Index: openacs-4/packages/acs-kernel/acs-kernel.info
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-kernel/acs-kernel.info,v
diff -u -r1.41 -r1.42
--- openacs-4/packages/acs-kernel/acs-kernel.info 2 Oct 2003 18:58:30 -0000 1.41
+++ openacs-4/packages/acs-kernel/acs-kernel.info 3 Oct 2003 16:03:31 -0000 1.42
@@ -7,13 +7,13 @@
t
t
-
+
Don Baccus
Routines and data models providing the foundation for OpenACS-based Web services.
2003-09-25
OpenACS
-
+
@@ -59,6 +59,7 @@
+
Index: openacs-4/packages/acs-tcl/tcl/request-processor-init.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-tcl/tcl/request-processor-init.tcl,v
diff -u -r1.7 -r1.8
--- openacs-4/packages/acs-tcl/tcl/request-processor-init.tcl 25 Sep 2003 13:39:02 -0000 1.7
+++ openacs-4/packages/acs-tcl/tcl/request-processor-init.tcl 3 Oct 2003 16:03:31 -0000 1.8
@@ -152,7 +152,3 @@
}
}
-# Deny access to .xql URLs
-if { ![parameter::get -parameter ServeXQLFiles -package_id [ad_acs_kernel_id] -default 0] } {
- ad_register_filter postauth GET *.xql request_denied_filter
-}
Index: openacs-4/packages/acs-tcl/tcl/request-processor-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-tcl/tcl/request-processor-procs.tcl,v
diff -u -r1.48 -r1.49
--- openacs-4/packages/acs-tcl/tcl/request-processor-procs.tcl 3 Oct 2003 10:14:30 -0000 1.48
+++ openacs-4/packages/acs-tcl/tcl/request-processor-procs.tcl 3 Oct 2003 16:03:31 -0000 1.49
@@ -832,13 +832,15 @@
return
}
- if {[info exists dir_index]} {
- if { [nsv_get rp_directory_listing_p .] } {
- ns_returnnotice 200 "Directory listing of $dir_index" \
- [rp_html_directory_listing $dir_index]
- return
+ if {[info exists dir_index]
+ && ![string match */CVS/* $dir_index]
+ } {
+ if { [nsv_get rp_directory_listing_p .] } {
+ ns_returnnotice 200 "Directory listing of $dir_index" \
+ [rp_html_directory_listing $dir_index]
+ return
+ }
}
- }
# Ok, we didn't find a normal file. Let's look for a path info style
# thingy.
@@ -986,33 +988,45 @@
}
ad_proc -public rp_serve_concrete_file {file} {
- Serves a file.
+ Serves a file.
} {
- set extension [file extension $file]
- set startclicks [clock clicks]
+ set extension [file extension $file]
+ set startclicks [clock clicks]
- if { [nsv_exists rp_extension_handlers $extension] } {
- set handler [nsv_get rp_extension_handlers $extension]
+ if { [nsv_exists rp_extension_handlers $extension] } {
+ set handler [nsv_get rp_extension_handlers $extension]
- if { [set errno [catch {
- ad_try {
- $handler
- } ad_script_abort val {
- # do nothing
- }
- rp_finish_serving_page
- ad_call_proc_if_exists ds_add rp [list serve_file [list $file $handler] $startclicks [clock clicks]]
- } error]] } {
- global errorCode errorInfo
- ad_call_proc_if_exists ds_add rp [list serve_file [list $file $handler] $startclicks [clock clicks] error "$errorCode: $errorInfo"]
- return -code $errno -errorcode $errorCode -errorinfo $errorInfo $error
+ if { [set errno [catch {
+ ad_try {
+ $handler
+ } ad_script_abort val {
+ # do nothing
+ }
+ rp_finish_serving_page
+ ad_call_proc_if_exists ds_add rp [list serve_file [list $file $handler] $startclicks [clock clicks]]
+ } error]] } {
+ global errorCode errorInfo
+ ad_call_proc_if_exists ds_add rp [list serve_file [list $file $handler] $startclicks [clock clicks] error "$errorCode: $errorInfo"]
+ return -code $errno -errorcode $errorCode -errorinfo $errorInfo $error
+ }
+ } else {
+ # Some other random kind of file - guess the type and return it.
+
+ # first check that we are not serving a forbidden file like a .xql, a backup or CVS file
+ foreach match [parameter::get -parameter ExcludedFiles -package_id [ad_acs_kernel_id] -default {}] {
+ if {[string match $match $file]} {
+ ad_raise notfound
+ }
+ }
+ if {[string equal $extension ".xql"]
+ && ![parameter::get -parameter ServeXQLFiles -package_id [ad_acs_kernel_id] -default 0] } {
+ ad_raise notfound
+ } else {
+ set type [ns_guesstype $file]
+ ad_call_proc_if_exists ds_add rp [list serve_file [list $file $type] $startclicks [clock clicks]]
+ ns_returnfile 200 $type $file
+ }
}
- } else {
- # Some other random kind of file - guess the type and return it.
- set type [ns_guesstype $file]
- ad_call_proc_if_exists ds_add rp [list serve_file [list $file $type] $startclicks [clock clicks]]
- ns_returnfile 200 $type $file
- }
}
ad_proc -private rp_concrete_file {
@@ -1400,7 +1414,5 @@
"Forbidden URL" \
"No, we're not going to show you this file
"
- ns_return 200 text/html $output
-
return filter_return
}