Mercurial > hg > rlgallery-misc
comparison web/archive.cgi @ 49:6138c27d1950
Escape the player's name when printing it into HTML.
Non-alphanumeric characters in names may eventually be possible.
| author | John "Elwin" Edwards | 
|---|---|
| date | Mon, 24 Mar 2014 16:01:28 -0700 | 
| parents | 86b616d88020 | 
| children | 
   comparison
  equal
  deleted
  inserted
  replaced
| 48:955c2fd68dcf | 49:6138c27d1950 | 
|---|---|
| 5 import sys | 5 import sys | 
| 6 import time | 6 import time | 
| 7 import calendar | 7 import calendar | 
| 8 from datetime import datetime | 8 from datetime import datetime | 
| 9 import pytz | 9 import pytz | 
| 10 import html | |
| 10 import rlgall | 11 import rlgall | 
| 11 #import cgitb | 12 #import cgitb | 
| 12 | 13 | 
| 13 #cgitb.enable() | 14 #cgitb.enable() | 
| 14 | 15 | 
| 34 return | 35 return | 
| 35 | 36 | 
| 36 def input_name(outf, defaultval=None): | 37 def input_name(outf, defaultval=None): | 
| 37 defstr = '<div>Adventurer\'s name: <input type="text" name="name" value="{0}"></div>\n' | 38 defstr = '<div>Adventurer\'s name: <input type="text" name="name" value="{0}"></div>\n' | 
| 38 if defaultval: | 39 if defaultval: | 
| 39 outf.write(defstr.format(defaultval)) | 40 outf.write(defstr.format(html.escape(defaultval))) | 
| 40 else: | 41 else: | 
| 41 outf.write('<div>Adventurer\'s Name: <input type="text" name="name"></div>\n') | 42 outf.write('<div>Adventurer\'s Name: <input type="text" name="name"></div>\n') | 
| 42 return | 43 return | 
| 43 | 44 | 
| 44 def input_time(outf, defaultval=None): | 45 def input_time(outf, defaultval=None): | 
| 122 # digging all over the filesystem. | 123 # digging all over the filesystem. | 
| 123 formname = fdata.getfirst("name").rpartition("/")[2] | 124 formname = fdata.getfirst("name").rpartition("/")[2] | 
| 124 try: | 125 try: | 
| 125 os.stat(ttyrecbase + formname) | 126 os.stat(ttyrecbase + formname) | 
| 126 except OSError: | 127 except OSError: | 
| 127 errlist.append(cantfind.format(cgi.escape(formname))) | 128 errlist.append(cantfind.format(html.escape(formname))) | 
| 128 return None | 129 return None | 
| 129 return formname | 130 return formname | 
| 130 | 131 | 
| 131 def processgame(fdata, errlist): | 132 def processgame(fdata, errlist): | 
| 132 "Takes a CGI data object and returns the game from rlgall.gamelist that \ | 133 "Takes a CGI data object and returns the game from rlgall.gamelist that \ | 
| 137 return None | 138 return None | 
| 138 formgame = fdata.getfirst("game") | 139 formgame = fdata.getfirst("game") | 
| 139 for agame in rlgall.gamelist: | 140 for agame in rlgall.gamelist: | 
| 140 if agame.uname == formgame: | 141 if agame.uname == formgame: | 
| 141 return agame | 142 return agame | 
| 142 errlist.append(cantfind.format(cgi.escape(formgame))) | 143 errlist.append(cantfind.format(html.escape(formgame))) | 
| 143 return None | 144 return None | 
| 144 | 145 | 
| 145 def processtime(fdata, errlist, hlist): | 146 def processtime(fdata, errlist, hlist): | 
| 146 "Takes a CGI data object and converts to a datetime object by finding \ | 147 "Takes a CGI data object and converts to a datetime object by finding \ | 
| 147 fields called year, month, etc. Any errors get appended to errlist. \ | 148 fields called year, month, etc. Any errors get appended to errlist. \ | 
| 154 formtime = fdata.getfirst("time") | 155 formtime = fdata.getfirst("time") | 
| 155 if formtime: | 156 if formtime: | 
| 156 try: | 157 try: | 
| 157 utime = int(formtime) | 158 utime = int(formtime) | 
| 158 except ValueError: | 159 except ValueError: | 
| 159 errlist.append(badtime.format(cgi.escape(formtime))) | 160 errlist.append(badtime.format(html.escape(formtime))) | 
| 160 return None | 161 return None | 
| 161 else: | 162 else: | 
| 162 if utime < 0: | 163 if utime < 0: | 
| 163 utime = 0 | 164 utime = 0 | 
| 164 if utime != None: | 165 if utime != None: | 
| 259 else: | 260 else: | 
| 260 hlist[5] = second | 261 hlist[5] = second | 
| 261 if lerrors: | 262 if lerrors: | 
| 262 errlist.extend(lerrors) | 263 errlist.extend(lerrors) | 
| 263 return None | 264 return None | 
| 264 #return calendar.timegm([year, month, day, hour, minute, second, 0, 0, 0]) | |
| 265 return datetime(year, month, day, hour, minute, second, 0, pytz.utc) | 265 return datetime(year, month, day, hour, minute, second, 0, pytz.utc) | 
| 266 | 266 | 
| 267 # Begin processing | 267 # Begin processing | 
| 268 fdata = cgi.FieldStorage() | 268 fdata = cgi.FieldStorage() | 
| 269 | 269 | 
| 322 searchtime.strftime("%Y/%m/%d %H:%M:%S"))) | 322 searchtime.strftime("%Y/%m/%d %H:%M:%S"))) | 
| 323 if not gamefiles: | 323 if not gamefiles: | 
| 324 sys.stdout.write("<p>No record found.</p>\n") | 324 sys.stdout.write("<p>No record found.</p>\n") | 
| 325 elif len(gamefiles) == 1: | 325 elif len(gamefiles) == 1: | 
| 326 sys.stdout.write('<p><a href="/ttyrecs/{0}/{1}/{2}">1 ttyrec found.</a>\ | 326 sys.stdout.write('<p><a href="/ttyrecs/{0}/{1}/{2}">1 ttyrec found.</a>\ | 
| 327 </p>\n'.format(formname, dungeon.uname, gamefiles[0])) | 327 </p>\n'.format(html.escape(formname), dungeon.uname, gamefiles[0])) | 
| 328 else: | 328 else: | 
| 329 sys.stdout.write('<p>{0}-part ttyrec found.</p>\n'.format(len(gamefiles))) | 329 sys.stdout.write('<p>{0}-part ttyrec found.</p>\n'.format(len(gamefiles))) | 
| 330 sys.stdout.write('<ul>\n') | 330 sys.stdout.write('<ul>\n') | 
| 331 for i, afile in enumerate(gamefiles): | 331 for i, afile in enumerate(gamefiles): | 
| 332 sys.stdout.write('<li><a href="/ttyrecs/{0}/{1}/{2}">Section {3}</a>\ | 332 sys.stdout.write('<li><a href="/ttyrecs/{0}/{1}/{2}">Section {3}</a>\ | 
| 333 </li>\n'.format(formname, dungeon.uname, afile, i + 1)) | 333 </li>\n'.format(html.escape(formname), dungeon.uname, afile, i + 1)) | 
| 334 sys.stdout.write('</ul>\n') | 334 sys.stdout.write('</ul>\n') | 
| 335 if isnotsearch: | 335 if isnotsearch: | 
| 336 sys.stdout.write(infop) | 336 sys.stdout.write(infop) | 
| 337 else: | 337 else: | 
| 338 # There was information, but not good enough, i.e. errors. | 338 # There was information, but not good enough, i.e. errors. | 
