use cgi dir for better security

[iankelling.org] / _site / cgi / comment

diff --git a/_site/comment.rb b/_site/cgi/comment
similarity index 92%
rename from _site/comment.rb
rename to _site/cgi/comment
index 14f1152cb92ca13970971b4b212a4c21ff71b623..b1e8796607706a844cf9a33ecf1a46500acfebec 100755 (executable)
--- a/_site/comment.rb
+++ b/_site/cgi/comment
@@ -27,9 +27,12 @@ require 'fileutils'
 require 'time'
 require 'sqlite3'
 
 require 'time'
 require 'sqlite3'
 

-require_relative '../b'
+Dir.chdir(File.join(File.dirname(__FILE__), '..'))
+
+require '../b'

 include B
 
 include B
 

+

 # constanty things
 DEBUG = true
 CAPTCHA = -> {
 # constanty things
 DEBUG = true
 CAPTCHA = -> {


@@ -77,11 +80,11 @@ EOF
 def do_captcha
   captcha_q = CAPTCHA.sample[0]
   puts "Content-type: text/html\n\n"
 def do_captcha
   captcha_q = CAPTCHA.sample[0]
   puts "Content-type: text/html\n\n"

-  puts skel('comment.rb', "#{DN}/captcha", <<EOF, ' / <a href="/blog.html">blog</a> / comment-captcha')
+  puts skel("#{DN}/captcha", <<EOF, header: ' / <a href="/blog.html">blog</a> / captcha')

 <p>Hello friend. I haven't read a post from #{IP}, and I only remember for a few months, so:</p>
 <p>#{captcha_q}</p>
 
 <p>Hello friend. I haven't read a post from #{IP}, and I only remember for a few months, so:</p>
 <p>#{captcha_q}</p>
 

-<form action="/comment.rb" method="post">
+<form action="/cgi/comment" method="post">

   <input class="misc" type="text" name="url">
   <input name="goto" type="hidden" value="#{GOTO}">
   <input name="question" type="hidden" value="#{captcha_q}">
   <input class="misc" type="text" name="url">
   <input name="goto" type="hidden" value="#{GOTO}">
   <input name="question" type="hidden" value="#{captcha_q}">


@@ -106,7 +109,6 @@ def fail(msg)
 end
 
 def redir
 end
 
 def redir

-  File.write('/tmp/x', GOTO)

   puts 'Status: 302 Found'
   puts "Location: #{GOTO}#comment-section\n\n"
   exit(0)
   puts 'Status: 302 Found'
   puts "Location: #{GOTO}#comment-section\n\n"
   exit(0)


@@ -126,18 +128,18 @@ if cgi.has_key?('goto')
   GOTO = cgi['goto']
 else
   GOTO = '/'
   GOTO = cgi['goto']
 else
   GOTO = '/'

-  fail['redir to /']
+  fail('redir to /')

 end
 
 if (cgi.has_key?('url') && cgi['url'] != "") || ! cgi.has_key?('comment')
 end
 
 if (cgi.has_key?('url') && cgi['url'] != "") || ! cgi.has_key?('comment')

-  fail["comment not in form or url in form. cgi.params: #{cgi.params}"]
+  fail("comment not in form or url in form. cgi.params: #{cgi.params}")

 end
 
 COMMENT_TXT = cgi["comment"]
 
 
 if COMMENT_TXT.length > 1000 or GOTO.length > 150
 end
 
 COMMENT_TXT = cgi["comment"]
 
 
 if COMMENT_TXT.length > 1000 or GOTO.length > 150

-  fail['length of comment or goto is too great']
+  fail('length of comment or goto is too great')

 end
 
 
 end
 
 


@@ -154,12 +156,12 @@ end
   found = false
   Dir.foreach('blog') do |entry|
     next if ['.','..'].any? { |f| f == entry }
   found = false
   Dir.foreach('blog') do |entry|
     next if ['.','..'].any? { |f| f == entry }

-    if GOTO == 'blog/' + entry
+    if GOTO == '/blog/' + entry

       found = true
       break
     end
   end
       found = true
       break
     end
   end

-  fail['goto entry not found'] unless found
+  fail('goto entry not found') unless found

 }[]
 ######### end error checking & arg parsing ########
 
 }[]
 ######### end error checking & arg parsing ########
 


@@ -194,18 +196,20 @@ SQL
 
 unless state
   older_date = NOW - DAY*2
 
 unless state
   older_date = NOW - DAY*2

-  last_moderated = $db.execute(<<-SQL, [older_date])[-1][0]
+  last_moderated = $db.execute(<<-SQL, [older_date])[-1]

   select date from c
   where ip = '#{IP}' and (
     state = 'moderated' or
     (date < ? and (state = 'timed' or state = 'known')))
 SQL
   select date from c
   where ip = '#{IP}' and (
     state = 'moderated' or
     (date < ? and (state = 'timed' or state = 'known')))
 SQL

-  last_good = $db.execute(<<-SQL, [older_date])[-1][0]
+  last_moderated = last_moderated[0] if last_moderated
+  last_good = $db.execute(<<-SQL, [older_date])[-1]

   select date from c
   where ip = '#{IP}' and (
     state = 'picked' or
     (date < ? and (state = 'timed' or state = 'known')))
 SQL
   select date from c
   where ip = '#{IP}' and (
     state = 'picked' or
     (date < ? and (state = 'timed' or state = 'known')))
 SQL

+  last_good = last_good[0] if last_good

   if last_moderated && last_good
     if last_good > last_moderated
       state = 'known'
   if last_moderated && last_good
     if last_good > last_moderated
       state = 'known'