From 70bb37983d5deeba70f9101a9f697ba0fbb55ebb Mon Sep 17 00:00:00 2001 From: Ben Pfaff Date: Mon, 3 Jul 2006 17:39:07 +0000 Subject: [PATCH] Make the destination for charts configurable in the HTML driver. Fixes bug #15723, "HTML driver creates .png files insecurely". Thanks to John Darrington for review. --- doc/configuring.texi | 9 +++++-- src/output/ChangeLog | 13 ++++++++++ src/output/html.c | 58 +++++++++++++++++++++++++++++++++++--------- src/output/htmlP.h | 3 +++ 4 files changed, 69 insertions(+), 14 deletions(-) diff --git a/doc/configuring.texi b/doc/configuring.texi index 0bb05d2c..49f4ccdf 100644 --- a/doc/configuring.texi +++ b/doc/configuring.texi @@ -797,14 +797,19 @@ tables-capable web browsers such as Emacs' w3-mode. Its configuration is very simple. Currently, the output has a very plain format. In the future, further work may be done on improving the output appearance. -There are is only one option: +There are only a few options: @table @code @item output-file=@var{file-name} File to which output should be sent. This can be an ordinary file name (i.e., @code{"pspp.ps"}), a pipe (i.e., @code{"|lpr"}), or -stdout (@code{"-"}). Default: @code{"pspp.html"}. +stdout (@code{"-"}). Default: @file{"pspp.html"}. + +@item chart-files=@var{file-name-template} +Template for the file names used for charts, which are output in PNG +format. The name should contain a single @samp{#}, which is replaced by +the chart number. Default: @file{"pspp-#.png"}. @end table @node Miscellaneous configuring,, HTML driver class, Configuration diff --git a/src/output/ChangeLog b/src/output/ChangeLog index 7c1d3d1c..8ed1b2a8 100644 --- a/src/output/ChangeLog +++ b/src/output/ChangeLog @@ -1,3 +1,16 @@ +Sat Jul 1 17:20:03 2006 Ben Pfaff + + Make the destination for charts configurable in the HTML driver. + Fixes bug #15723, "HTML driver creates .png files insecurely". + + * htmlP.h: (struct html_driver_ext) Add chart_file_name, chart_cnt + members. + + * html.c: (html_open_driver) Initialize new members. + (option_tab var) Add "chart-files" option. + (handle_option) Parse "chart-files" option. + (html_initialise_chart) Name file based on "chart-files" option. + Sat Jul 1 22:41:26 2006 Ben Pfaff Fix bug #16644: Output Driver crashes in DISPLAY VARIABLES. diff --git a/src/output/html.c b/src/output/html.c index 95120871..b79deb45 100644 --- a/src/output/html.c +++ b/src/output/html.c @@ -36,7 +36,8 @@ #include "manager.h" #include "table.h" #include -#include + +#include "size_max.h" #include "gettext.h" #define _(msgid) gettext (msgid) @@ -56,7 +57,9 @@ html_open_driver (struct outp_driver *this, struct substring options) this->ext = x = xmalloc (sizeof *x); x->file_name = xstrdup ("pspp.html"); + x->chart_file_name = xstrdup ("pspp-#.png"); x->file = NULL; + x->chart_cnt = 0; outp_parse_options (options, handle_option, this); @@ -146,6 +149,7 @@ enum static struct outp_option option_tab[] = { {"output-file", string_arg, 0}, + {"chart-files", string_arg, 1}, {NULL, 0, 0}, }; @@ -164,8 +168,23 @@ handle_option (struct outp_driver *this, key); break; case string_arg: - free (x->file_name); - x->file_name = ds_xstrdup (val); + switch (subcat) + { + case 0: + free (x->file_name); + x->file_name = ds_xstrdup (val); + break; + case 1: + if (ds_find_char (val, '#') != SIZE_MAX) + { + free (x->chart_file_name); + x->chart_file_name = ds_xstrdup (val); + } + error (0, 0, _("`chart-files' value must contain `#'")); + break; + default: + abort (); + } break; default: abort (); @@ -339,20 +358,35 @@ output_tab_table (struct outp_driver *this, struct tab_table *t) } static void -html_initialise_chart(struct outp_driver *d UNUSED, struct chart *ch) +html_initialise_chart (struct outp_driver *this, struct chart *ch) { - - FILE *fp; - - make_unique_file_stream(&fp, &ch->file_name); - #ifdef NO_CHARTS - ch->lp = 0; + ch->lp = NULL; #else - ch->pl_params = pl_newplparams(); + struct html_driver_ext *x = this->ext; + + FILE *fp; + int number_pos; + + x->chart_cnt++; + + number_pos = strchr (x->chart_file_name, '#') - x->chart_file_name; + ch->file_name = xasprintf ("%.*s%d%s", + number_pos, x->chart_file_name, + x->chart_cnt, + x->chart_file_name + number_pos + 1); + fp = fopen (ch->file_name, "wb"); + if (fp == NULL) + { + error (0, errno, _("creating \"%s\""), ch->file_name); + free (ch->file_name); + ch->file_name = NULL; + return; + } + + ch->pl_params = pl_newplparams (); ch->lp = pl_newpl_r ("png", 0, fp, stderr, ch->pl_params); #endif - } static void diff --git a/src/output/htmlP.h b/src/output/htmlP.h index da292ab0..f1bf3d34 100644 --- a/src/output/htmlP.h +++ b/src/output/htmlP.h @@ -26,7 +26,10 @@ struct html_driver_ext { char *file_name; + char *chart_file_name; FILE *file; + + size_t chart_cnt; }; extern struct outp_class html_class; -- 2.30.2