL)) {
+       if (!file_exist(get_dyn_CONFIGFILE())) {
                have_read_access = True;
                have_write_access = True;
        } else {