From 77e0acc0d3401860baa8663d6fe555528b492d72 Mon Sep 17 00:00:00 2001
From: Fumitoshi UKAI <ukai@debian.or.jp>
Date: Tue, 26 Nov 2002 18:03:18 +0000
Subject: use local_cookie for support local-cgi commands * file.c
 (loadGeneralFile): pass Local_cookie to DirBufferCommand * fm.h
 (Local_cookie): Str * local.c (setLocalCookie): Str, set_environ() 
 (set_cgi_environ): remove LOCAL_COOKIE * main.c (ldhelp): pass Local_cookie 
 (adBmark): ditto * rc.c (optionpanel_src1): cookie 	(load_option_panel):
 pass Local_cookie * w3mbookmark.c (main): check Local_cookie * w3mhelperpanel
 (main): ditto * scripts/dirlist.cgi.in: ditto * scripts/w3mhelp.cgi.in: ditto
 * scripts/multipart/multipart.cgi.in: ditto From: Hironori SAKAMOTO
 <hsaka@mth.biglobe.ne.jp>

---
 scripts/multipart/multipart.cgi.in | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

(limited to 'scripts/multipart')

diff --git a/scripts/multipart/multipart.cgi.in b/scripts/multipart/multipart.cgi.in
index 1c92d70..d51a521 100644
--- a/scripts/multipart/multipart.cgi.in
+++ b/scripts/multipart/multipart.cgi.in
@@ -28,11 +28,21 @@ if (defined($query)) {
 	}
 	$file = &form_decode($v{'file'});
 	$boundary = &form_decode($v{'boundary'});
+	$cookie = &form_decode($v{'cookie'});
+	if (($cookie eq "") || ($cookie ne $ENV{"LOCAL_COOKIE"})) {
+		print <<EOF;
+Content-Type: text/plain
+
+Local cookie doesn't match: It may be an illegal execution
+EOF
+		exit(1);
+	}
 } else {
 	$file = $ARGV[0];
 	if (@ARGV >= 2) {
 		$boundary = $ARGV[1];
 	}
+	$cookie = $ENV{'LOCAL_COOKIE'};
 }
 
 open(F, "< $file");
@@ -121,6 +131,7 @@ if (defined($v{'count'})) {
 $qcgi = &html_quote($CGI);
 $qfile = &html_quote($file);
 $qboundary = &html_quote($boundary);
+$qcookie = &html_quote($cookie);
 
 if ($mbody =~ /\S/) {
 	$_ = $mbody;
@@ -195,9 +206,10 @@ while(! $end) {
 		print "<form method=POST action=\"$qcgi?$count\">\n";
 		print "<input type=hidden name=file value=\"$qfile\">\n";
 		print "<input type=hidden name=boundary value=\"$qboundary\">\n";
+		print "<input type=hidden name=cookie value=\"$qcookie\">\n";
 		print "<input type=hidden name=count value=\"$count\">\n";
 		if ($image) {
-			print "<input type=image name=submit src=\"$CGI?file=$qfile&amp;boundary=$qboundary&amp;count=$count\" alt=\"",
+			print "<input type=image name=submit src=\"$CGI?file=$qfile&amp;boundary=$qboundary&amp;cookie=$qcookie&amp;count=$count\" alt=\"",
 				&html_quote($name), "\">\n";
 		} else {
 			print "<input type=submit name=submit value=\"",
-- 
cgit v1.2.3