Script 'mail_helper' called by obssrc
Hello community,

here is the log from the commit of package goaccess for openSUSE:Factory 
checked in at 2022-09-02 21:56:45
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/goaccess (Old)
 and      /work/SRC/openSUSE:Factory/.goaccess.new.2083 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Package is "goaccess"

Fri Sep  2 21:56:45 2022 rev:24 rq:1000839 version:1.6.3

Changes:
--------
--- /work/SRC/openSUSE:Factory/goaccess/goaccess.changes        2022-07-15 
13:53:09.779576699 +0200
+++ /work/SRC/openSUSE:Factory/.goaccess.new.2083/goaccess.changes      
2022-09-02 21:57:08.512383451 +0200
@@ -1,0 +2,11 @@
+Fri Sep  2 08:36:25 UTC 2022 - Michael Vetter <[email protected]>
+
+- Update to 1.6.3:
+  * Enabled DNS thread when resolving a host and outputting real-time HTML.
+    This helps avoid stalling the WS server on busy connections.
+  * Fixed issue where it would not properly parse an XFF if the '%h' specifier
+    was already set.
+  * Fixed possible XSS issues when using '--html-custom-css' and
+    '--html-custom-js' by allowing valid filenames.
+
+-------------------------------------------------------------------

Old:
----
  goaccess-1.6.2.tar.gz

New:
----
  goaccess-1.6.3.tar.gz

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Other differences:
------------------
++++++ goaccess.spec ++++++
--- /var/tmp/diff_new_pack.1PqPe8/_old  2022-09-02 21:57:08.948384505 +0200
+++ /var/tmp/diff_new_pack.1PqPe8/_new  2022-09-02 21:57:08.956384525 +0200
@@ -20,7 +20,7 @@
 %global goaccess_services [email protected] [email protected]
 
 Name:           goaccess
-Version:        1.6.2
+Version:        1.6.3
 Release:        0
 Summary:        Apache Web Log Analyzer
 License:        GPL-2.0-or-later

++++++ goaccess-1.6.2.tar.gz -> goaccess-1.6.3.tar.gz ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/goaccess-1.6.2/ChangeLog new/goaccess-1.6.3/ChangeLog
--- old/goaccess-1.6.2/ChangeLog        2022-07-15 02:58:39.000000000 +0200
+++ new/goaccess-1.6.3/ChangeLog        2022-09-01 01:12:42.000000000 +0200
@@ -1,3 +1,12 @@
+Changes to GoAccess 1.6.3 - Thursday, August 31, 2022
+
+  - Enabled DNS thread when resolving a host and outputting real-time HTML.
+    This helps avoid stalling the WS server on busy connections.
+  - Fixed issue where it would not properly parse an XFF if the '%h' specifier
+    was already set.
+  - Fixed possible XSS issues when using '--html-custom-css' and
+    '--html-custom-js' by allowing valid filenames.
+
 Changes to GoAccess 1.6.2 - Thursday, July 14, 2022
 
   - Added `Android 12` to the list of OSs.
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/goaccess-1.6.2/NEWS new/goaccess-1.6.3/NEWS
--- old/goaccess-1.6.2/NEWS     2022-07-15 00:40:06.000000000 +0200
+++ new/goaccess-1.6.3/NEWS     2022-09-01 01:06:34.000000000 +0200
@@ -2,6 +2,8 @@
 Gerardo Orellana <[email protected]>
 
 * Version history:
+    - 1.6.3 [Thursday, August 31 , 2022]
+        . GoAccess 1.6.3 Released. See ChangeLog for new features/bug-fixes.
     - 1.6.2 [Thursday, July 14 , 2022]
         . GoAccess 1.6.2 Released. See ChangeLog for new features/bug-fixes.
     - 1.6.1 [Thursday, June 30 , 2022]
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/goaccess-1.6.2/configure new/goaccess-1.6.3/configure
--- old/goaccess-1.6.2/configure        2022-07-15 00:00:34.000000000 +0200
+++ new/goaccess-1.6.3/configure        2022-09-01 01:18:41.000000000 +0200
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for goaccess 1.6.2.
+# Generated by GNU Autoconf 2.69 for goaccess 1.6.3.
 #
 # Report bugs to <[email protected]>.
 #
@@ -580,8 +580,8 @@
 # Identity of this package.
 PACKAGE_NAME='goaccess'
 PACKAGE_TARNAME='goaccess'
-PACKAGE_VERSION='1.6.2'
-PACKAGE_STRING='goaccess 1.6.2'
+PACKAGE_VERSION='1.6.3'
+PACKAGE_STRING='goaccess 1.6.3'
 PACKAGE_BUGREPORT='[email protected]'
 PACKAGE_URL='https://goaccess.io'
 
@@ -1333,7 +1333,7 @@
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures goaccess 1.6.2 to adapt to many kinds of systems.
+\`configure' configures goaccess 1.6.3 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1404,7 +1404,7 @@
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of goaccess 1.6.2:";;
+     short | recursive ) echo "Configuration of goaccess 1.6.3:";;
    esac
   cat <<\_ACEOF
 
@@ -1514,7 +1514,7 @@
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-goaccess configure 1.6.2
+goaccess configure 1.6.3
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2067,7 +2067,7 @@
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by goaccess $as_me 1.6.2, which was
+It was created by goaccess $as_me 1.6.3, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -2934,7 +2934,7 @@
 
 # Define the identity of the package.
  PACKAGE='goaccess'
- VERSION='1.6.2'
+ VERSION='1.6.3'
 
 
 cat >>confdefs.h <<_ACEOF
@@ -9669,7 +9669,7 @@
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by goaccess $as_me 1.6.2, which was
+This file was extended by goaccess $as_me 1.6.3, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -9736,7 +9736,7 @@
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; 
s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-goaccess config.status 1.6.2
+goaccess config.status 1.6.3
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/goaccess-1.6.2/configure.ac 
new/goaccess-1.6.3/configure.ac
--- old/goaccess-1.6.2/configure.ac     2022-07-14 23:45:46.000000000 +0200
+++ new/goaccess-1.6.3/configure.ac     2022-09-01 01:06:49.000000000 +0200
@@ -2,7 +2,7 @@
 # Process this file with autoconf to produce a configure script.
 
 AC_PREREQ([2.69])
-AC_INIT([goaccess],[1.6.2],[[email protected]],[],[https://goaccess.io])
+AC_INIT([goaccess],[1.6.3],[[email protected]],[],[https://goaccess.io])
 AM_INIT_AUTOMAKE
 AC_CONFIG_SRCDIR([src/goaccess.c])
 AC_CONFIG_HEADERS([src/config.h])
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/goaccess-1.6.2/goaccess.1 
new/goaccess-1.6.3/goaccess.1
--- old/goaccess-1.6.2/goaccess.1       2022-07-15 03:12:07.000000000 +0200
+++ new/goaccess-1.6.3/goaccess.1       2022-09-01 00:46:32.000000000 +0200
@@ -1,4 +1,4 @@
-.TH goaccess 1 "JULY 2022" GNU+Linux "User Manuals"
+.TH goaccess 1 "AUGUST 2022" GNU+Linux "User Manuals"
 .SH NAME
 goaccess \- fast web log analyzer and interactive viewer.
 .SH SYNOPSIS
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/goaccess-1.6.2/po/de.po new/goaccess-1.6.3/po/de.po
--- old/goaccess-1.6.2/po/de.po 2022-07-15 03:06:01.000000000 +0200
+++ new/goaccess-1.6.3/po/de.po 2022-09-01 01:19:06.000000000 +0200
@@ -7,7 +7,7 @@
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: [email protected]\n"
-"POT-Creation-Date: 2022-07-14 20:06-0500\n"
+"POT-Creation-Date: 2022-08-31 18:19-0500\n"
 "PO-Revision-Date: 2019-05-05 16:03+0200\n"
 "Last-Translator: Axel Wehner <[email protected]>\n"
 "Language: de\n"
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/goaccess-1.6.2/po/es.po new/goaccess-1.6.3/po/es.po
--- old/goaccess-1.6.2/po/es.po 2022-07-15 03:06:01.000000000 +0200
+++ new/goaccess-1.6.3/po/es.po 2022-09-01 01:19:06.000000000 +0200
@@ -7,7 +7,7 @@
 msgstr ""
 "Project-Id-Version: Goaccess\n"
 "Report-Msgid-Bugs-To: [email protected]\n"
-"POT-Creation-Date: 2022-07-14 20:06-0500\n"
+"POT-Creation-Date: 2022-08-31 18:19-0500\n"
 "PO-Revision-Date: 2017-08-04 13:00-0300\n"
 "Last-Translator: Enrique Becerra <[email protected]>\n"
 "Language-Team: \n"
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/goaccess-1.6.2/po/fr.po new/goaccess-1.6.3/po/fr.po
--- old/goaccess-1.6.2/po/fr.po 2022-07-15 03:06:01.000000000 +0200
+++ new/goaccess-1.6.3/po/fr.po 2022-09-01 01:19:06.000000000 +0200
@@ -6,7 +6,7 @@
 msgstr ""
 "Project-Id-Version: goaccess 1.4\n"
 "Report-Msgid-Bugs-To: [email protected]\n"
-"POT-Creation-Date: 2022-07-14 20:06-0500\n"
+"POT-Creation-Date: 2022-08-31 18:19-0500\n"
 "PO-Revision-Date: 2020-07-10 11:44+0200\n"
 "Last-Translator: Coban L. <[email protected]>\n"
 "Language-Team: fran??ais\n"
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/goaccess-1.6.2/po/goaccess.pot 
new/goaccess-1.6.3/po/goaccess.pot
--- old/goaccess-1.6.2/po/goaccess.pot  2022-07-15 03:06:01.000000000 +0200
+++ new/goaccess-1.6.3/po/goaccess.pot  2022-09-01 01:19:06.000000000 +0200
@@ -6,9 +6,9 @@
 #, fuzzy
 msgid ""
 msgstr ""
-"Project-Id-Version: goaccess 1.6.2\n"
+"Project-Id-Version: goaccess 1.6.3\n"
 "Report-Msgid-Bugs-To: [email protected]\n"
-"POT-Creation-Date: 2022-07-14 20:06-0500\n"
+"POT-Creation-Date: 2022-08-31 18:19-0500\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <[email protected]>\n"
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/goaccess-1.6.2/po/it.po new/goaccess-1.6.3/po/it.po
--- old/goaccess-1.6.2/po/it.po 2022-07-15 03:06:01.000000000 +0200
+++ new/goaccess-1.6.3/po/it.po 2022-09-01 01:19:07.000000000 +0200
@@ -7,7 +7,7 @@
 msgstr ""
 "Project-Id-Version: Goaccess\n"
 "Report-Msgid-Bugs-To: [email protected]\n"
-"POT-Creation-Date: 2022-07-14 20:06-0500\n"
+"POT-Creation-Date: 2022-08-31 18:19-0500\n"
 "PO-Revision-Date: 2017-08-04 13:00-0300\n"
 "Last-Translator: Mario Donnarumma <[email protected]>\n"
 "Language-Team: \n"
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/goaccess-1.6.2/po/ja.po new/goaccess-1.6.3/po/ja.po
--- old/goaccess-1.6.2/po/ja.po 2022-07-15 03:06:01.000000000 +0200
+++ new/goaccess-1.6.3/po/ja.po 2022-09-01 01:19:06.000000000 +0200
@@ -7,7 +7,7 @@
 msgstr ""
 "Project-Id-Version: goaccess 1.3\n"
 "Report-Msgid-Bugs-To: [email protected]\n"
-"POT-Creation-Date: 2022-07-14 20:06-0500\n"
+"POT-Creation-Date: 2022-08-31 18:19-0500\n"
 "PO-Revision-Date: 2020-08-19 06:27+0900\n"
 "Last-Translator: Kamino <[email protected]>\n"
 "Language-Team: Japanese\n"
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/goaccess-1.6.2/po/pt_BR.po 
new/goaccess-1.6.3/po/pt_BR.po
--- old/goaccess-1.6.2/po/pt_BR.po      2022-07-15 03:06:01.000000000 +0200
+++ new/goaccess-1.6.3/po/pt_BR.po      2022-09-01 01:19:06.000000000 +0200
@@ -7,7 +7,7 @@
 msgstr ""
 "Project-Id-Version: Goaccess\n"
 "Report-Msgid-Bugs-To: [email protected]\n"
-"POT-Creation-Date: 2022-07-14 20:06-0500\n"
+"POT-Creation-Date: 2022-08-31 18:19-0500\n"
 "PO-Revision-Date: 2019-04-25 20:34-0300\n"
 "Last-Translator: Alan Placidina Maria <[email protected]>\n"
 "Language-Team: \n"
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/goaccess-1.6.2/po/ru.po new/goaccess-1.6.3/po/ru.po
--- old/goaccess-1.6.2/po/ru.po 2022-07-15 03:06:01.000000000 +0200
+++ new/goaccess-1.6.3/po/ru.po 2022-09-01 01:19:06.000000000 +0200
@@ -7,7 +7,7 @@
 msgstr ""
 "Project-Id-Version: goaccess 1.5.6\n"
 "Report-Msgid-Bugs-To: [email protected]\n"
-"POT-Creation-Date: 2022-07-14 20:06-0500\n"
+"POT-Creation-Date: 2022-08-31 18:19-0500\n"
 "PO-Revision-Date: 2022-04-21 10:17+0300\n"
 "Last-Translator: Artyom Karlov <[email protected]>\n"
 "Language-Team: \n"
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/goaccess-1.6.2/po/sv.po new/goaccess-1.6.3/po/sv.po
--- old/goaccess-1.6.2/po/sv.po 2022-07-15 03:06:01.000000000 +0200
+++ new/goaccess-1.6.3/po/sv.po 2022-09-01 01:19:06.000000000 +0200
@@ -7,7 +7,7 @@
 msgstr ""
 "Project-Id-Version: goaccess 1.3\n"
 "Report-Msgid-Bugs-To: [email protected]\n"
-"POT-Creation-Date: 2022-07-14 20:06-0500\n"
+"POT-Creation-Date: 2022-08-31 18:19-0500\n"
 "PO-Revision-Date: 2018-12-13 22:48-0600\n"
 "Last-Translator: Anders Johansson <[email protected]>\n"
 "Language-Team: none\n"
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/goaccess-1.6.2/po/uk.po new/goaccess-1.6.3/po/uk.po
--- old/goaccess-1.6.2/po/uk.po 2022-07-15 03:06:01.000000000 +0200
+++ new/goaccess-1.6.3/po/uk.po 2022-09-01 01:19:06.000000000 +0200
@@ -7,7 +7,7 @@
 msgstr ""
 "Project-Id-Version: goaccess 1.5.6\n"
 "Report-Msgid-Bugs-To: [email protected]\n"
-"POT-Creation-Date: 2022-07-14 20:06-0500\n"
+"POT-Creation-Date: 2022-08-31 18:19-0500\n"
 "PO-Revision-Date: 2022-04-21 10:17+0300\n"
 "Last-Translator: Artyom Karlov <[email protected]>\n"
 "Language-Team: \n"
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/goaccess-1.6.2/po/zh_CN.po 
new/goaccess-1.6.3/po/zh_CN.po
--- old/goaccess-1.6.2/po/zh_CN.po      2022-07-15 03:06:01.000000000 +0200
+++ new/goaccess-1.6.3/po/zh_CN.po      2022-09-01 01:19:06.000000000 +0200
@@ -5,7 +5,7 @@
 msgstr ""
 "Project-Id-Version: goaccess 1.5.6\n"
 "Report-Msgid-Bugs-To: [email protected]\n"
-"POT-Creation-Date: 2022-07-14 20:06-0500\n"
+"POT-Creation-Date: 2022-08-31 18:19-0500\n"
 "PO-Revision-Date: 2017-04-03 09:43+0200\n"
 "Last-Translator: Ai<[email protected]>\n"
 "Language-Team: Ai\n"
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/goaccess-1.6.2/resources/js/app.js 
new/goaccess-1.6.3/resources/js/app.js
--- old/goaccess-1.6.2/resources/js/app.js      2022-07-14 23:41:31.000000000 
+0200
+++ new/goaccess-1.6.3/resources/js/app.js      2022-09-01 00:25:25.000000000 
+0200
@@ -114,7 +114,7 @@
                        if (wsConn.ping_interval)
                                pingId = setInterval(() => { 
socket.send('ping'); }, wsConn.ping_interval * 1E3);
 
-                       GoAccess.Nav.WSOpen();
+                       GoAccess.Nav.WSOpen(str);
                }.bind(this);
 
                socket.onmessage = function (event) {
@@ -245,7 +245,7 @@
                        val = value;
                }
 
-               return value == 0 ? String(val) : val;
+               return value == 0 ? String(val) : (val === undefined ? '???' : 
val);
        },
 
        isPanelHidden: function (panel) {
@@ -671,10 +671,10 @@
                });
        },
 
-       WSOpen: function () {
+       WSOpen: function (str) {
                $$('.nav-ws-status', function (item) {
                        item.classList.add('connected');
-                       item.setAttribute('title', 'Connected to ' + 
GoAccess.AppWSConn.url);
+                       item.setAttribute('title', 'Connected to ' + str);
                });
        },
 
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/goaccess-1.6.2/src/commons.h 
new/goaccess-1.6.3/src/commons.h
--- old/goaccess-1.6.2/src/commons.h    2022-07-14 23:45:31.000000000 +0200
+++ new/goaccess-1.6.3/src/commons.h    2022-09-01 01:07:06.000000000 +0200
@@ -43,7 +43,7 @@
 #define __attribute__(x) /**/
 #endif
 #define GO_UNUSED __attribute__((unused))
-#define GO_VERSION             "1.6.2"
+#define GO_VERSION             "1.6.3"
 #define GO_WEBSITE             "https://goaccess.io/";
 extern struct tm now_tm;
 
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/goaccess-1.6.2/src/gholder.c 
new/goaccess-1.6.3/src/gholder.c
--- old/goaccess-1.6.2/src/gholder.c    2022-07-14 23:41:31.000000000 +0200
+++ new/goaccess-1.6.3/src/gholder.c    2022-09-01 00:45:07.000000000 +0200
@@ -365,7 +365,8 @@
 #endif
 
   /* hostname */
-  if (conf.enable_html_resolver && conf.output_stdout && 
!conf.no_ip_validation) {
+  if (conf.enable_html_resolver && conf.output_stdout && 
!conf.no_ip_validation &&
+      !conf.real_time_html) {
     hostname = reverse_ip (host);
     set_host_child_metrics (hostname, MTRC_ID_HOSTNAME, &nmetrics);
     add_sub_item_back (sub_list, h->module, nmetrics);
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/goaccess-1.6.2/src/goaccess.c 
new/goaccess-1.6.3/src/goaccess.c
--- old/goaccess-1.6.2/src/goaccess.c   2022-07-14 23:41:31.000000000 +0200
+++ new/goaccess-1.6.3/src/goaccess.c   2022-09-01 00:45:07.000000000 +0200
@@ -1247,6 +1247,10 @@
   init_storage ();
   insert_methods_protocols ();
   set_spec_date_format ();
+
+  if ((!conf.skip_term_resolver && !conf.output_stdout) ||
+      (conf.enable_html_resolver && conf.real_time_html))
+    gdns_thread_create ();
 }
 
 /* Determine the type of output, i.e., JSON, CSV, HTML */
@@ -1273,8 +1277,6 @@
 static void
 curses_output (Logs * logs) {
   allocate_data ();
-  if (!conf.skip_term_resolver)
-    gdns_thread_create ();
 
   clean_stdscrn ();
   render_screens (0);
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/goaccess-1.6.2/src/options.c 
new/goaccess-1.6.3/src/options.c
--- old/goaccess-1.6.2/src/options.c    2022-06-25 18:35:28.000000000 +0200
+++ new/goaccess-1.6.3/src/options.c    2022-09-01 00:45:07.000000000 +0200
@@ -37,6 +37,7 @@
 #include <string.h>
 #include <getopt.h>
 #include <errno.h>
+#include <unistd.h>
 
 #ifdef HAVE_LIBGEOIP
 #include <GeoIP.h>
@@ -348,12 +349,22 @@
     conf.color_scheme = atoi (oarg);
 
   /* html custom CSS */
-  if (!strcmp ("html-custom-css", name))
+  if (!strcmp ("html-custom-css", name)) {
+    if (strpbrk (oarg, "&\"'<>"))
+      FATAL ("Invalid filename. The following chars are not allowed in 
filename: [\"'&<>]\n");
+    if (access (oarg, F_OK) != 0)
+      FATAL ("Unable to open custom CSS filename: %s\n", oarg);
     conf.html_custom_css = oarg;
+  }
 
   /* html custom JS */
-  if (!strcmp ("html-custom-js", name))
+  if (!strcmp ("html-custom-js", name)) {
+    if (strpbrk (oarg, "&\"'<>"))
+      FATAL ("Invalid filename. The following chars are not allowed in 
filename: [\"'&<>]\n");
+    if (access (oarg, F_OK) != 0)
+      FATAL ("Unable to open custom JS filename: %s\n", oarg);
     conf.html_custom_js = oarg;
+  }
 
   /* html JSON object containing default preferences */
   if (!strcmp ("html-prefs", name))
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/goaccess-1.6.2/src/parser.c 
new/goaccess-1.6.3/src/parser.c
--- old/goaccess-1.6.2/src/parser.c     2022-07-14 23:42:03.000000000 +0200
+++ new/goaccess-1.6.3/src/parser.c     2022-09-01 00:45:07.000000000 +0200
@@ -1373,8 +1373,6 @@
   switch (**p) {
     /* XFF remote hostname (IP only) */
   case 'h':
-    if (logitem->host)
-      return 0;
     if (find_xff_host (logitem, str, p))
       return spec_err (logitem, SPEC_TOKN_NUL, 'h', NULL);
     break;

Reply via email to