Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] php gaze script

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Seth Alan Woolley <seth AT positivism.org>
  • To: Duane Malcolm <d.malcolm AT auckland.ac.nz>
  • Cc: sm-discuss <sm-discuss AT lists.ibiblio.org>
  • Subject: Re: [SM-Discuss] php gaze script
  • Date: Tue, 11 Jan 2005 17:01:05 -0800

I would block out '..' and '/' strings from the spell and grimoire data
input, although since you test for DETAILS, there's not much of a
security risk present as it is. Preferably this class: [-+._a-zA-Z0-9]
is all we allow in spell and section names, but note that '..' together
is bad.

We could remove '.' from the allowed characters were it not for
automake-1.{7,8}, init.d, gst-plugins-0.6, mixer.app, and xfree86-4.3.

I also don't see where spell_path and other stuff are set. Is that what
we're supposed to set ourselves?

Seth

On Wed, Jan 12, 2005 at 12:52:53PM +1300, Duane Malcolm wrote:
> Hi,
>
> I've written a gaze.php script to allow some gaze functionality on the
> sourcemage website. This script will allow:
> 1. quick reference to a spell summary
> 2. basic spell searching
> 3. robust links from other websites, e.g., if xmms-weasel was to link to
> sourcemage to acknowledge our support of their package. This method
> would be robust because the link is independent from what grimoire and
> section the spell is stored in and the file system.
> 4. Sourcemage can then get more exposure.
>
> This script is very developmental and I don't have much time to further
> develop it. However, with your help we can get it to a pretty good state.
>
> You can help by reviewing my script and suggesting improvements,
> problems, and security issues.
>
> I have attached the gaze.php.
>
> Below are some examples of the script working:
> [0]
> http://www.bioeng.auckland.ac.nz/people/malcolm/smgl/gaze.php?spell=j2sdk-bin&grimoire=z-rejected
> [1]
> http://www.bioeng.auckland.ac.nz/people/malcolm/smgl/gaze.php?spell=octave&grimoire=z-rejected
> [2]
> http://www.bioeng.auckland.ac.nz/people/malcolm/smgl/gaze.php?spell=xmms-weasel
> [3] http://www.bioeng.auckland.ac.nz/people/malcolm/smgl/gaze.php?spell=blah
>
> Cheers, Duane.

> Spell Details Summary:
>
> \n"; if(file_exists("$spell_path/DETAILS")) { $lines = file("$spell_path/
> DETAILS"); foreach ($lines as $line_num => $line) { if
> (preg_match("/SPELL=/",
> $line)){ echo "
>
> $line
>
> "; } if (preg_match("/VERSION=/", $line)){ echo "
>
> $line
>
> "; } if (preg_match("/WEB_SITE=/", $line)){ echo "
>
> $line
>
> "; } if (preg_match("/LICENSE/", $line)){ echo "
>
> $line
>
> "; } if (preg_match("/MAINTAINER/", $line)){ echo "
>
> $line
>
> "; } if (preg_match("/SHORT=/", $line)){ echo "
>
> $line
>
> "; } } }else{ echo "
>
> This spell has no details file, that's very perculiar.
>
> \n"; } return 1; } ?> Spell Dependancies:
>
> \n"; if(file_exists("$spell_path/DEPENDS")) { $lines = file("$spell_path/
> DEPENDS"); echo "
>
> \n";
> foreach ($lines as $line_num => $line) {
> echo "$line";
> }
> echo "
>
> "; }else{ echo "
>
> This spell has no dependancies.
>
> \n"; } return 1; } ?> Spell Scripts:
>
> \n"; echo "
>
> \n"; $handle1 = opendir("$spell_path"); while (false !== ($filename1 =
> readdir
> ($handle1))) { if (is_file("$spell_path/$filename1")) { echo "$filename1
> "; } } echo "
>
> "; return 1; } ?> Spell History:
>
> \n"; echo "
>
> \n";
> $lines = file("$spell_path/HISTORY");
>
> foreach ($lines as $line_num => $line) {
> echo "$line";
> }
>
> echo "
>
> "; return 1; } ?> Spell not found in $sent_grimoire grimoire but found at
> $grimoire/$spell.
>
> "; // If spell is not found in any grimoire }else{ echo "Spell not found -
> Contact your nearest guru"; } ?>

> _______________________________________________
> SM-Discuss mailing list
> SM-Discuss AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-discuss


--
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Key id EF10E21A = 36AD 8A92 8499 8439 E6A8 3724 D437 AF5D EF10 E21A
http://smgl.positivism.org:11371/pks/lookup?op=get&search=0xEF10E21A
Security Team Leader Source Mage GNU/Linux http://www.sourcemage.org

Attachment: pgp5hlG1Jp3TL.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page