CGI: Added "multiline" flag, which allows newline in parameter values.

[libucw.git] / lib / perl / CGI.pm

diff --git a/lib/perl/CGI.pm b/lib/perl/CGI.pm
index 14a39e24bafd70078f478da46355e3a47ec552ac..55e76e1c7fb4b56a79ad20148a80b10b47cb4f11 100644 (file)
--- a/lib/perl/CGI.pm
+++ b/lib/perl/CGI.pm
@@ -17,17 +17,26 @@ BEGIN {
        our ($VERSION, @ISA, @EXPORT, @EXPORT_OK, %EXPORT_TAGS);
        $VERSION = 1.0;
        @ISA = qw(Exporter);
-       @EXPORT = qw(&html_escape &url_escape &self_ref &self_form);
+       @EXPORT = qw(&html_escape &url_escape &url_param_escape &self_ref &self_form);
        @EXPORT_OK = qw();
        %EXPORT_TAGS = ();
 }
 
+### Escaping ###
+
 sub url_escape($) {
        my $x = shift @_;
        $x =~ s/([^-\$_.!*'(),0-9A-Za-z\x80-\xff])/"%".unpack('H2',$1)/ge;
        return $x;
 }
 
+sub url_param_escape($) {
+       my $x = shift @_;
+       $x = url_escape($x);
+       $x =~ s/%20/+/g;
+       return $x;
+}
+
 sub html_escape($) {
        my $x = shift @_;
        $x =~ s/&/&/g;
@@ -37,6 +46,41 @@ sub html_escape($) {
        return $x;
 }
 
+### Analysing RFC 822 Style Headers ###
+
+sub rfc822_prepare($) {
+       my $x = shift @_;
+       # Convert all %'s and backslash escapes to %xx escapes
+       $x =~ s/%/%25/g;
+       $x =~ s/\\(.)/"%".unpack("H2",$1)/ge;
+       # Remove all comments, beware, they can be nested (unterminated comments are closed at EOL automatically)
+       while ($x =~ s/^(("[^"]*"|[^"(])*(\([^)]*)*)(\([^()]*(\)|$))/$1 /) { }
+       # Remove quotes and escape dangerous characters inside (again closing at the end automatically)
+       $x =~ s{"([^"]*)("|$)}{my $z=$1; $z =~ s/([^0-9a-zA-Z%_-])/"%".unpack("H2",$1)/ge; $z;}ge;
+       # All control characters are properly escaped, tokens are clearly visible.
+       # Finally remove all unnecessary spaces.
+       $x =~ s/\s+/ /g;
+       $x =~ s/(^ | $)//g;
+       $x =~ s{\s*([()<>@,;:\\"/\[\]?=])\s*}{$1}g;
+       return $x;
+}
+
+sub rfc822_deescape($) {
+       my $x = shift @_;
+       $x =~ s/%(..)/pack("H2",$1)/ge;
+       return $x;
+}
+
+### Reading of HTTP headers ###
+
+sub http_get($) {
+       my $h = shift @_;
+       $h =~ tr/a-z-/A-Z_/;
+       return $ENV{"HTTP_$h"} || $ENV{"$h"};
+}
+
+### Parsing of Arguments ###
+
 our $arg_table;
 
 sub parse_arg_string($) {
@@ -47,8 +91,10 @@ sub parse_arg_string($) {
                my $arg = $arg_table->{$1} or next;
                $_ = $2;
                s/\+/ /g;
-               s/%(..)/pack("c",hex $1)/eg;
-               s/(\r|\n|\t)/ /g;
+               s/%(..)/pack("H2",$1)/eg;
+               s/\r\n/\n/g;
+               s/\r/\n/g;
+               $arg->{'multiline'} || s/(\n|\t)/ /g;
                s/^\s+//;
                s/\s+$//;
                if (my $rx = $arg->{'check'}) {
@@ -93,12 +139,15 @@ sub parse_args($) {
        }
 }
 
+### Generating Self-ref URL's ###
+
 sub make_out_args($) {
        my ($overrides) = @_;
        my $out = {};
        foreach my $name (keys %$arg_table) {
                my $arg = $arg_table->{$name};
-               defined $arg->{'pass'} && !$arg->{'pass'} && !exists $overrides->{$name} && next;
+               defined($arg->{'var'}) || next;
+               defined($arg->{'pass'}) && !$arg->{'pass'} && !exists $overrides->{$name} && next;
                my $value;
                if (!defined($value = $overrides->{$name})) {
                        if (exists $overrides->{$name}) {
@@ -117,7 +166,7 @@ sub make_out_args($) {
 sub self_ref(@) {
        my %h = @_;
        my $out = make_out_args(\%h);
-       return "?" . join(':', map { "$_=" . url_escape($out->{$_}) } sort keys %$out);
+       return "?" . join(':', map { "$_=" . url_param_escape($out->{$_}) } sort keys %$out);
 }
 
 sub self_form(@) {