commit 4c14a2e

Sanitize local user names in the greeting page.

  1@@ -36,7 +36,7 @@ const char *nodeinfo_2_0_template = ""
  2     "\"localPosts\":%d},"
  3     "\"openRegistrations\":false,\"metadata\":{}}";
  4 
  5-d_char *nodeinfo_2_0(void)
  6+xs_str *nodeinfo_2_0(void)
  7 /* builds a nodeinfo json object */
  8 {
  9     xs *users   = user_list();
 10@@ -47,66 +47,75 @@ d_char *nodeinfo_2_0(void)
 11 }
 12 
 13 
 14-int server_get_handler(xs_dict *req, char *q_path,
 15-                       char **body, int *b_size, char **ctype)
 16-/* basic server services */
 17+static xs_str *greeting_html(void)
 18+/* processes and returns greeting.html */
 19 {
 20-    int status = 0;
 21+    /* try to open greeting.html */
 22+    xs *fn = xs_fmt("%s/greeting.html", srv_basedir);
 23+    FILE *f;
 24+    xs_str *s = NULL;
 25 
 26-    (void)req;
 27+    if ((f = fopen(fn, "r")) != NULL) {
 28+        s = xs_readall(f);
 29+        fclose(f);
 30 
 31-    /* is it the server root? */
 32-    if (*q_path == '\0') {
 33-        /* try to open greeting.html */
 34-        xs *fn = xs_fmt("%s/greeting.html", srv_basedir);
 35-        FILE *f;
 36+        /* replace %host% */
 37+        s = xs_replace_i(s, "%host%", xs_dict_get(srv_config, "host"));
 38 
 39-        if ((f = fopen(fn, "r")) != NULL) {
 40-            d_char *s = xs_readall(f);
 41-            fclose(f);
 42+        const char *adm_email = xs_dict_get(srv_config, "admin_email");
 43+        if (xs_is_null(adm_email) || *adm_email == '\0')
 44+            adm_email = "the administrator of this instance";
 45 
 46-            status = 200;
 47+        /* replace %admin_email */
 48+        s = xs_replace_i(s, "%admin_email%", adm_email);
 49 
 50-            /* replace %host% */
 51-            s = xs_replace_i(s, "%host%", xs_dict_get(srv_config, "host"));
 52+        /* does it have a %userlist% mark? */
 53+        if (xs_str_in(s, "%userlist%") != -1) {
 54+            const char *host = xs_dict_get(srv_config, "host");
 55+            xs *list = user_list();
 56+            xs_list *p;
 57+            xs_str *uid;
 58+            xs *ul = xs_str_new("<ul class=\"snac-user-list\">\n");
 59 
 60-            const char *adm_email = xs_dict_get(srv_config, "admin_email");
 61-            if (xs_is_null(adm_email) || *adm_email == '\0')
 62-                adm_email = "the administrator of this instance";
 63+            p = list;
 64+            while (xs_list_iter(&p, &uid)) {
 65+                snac user;
 66 
 67-            /* replace %admin_email */
 68-            s = xs_replace_i(s, "%admin_email%", adm_email);
 69+                if (user_open(&user, uid)) {
 70+                    xs *uname = encode_html(xs_dict_get(user.config, "name"));
 71 
 72-            /* does it have a %userlist% mark? */
 73-            if (xs_str_in(s, "%userlist%") != -1) {
 74-                char *host = xs_dict_get(srv_config, "host");
 75-                xs *list = user_list();
 76-                char *p, *uid;
 77-                xs *ul = xs_str_new("<ul class=\"snac-user-list\">\n");
 78+                    xs *u = xs_fmt(
 79+                        "<li><a href=\"%s\">@%s@%s (%s)</a></li>\n",
 80+                            user.actor, uid, host, uname);
 81 
 82-                p = list;
 83-                while (xs_list_iter(&p, &uid)) {
 84-                    snac snac;
 85+                    ul = xs_str_cat(ul, u);
 86 
 87-                    if (user_open(&snac, uid)) {
 88-                        xs *u = xs_fmt(
 89-                            "<li><a href=\"%s\">@%s@%s (%s)</a></li>\n",
 90-                                snac.actor, uid, host,
 91-                                xs_dict_get(snac.config, "name"));
 92+                    user_free(&user);
 93+                }
 94+            }
 95 
 96-                        ul = xs_str_cat(ul, u);
 97+            ul = xs_str_cat(ul, "</ul>\n");
 98 
 99-                        user_free(&snac);
100-                    }
101-                }
102+            s = xs_replace_i(s, "%userlist%", ul);
103+        }
104+    }
105 
106-                ul = xs_str_cat(ul, "</ul>\n");
107+    return s;
108+}
109 
110-                s = xs_replace_i(s, "%userlist%", ul);
111-            }
112 
113-            *body = s;
114-        }
115+int server_get_handler(xs_dict *req, const char *q_path,
116+                       char **body, int *b_size, char **ctype)
117+/* basic server services */
118+{
119+    int status = 0;
120+
121+    (void)req;
122+
123+    /* is it the server root? */
124+    if (*q_path == '\0') {
125+        if ((*body = greeting_html()) != NULL)
126+            status = 200;
127     }
128     else
129     if (strcmp(q_path, "/susie.png") == 0 || strcmp(q_path, "/favicon.ico") == 0 ) {
130@@ -150,7 +159,7 @@ void httpd_connection(FILE *f)
131     xs *req;
132     char *method;
133     int status   = 0;
134-    d_char *body = NULL;
135+    xs_str *body = NULL;
136     int b_size   = 0;
137     char *ctype  = NULL;
138     xs *headers  = xs_dict_new();

 1@@ -13,7 +13,7 @@
 2 #include <sys/stat.h>
 3 #include <stdlib.h>
 4 
 5-const char *default_srv_config = "{"
 6+static const char *default_srv_config = "{"
 7     "\"host\":                 \"\","
 8     "\"prefix\":               \"\","
 9     "\"address\":              \"127.0.0.1\","
10@@ -30,7 +30,7 @@ const char *default_srv_config = "{"
11     "\"admin_account\":        \"\""
12     "}";
13 
14-const char *default_css =
15+static const char *default_css =
16     "body { max-width: 48em; margin: auto; line-height: 1.5; padding: 0.8em; word-wrap: break-word; }\n"
17     "pre { overflow-x: scroll; }\n"
18     ".snac-embedded-video, img { max-width: 100% }\n"
19@@ -60,7 +60,7 @@ const char *default_css =
20     ".snac-poll-result { margin-left: auto; margin-right: auto; }\n"
21 ;
22 
23-const char *greeting_html =
24+static const char *greeting_html =
25     "<!DOCTYPE html>\n"
26     "<html><head>\n"
27     "<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"/>\n"