X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~mdw/git/chopwood/blobdiff_plain/623103dbef4dee3aff676cdc699fb7c1aaadcfd6..76ee7d4f64bc1f20013f44c8045cd708ef0b9641:/cgi.py

diff --git a/cgi.py b/cgi.py
index 05c6c9e..6006062 100644
--- a/cgi.py
+++ b/cgi.py
@@ -59,7 +59,7 @@ CONF.DEFAULTS.update(
 ## Some handy regular expressions.
 R_URLESC = RX.compile('%([0-9a-fA-F]{2})')
 R_URLBAD = RX.compile('[^-\\w,.!]')
-R_HTMLBAD = RX.compile('[&<>]')
+R_HTMLBAD = RX.compile('[&<>\'"]')
 
 def urldecode(s):
   """Decode a single form-url-encoded string S."""
@@ -77,17 +77,18 @@ def htmlescape(s):
 
 ## Some standard character sequences, and HTML entity names for prettier
 ## versions.
-_quotify = U.StringSubst({
+html_quotify = U.StringSubst({
+  "<": '&lt;',
+  ">": '&gt;',
+  "&": '&amp;',
   "`": '&lsquo;',
   "'": '&rsquo;',
+  '"': '&quot;',
   "``": '&ldquo;',
   "''": '&rdquo;',
   "--": '&ndash;',
   "---": '&mdash;'
 })
-def html_quotify(s):
-  """Return a pretty HTML version of S."""
-  return _quotify(htmlescape(s))
 
 ###--------------------------------------------------------------------------
 ### Output machinery.
@@ -114,7 +115,7 @@ class HTTPOutput (O.FileOutput):
     """
     Print a header, if none has yet been printed.
 
-    Keyword arguments can be passed to emit HTTP headers: see `http_header'
+    Keyword arguments can be passed to emit HTTP headers: see `http_headers'
     for the formatting rules.
     """
     if me.headerp: return
@@ -122,6 +123,8 @@ class HTTPOutput (O.FileOutput):
     for h in O.http_headers(content_type = content_type, **kw):
       me.writeln(h)
     me.writeln('')
+    if METHOD == 'HEAD':
+      HEADER_DONE()
 
 def cookie(name, value, **kw):
   """
@@ -196,7 +199,8 @@ def set_template_keywords():
     package = PACKAGE,
     version = VERSION,
     script = CFG.SCRIPT_NAME,
-    static = CFG.STATIC)
+    static = CFG.STATIC,
+    allowop = CFG.ALLOWOP)
 
 class TemplateFinder (object):
   """
@@ -211,7 +215,7 @@ class TemplateFinder (object):
     with open(OS.path.join(me._dir, key)) as f: tmpl = f.read()
     me._cache[key] = tmpl
     return tmpl
-TMPL = TemplateFinder(TMPLDIR)
+STATE.kw['TMPL'] = TMPL = TemplateFinder(TMPLDIR)
 
 @CTX.contextmanager
 def tmplkw(**kw):
@@ -229,13 +233,36 @@ class FormatHTML (F.SimpleFormatOperation):
   """
   ~H: escape output suitable for inclusion in HTML.
 
-  With `:', instead apply form-urlencoding.
+  With `:', additionally apply quotification.
   """
   def _convert(me, arg):
     if me.colonp: return html_quotify(arg)
     else: return htmlescape(arg)
 FORMATOPS['H'] = FormatHTML
 
+class FormatWrap (F.BaseFormatOperation):
+  """
+  ~<...~@>: wrap enclosed material in another formatting control string.
+
+  The argument is a formatting control.  The enclosed material is split into
+  pieces separated by `~;' markers.  The formatting control is performed, and
+  passed the list of pieces (as compiled formatting operations) in the
+  keyword argument `wrapped'.
+  """
+  def __init__(me, *args):
+    super(FormatWrap, me).__init__(*args)
+    pieces = []
+    while True:
+      piece, delim = F.collect_subformat('>;')
+      pieces.append(piece)
+      if delim.char == '>': break
+    me.pieces = pieces
+  def _format(me, atp, colonp):
+    op = F.compile(me.getarg.get())
+    with F.FORMAT.bind(argmap = dict(F.FORMAT.argmap, wrapped = me.pieces)):
+      op.format()
+FORMATOPS['<'] = FormatWrap
+
 def format_tmpl(control, **kw):
   with F.COMPILE.bind(opmaps = [FORMATOPS, F.BASEOPS]):
     with tmplkw(**kw):
@@ -286,11 +313,14 @@ def cgi_errors(hook = None):
 ### CGI input.
 
 ## Lots of global variables to be filled in by `cgiparse'.
+METHOD = None
 COOKIE = {}
 SPECIAL = {}
 PARAM = []
 PARAMDICT = {}
 PATH = []
+SSLP = False
+HEADER_DONE = lambda: None
 
 ## Regular expressions for splitting apart query and cookie strings.
 R_QSPLIT = RX.compile('[;&]')
@@ -346,34 +376,40 @@ def cgiparse():
   `PATH'
         The trailing `PATH_INFO' path, split at `/' markers, with any
         trailing empty component removed.
+
+  `SSLP'
+        True if the client connection is carried over SSL or TLS.
   """
 
+  global METHOD, SSLP
+
   def getenv(var):
     try: return ENV[var]
     except KeyError: raise U.ExpectedError, (500, "No `%s' supplied" % var)
 
   ## Yes, we want the request method.
-  method = getenv('REQUEST_METHOD')
+  METHOD = getenv('REQUEST_METHOD')
 
   ## Acquire the query string.
-  if method == 'GET':
+  if METHOD in ['GET', 'HEAD']:
     q = getenv('QUERY_STRING')
 
-  elif method == 'POST':
+  elif METHOD == 'POST':
 
     ## We must read the query string from stdin.
     n = getenv('CONTENT_LENGTH')
     if not n.isdigit():
       raise U.ExpectedError, (500, "Invalid CONTENT_LENGTH")
     n = int(n, 10)
-    if getenv('CONTENT_TYPE') != 'application/x-www-form-urlencoded':
+    ct = getenv('CONTENT_TYPE')
+    if ct != 'application/x-www-form-urlencoded':
       raise U.ExpectedError, (500, "Unexpected content type `%s'" % ct)
     q = SYS.stdin.read(n)
     if len(q) != n:
       raise U.ExpectedError, (500, "Failed to read correct length")
 
   else:
-    raise U.ExpectedError, (500, "Unexpected request method `%s'" % method)
+    raise U.ExpectedError, (500, "Unexpected request method `%s'" % METHOD)
 
   ## Populate the `SPECIAL', `PARAM' and `PARAMDICT' tables.
   seen = set()
@@ -402,6 +438,10 @@ def cgiparse():
     if pp and not pp[-1]: pp.pop()
     PATH[:] = pp
 
+  ## Check the crypto for the connection.
+  if ENV.get('SSL_PROTOCOL'):
+    SSLP = True
+
 ###--------------------------------------------------------------------------
 ### CGI subcommands.
 
@@ -429,6 +469,8 @@ class Subcommand (SC.Subcommand):
     the list of path elements is non-empty.
     """
 
+    global HEADER_DONE
+
     ## We're going to make a pass over the supplied parameters, and we'll
     ## check them off against the formal parameters as we go; so we'll need
     ## to be able to look them up.  We'll also keep track of the ones we've