Changeset 1201


Ignore:
Timestamp:
12/07/08 17:13:55 (3 years ago)
Author:
KennethLavrsen
Message:

Item375: Eliminate use of URLPARAM in docs so it becomes an XSS trap
Done with the System web topics now

Location:
trunk
Files:
4 edited

Legend:

Unmodified
Added
Removed

  • trunk/RevCommentPlugin/data/System/WebRssBaseWC.txt

    r1105 r1201  
    5050  <items> 
    5151    <rdf:Seq> 
    52 %SEARCH{"%URLPARAM{"search" default=".*" }%" web="%URLPARAM{"web" default="%INCLUDINGWEB%" }%" excludetopic="%URLPARAM{"excludetopic" default="WebStatistics" }%" type="%URLPARAM{"type" default="regex" }%" nosearch="on" order="modified" reverse="on" nototal="on" limit="%URLPARAM{"limit" default="16" }%" scope="%URLPARAM{"scope" default="text" }%" casesensitive="%URLPARAM{"casesensitive" default="on" }%" date="%URLPARAM{"date" default="" }%" format="<item rdf:about=\"%SCRIPTURL{"view"}%/$web/$topic\">$n  <title>$topic</title>$n  <link>%SCRIPTURL{"view"}%/$web/$topic</link>$n <description>%REVCOMMENT[rev=''$rev'' web=''$web'' topic=''$topic'' pre=''ChangeLog: '' delimiter='' -- '' post='''']%</description>$n  <dc:date>$isodate</dc:date>$n  <dc:contributor>$n    <rdf:Description link=\"%SCRIPTURL{"view"}%?topic=$wikiusername\">$n      <rdf:value>$username</rdf:value>$n    </rdf:Description>$n  </dc:contributor>$n</item>"}% 
     52%SEARCH{"%URLPARAM{"search" encode="quote" default=".*" }%" web="%URLPARAM{"web" encode="quote" default="%INCLUDINGWEB%" }%" excludetopic="%URLPARAM{"excludetopic" encode="quote" default="WebStatistics" }%" type="%URLPARAM{"type" encode="quote" default="regex" }%" nosearch="on" order="modified" reverse="on" nototal="on" limit="%URLPARAM{"limit" encode="quote" default="16" }%" scope="%URLPARAM{"scope" encode="quote" default="text" }%" casesensitive="%URLPARAM{"casesensitive" encode="quote" default="on" }%" date="%URLPARAM{"date" encode="quote" default="" }%" format="<item rdf:about=\"%SCRIPTURL{"view"}%/$web/$topic\">$n  <title>$topic</title>$n  <link>%SCRIPTURL{"view"}%/$web/$topic</link>$n <description>%REVCOMMENT[rev=''$rev'' web=''$web'' topic=''$topic'' pre=''ChangeLog: '' delimiter='' -- '' post='''']%</description>$n  <dc:date>$isodate</dc:date>$n  <dc:contributor>$n    <rdf:Description link=\"%SCRIPTURL{"view"}%?topic=$wikiusername\">$n      <rdf:value>$username</rdf:value>$n    </rdf:Description>$n  </dc:contributor>$n</item>"}% 
    5353    </rdf:Seq> 
    5454  </items> 
    … …  
    5959  <url>%WIKILOGOIMG%</url> 
    6060</image> 
    61 %SEARCH{"%URLPARAM{"search" default=".*" }%" web="%URLPARAM{"web" default="%INCLUDINGWEB%" }%" excludetopic="%URLPARAM{"excludetopic" default="WebStatistics" }%" type="%URLPARAM{"type" default="regex" }%" nosearch="on" order="modified" reverse="on" nototal="on" limit="%URLPARAM{"limit" default="16" }%" scope="%URLPARAM{"scope" default="text" }%" casesensitive="%URLPARAM{"casesensitive" default="on" }%" date="%URLPARAM{"date" default="" }%" format="<item rdf:about=\"%SCRIPTURL{"view"}%/$web/$topic\">$n  <title>$topic</title>$n  <link>%SCRIPTURL{"view"}%/$web/$topic</link>$n  <description>$summary (last changed by <nop>$wikiname)</description>$n  <dc:date>$isodate</dc:date>$n  <dc:contributor>$n    <rdf:Description link=\"%SCRIPTURL{"view"}%?topic=$wikiusername\">$n      <rdf:value>$username</rdf:value>$n    </rdf:Description>$n  </dc:contributor>$n</item>"}% 
     61%SEARCH{"%URLPARAM{"search" default=".*" }%" web="%URLPARAM{"web" encode="quote" default="%INCLUDINGWEB%" }%" excludetopic="%URLPARAM{"excludetopic" encode="quote" default="WebStatistics" }%" type="%URLPARAM{"type" encode="quote" default="regex" }%" nosearch="on" order="modified" reverse="on" nototal="on" limit="%URLPARAM{"limit" encode="quote" default="16" }%" scope="%URLPARAM{"scope" encode="quote" default="text" }%" casesensitive="%URLPARAM{"casesensitive" encode="quote" default="on" }%" date="%URLPARAM{"date" encode="quote" default="" }%" format="<item rdf:about=\"%SCRIPTURL{"view"}%/$web/$topic\">$n  <title>$topic</title>$n  <link>%SCRIPTURL{"view"}%/$web/$topic</link>$n  <description>$summary (last changed by <nop>$wikiname)</description>$n  <dc:date>$isodate</dc:date>$n  <dc:contributor>$n    <rdf:Description link=\"%SCRIPTURL{"view"}%?topic=$wikiusername\">$n      <rdf:value>$username</rdf:value>$n    </rdf:Description>$n  </dc:contributor>$n</item>"}% 
    6262%STOPINCLUDE% 
    6363</verbatim> 

  • trunk/TipsContrib/data/System/TipsTopics.txt

    r1074 r1201  
    77Search (perl regular expression): <input name="searchfor" type="text" value="%URLPARAM{"searchfor" default="Enter search keywords here"}%" size="100" /> 
    88</form> 
    9 %SEARCH{ "%URLPARAM{"searchfor" default="search results go here"}%" topic="*TipTopic*" type="keyword" web="%SYSTEMWEB%, %MAINWEB%" format="     * [[$web.$topic][$pattern(.*?\-\-\-\+([^\n\r]+).*)]]:$n()       $summary(noheader, 100)$n()$percntCALC{$SETM(total, +1)}$percnt"}% 
     9%SEARCH{ "%URLPARAM{"searchfor" encode="quote" default="search results go here"}%" topic="*TipTopic*" type="keyword" web="%SYSTEMWEB%, %USERSWEB%" format="     * [[$web.$topic][$pattern(.*?\-\-\-\+([^\n\r]+).*)]]:$n()       $summary(noheader, 100)$n()$percntCALC{$SETM(total, +1)}$percnt"}% 
    1010 
    1111Total: %CALC{$GET(total)}% tips 

  • trunk/core/data/System/SiteChanges.txt

    r482 r1201  
    88nosearch="on"  
    99nototal="on"  
    10 limit="%URLPARAM{"limit" default="25"}%"  
    11 web="%URLPARAM{"web" default="all"}%"  
     10limit="%URLPARAM{"limit" encode="quote" default="25"}%"  
     11web="%URLPARAM{"web" encode="quote" default="all"}%"  
    1212excludetopic="WebStatistics"  
    1313reverse="on" 

  • trunk/core/data/System/WebCreateNewTopicTemplate.txt

    r1022 r1201  
    5252 
    5353 
    54 %TMPL:DEF{"topicname"}%<input type="text" class="twikiInputField" name="topic" id="topic" size="40" %IF{"'%PREFILLTOPIC%'='1'" then="value=\"%BASETOPIC%\""}% %IF{"'%URLPARAM{"newtopic"}%'" then="value=\"%URLPARAM{"newtopic"}%\""}% />%TMPL:END% 
     54%TMPL:DEF{"topicname"}%<input type="text" class="twikiInputField" name="topic" id="topic" size="40" %IF{"'%PREFILLTOPIC%'='1'" then="value=\"%BASETOPIC%\""}% %IF{"'%URLPARAM{"newtopic" encode="quote"}%'" then="value=\"%URLPARAM{"newtopic"}%\""}% />%TMPL:END% 
    5555 
    5656 
    5757%TMPL:DEF{"topicparent"}%%IF{"defined pickparent" then="<select name='topicparent' size='10' class='twikiSelect'>$percntTOPICLIST{$quot<option $marker value='$name'>$name</option>$quot marker=$quotselected$quot separator=$quot$quot selection=$quot$percntURLPARAM{ $quottopicparent$quot default=$quot%MAKETEXT{"(no parent, orphaned topic)"}%$quot }$percnt$quot}$percnt<option value=$quot$quot>$percntMAKETEXT{$quot(no parent, orphaned topic)$quot}$percnt</option></select>" else="<input type='text' size='40' name='topicparent' class='twikiInputField' value='%URLPARAM{topicparent}%' />&nbsp;<a id='pickparent' href='$percntSCRIPTURLPATH{view}$percnt/$percntBASEWEB$percnt/$percntBASETOPIC$percnt?$percntQUERYSTRING$percnt;pickparent=1'>%MAKETEXT{"Pick from a list"}%</a>"}%%TMPL:END% 
    5858 
    59 %TMPL:DEF{"topictemplate"}%<select name="templatetopic" class="twikiSelect">%IF{"'%URLPARAM{"templatetopic"}%'" then='<option selected="selected">%URLPARAM{"templatetopic"}%</option>'}%<option value="">%MAKETEXT{"Default template"}%</option>%SEARCH{"name~'*Template'" scope="topic" excludetopic="WebTopicEditTemplate,WebCreateNewTopicTemplate,*ViewTemplate" type="query" nonoise="on" format="<option>$topic</option>"}%</select> <a id="viewtemplates" href="%SCRIPTURL{view}%/%SYSTEMWEB%/WebTemplateTopics?web=%BASEWEB%">%MAKETEXT{"View templates"}%</a> %TMPL:END% 
     59%TMPL:DEF{"topictemplate"}%<select name="templatetopic" class="twikiSelect">%IF{"'%URLPARAM{"templatetopic" encode="quote"}%'" then='<option selected="selected">%URLPARAM{"templatetopic"}%</option>'}%<option value="">%MAKETEXT{"Default template"}%</option>%SEARCH{"name~'*Template'" scope="topic" excludetopic="WebTopicEditTemplate,WebCreateNewTopicTemplate,*ViewTemplate" type="query" nonoise="on" format="<option>$topic</option>"}%</select> <a id="viewtemplates" href="%SCRIPTURL{view}%/%SYSTEMWEB%/WebTemplateTopics?web=%BASEWEB%">%MAKETEXT{"View templates"}%</a> %TMPL:END% 
    6060 
    6161%TMPL:DEF{"submit"}%<input id="submit" type="submit" class="twikiSubmit" value='%MAKETEXT{"Create this topic"}%' />%TMPL:END% 
Note: See TracChangeset for help on using the changeset viewer.