sm-discuss AT lists.ibiblio.org
Subject: Public SourceMage Discussion List
List archive
- From: Seth Alan Woolley <seth AT positivism.org>
- To: Duane Malcolm <d.malcolm AT auckland.ac.nz>
- Cc: sm-discuss <sm-discuss AT lists.ibiblio.org>
- Subject: Re: [SM-Discuss] php gaze script
- Date: Tue, 11 Jan 2005 17:01:05 -0800
I would block out '..' and '/' strings from the spell and grimoire data
input, although since you test for DETAILS, there's not much of a
security risk present as it is. Preferably this class: [-+._a-zA-Z0-9]
is all we allow in spell and section names, but note that '..' together
is bad.
We could remove '.' from the allowed characters were it not for
automake-1.{7,8}, init.d, gst-plugins-0.6, mixer.app, and xfree86-4.3.
I also don't see where spell_path and other stuff are set. Is that what
we're supposed to set ourselves?
Seth
On Wed, Jan 12, 2005 at 12:52:53PM +1300, Duane Malcolm wrote:
> Hi,
>
> I've written a gaze.php script to allow some gaze functionality on the
> sourcemage website. This script will allow:
> 1. quick reference to a spell summary
> 2. basic spell searching
> 3. robust links from other websites, e.g., if xmms-weasel was to link to
> sourcemage to acknowledge our support of their package. This method
> would be robust because the link is independent from what grimoire and
> section the spell is stored in and the file system.
> 4. Sourcemage can then get more exposure.
>
> This script is very developmental and I don't have much time to further
> develop it. However, with your help we can get it to a pretty good state.
>
> You can help by reviewing my script and suggesting improvements,
> problems, and security issues.
>
> I have attached the gaze.php.
>
> Below are some examples of the script working:
> [0]
> http://www.bioeng.auckland.ac.nz/people/malcolm/smgl/gaze.php?spell=j2sdk-bin&grimoire=z-rejected
> [1]
> http://www.bioeng.auckland.ac.nz/people/malcolm/smgl/gaze.php?spell=octave&grimoire=z-rejected
> [2]
> http://www.bioeng.auckland.ac.nz/people/malcolm/smgl/gaze.php?spell=xmms-weasel
> [3] http://www.bioeng.auckland.ac.nz/people/malcolm/smgl/gaze.php?spell=blah
>
> Cheers, Duane.
> Spell Details Summary:
>
> \n"; if(file_exists("$spell_path/DETAILS")) { $lines = file("$spell_path/
> DETAILS"); foreach ($lines as $line_num => $line) { if
> (preg_match("/SPELL=/",
> $line)){ echo "
>
> $line
>
> "; } if (preg_match("/VERSION=/", $line)){ echo "
>
> $line
>
> "; } if (preg_match("/WEB_SITE=/", $line)){ echo "
>
> $line
>
> "; } if (preg_match("/LICENSE/", $line)){ echo "
>
> $line
>
> "; } if (preg_match("/MAINTAINER/", $line)){ echo "
>
> $line
>
> "; } if (preg_match("/SHORT=/", $line)){ echo "
>
> $line
>
> "; } } }else{ echo "
>
> This spell has no details file, that's very perculiar.
>
> \n"; } return 1; } ?> Spell Dependancies:
>
> \n"; if(file_exists("$spell_path/DEPENDS")) { $lines = file("$spell_path/
> DEPENDS"); echo "
>
> \n";
> foreach ($lines as $line_num => $line) {
> echo "$line";
> }
> echo "
>
> "; }else{ echo "
>
> This spell has no dependancies.
>
> \n"; } return 1; } ?> Spell Scripts:
>
> \n"; echo "
>
> \n"; $handle1 = opendir("$spell_path"); while (false !== ($filename1 =
> readdir
> ($handle1))) { if (is_file("$spell_path/$filename1")) { echo "$filename1
> "; } } echo "
>
> "; return 1; } ?> Spell History:
>
> \n"; echo "
>
> \n";
> $lines = file("$spell_path/HISTORY");
>
> foreach ($lines as $line_num => $line) {
> echo "$line";
> }
>
> echo "
>
> "; return 1; } ?> Spell not found in $sent_grimoire grimoire but found at
> $grimoire/$spell.
>
> "; // If spell is not found in any grimoire }else{ echo "Spell not found -
> Contact your nearest guru"; } ?>
> _______________________________________________
> SM-Discuss mailing list
> SM-Discuss AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-discuss
--
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Key id EF10E21A = 36AD 8A92 8499 8439 E6A8 3724 D437 AF5D EF10 E21A
http://smgl.positivism.org:11371/pks/lookup?op=get&search=0xEF10E21A
Security Team Leader Source Mage GNU/Linux http://www.sourcemage.org
Attachment:
pgp5hlG1Jp3TL.pgp
Description: PGP signature
-
[SM-Discuss] php gaze script,
Duane Malcolm, 01/11/2005
-
Re: [SM-Discuss] php gaze script,
David Kowis, 01/11/2005
-
Re: [SM-Discuss] php gaze script,
Duane Malcolm, 01/11/2005
-
Re: [SM-Discuss] php gaze script,
David Kowis, 01/11/2005
- Re: [SM-Discuss] php gaze script, Duane Malcolm, 01/11/2005
-
Re: [SM-Discuss] php gaze script,
Duane Malcolm, 01/11/2005
- Re: [SM-Discuss] php gaze script, David Kowis, 01/11/2005
-
Re: [SM-Discuss] php gaze script,
David Kowis, 01/11/2005
-
Re: [SM-Discuss] php gaze script,
Duane Malcolm, 01/11/2005
- Re: [SM-Discuss] php gaze script, Seth Alan Woolley, 01/11/2005
- <Possible follow-up(s)>
-
Re: [SM-Discuss] php gaze script,
jason AT flattfamily.com, 01/11/2005
- RE: [SM-Discuss] php gaze script, David Kowis, 01/11/2005
- RE: [SM-Discuss] php gaze script, jason AT flattfamily.com, 01/12/2005
-
Re: [SM-Discuss] php gaze script,
David Kowis, 01/11/2005
Archive powered by MHonArc 2.6.24.