Mercurial > hg > rlgallery-misc
comparison web/archive.cgi @ 49:6138c27d1950
Escape the player's name when printing it into HTML.
Non-alphanumeric characters in names may eventually be possible.
author | John "Elwin" Edwards |
---|---|
date | Mon, 24 Mar 2014 16:01:28 -0700 |
parents | 86b616d88020 |
children |
comparison
equal
deleted
inserted
replaced
48:955c2fd68dcf | 49:6138c27d1950 |
---|---|
5 import sys | 5 import sys |
6 import time | 6 import time |
7 import calendar | 7 import calendar |
8 from datetime import datetime | 8 from datetime import datetime |
9 import pytz | 9 import pytz |
10 import html | |
10 import rlgall | 11 import rlgall |
11 #import cgitb | 12 #import cgitb |
12 | 13 |
13 #cgitb.enable() | 14 #cgitb.enable() |
14 | 15 |
34 return | 35 return |
35 | 36 |
36 def input_name(outf, defaultval=None): | 37 def input_name(outf, defaultval=None): |
37 defstr = '<div>Adventurer\'s name: <input type="text" name="name" value="{0}"></div>\n' | 38 defstr = '<div>Adventurer\'s name: <input type="text" name="name" value="{0}"></div>\n' |
38 if defaultval: | 39 if defaultval: |
39 outf.write(defstr.format(defaultval)) | 40 outf.write(defstr.format(html.escape(defaultval))) |
40 else: | 41 else: |
41 outf.write('<div>Adventurer\'s Name: <input type="text" name="name"></div>\n') | 42 outf.write('<div>Adventurer\'s Name: <input type="text" name="name"></div>\n') |
42 return | 43 return |
43 | 44 |
44 def input_time(outf, defaultval=None): | 45 def input_time(outf, defaultval=None): |
122 # digging all over the filesystem. | 123 # digging all over the filesystem. |
123 formname = fdata.getfirst("name").rpartition("/")[2] | 124 formname = fdata.getfirst("name").rpartition("/")[2] |
124 try: | 125 try: |
125 os.stat(ttyrecbase + formname) | 126 os.stat(ttyrecbase + formname) |
126 except OSError: | 127 except OSError: |
127 errlist.append(cantfind.format(cgi.escape(formname))) | 128 errlist.append(cantfind.format(html.escape(formname))) |
128 return None | 129 return None |
129 return formname | 130 return formname |
130 | 131 |
131 def processgame(fdata, errlist): | 132 def processgame(fdata, errlist): |
132 "Takes a CGI data object and returns the game from rlgall.gamelist that \ | 133 "Takes a CGI data object and returns the game from rlgall.gamelist that \ |
137 return None | 138 return None |
138 formgame = fdata.getfirst("game") | 139 formgame = fdata.getfirst("game") |
139 for agame in rlgall.gamelist: | 140 for agame in rlgall.gamelist: |
140 if agame.uname == formgame: | 141 if agame.uname == formgame: |
141 return agame | 142 return agame |
142 errlist.append(cantfind.format(cgi.escape(formgame))) | 143 errlist.append(cantfind.format(html.escape(formgame))) |
143 return None | 144 return None |
144 | 145 |
145 def processtime(fdata, errlist, hlist): | 146 def processtime(fdata, errlist, hlist): |
146 "Takes a CGI data object and converts to a datetime object by finding \ | 147 "Takes a CGI data object and converts to a datetime object by finding \ |
147 fields called year, month, etc. Any errors get appended to errlist. \ | 148 fields called year, month, etc. Any errors get appended to errlist. \ |
154 formtime = fdata.getfirst("time") | 155 formtime = fdata.getfirst("time") |
155 if formtime: | 156 if formtime: |
156 try: | 157 try: |
157 utime = int(formtime) | 158 utime = int(formtime) |
158 except ValueError: | 159 except ValueError: |
159 errlist.append(badtime.format(cgi.escape(formtime))) | 160 errlist.append(badtime.format(html.escape(formtime))) |
160 return None | 161 return None |
161 else: | 162 else: |
162 if utime < 0: | 163 if utime < 0: |
163 utime = 0 | 164 utime = 0 |
164 if utime != None: | 165 if utime != None: |
259 else: | 260 else: |
260 hlist[5] = second | 261 hlist[5] = second |
261 if lerrors: | 262 if lerrors: |
262 errlist.extend(lerrors) | 263 errlist.extend(lerrors) |
263 return None | 264 return None |
264 #return calendar.timegm([year, month, day, hour, minute, second, 0, 0, 0]) | |
265 return datetime(year, month, day, hour, minute, second, 0, pytz.utc) | 265 return datetime(year, month, day, hour, minute, second, 0, pytz.utc) |
266 | 266 |
267 # Begin processing | 267 # Begin processing |
268 fdata = cgi.FieldStorage() | 268 fdata = cgi.FieldStorage() |
269 | 269 |
322 searchtime.strftime("%Y/%m/%d %H:%M:%S"))) | 322 searchtime.strftime("%Y/%m/%d %H:%M:%S"))) |
323 if not gamefiles: | 323 if not gamefiles: |
324 sys.stdout.write("<p>No record found.</p>\n") | 324 sys.stdout.write("<p>No record found.</p>\n") |
325 elif len(gamefiles) == 1: | 325 elif len(gamefiles) == 1: |
326 sys.stdout.write('<p><a href="/ttyrecs/{0}/{1}/{2}">1 ttyrec found.</a>\ | 326 sys.stdout.write('<p><a href="/ttyrecs/{0}/{1}/{2}">1 ttyrec found.</a>\ |
327 </p>\n'.format(formname, dungeon.uname, gamefiles[0])) | 327 </p>\n'.format(html.escape(formname), dungeon.uname, gamefiles[0])) |
328 else: | 328 else: |
329 sys.stdout.write('<p>{0}-part ttyrec found.</p>\n'.format(len(gamefiles))) | 329 sys.stdout.write('<p>{0}-part ttyrec found.</p>\n'.format(len(gamefiles))) |
330 sys.stdout.write('<ul>\n') | 330 sys.stdout.write('<ul>\n') |
331 for i, afile in enumerate(gamefiles): | 331 for i, afile in enumerate(gamefiles): |
332 sys.stdout.write('<li><a href="/ttyrecs/{0}/{1}/{2}">Section {3}</a>\ | 332 sys.stdout.write('<li><a href="/ttyrecs/{0}/{1}/{2}">Section {3}</a>\ |
333 </li>\n'.format(formname, dungeon.uname, afile, i + 1)) | 333 </li>\n'.format(html.escape(formname), dungeon.uname, afile, i + 1)) |
334 sys.stdout.write('</ul>\n') | 334 sys.stdout.write('</ul>\n') |
335 if isnotsearch: | 335 if isnotsearch: |
336 sys.stdout.write(infop) | 336 sys.stdout.write(infop) |
337 else: | 337 else: |
338 # There was information, but not good enough, i.e. errors. | 338 # There was information, but not good enough, i.e. errors. |