s3 swat: Fix possible XSS attack (bug #8289)
[samba.git] / source3 / web / swat.c
index d7e4e722412426001f289f848816b62e710f257d..ac5787bf1fcfb1cc35a3c423cbe50d6277040355 100644 (file)
@@ -7,7 +7,7 @@
    
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
+   the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
    
    This program is distributed in the hope that it will be useful,
@@ -16,8 +16,7 @@
    GNU General Public License for more details.
    
    You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
 /**
 #include "includes.h"
 #include "web/swat_proto.h"
 
-static BOOL demo_mode = False;
-static BOOL passwd_only = False;
-static BOOL have_write_access = False;
-static BOOL have_read_access = False;
+static int demo_mode = False;
+static int passwd_only = False;
+static bool have_write_access = False;
+static bool have_read_access = False;
 static int iNumNonAutoPrintServices = 0;
 
 /*
@@ -52,6 +51,7 @@ static int iNumNonAutoPrintServices = 0;
 #define ENABLE_USER_FLAG "enable_user_flag"
 #define RHOST "remote_host"
 
+#define _(x) lang_msg_rotate(talloc_tos(),x)
 
 /****************************************************************************
 ****************************************************************************/
@@ -77,21 +77,35 @@ static char *fix_backslash(const char *str)
        return newstring;
 }
 
-static char *fix_quotes(const char *str)
+static const char *fix_quotes(TALLOC_CTX *ctx, const char *str)
 {
-       static pstring newstring;
-       char *p = newstring;
-       size_t newstring_len = sizeof(newstring);
+       char *newstring = NULL;
+       char *p = NULL;
+       size_t newstring_len;
        int quote_len = strlen("&quot;");
 
-       while (*str) {
-               if ( *str == '\"' && (newstring_len - PTR_DIFF(p, newstring) - 1) > quote_len ) {
-                       strncpy( p, "&quot;", quote_len); 
-                       p += 6;
+       /* Count the number of quotes. */
+       newstring_len = 1;
+       p = (char *) str;
+       while (*p) {
+               if ( *p == '\"') {
+                       newstring_len += quote_len;
+               } else {
+                       newstring_len++;
+               }
+               ++p;
+       }
+       newstring = TALLOC_ARRAY(ctx, char, newstring_len);
+       if (!newstring) {
+               return "";
+       }
+       for (p = newstring; *str; str++) {
+               if ( *str == '\"') {
+                       strncpy( p, "&quot;", quote_len);
+                       p += quote_len;
                } else {
                        *p++ = *str;
                }
-               ++str;
        }
        *p = '\0';
        return newstring;
@@ -103,7 +117,7 @@ static char *stripspaceupper(const char *str)
        char *p = newstring;
 
        while (*str) {
-               if (*str != ' ') *p++ = toupper(*str);
+               if (*str != ' ') *p++ = toupper_ascii(*str);
                ++str;
        }
        *p = '\0';
@@ -142,7 +156,9 @@ static int include_html(const char *fname)
        }
 
        while ((ret = read(fd, buf, sizeof(buf))) > 0) {
-               write(1, buf, ret);
+               if (write(1, buf, ret) == -1) {
+                       break;
+               }
        }
 
        close(fd);
@@ -180,25 +196,24 @@ static void print_header(void)
    "i18n_translated_parm" class is used to change the color of the
    translated parameter with CSS.
    **************************************************************** */
-static const char* get_parm_translated(
+static const char *get_parm_translated(TALLOC_CTX *ctx,
        const char* pAnchor, const char* pHelp, const char* pLabel)
 {
-       const char* pTranslated = _(pLabel);
-       static pstring output;
-       if(strcmp(pLabel, pTranslated) != 0)
-       {
-               pstr_sprintf(output,
-                 "<A HREF=\"/swat/help/smb.conf.5.html#%s\" target=\"docs\"> %s</A>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; %s <br><span class=\"i18n_translated_parm\">%s</span>",
+       const char *pTranslated = _(pLabel);
+       char *output;
+       if(strcmp(pLabel, pTranslated) != 0) {
+               output = talloc_asprintf(ctx,
+                 "<A HREF=\"/swat/help/manpages/smb.conf.5.html#%s\" target=\"docs\"> %s</A>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; %s <br><span class=\"i18n_translated_parm\">%s</span>",
                   pAnchor, pHelp, pLabel, pTranslated);
                return output;
        }
-       pstr_sprintf(output, 
-         "<A HREF=\"/swat/help/smb.conf.5.html#%s\" target=\"docs\"> %s</A>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; %s",
+       output = talloc_asprintf(ctx,
+         "<A HREF=\"/swat/help/manpages/smb.conf.5.html#%s\" target=\"docs\"> %s</A>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; %s",
          pAnchor, pHelp, pLabel);
        return output;
 }
 /****************************************************************************
- finish off the page 
+ finish off the page
 ****************************************************************************/
 static void print_footer(void)
 {
@@ -208,19 +223,22 @@ static void print_footer(void)
 }
 
 /****************************************************************************
-  display one editable parameter in a form 
+  display one editable parameter in a form
 ****************************************************************************/
 static void show_parameter(int snum, struct parm_struct *parm)
 {
        int i;
        void *ptr = parm->ptr;
        char *utf8_s1, *utf8_s2;
+       size_t converted_size;
+       TALLOC_CTX *ctx = talloc_stackframe();
 
-       if (parm->class == P_LOCAL && snum >= 0) {
-               ptr = lp_local_ptr(snum, ptr);
+       if (parm->p_class == P_LOCAL && snum >= 0) {
+               ptr = lp_local_ptr_by_snum(snum, ptr);
        }
 
-       printf("<tr><td>%s</td><td>", get_parm_translated(stripspaceupper(parm->label), _("Help"), parm->label));
+       printf("<tr><td>%s</td><td>", get_parm_translated(ctx,
+                               stripspaceupper(parm->label), _("Help"), parm->label));
        switch (parm->type) {
        case P_CHAR:
                printf("<input type=text size=2 name=\"parm_%s\" value=\"%c\">",
@@ -237,12 +255,12 @@ static void show_parameter(int snum, struct parm_struct *parm)
                        for (;*list;list++) {
                                /* enclose in HTML encoded quotes if the string contains a space */
                                if ( strchr_m(*list, ' ') ) {
-                                       push_utf8_allocate(&utf8_s1, *list);
-                                       push_utf8_allocate(&utf8_s2, ((*(list+1))?", ":""));
+                                       push_utf8_allocate(&utf8_s1, *list, &converted_size);
+                                       push_utf8_allocate(&utf8_s2, ((*(list+1))?", ":""), &converted_size);
                                        printf("&quot;%s&quot;%s", utf8_s1, utf8_s2);
                                } else {
-                                       push_utf8_allocate(&utf8_s1, *list);
-                                       push_utf8_allocate(&utf8_s2, ((*(list+1))?", ":""));
+                                       push_utf8_allocate(&utf8_s1, *list, &converted_size);
+                                       push_utf8_allocate(&utf8_s2, ((*(list+1))?", ":""), &converted_size);
                                        printf("%s%s", utf8_s1, utf8_s2);
                                }
                                SAFE_FREE(utf8_s1);
@@ -256,7 +274,7 @@ static void show_parameter(int snum, struct parm_struct *parm)
                        char **list = (char **)(parm->def.lvalue);
                        for (; *list; list++) {
                                /* enclose in HTML encoded quotes if the string contains a space */
-                               if ( strchr_m(*list, ' ') ) 
+                               if ( strchr_m(*list, ' ') )
                                        printf("&quot;%s&quot;%s", *list, ((*(list+1))?", ":""));
                                else
                                        printf("%s%s", *list, ((*(list+1))?", ":""));
@@ -267,19 +285,9 @@ static void show_parameter(int snum, struct parm_struct *parm)
 
        case P_STRING:
        case P_USTRING:
-               push_utf8_allocate(&utf8_s1, *(char **)ptr);
+               push_utf8_allocate(&utf8_s1, *(char **)ptr, &converted_size);
                printf("<input type=text size=40 name=\"parm_%s\" value=\"%s\">",
-                      make_parm_name(parm->label), fix_quotes(utf8_s1));
-               SAFE_FREE(utf8_s1);
-               printf("<input type=button value=\"%s\" onClick=\"swatform.parm_%s.value=\'%s\'\">",
-                       _("Set Default"), make_parm_name(parm->label),fix_backslash((char *)(parm->def.svalue)));
-               break;
-
-       case P_GSTRING:
-       case P_UGSTRING:
-               push_utf8_allocate(&utf8_s1, (char *)ptr);
-               printf("<input type=text size=40 name=\"parm_%s\" value=\"%s\">",
-                      make_parm_name(parm->label), fix_quotes(utf8_s1));
+                      make_parm_name(parm->label), fix_quotes(ctx, utf8_s1));
                SAFE_FREE(utf8_s1);
                printf("<input type=button value=\"%s\" onClick=\"swatform.parm_%s.value=\'%s\'\">",
                        _("Set Default"), make_parm_name(parm->label),fix_backslash((char *)(parm->def.svalue)));
@@ -287,20 +295,20 @@ static void show_parameter(int snum, struct parm_struct *parm)
 
        case P_BOOL:
                printf("<select name=\"parm_%s\">",make_parm_name(parm->label)); 
-               printf("<option %s>Yes", (*(BOOL *)ptr)?"selected":"");
-               printf("<option %s>No", (*(BOOL *)ptr)?"":"selected");
+               printf("<option %s>Yes", (*(bool *)ptr)?"selected":"");
+               printf("<option %s>No", (*(bool *)ptr)?"":"selected");
                printf("</select>");
                printf("<input type=button value=\"%s\" onClick=\"swatform.parm_%s.selectedIndex=\'%d\'\">",
-                       _("Set Default"), make_parm_name(parm->label),(BOOL)(parm->def.bvalue)?0:1);
+                       _("Set Default"), make_parm_name(parm->label),(bool)(parm->def.bvalue)?0:1);
                break;
 
        case P_BOOLREV:
                printf("<select name=\"parm_%s\">",make_parm_name(parm->label)); 
-               printf("<option %s>Yes", (*(BOOL *)ptr)?"":"selected");
-               printf("<option %s>No", (*(BOOL *)ptr)?"selected":"");
+               printf("<option %s>Yes", (*(bool *)ptr)?"":"selected");
+               printf("<option %s>No", (*(bool *)ptr)?"selected":"");
                printf("</select>");
                printf("<input type=button value=\"%s\" onClick=\"swatform.parm_%s.selectedIndex=\'%d\'\">",
-                       _("Set Default"), make_parm_name(parm->label),(BOOL)(parm->def.bvalue)?1:0);
+                       _("Set Default"), make_parm_name(parm->label),(bool)(parm->def.bvalue)?1:0);
                break;
 
        case P_INTEGER:
@@ -309,12 +317,19 @@ static void show_parameter(int snum, struct parm_struct *parm)
                        _("Set Default"), make_parm_name(parm->label),(int)(parm->def.ivalue));
                break;
 
-       case P_OCTAL:
-               printf("<input type=text size=8 name=\"parm_%s\" value=%s>", make_parm_name(parm->label), octal_string(*(int *)ptr));
-               printf("<input type=button value=\"%s\" onClick=\"swatform.parm_%s.value=\'%s\'\">",
-                      _("Set Default"), make_parm_name(parm->label),
-                      octal_string((int)(parm->def.ivalue)));
+       case P_OCTAL: {
+               char *o;
+               o = octal_string(*(int *)ptr);
+               printf("<input type=text size=8 name=\"parm_%s\" value=%s>",
+                      make_parm_name(parm->label), o);
+               TALLOC_FREE(o);
+               o = octal_string((int)(parm->def.ivalue));
+               printf("<input type=button value=\"%s\" "
+                      "onClick=\"swatform.parm_%s.value=\'%s\'\">",
+                      _("Set Default"), make_parm_name(parm->label), o);
+               TALLOC_FREE(o);
                break;
+       }
 
        case P_ENUM:
                printf("<select name=\"parm_%s\">",make_parm_name(parm->label)); 
@@ -331,6 +346,7 @@ static void show_parameter(int snum, struct parm_struct *parm)
                break;
        }
        printf("</td></tr>\n");
+       TALLOC_FREE(ctx);
 }
 
 /****************************************************************************
@@ -344,9 +360,9 @@ static void show_parameters(int snum, int allparameters, unsigned int parm_filte
        const char *last_heading = NULL;
 
        while ((parm = lp_next_parameter(snum, &i, allparameters))) {
-               if (snum < 0 && parm->class == P_LOCAL && !(parm->flags & FLAG_GLOBAL))
+               if (snum < 0 && parm->p_class == P_LOCAL && !(parm->flags & FLAG_GLOBAL))
                        continue;
-               if (parm->class == P_SEPARATOR) {
+               if (parm->p_class == P_SEPARATOR) {
                        heading = parm->label;
                        continue;
                }
@@ -360,8 +376,8 @@ static void show_parameters(int snum, int allparameters, unsigned int parm_filte
                        if (!(parm->flags & FLAG_BASIC)) {
                                        void *ptr = parm->ptr;
 
-                               if (parm->class == P_LOCAL && snum >= 0) {
-                                       ptr = lp_local_ptr(snum, ptr);
+                               if (parm->p_class == P_LOCAL && snum >= 0) {
+                                       ptr = lp_local_ptr_by_snum(snum, ptr);
                                }
 
                                switch (parm->type) {
@@ -370,7 +386,8 @@ static void show_parameters(int snum, int allparameters, unsigned int parm_filte
                                        break;
 
                                case P_LIST:
-                                       if (!str_list_compare(*(char ***)ptr, (char **)(parm->def.lvalue))) continue;
+                                       if (!str_list_equal(*(const char ***)ptr, 
+                                                           (const char **)(parm->def.lvalue))) continue;
                                        break;
 
                                case P_STRING:
@@ -378,14 +395,9 @@ static void show_parameters(int snum, int allparameters, unsigned int parm_filte
                                        if (!strcmp(*(char **)ptr,(char *)(parm->def.svalue))) continue;
                                        break;
 
-                               case P_GSTRING:
-                               case P_UGSTRING:
-                                       if (!strcmp((char *)ptr,(char *)(parm->def.svalue))) continue;
-                                       break;
-
                                case P_BOOL:
                                case P_BOOLREV:
-                                       if (*(BOOL *)ptr == (BOOL)(parm->def.bvalue)) continue;
+                                       if (*(bool *)ptr == (bool)(parm->def.bvalue)) continue;
                                        break;
 
                                case P_INTEGER:
@@ -419,22 +431,25 @@ static void show_parameters(int snum, int allparameters, unsigned int parm_filte
 /****************************************************************************
   load the smb.conf file into loadparm.
 ****************************************************************************/
-static BOOL load_config(BOOL save_def)
+static bool load_config(bool save_def)
 {
-       lp_resetnumservices();
-       return lp_load(dyn_CONFIGFILE,False,save_def,False);
+       return lp_load(get_dyn_CONFIGFILE(),False,save_def,False,True);
 }
 
 /****************************************************************************
   write a config file 
 ****************************************************************************/
-static void write_config(FILE *f, BOOL show_defaults)
+static void write_config(FILE *f, bool show_defaults)
 {
+       TALLOC_CTX *ctx = talloc_stackframe();
+
        fprintf(f, "# Samba config file created using SWAT\n");
        fprintf(f, "# from %s (%s)\n", cgi_remote_host(), cgi_remote_addr());
-       fprintf(f, "# Date: %s\n\n", timestring(False));
+       fprintf(f, "# Date: %s\n\n", current_timestring(ctx, False));
        
        lp_dump(f, show_defaults, iNumNonAutoPrintServices);
+
+       TALLOC_FREE(ctx);
 }
 
 /****************************************************************************
@@ -445,9 +460,9 @@ static int save_reload(int snum)
        FILE *f;
        struct stat st;
 
-       f = sys_fopen(dyn_CONFIGFILE,"w");
+       f = sys_fopen(get_dyn_CONFIGFILE(),"w");
        if (!f) {
-               printf(_("failed to open %s for writing"), dyn_CONFIGFILE);
+               printf(_("failed to open %s for writing"), get_dyn_CONFIGFILE());
                printf("\n");
                return 0;
        }
@@ -458,19 +473,19 @@ static int save_reload(int snum)
 #if defined HAVE_FCHMOD
                fchmod(fileno(f), S_IWUSR | S_IRUSR | S_IRGRP | S_IROTH);
 #else
-               chmod(dyn_CONFIGFILE, S_IWUSR | S_IRUSR | S_IRGRP | S_IROTH);
+               chmod(get_dyn_CONFIGFILE(), S_IWUSR | S_IRUSR | S_IRGRP | S_IROTH);
 #endif
        }
 
        write_config(f, False);
-       if (snum)
+       if (snum >= 0)
                lp_dump_one(f, False, snum);
        fclose(f);
 
-       lp_killunused(NULL);
+       lp_kill_all_services();
 
        if (!load_config(False)) {
-                printf(_("Can't reload %s"), dyn_CONFIGFILE);
+                printf(_("Can't reload %s"), get_dyn_CONFIGFILE());
                printf("\n");
                 return 0;
         }
@@ -488,7 +503,7 @@ static void commit_parameter(int snum, struct parm_struct *parm, const char *v)
        int i;
        char *s;
 
-       if (snum < 0 && parm->class == P_LOCAL) {
+       if (snum < 0 && parm->p_class == P_LOCAL) {
                /* this handles the case where we are changing a local
                   variable globally. We need to change the parameter in 
                   all shares where it is currently set to the default */
@@ -510,14 +525,17 @@ static void commit_parameters(int snum)
 {
        int i = 0;
        struct parm_struct *parm;
-       pstring label;
+       char *label;
        const char *v;
 
        while ((parm = lp_next_parameter(snum, &i, 1))) {
-               slprintf(label, sizeof(label)-1, "parm_%s", make_parm_name(parm->label));
-               if ((v = cgi_variable(label))) {
-                       if (parm->flags & FLAG_HIDE) continue;
-                       commit_parameter(snum, parm, v); 
+               if (asprintf(&label, "parm_%s", make_parm_name(parm->label)) > 0) {
+                       if ((v = cgi_variable(label)) != NULL) {
+                               if (parm->flags & FLAG_HIDE)
+                                       continue;
+                               commit_parameter(snum, parm, v);
+                       }
+                       SAFE_FREE(label);
                }
        }
 }
@@ -580,7 +598,11 @@ static void ViewModeBoxes(int mode)
 ****************************************************************************/
 static void welcome_page(void)
 {
-       include_html("help/welcome.html");
+       if (file_exist("help/welcome.html")) {
+               include_html("help/welcome.html");
+       } else {
+               include_html("help/welcome-no-samba-doc.html");
+       }
 }
 
 /****************************************************************************
@@ -674,10 +696,10 @@ static void wizard_page(void)
        }
 
        if (cgi_variable("Commit")){
-               SerType = atoi(cgi_variable("ServerType"));
-               winstype = atoi(cgi_variable("WINSType"));
+               SerType = atoi(cgi_variable_nonull("ServerType"));
+               winstype = atoi(cgi_variable_nonull("WINSType"));
                have_home = lp_servicenumber(HOMES_NAME);
-               HomeExpo = atoi(cgi_variable("HomeExpo"));
+               HomeExpo = atoi(cgi_variable_nonull("HomeExpo"));
 
                /* Plain text passwords are too badly broken - use encrypted passwords only */
                lp_do_parameter( GLOBAL_SECTION_SNUM, "encrypt passwords", "Yes");
@@ -710,23 +732,22 @@ static void wizard_page(void)
                                break;
                        case 2:
                                lp_do_parameter( GLOBAL_SECTION_SNUM, "wins support", "No" );
-                               lp_do_parameter( GLOBAL_SECTION_SNUM, "wins server", cgi_variable("WINSAddr"));
+                               lp_do_parameter( GLOBAL_SECTION_SNUM, "wins server", cgi_variable_nonull("WINSAddr"));
                                break;
                }
 
                /* Have to create Homes share? */
                if ((HomeExpo == 1) && (have_home == -1)) {
-                       pstring unix_share;
-                       
-                       pstrcpy(unix_share,HOMES_NAME);
+                       const char *unix_share = HOMES_NAME;
+
                        load_config(False);
                        lp_copy_service(GLOBAL_SECTION_SNUM, unix_share);
-                       iNumNonAutoPrintServices = lp_numservices();
                        have_home = lp_servicenumber(HOMES_NAME);
                        lp_do_parameter( have_home, "read only", "No");
                        lp_do_parameter( have_home, "valid users", "%S");
                        lp_do_parameter( have_home, "browseable", "No");
                        commit_parameters(have_home);
+                       save_reload(have_home);
                }
 
                /* Need to Delete Homes share? */
@@ -745,7 +766,6 @@ static void wizard_page(void)
                        winstype = 1;
                if (lp_wins_server_list() && strlen(*lp_wins_server_list()))
                        winstype = 2;
-               
 
                /* Do we have a homes share? */
                have_home = lp_servicenumber(HOMES_NAME);
@@ -835,7 +855,7 @@ static void globals_page(void)
        }
 
        if ( cgi_variable("ViewMode") )
-               mode = atoi(cgi_variable("ViewMode"));
+               mode = atoi(cgi_variable_nonull("ViewMode"));
        if ( cgi_variable("BasicMode"))
                mode = 0;
        if ( cgi_variable("AdvMode"))
@@ -880,6 +900,7 @@ static void shares_page(void)
        int i;
        int mode = 0;
        unsigned int parm_filter = FLAG_BASIC;
+       size_t converted_size;
 
        if (share)
                snum = lp_servicenumber(share);
@@ -889,6 +910,7 @@ static void shares_page(void)
        if (cgi_variable("Commit") && snum >= 0) {
                commit_parameters(snum);
                save_reload(0);
+               snum = lp_servicenumber(share);
        }
 
        if (cgi_variable("Delete") && snum >= 0) {
@@ -899,11 +921,14 @@ static void shares_page(void)
        }
 
        if (cgi_variable("createshare") && (share=cgi_variable("newshare"))) {
-               load_config(False);
-               lp_copy_service(GLOBAL_SECTION_SNUM, share);
-               iNumNonAutoPrintServices = lp_numservices();
-               save_reload(0);
                snum = lp_servicenumber(share);
+               if (snum < 0) {
+                       load_config(False);
+                       lp_copy_service(GLOBAL_SECTION_SNUM, share);
+                       snum = lp_servicenumber(share);
+                       save_reload(snum);
+                       snum = lp_servicenumber(share);
+               }
        }
 
        printf("<FORM name=\"swatform\" method=post>\n");
@@ -911,7 +936,7 @@ static void shares_page(void)
        printf("<table>\n");
 
        if ( cgi_variable("ViewMode") )
-               mode = atoi(cgi_variable("ViewMode"));
+               mode = atoi(cgi_variable_nonull("ViewMode"));
        if ( cgi_variable("BasicMode"))
                mode = 0;
        if ( cgi_variable("AdvMode"))
@@ -934,12 +959,11 @@ static void shares_page(void)
        for (i=0;i<lp_numservices();i++) {
                s = lp_servicename(i);
                if (s && (*s) && strcmp(s,"IPC$") && !lp_print_ok(i)) {
-                       push_utf8_allocate(&utf8_s, s);
+                       push_utf8_allocate(&utf8_s, s, &converted_size);
                        printf("<option %s value=\"%s\">%s\n", 
                               (share && strcmp(share,s)==0)?"SELECTED":"",
                               utf8_s, utf8_s);
                        SAFE_FREE(utf8_s);
-                       
                }
        }
        printf("</select></td>\n");
@@ -978,13 +1002,13 @@ static void shares_page(void)
 /*************************************************************
 change a password either locally or remotely
 *************************************************************/
-static BOOL change_password(const char *remote_machine, const char *user_name, 
+static bool change_password(const char *remote_machine, const char *user_name, 
                            const char *old_passwd, const char *new_passwd, 
                                int local_flags)
 {
-       BOOL ret = False;
-       pstring err_str;
-       pstring msg_str;
+       NTSTATUS ret;
+       char *err_str = NULL;
+       char *msg_str = NULL;
 
        if (demo_mode) {
                printf("%s\n<p>", _("password change in demo mode rejected"));
@@ -992,27 +1016,30 @@ static BOOL change_password(const char *remote_machine, const char *user_name,
        }
        
        if (remote_machine != NULL) {
-               ret = remote_password_change(remote_machine, user_name, old_passwd, 
-                                                                        new_passwd, err_str, sizeof(err_str));
-               if(*err_str)
+               ret = remote_password_change(remote_machine, user_name,
+                                            old_passwd, new_passwd, &err_str);
+               if (err_str != NULL)
                        printf("%s\n<p>", err_str);
-               return ret;
+               SAFE_FREE(err_str);
+               return NT_STATUS_IS_OK(ret);
        }
 
-       if(!initialize_password_db(True)) {
+       if(!initialize_password_db(True, NULL)) {
                printf("%s\n<p>", _("Can't setup password database vectors."));
                return False;
        }
        
-       ret = local_password_change(user_name, local_flags, new_passwd, err_str, sizeof(err_str),
-                                        msg_str, sizeof(msg_str));
+       ret = local_password_change(user_name, local_flags, new_passwd,
+                                       &err_str, &msg_str);
 
-       if(*msg_str)
+       if(msg_str)
                printf("%s\n<p>", msg_str);
-       if(*err_str)
+       if(err_str)
                printf("%s\n<p>", err_str);
 
-       return ret;
+       SAFE_FREE(msg_str);
+       SAFE_FREE(err_str);
+       return NT_STATUS_IS_OK(ret);
 }
 
 /****************************************************************************
@@ -1021,11 +1048,11 @@ static BOOL change_password(const char *remote_machine, const char *user_name,
 static void chg_passwd(void)
 {
        const char *host;
-       BOOL rslt;
+       bool rslt;
        int local_flags = 0;
 
        /* Make sure users name has been specified */
-       if (strlen(cgi_variable(SWAT_USER)) == 0) {
+       if (strlen(cgi_variable_nonull(SWAT_USER)) == 0) {
                printf("<p>%s\n", _(" Must specify \"User Name\" "));
                return;
        }
@@ -1040,27 +1067,27 @@ static void chg_passwd(void)
                 * If current user is not root, make sure old password has been specified 
                 * If REMOTE change, even root must provide old password 
                 */
-               if (((!am_root()) && (strlen( cgi_variable(OLD_PSWD)) <= 0)) ||
-                   ((cgi_variable(CHG_R_PASSWD_FLAG)) &&  (strlen( cgi_variable(OLD_PSWD)) <= 0))) {
+               if (((!am_root()) && (strlen( cgi_variable_nonull(OLD_PSWD)) <= 0)) ||
+                   ((cgi_variable(CHG_R_PASSWD_FLAG)) &&  (strlen( cgi_variable_nonull(OLD_PSWD)) <= 0))) {
                        printf("<p>%s\n", _(" Must specify \"Old Password\" "));
                        return;
                }
 
                /* If changing a users password on a remote hosts we have to know what host */
-               if ((cgi_variable(CHG_R_PASSWD_FLAG)) && (strlen( cgi_variable(RHOST)) <= 0)) {
+               if ((cgi_variable(CHG_R_PASSWD_FLAG)) && (strlen( cgi_variable_nonull(RHOST)) <= 0)) {
                        printf("<p>%s\n", _(" Must specify \"Remote Machine\" "));
                        return;
                }
 
                /* Make sure new passwords have been specified */
-               if ((strlen( cgi_variable(NEW_PSWD)) <= 0) ||
-                   (strlen( cgi_variable(NEW2_PSWD)) <= 0)) {
+               if ((strlen( cgi_variable_nonull(NEW_PSWD)) <= 0) ||
+                   (strlen( cgi_variable_nonull(NEW2_PSWD)) <= 0)) {
                        printf("<p>%s\n", _(" Must specify \"New, and Re-typed Passwords\" "));
                        return;
                }
 
                /* Make sure new passwords was typed correctly twice */
-               if (strcmp(cgi_variable(NEW_PSWD), cgi_variable(NEW2_PSWD)) != 0) {
+               if (strcmp(cgi_variable_nonull(NEW_PSWD), cgi_variable_nonull(NEW2_PSWD)) != 0) {
                        printf("<p>%s\n", _(" Re-typed password didn't match new password "));
                        return;
                }
@@ -1087,18 +1114,16 @@ static void chg_passwd(void)
        
 
        rslt = change_password(host,
-                              cgi_variable(SWAT_USER),
-                              cgi_variable(OLD_PSWD), cgi_variable(NEW_PSWD),
+                              cgi_variable_nonull(SWAT_USER),
+                              cgi_variable_nonull(OLD_PSWD), cgi_variable_nonull(NEW_PSWD),
                                   local_flags);
 
        if(cgi_variable(CHG_S_PASSWD_FLAG)) {
                printf("<p>");
                if (rslt == True) {
-                       printf(_(" The passwd for '%s' has been changed."), cgi_variable(SWAT_USER));
-                       printf("\n");
+                       printf("%s\n", _(" The passwd has been changed."));
                } else {
-                       printf(_(" The passwd for '%s' has NOT been changed."), cgi_variable(SWAT_USER));
-                       printf("\n");
+                       printf("%s\n", _(" The passwd for has NOT been changed."));
                }
        }
        
@@ -1112,14 +1137,6 @@ static void passwd_page(void)
 {
        const char *new_name = cgi_user_name();
 
-       /* 
-        * After the first time through here be nice. If the user
-        * changed the User box text to another users name, remember it.
-        */
-       if (cgi_variable(SWAT_USER)) {
-               new_name = cgi_variable(SWAT_USER);
-       } 
-
        if (!new_name) new_name = "";
 
        printf("<H2>%s</H2>\n", _("Server Password Management"));
@@ -1228,8 +1245,8 @@ static void printers_page(void)
         printf("<H2>%s</H2>\n", _("Printer Parameters"));
  
         printf("<H3>%s</H3>\n", _("Important Note:"));
-        printf(_("Printer names marked with [*] in the Choose Printer drop-down box "));
-        printf(_("are autoloaded printers from "));
+        printf("%s",_("Printer names marked with [*] in the Choose Printer drop-down box "));
+        printf("%s",_("are autoloaded printers from "));
         printf("<A HREF=\"/swat/help/smb.conf.5.html#printcapname\" target=\"docs\">%s</A>\n", _("Printcap Name"));
         printf("%s\n", _("Attempting to delete these printers from SWAT will have no effect."));
 
@@ -1239,6 +1256,7 @@ static void printers_page(void)
                    save_reload(snum);
                else
                    save_reload(0);
+               snum = lp_servicenumber(share);
        }
 
        if (cgi_variable("Delete") && snum >= 0) {
@@ -1249,19 +1267,21 @@ static void printers_page(void)
        }
 
        if (cgi_variable("createshare") && (share=cgi_variable("newshare"))) {
-               load_config(False);
-               lp_copy_service(GLOBAL_SECTION_SNUM, share);
-               iNumNonAutoPrintServices = lp_numservices();
-               snum = lp_servicenumber(share);
-               lp_do_parameter(snum, "print ok", "Yes");
-               save_reload(0);
                snum = lp_servicenumber(share);
+               if (snum < 0 || snum >= iNumNonAutoPrintServices) {
+                       load_config(False);
+                       lp_copy_service(GLOBAL_SECTION_SNUM, share);
+                       snum = lp_servicenumber(share);
+                       lp_do_parameter(snum, "print ok", "Yes");
+                       save_reload(snum);
+                       snum = lp_servicenumber(share);
+               }
        }
 
        printf("<FORM name=\"swatform\" method=post>\n");
 
        if ( cgi_variable("ViewMode") )
-               mode = atoi(cgi_variable("ViewMode"));
+               mode = atoi(cgi_variable_nonull("ViewMode"));
         if ( cgi_variable("BasicMode"))
                 mode = 0;
         if ( cgi_variable("AdvMode"))
@@ -1325,22 +1345,48 @@ static void printers_page(void)
        printf("</FORM>\n");
 }
 
+/*
+  when the _() translation macro is used there is no obvious place to free
+  the resulting string and there is no easy way to give a static pointer.
+  All we can do is rotate between some static buffers and hope a single d_printf()
+  doesn't have more calls to _() than the number of buffers
+*/
+
+const char *lang_msg_rotate(TALLOC_CTX *ctx, const char *msgid)
+{
+       const char *msgstr;
+       const char *ret;
+
+       msgstr = lang_msg(msgid);
+       if (!msgstr) {
+               return msgid;
+       }
+
+       ret = talloc_strdup(ctx, msgstr);
+
+       lang_msg_free(msgstr);
+       if (!ret) {
+               return msgid;
+       }
+
+       return ret;
+}
 
 /**
  * main function for SWAT.
  **/
  int main(int argc, char *argv[])
 {
-       int opt;
        const char *page;
        poptContext pc;
        struct poptOption long_options[] = {
                POPT_AUTOHELP
                { "disable-authentication", 'a', POPT_ARG_VAL, &demo_mode, True, "Disable authentication (demo mode)" },
-        { "password-menu-only", 'P', POPT_ARG_VAL, &passwd_only, True, "Show only change password menu" }, 
+               { "password-menu-only", 'P', POPT_ARG_VAL, &passwd_only, True, "Show only change password menu" }, 
                POPT_COMMON_SAMBA
                POPT_TABLEEND
        };
+       TALLOC_CTX *frame = talloc_stackframe();
 
        fault_setup(NULL);
        umask(S_IWGRP | S_IWOTH);
@@ -1368,32 +1414,35 @@ static void printers_page(void)
 
        /* Parse command line options */
 
-       while((opt = poptGetNextOpt(pc)) != -1) { }
+       while(poptGetNextOpt(pc) != -1) { }
 
        poptFreeContext(pc);
 
+       load_case_tables();
+
        setup_logging(argv[0],False);
        load_config(True);
+       load_interfaces();
        iNumNonAutoPrintServices = lp_numservices();
        load_printers();
 
-       cgi_setup(dyn_SWATDIR, !demo_mode);
+       cgi_setup(get_dyn_SWATDIR(), !demo_mode);
 
        print_header();
 
        cgi_load_variables();
 
-       if (!file_exist(dyn_CONFIGFILE, NULL)) {
+       if (!file_exist(get_dyn_CONFIGFILE())) {
                have_read_access = True;
                have_write_access = True;
        } else {
                /* check if the authenticated user has write access - if not then
                   don't show write options */
-               have_write_access = (access(dyn_CONFIGFILE,W_OK) == 0);
+               have_write_access = (access(get_dyn_CONFIGFILE(),W_OK) == 0);
 
                /* if the user doesn't have read access to smb.conf then
                   don't let them view it */
-               have_read_access = (access(dyn_CONFIGFILE,R_OK) == 0);
+               have_read_access = (access(get_dyn_CONFIGFILE(),R_OK) == 0);
        }
 
        show_main_buttons();
@@ -1424,6 +1473,8 @@ static void printers_page(void)
        }
 
        print_footer();
+
+       TALLOC_FREE(frame);
        return 0;
 }