Mercurial > hg > rlgallery-misc
comparison web/archive.cgi @ 49:6138c27d1950
Escape the player's name when printing it into HTML.
Non-alphanumeric characters in names may eventually be possible.
| author | John "Elwin" Edwards |
|---|---|
| date | Mon, 24 Mar 2014 16:01:28 -0700 |
| parents | 86b616d88020 |
| children |
comparison
equal
deleted
inserted
replaced
| 48:955c2fd68dcf | 49:6138c27d1950 |
|---|---|
| 5 import sys | 5 import sys |
| 6 import time | 6 import time |
| 7 import calendar | 7 import calendar |
| 8 from datetime import datetime | 8 from datetime import datetime |
| 9 import pytz | 9 import pytz |
| 10 import html | |
| 10 import rlgall | 11 import rlgall |
| 11 #import cgitb | 12 #import cgitb |
| 12 | 13 |
| 13 #cgitb.enable() | 14 #cgitb.enable() |
| 14 | 15 |
| 34 return | 35 return |
| 35 | 36 |
| 36 def input_name(outf, defaultval=None): | 37 def input_name(outf, defaultval=None): |
| 37 defstr = '<div>Adventurer\'s name: <input type="text" name="name" value="{0}"></div>\n' | 38 defstr = '<div>Adventurer\'s name: <input type="text" name="name" value="{0}"></div>\n' |
| 38 if defaultval: | 39 if defaultval: |
| 39 outf.write(defstr.format(defaultval)) | 40 outf.write(defstr.format(html.escape(defaultval))) |
| 40 else: | 41 else: |
| 41 outf.write('<div>Adventurer\'s Name: <input type="text" name="name"></div>\n') | 42 outf.write('<div>Adventurer\'s Name: <input type="text" name="name"></div>\n') |
| 42 return | 43 return |
| 43 | 44 |
| 44 def input_time(outf, defaultval=None): | 45 def input_time(outf, defaultval=None): |
| 122 # digging all over the filesystem. | 123 # digging all over the filesystem. |
| 123 formname = fdata.getfirst("name").rpartition("/")[2] | 124 formname = fdata.getfirst("name").rpartition("/")[2] |
| 124 try: | 125 try: |
| 125 os.stat(ttyrecbase + formname) | 126 os.stat(ttyrecbase + formname) |
| 126 except OSError: | 127 except OSError: |
| 127 errlist.append(cantfind.format(cgi.escape(formname))) | 128 errlist.append(cantfind.format(html.escape(formname))) |
| 128 return None | 129 return None |
| 129 return formname | 130 return formname |
| 130 | 131 |
| 131 def processgame(fdata, errlist): | 132 def processgame(fdata, errlist): |
| 132 "Takes a CGI data object and returns the game from rlgall.gamelist that \ | 133 "Takes a CGI data object and returns the game from rlgall.gamelist that \ |
| 137 return None | 138 return None |
| 138 formgame = fdata.getfirst("game") | 139 formgame = fdata.getfirst("game") |
| 139 for agame in rlgall.gamelist: | 140 for agame in rlgall.gamelist: |
| 140 if agame.uname == formgame: | 141 if agame.uname == formgame: |
| 141 return agame | 142 return agame |
| 142 errlist.append(cantfind.format(cgi.escape(formgame))) | 143 errlist.append(cantfind.format(html.escape(formgame))) |
| 143 return None | 144 return None |
| 144 | 145 |
| 145 def processtime(fdata, errlist, hlist): | 146 def processtime(fdata, errlist, hlist): |
| 146 "Takes a CGI data object and converts to a datetime object by finding \ | 147 "Takes a CGI data object and converts to a datetime object by finding \ |
| 147 fields called year, month, etc. Any errors get appended to errlist. \ | 148 fields called year, month, etc. Any errors get appended to errlist. \ |
| 154 formtime = fdata.getfirst("time") | 155 formtime = fdata.getfirst("time") |
| 155 if formtime: | 156 if formtime: |
| 156 try: | 157 try: |
| 157 utime = int(formtime) | 158 utime = int(formtime) |
| 158 except ValueError: | 159 except ValueError: |
| 159 errlist.append(badtime.format(cgi.escape(formtime))) | 160 errlist.append(badtime.format(html.escape(formtime))) |
| 160 return None | 161 return None |
| 161 else: | 162 else: |
| 162 if utime < 0: | 163 if utime < 0: |
| 163 utime = 0 | 164 utime = 0 |
| 164 if utime != None: | 165 if utime != None: |
| 259 else: | 260 else: |
| 260 hlist[5] = second | 261 hlist[5] = second |
| 261 if lerrors: | 262 if lerrors: |
| 262 errlist.extend(lerrors) | 263 errlist.extend(lerrors) |
| 263 return None | 264 return None |
| 264 #return calendar.timegm([year, month, day, hour, minute, second, 0, 0, 0]) | |
| 265 return datetime(year, month, day, hour, minute, second, 0, pytz.utc) | 265 return datetime(year, month, day, hour, minute, second, 0, pytz.utc) |
| 266 | 266 |
| 267 # Begin processing | 267 # Begin processing |
| 268 fdata = cgi.FieldStorage() | 268 fdata = cgi.FieldStorage() |
| 269 | 269 |
| 322 searchtime.strftime("%Y/%m/%d %H:%M:%S"))) | 322 searchtime.strftime("%Y/%m/%d %H:%M:%S"))) |
| 323 if not gamefiles: | 323 if not gamefiles: |
| 324 sys.stdout.write("<p>No record found.</p>\n") | 324 sys.stdout.write("<p>No record found.</p>\n") |
| 325 elif len(gamefiles) == 1: | 325 elif len(gamefiles) == 1: |
| 326 sys.stdout.write('<p><a href="/ttyrecs/{0}/{1}/{2}">1 ttyrec found.</a>\ | 326 sys.stdout.write('<p><a href="/ttyrecs/{0}/{1}/{2}">1 ttyrec found.</a>\ |
| 327 </p>\n'.format(formname, dungeon.uname, gamefiles[0])) | 327 </p>\n'.format(html.escape(formname), dungeon.uname, gamefiles[0])) |
| 328 else: | 328 else: |
| 329 sys.stdout.write('<p>{0}-part ttyrec found.</p>\n'.format(len(gamefiles))) | 329 sys.stdout.write('<p>{0}-part ttyrec found.</p>\n'.format(len(gamefiles))) |
| 330 sys.stdout.write('<ul>\n') | 330 sys.stdout.write('<ul>\n') |
| 331 for i, afile in enumerate(gamefiles): | 331 for i, afile in enumerate(gamefiles): |
| 332 sys.stdout.write('<li><a href="/ttyrecs/{0}/{1}/{2}">Section {3}</a>\ | 332 sys.stdout.write('<li><a href="/ttyrecs/{0}/{1}/{2}">Section {3}</a>\ |
| 333 </li>\n'.format(formname, dungeon.uname, afile, i + 1)) | 333 </li>\n'.format(html.escape(formname), dungeon.uname, afile, i + 1)) |
| 334 sys.stdout.write('</ul>\n') | 334 sys.stdout.write('</ul>\n') |
| 335 if isnotsearch: | 335 if isnotsearch: |
| 336 sys.stdout.write(infop) | 336 sys.stdout.write(infop) |
| 337 else: | 337 else: |
| 338 # There was information, but not good enough, i.e. errors. | 338 # There was information, but not good enough, i.e. errors. |
