s3 swat: Fix possible XSS attack (bug #8289)
[samba.git] / source3 / web / swat.c
index b36168f71ff6ca3438d4f92959a505cfb9d1cdc6..ac5787bf1fcfb1cc35a3c423cbe50d6277040355 100644 (file)
@@ -86,13 +86,14 @@ static const char *fix_quotes(TALLOC_CTX *ctx, const char *str)
 
        /* Count the number of quotes. */
        newstring_len = 1;
-       while (*str) {
-               if ( *str == '\"') {
+       p = (char *) str;
+       while (*p) {
+               if ( *p == '\"') {
                        newstring_len += quote_len;
                } else {
                        newstring_len++;
                }
-               ++str;
+               ++p;
        }
        newstring = TALLOC_ARRAY(ctx, char, newstring_len);
        if (!newstring) {
@@ -105,7 +106,6 @@ static const char *fix_quotes(TALLOC_CTX *ctx, const char *str)
                } else {
                        *p++ = *str;
                }
-               ++str;
        }
        *p = '\0';
        return newstring;
@@ -156,7 +156,9 @@ static int include_html(const char *fname)
        }
 
        while ((ret = read(fd, buf, sizeof(buf))) > 0) {
-               write(1, buf, ret);
+               if (write(1, buf, ret) == -1) {
+                       break;
+               }
        }
 
        close(fd);
@@ -228,10 +230,11 @@ static void show_parameter(int snum, struct parm_struct *parm)
        int i;
        void *ptr = parm->ptr;
        char *utf8_s1, *utf8_s2;
+       size_t converted_size;
        TALLOC_CTX *ctx = talloc_stackframe();
 
        if (parm->p_class == P_LOCAL && snum >= 0) {
-               ptr = lp_local_ptr(snum, ptr);
+               ptr = lp_local_ptr_by_snum(snum, ptr);
        }
 
        printf("<tr><td>%s</td><td>", get_parm_translated(ctx,
@@ -252,12 +255,12 @@ static void show_parameter(int snum, struct parm_struct *parm)
                        for (;*list;list++) {
                                /* enclose in HTML encoded quotes if the string contains a space */
                                if ( strchr_m(*list, ' ') ) {
-                                       push_utf8_allocate(&utf8_s1, *list);
-                                       push_utf8_allocate(&utf8_s2, ((*(list+1))?", ":""));
+                                       push_utf8_allocate(&utf8_s1, *list, &converted_size);
+                                       push_utf8_allocate(&utf8_s2, ((*(list+1))?", ":""), &converted_size);
                                        printf("&quot;%s&quot;%s", utf8_s1, utf8_s2);
                                } else {
-                                       push_utf8_allocate(&utf8_s1, *list);
-                                       push_utf8_allocate(&utf8_s2, ((*(list+1))?", ":""));
+                                       push_utf8_allocate(&utf8_s1, *list, &converted_size);
+                                       push_utf8_allocate(&utf8_s2, ((*(list+1))?", ":""), &converted_size);
                                        printf("%s%s", utf8_s1, utf8_s2);
                                }
                                SAFE_FREE(utf8_s1);
@@ -282,17 +285,7 @@ static void show_parameter(int snum, struct parm_struct *parm)
 
        case P_STRING:
        case P_USTRING:
-               push_utf8_allocate(&utf8_s1, *(char **)ptr);
-               printf("<input type=text size=40 name=\"parm_%s\" value=\"%s\">",
-                      make_parm_name(parm->label), fix_quotes(ctx, utf8_s1));
-               SAFE_FREE(utf8_s1);
-               printf("<input type=button value=\"%s\" onClick=\"swatform.parm_%s.value=\'%s\'\">",
-                       _("Set Default"), make_parm_name(parm->label),fix_backslash((char *)(parm->def.svalue)));
-               break;
-
-       case P_GSTRING:
-       case P_UGSTRING:
-               push_utf8_allocate(&utf8_s1, (char *)ptr);
+               push_utf8_allocate(&utf8_s1, *(char **)ptr, &converted_size);
                printf("<input type=text size=40 name=\"parm_%s\" value=\"%s\">",
                       make_parm_name(parm->label), fix_quotes(ctx, utf8_s1));
                SAFE_FREE(utf8_s1);
@@ -324,12 +317,19 @@ static void show_parameter(int snum, struct parm_struct *parm)
                        _("Set Default"), make_parm_name(parm->label),(int)(parm->def.ivalue));
                break;
 
-       case P_OCTAL:
-               printf("<input type=text size=8 name=\"parm_%s\" value=%s>", make_parm_name(parm->label), octal_string(*(int *)ptr));
-               printf("<input type=button value=\"%s\" onClick=\"swatform.parm_%s.value=\'%s\'\">",
-                      _("Set Default"), make_parm_name(parm->label),
-                      octal_string((int)(parm->def.ivalue)));
+       case P_OCTAL: {
+               char *o;
+               o = octal_string(*(int *)ptr);
+               printf("<input type=text size=8 name=\"parm_%s\" value=%s>",
+                      make_parm_name(parm->label), o);
+               TALLOC_FREE(o);
+               o = octal_string((int)(parm->def.ivalue));
+               printf("<input type=button value=\"%s\" "
+                      "onClick=\"swatform.parm_%s.value=\'%s\'\">",
+                      _("Set Default"), make_parm_name(parm->label), o);
+               TALLOC_FREE(o);
                break;
+       }
 
        case P_ENUM:
                printf("<select name=\"parm_%s\">",make_parm_name(parm->label)); 
@@ -377,7 +377,7 @@ static void show_parameters(int snum, int allparameters, unsigned int parm_filte
                                        void *ptr = parm->ptr;
 
                                if (parm->p_class == P_LOCAL && snum >= 0) {
-                                       ptr = lp_local_ptr(snum, ptr);
+                                       ptr = lp_local_ptr_by_snum(snum, ptr);
                                }
 
                                switch (parm->type) {
@@ -386,7 +386,8 @@ static void show_parameters(int snum, int allparameters, unsigned int parm_filte
                                        break;
 
                                case P_LIST:
-                                       if (!str_list_compare(*(char ***)ptr, (char **)(parm->def.lvalue))) continue;
+                                       if (!str_list_equal(*(const char ***)ptr, 
+                                                           (const char **)(parm->def.lvalue))) continue;
                                        break;
 
                                case P_STRING:
@@ -394,11 +395,6 @@ static void show_parameters(int snum, int allparameters, unsigned int parm_filte
                                        if (!strcmp(*(char **)ptr,(char *)(parm->def.svalue))) continue;
                                        break;
 
-                               case P_GSTRING:
-                               case P_UGSTRING:
-                                       if (!strcmp((char *)ptr,(char *)(parm->def.svalue))) continue;
-                                       break;
-
                                case P_BOOL:
                                case P_BOOLREV:
                                        if (*(bool *)ptr == (bool)(parm->def.bvalue)) continue;
@@ -437,8 +433,7 @@ static void show_parameters(int snum, int allparameters, unsigned int parm_filte
 ****************************************************************************/
 static bool load_config(bool save_def)
 {
-       lp_resetnumservices();
-       return lp_load(dyn_CONFIGFILE,False,save_def,False,True);
+       return lp_load(get_dyn_CONFIGFILE(),False,save_def,False,True);
 }
 
 /****************************************************************************
@@ -446,11 +441,15 @@ static bool load_config(bool save_def)
 ****************************************************************************/
 static void write_config(FILE *f, bool show_defaults)
 {
+       TALLOC_CTX *ctx = talloc_stackframe();
+
        fprintf(f, "# Samba config file created using SWAT\n");
        fprintf(f, "# from %s (%s)\n", cgi_remote_host(), cgi_remote_addr());
-       fprintf(f, "# Date: %s\n\n", current_timestring(False));
+       fprintf(f, "# Date: %s\n\n", current_timestring(ctx, False));
        
        lp_dump(f, show_defaults, iNumNonAutoPrintServices);
+
+       TALLOC_FREE(ctx);
 }
 
 /****************************************************************************
@@ -461,9 +460,9 @@ static int save_reload(int snum)
        FILE *f;
        struct stat st;
 
-       f = sys_fopen(dyn_CONFIGFILE,"w");
+       f = sys_fopen(get_dyn_CONFIGFILE(),"w");
        if (!f) {
-               printf(_("failed to open %s for writing"), dyn_CONFIGFILE);
+               printf(_("failed to open %s for writing"), get_dyn_CONFIGFILE());
                printf("\n");
                return 0;
        }
@@ -474,19 +473,19 @@ static int save_reload(int snum)
 #if defined HAVE_FCHMOD
                fchmod(fileno(f), S_IWUSR | S_IRUSR | S_IRGRP | S_IROTH);
 #else
-               chmod(dyn_CONFIGFILE, S_IWUSR | S_IRUSR | S_IRGRP | S_IROTH);
+               chmod(get_dyn_CONFIGFILE(), S_IWUSR | S_IRUSR | S_IRGRP | S_IROTH);
 #endif
        }
 
        write_config(f, False);
-       if (snum)
+       if (snum >= 0)
                lp_dump_one(f, False, snum);
        fclose(f);
 
-       lp_killunused(NULL);
+       lp_kill_all_services();
 
        if (!load_config(False)) {
-                printf(_("Can't reload %s"), dyn_CONFIGFILE);
+                printf(_("Can't reload %s"), get_dyn_CONFIGFILE());
                printf("\n");
                 return 0;
         }
@@ -599,7 +598,7 @@ static void ViewModeBoxes(int mode)
 ****************************************************************************/
 static void welcome_page(void)
 {
-       if (file_exist("help/welcome.html", NULL)) {
+       if (file_exist("help/welcome.html")) {
                include_html("help/welcome.html");
        } else {
                include_html("help/welcome-no-samba-doc.html");
@@ -743,12 +742,12 @@ static void wizard_page(void)
 
                        load_config(False);
                        lp_copy_service(GLOBAL_SECTION_SNUM, unix_share);
-                       iNumNonAutoPrintServices = lp_numservices();
                        have_home = lp_servicenumber(HOMES_NAME);
                        lp_do_parameter( have_home, "read only", "No");
                        lp_do_parameter( have_home, "valid users", "%S");
                        lp_do_parameter( have_home, "browseable", "No");
                        commit_parameters(have_home);
+                       save_reload(have_home);
                }
 
                /* Need to Delete Homes share? */
@@ -901,6 +900,7 @@ static void shares_page(void)
        int i;
        int mode = 0;
        unsigned int parm_filter = FLAG_BASIC;
+       size_t converted_size;
 
        if (share)
                snum = lp_servicenumber(share);
@@ -910,6 +910,7 @@ static void shares_page(void)
        if (cgi_variable("Commit") && snum >= 0) {
                commit_parameters(snum);
                save_reload(0);
+               snum = lp_servicenumber(share);
        }
 
        if (cgi_variable("Delete") && snum >= 0) {
@@ -920,11 +921,14 @@ static void shares_page(void)
        }
 
        if (cgi_variable("createshare") && (share=cgi_variable("newshare"))) {
-               load_config(False);
-               lp_copy_service(GLOBAL_SECTION_SNUM, share);
-               iNumNonAutoPrintServices = lp_numservices();
-               save_reload(0);
                snum = lp_servicenumber(share);
+               if (snum < 0) {
+                       load_config(False);
+                       lp_copy_service(GLOBAL_SECTION_SNUM, share);
+                       snum = lp_servicenumber(share);
+                       save_reload(snum);
+                       snum = lp_servicenumber(share);
+               }
        }
 
        printf("<FORM name=\"swatform\" method=post>\n");
@@ -955,12 +959,11 @@ static void shares_page(void)
        for (i=0;i<lp_numservices();i++) {
                s = lp_servicename(i);
                if (s && (*s) && strcmp(s,"IPC$") && !lp_print_ok(i)) {
-                       push_utf8_allocate(&utf8_s, s);
+                       push_utf8_allocate(&utf8_s, s, &converted_size);
                        printf("<option %s value=\"%s\">%s\n", 
                               (share && strcmp(share,s)==0)?"SELECTED":"",
                               utf8_s, utf8_s);
                        SAFE_FREE(utf8_s);
-                       
                }
        }
        printf("</select></td>\n");
@@ -1118,11 +1121,9 @@ static void chg_passwd(void)
        if(cgi_variable(CHG_S_PASSWD_FLAG)) {
                printf("<p>");
                if (rslt == True) {
-                       printf(_(" The passwd for '%s' has been changed."), cgi_variable_nonull(SWAT_USER));
-                       printf("\n");
+                       printf("%s\n", _(" The passwd has been changed."));
                } else {
-                       printf(_(" The passwd for '%s' has NOT been changed."), cgi_variable_nonull(SWAT_USER));
-                       printf("\n");
+                       printf("%s\n", _(" The passwd for has NOT been changed."));
                }
        }
        
@@ -1136,14 +1137,6 @@ static void passwd_page(void)
 {
        const char *new_name = cgi_user_name();
 
-       /* 
-        * After the first time through here be nice. If the user
-        * changed the User box text to another users name, remember it.
-        */
-       if (cgi_variable(SWAT_USER)) {
-               new_name = cgi_variable_nonull(SWAT_USER);
-       } 
-
        if (!new_name) new_name = "";
 
        printf("<H2>%s</H2>\n", _("Server Password Management"));
@@ -1252,8 +1245,8 @@ static void printers_page(void)
         printf("<H2>%s</H2>\n", _("Printer Parameters"));
  
         printf("<H3>%s</H3>\n", _("Important Note:"));
-        printf(_("Printer names marked with [*] in the Choose Printer drop-down box "));
-        printf(_("are autoloaded printers from "));
+        printf("%s",_("Printer names marked with [*] in the Choose Printer drop-down box "));
+        printf("%s",_("are autoloaded printers from "));
         printf("<A HREF=\"/swat/help/smb.conf.5.html#printcapname\" target=\"docs\">%s</A>\n", _("Printcap Name"));
         printf("%s\n", _("Attempting to delete these printers from SWAT will have no effect."));
 
@@ -1263,6 +1256,7 @@ static void printers_page(void)
                    save_reload(snum);
                else
                    save_reload(0);
+               snum = lp_servicenumber(share);
        }
 
        if (cgi_variable("Delete") && snum >= 0) {
@@ -1273,13 +1267,15 @@ static void printers_page(void)
        }
 
        if (cgi_variable("createshare") && (share=cgi_variable("newshare"))) {
-               load_config(False);
-               lp_copy_service(GLOBAL_SECTION_SNUM, share);
-               iNumNonAutoPrintServices = lp_numservices();
-               snum = lp_servicenumber(share);
-               lp_do_parameter(snum, "print ok", "Yes");
-               save_reload(0);
                snum = lp_servicenumber(share);
+               if (snum < 0 || snum >= iNumNonAutoPrintServices) {
+                       load_config(False);
+                       lp_copy_service(GLOBAL_SECTION_SNUM, share);
+                       snum = lp_servicenumber(share);
+                       lp_do_parameter(snum, "print ok", "Yes");
+                       save_reload(snum);
+                       snum = lp_servicenumber(share);
+               }
        }
 
        printf("<FORM name=\"swatform\" method=post>\n");
@@ -1430,23 +1426,23 @@ const char *lang_msg_rotate(TALLOC_CTX *ctx, const char *msgid)
        iNumNonAutoPrintServices = lp_numservices();
        load_printers();
 
-       cgi_setup(dyn_SWATDIR, !demo_mode);
+       cgi_setup(get_dyn_SWATDIR(), !demo_mode);
 
        print_header();
 
        cgi_load_variables();
 
-       if (!file_exist(dyn_CONFIGFILE, NULL)) {
+       if (!file_exist(get_dyn_CONFIGFILE())) {
                have_read_access = True;
                have_write_access = True;
        } else {
                /* check if the authenticated user has write access - if not then
                   don't show write options */
-               have_write_access = (access(dyn_CONFIGFILE,W_OK) == 0);
+               have_write_access = (access(get_dyn_CONFIGFILE(),W_OK) == 0);
 
                /* if the user doesn't have read access to smb.conf then
                   don't let them view it */
-               have_read_access = (access(dyn_CONFIGFILE,R_OK) == 0);
+               have_read_access = (access(get_dyn_CONFIGFILE(),R_OK) == 0);
        }
 
        show_main_buttons();