Make the destination for charts configurable in the HTML driver.

Fixes bug #15723, "HTML driver creates .png files insecurely".
Thanks to John Darrington for review.

diff --git a/doc/configuring.texi b/doc/configuring.texi
index 0bb05d2c4cc4862a2dd8d1966e02823dda05c50d..49f4ccdfc15c719706687413ae297e719a1ba18e 100644 (file)
--- a/doc/configuring.texi
+++ b/doc/configuring.texi
@@ -797,14 +797,19 @@ tables-capable web browsers such as Emacs' w3-mode.  Its configuration
 is very simple.  Currently, the output has a very plain format.  In the
 future, further work may be done on improving the output appearance.
 
-There are is only one option:
+There are only a few options:
 
 @table @code
 @item output-file=@var{file-name}
 
 File to which output should be sent.  This can be an ordinary file name
 (i.e., @code{"pspp.ps"}), a pipe (i.e., @code{"|lpr"}), or
-stdout (@code{"-"}).  Default: @code{"pspp.html"}.
+stdout (@code{"-"}).  Default: @file{"pspp.html"}.
+
+@item chart-files=@var{file-name-template}
+Template for the file names used for charts, which are output in PNG
+format.  The name should contain a single @samp{#}, which is replaced by
+the chart number.  Default: @file{"pspp-#.png"}.
 @end table
 
 @node Miscellaneous configuring,, HTML driver class, Configuration

diff --git a/src/output/ChangeLog b/src/output/ChangeLog
index 7c1d3d1c654695bd1b2aaa90e8fd9acba7fb39d5..8ed1b2a8f967ec13394e153b7585d167116da26d 100644 (file)
--- a/src/output/ChangeLog
+++ b/src/output/ChangeLog
@@ -1,3 +1,16 @@
+Sat Jul  1 17:20:03 2006  Ben Pfaff  <blp@gnu.org>
+
+       Make the destination for charts configurable in the HTML driver.
+       Fixes bug #15723, "HTML driver creates .png files insecurely".
+
+       * htmlP.h: (struct html_driver_ext) Add chart_file_name, chart_cnt
+       members.
+       
+       * html.c: (html_open_driver) Initialize new members.
+       (option_tab var) Add "chart-files" option.
+       (handle_option) Parse "chart-files" option.
+       (html_initialise_chart) Name file based on "chart-files" option.
+       
 Sat Jul  1 22:41:26 2006  Ben Pfaff  <blp@gnu.org>
 
        Fix bug #16644: Output Driver crashes in DISPLAY VARIABLES.

diff --git a/src/output/html.c b/src/output/html.c
index 951208717f8ec7a47bc964f15262511f7c45294b..b79deb45fac95c23c8ea33d543101f7c4fb84fbd 100644 (file)
--- a/src/output/html.c
+++ b/src/output/html.c
@@ -36,7 +36,8 @@
 #include "manager.h"
 #include "table.h"
 #include <libpspp/version.h>
-#include <data/make-file.h>
+
+#include "size_max.h"
 
 #include "gettext.h"
 #define _(msgid) gettext (msgid)
@@ -56,7 +57,9 @@ html_open_driver (struct outp_driver *this, struct substring options)
 
   this->ext = x = xmalloc (sizeof *x);
   x->file_name = xstrdup ("pspp.html");
+  x->chart_file_name = xstrdup ("pspp-#.png");
   x->file = NULL;
+  x->chart_cnt = 0;
 
   outp_parse_options (options, handle_option, this);
 
@@ -146,6 +149,7 @@ enum
 static struct outp_option option_tab[] =
   {
     {"output-file",            string_arg,     0},
+    {"chart-files",            string_arg,     1},
     {NULL, 0, 0},
   };
 
@@ -164,8 +168,23 @@ handle_option (struct outp_driver *this,
              key);
       break;
     case string_arg:
-      free (x->file_name);
-      x->file_name = ds_xstrdup (val);
+      switch (subcat) 
+        {
+        case 0:
+          free (x->file_name);
+          x->file_name = ds_xstrdup (val);
+          break;
+        case 1:
+          if (ds_find_char (val, '#') != SIZE_MAX) 
+            {
+              free (x->chart_file_name);
+              x->chart_file_name = ds_xstrdup (val);
+            }
+          error (0, 0, _("`chart-files' value must contain `#'"));
+          break;
+        default:
+          abort ();
+        }
       break;
     default:
       abort ();
@@ -339,20 +358,35 @@ output_tab_table (struct outp_driver *this, struct tab_table *t)
 }
 
 static void
-html_initialise_chart(struct outp_driver *d UNUSED, struct chart *ch)
+html_initialise_chart (struct outp_driver *this, struct chart *ch)
 {
-
-  FILE  *fp;
-
-  make_unique_file_stream(&fp, &ch->file_name);
-
 #ifdef NO_CHARTS
-  ch->lp = 0;
+  ch->lp = NULL;
 #else
-  ch->pl_params = pl_newplparams();
+  struct html_driver_ext *x = this->ext;
+  
+  FILE *fp;
+  int number_pos;
+
+  x->chart_cnt++;
+  
+  number_pos = strchr (x->chart_file_name, '#') - x->chart_file_name;
+  ch->file_name = xasprintf ("%.*s%d%s",
+                             number_pos, x->chart_file_name,
+                             x->chart_cnt,
+                             x->chart_file_name + number_pos + 1);
+  fp = fopen (ch->file_name, "wb");
+  if (fp == NULL) 
+    {
+      error (0, errno, _("creating \"%s\""), ch->file_name);
+      free (ch->file_name);
+      ch->file_name = NULL;
+      return;
+    }
+
+  ch->pl_params = pl_newplparams ();
   ch->lp = pl_newpl_r ("png", 0, fp, stderr, ch->pl_params);
 #endif
-
 }
 
 static void 

diff --git a/src/output/htmlP.h b/src/output/htmlP.h
index da292ab08af7a4dc21d394483eb0abb81c4036f7..f1bf3d34bff4443bfaaf88c693160d2ca59b0bed 100644 (file)
--- a/src/output/htmlP.h
+++ b/src/output/htmlP.h
@@ -26,7 +26,10 @@
 struct html_driver_ext
   {
     char *file_name;
+    char *chart_file_name;
     FILE *file;
+
+    size_t chart_cnt;
   };
 
 extern struct outp_class html_class;