715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
|
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
|
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
+
-
-
+
+
+
|
(cons header pagedat))))
(define (session:log self . msg)
(with-output-to-port (sdat-get-log-port self) ;; (sdat-get-logpt self)
(lambda ()
(apply print msg))))
;; escape, convert or return raw when given user input data that potentially
;; could be malicious
;;
(define (session:apply-type-preference res params)
(let* ((dtype (if (null? params)
'escaped
(car params)))
(tags (if (null? params)
'()
(cdr params))))
(case dtype
((raw) res)
((number) (if (string? res)(string->number res) #f))
((escaped) (if (string? res)
(s:html-filter->string res tags)
res))
(else (if (string? res)
(s:html-filter->string res '())
res)))))
(define (session:get-param self key)
(define (session:get-param self key type-params)
;; (session:log s:session "params=" (slot-ref s:session 'params))
(let ((params (sdat-get-params self)))
(session:get-param-from params key)))
(let* ((params (sdat-get-params self))
(res (session:get-param-from params key)))
(session:apply-type-preference res type-params)))
;; This one will get the first value found regardless of form
;; param: (dtype [tag1 tag2 ...])
;; dtype:
;; 'raw : do no conversion
;; 'number : convert to number, return #f if fails
;; 'escaped : use html-escape to protect the input -- this is the default
|
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
|
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
|
-
+
|
(if (and (vector? formdat)(eq? (vector-length formdat) 1)(hash-table? (vector-ref formdat 0)))
(formdat:keys formdat)
(begin
(session:log self "ERROR: formdat: " formdat " is not of class <formdat>")
#f)))))
(define (session:run-actions self)
(let* ((action (session:get-param self 'action))
(let* ((action (session:get-param self 'action '(raw)))
(page (sdat-get-page self)))
;; (print "action=" action " page=" page)
(if action
(let ((action-lst (string-split action ".")))
;; (print "action-lst=" action-lst)
(if (not (= (length action-lst) 2))
(err:log "Action should be of form: module.action")
|