On Thu, Dec 31, 2009 at 5:34 PM, Jeremy Cowgar <[email protected]> wrote:
> I just merged your user() function into trunk. Ok. Thanks. > I did not merge the CGI function into trunk as I am > unsure about all the security ramifications. The cgi function can only be used by someone with report edit permissions. So if no calls to the cgi function are added to any reports, fossil is just as secure as without the cgi function implementation. Once a call to the cgi function is added to a report, anyone viewing the report will be able to inject any value into the cgi variable referenced in the report. That value will be included in the sql, but the sql gets passed through the sqlite authorizer callback. Fossil's callback implementation allows only a single select statement to be executed and only on a small subset of the database tables. Assuming the sqlite authorizor functionality is airtight, any sort of sql injection attack should be effectively blocked by this callback. > I would like if some more knowledgable than myself > would do that merge. Ok. > BTW... in what cases do you make use of that > function? I am interested in seeing how others > are extending Fossil. I don't use it in fossil, but have used it in cvstrac reports. Usually for showing ticket assignments for the currently logged in user. Cvstrac also has cgi(), option(), and aux() functions which combine nicely with user(). For example, the option() function can be used to display a dropdown showing a list of all users with the default selection set to the output of user(). For the cgi() and _wiki_ functionality I have in my branch, I posted this example last month: http://tkoutline.sourceforge.net/cgi-bin/fossil/rptview?rn=6 The sql for report 6 is: SELECT type, '[/rptview?rn=5&type=' || type || '|' || count(type) || ']' as _wiki_count FROM ticket WHERE status IN ('Open', 'Verified') GROUP BY type ORDER BY count(type) DESC The wiki formatting is triggered by the special '_wiki_' prefix on the column name. Each row in the report 6 output has a "drill down" link to report 5. The sql for report 5 implements the "drill down" by including "type=cgi('type', 'Feature_Request')" in the where clause. When the user clicks on one of the "drill down" links the cgi parameter "type" will be passed using the corresponding value from that row's results. > I'll let that be answered by others who have more authority with fossil than > I do. How did you get commit access? Brian _______________________________________________ fossil-users mailing list [email protected] http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
