comparison web/archive.cgi @ 49:6138c27d1950

Escape the player's name when printing it into HTML. Non-alphanumeric characters in names may eventually be possible.
author John "Elwin" Edwards
date Mon, 24 Mar 2014 16:01:28 -0700
parents 86b616d88020
children
comparison
equal deleted inserted replaced
48:955c2fd68dcf 49:6138c27d1950
5 import sys 5 import sys
6 import time 6 import time
7 import calendar 7 import calendar
8 from datetime import datetime 8 from datetime import datetime
9 import pytz 9 import pytz
10 import html
10 import rlgall 11 import rlgall
11 #import cgitb 12 #import cgitb
12 13
13 #cgitb.enable() 14 #cgitb.enable()
14 15
34 return 35 return
35 36
36 def input_name(outf, defaultval=None): 37 def input_name(outf, defaultval=None):
37 defstr = '<div>Adventurer\'s name: <input type="text" name="name" value="{0}"></div>\n' 38 defstr = '<div>Adventurer\'s name: <input type="text" name="name" value="{0}"></div>\n'
38 if defaultval: 39 if defaultval:
39 outf.write(defstr.format(defaultval)) 40 outf.write(defstr.format(html.escape(defaultval)))
40 else: 41 else:
41 outf.write('<div>Adventurer\'s Name: <input type="text" name="name"></div>\n') 42 outf.write('<div>Adventurer\'s Name: <input type="text" name="name"></div>\n')
42 return 43 return
43 44
44 def input_time(outf, defaultval=None): 45 def input_time(outf, defaultval=None):
122 # digging all over the filesystem. 123 # digging all over the filesystem.
123 formname = fdata.getfirst("name").rpartition("/")[2] 124 formname = fdata.getfirst("name").rpartition("/")[2]
124 try: 125 try:
125 os.stat(ttyrecbase + formname) 126 os.stat(ttyrecbase + formname)
126 except OSError: 127 except OSError:
127 errlist.append(cantfind.format(cgi.escape(formname))) 128 errlist.append(cantfind.format(html.escape(formname)))
128 return None 129 return None
129 return formname 130 return formname
130 131
131 def processgame(fdata, errlist): 132 def processgame(fdata, errlist):
132 "Takes a CGI data object and returns the game from rlgall.gamelist that \ 133 "Takes a CGI data object and returns the game from rlgall.gamelist that \
137 return None 138 return None
138 formgame = fdata.getfirst("game") 139 formgame = fdata.getfirst("game")
139 for agame in rlgall.gamelist: 140 for agame in rlgall.gamelist:
140 if agame.uname == formgame: 141 if agame.uname == formgame:
141 return agame 142 return agame
142 errlist.append(cantfind.format(cgi.escape(formgame))) 143 errlist.append(cantfind.format(html.escape(formgame)))
143 return None 144 return None
144 145
145 def processtime(fdata, errlist, hlist): 146 def processtime(fdata, errlist, hlist):
146 "Takes a CGI data object and converts to a datetime object by finding \ 147 "Takes a CGI data object and converts to a datetime object by finding \
147 fields called year, month, etc. Any errors get appended to errlist. \ 148 fields called year, month, etc. Any errors get appended to errlist. \
154 formtime = fdata.getfirst("time") 155 formtime = fdata.getfirst("time")
155 if formtime: 156 if formtime:
156 try: 157 try:
157 utime = int(formtime) 158 utime = int(formtime)
158 except ValueError: 159 except ValueError:
159 errlist.append(badtime.format(cgi.escape(formtime))) 160 errlist.append(badtime.format(html.escape(formtime)))
160 return None 161 return None
161 else: 162 else:
162 if utime < 0: 163 if utime < 0:
163 utime = 0 164 utime = 0
164 if utime != None: 165 if utime != None:
259 else: 260 else:
260 hlist[5] = second 261 hlist[5] = second
261 if lerrors: 262 if lerrors:
262 errlist.extend(lerrors) 263 errlist.extend(lerrors)
263 return None 264 return None
264 #return calendar.timegm([year, month, day, hour, minute, second, 0, 0, 0])
265 return datetime(year, month, day, hour, minute, second, 0, pytz.utc) 265 return datetime(year, month, day, hour, minute, second, 0, pytz.utc)
266 266
267 # Begin processing 267 # Begin processing
268 fdata = cgi.FieldStorage() 268 fdata = cgi.FieldStorage()
269 269
322 searchtime.strftime("%Y/%m/%d %H:%M:%S"))) 322 searchtime.strftime("%Y/%m/%d %H:%M:%S")))
323 if not gamefiles: 323 if not gamefiles:
324 sys.stdout.write("<p>No record found.</p>\n") 324 sys.stdout.write("<p>No record found.</p>\n")
325 elif len(gamefiles) == 1: 325 elif len(gamefiles) == 1:
326 sys.stdout.write('<p><a href="/ttyrecs/{0}/{1}/{2}">1 ttyrec found.</a>\ 326 sys.stdout.write('<p><a href="/ttyrecs/{0}/{1}/{2}">1 ttyrec found.</a>\
327 </p>\n'.format(formname, dungeon.uname, gamefiles[0])) 327 </p>\n'.format(html.escape(formname), dungeon.uname, gamefiles[0]))
328 else: 328 else:
329 sys.stdout.write('<p>{0}-part ttyrec found.</p>\n'.format(len(gamefiles))) 329 sys.stdout.write('<p>{0}-part ttyrec found.</p>\n'.format(len(gamefiles)))
330 sys.stdout.write('<ul>\n') 330 sys.stdout.write('<ul>\n')
331 for i, afile in enumerate(gamefiles): 331 for i, afile in enumerate(gamefiles):
332 sys.stdout.write('<li><a href="/ttyrecs/{0}/{1}/{2}">Section {3}</a>\ 332 sys.stdout.write('<li><a href="/ttyrecs/{0}/{1}/{2}">Section {3}</a>\
333 </li>\n'.format(formname, dungeon.uname, afile, i + 1)) 333 </li>\n'.format(html.escape(formname), dungeon.uname, afile, i + 1))
334 sys.stdout.write('</ul>\n') 334 sys.stdout.write('</ul>\n')
335 if isnotsearch: 335 if isnotsearch:
336 sys.stdout.write(infop) 336 sys.stdout.write(infop)
337 else: 337 else:
338 # There was information, but not good enough, i.e. errors. 338 # There was information, but not good enough, i.e. errors.