Fix XSS
[webmin.git] / module_chooser.cgi
1 #!/usr/local/bin/perl
2 # This CGI generates the HTML for choosing a module or list of modules
3
4 $trust_unknown_referers = 1;
5 require './web-lib.pl';
6 &init_config();
7 &ReadParse(undef, undef, 2);
8 %access = &get_module_acl();
9
10 if ($in{'multi'}) {
11         # selecting multiple modules
12         if ($in{'frame'} == 0) {
13                 # base frame
14                 &PrintHeader();
15                 print "<script>\n";
16                 @ul = split(/\s+/, $in{'module'});
17                 $len = @ul;
18                 print "sel = new Array($len);\n";
19                 print "selr = new Array($len);\n";
20                 for($i=0; $i<$len; $i++) {
21                         %minfo = &get_module_info($ul[$i]);
22                         if (%minfo) {
23                                 print "sel[$i] = \"$ul[$i]\";\n";
24                                 print "selr[$i] = \"$minfo{'desc'}\";\n";
25                                 }
26                         }
27                 print "</script>\n";
28                 print "<title>$text{'modules_title1'}</title>\n";
29                 print "<frameset cols='50%,50%'>\n";
30                 print "<frame src=\"/module_chooser.cgi?frame=1&multi=1\">\n";
31                 print "<frameset rows='*,50' frameborder=no>\n";
32                 print " <frame src=\"/module_chooser.cgi?frame=2&multi=1\">\n";
33                 print " <frame src=\"/module_chooser.cgi?frame=3&multi=1\" scrolling=no>\n";
34                 print "</frameset>\n";
35                 print "</frameset>\n";
36                 }
37         elsif ($in{'frame'} == 1) {
38                 # list of all modules to choose from
39                 &popup_header();
40                 print "<script>\n";
41                 print "function addmodule(u, r)\n";
42                 print "{\n";
43                 print "top.sel[top.sel.length] = u\n";
44                 print "top.selr[top.selr.length] = r\n";
45                 print "top.frames[1].location = top.frames[1].location\n";
46                 print "return false;\n";
47                 print "}\n";
48                 print "</script>\n";
49                 print "<font size=+1>$text{'modules_all'}</font>\n";
50                 print "<table width=100%>\n";
51                 foreach $m (&get_all_module_infos()) {
52                         if ($in{'module'} eq $m->{'dir'}) { print "<tr $cb>\n"; }
53                         else { print "<tr>\n"; }
54                         print "<td width=20%><a href=\"\" onClick='return addmodule(\"$m->{'dir'}\", \"$m->{'desc'}\")'>$m->{'dir'}</a></td>\n";
55                         print "<td>$m->{'desc'}</td> </tr>\n";
56                         }
57                 print "</table>\n";
58                 &popup_footer();
59                 }
60         elsif ($in{'frame'} == 2) {
61                 # show chosen modules
62                 &popup_header();
63                 print "<font size=+1>$text{'modules_sel'}</font>\n";
64                 print <<'EOF';
65 <table width=100%>
66 <script>
67 function sub(j)
68 {
69 sel2 = new Array(); selr2 = new Array();
70 for(k=0,l=0; k<top.sel.length; k++) {
71         if (k != j) {
72                 sel2[l] = top.sel[k];
73                 selr2[l] = top.selr[k];
74                 l++;
75                 }
76         }
77 top.sel = sel2; top.selr = selr2;
78 top.frames[1].location = top.frames[1].location;
79 return false;
80 }
81 for(i=0; i<top.sel.length; i++) {
82         document.write("<tr>\n");
83         document.write("<td><a href=\"\" onClick='return sub("+i+")'>"+top.sel[i]+"</a></td>\n");
84         document.write("<td>"+top.selr[i]+"</td>\n");
85         }
86 </script>
87 </table>
88 EOF
89                 &popup_footer();
90                 }
91         elsif ($in{'frame'} == 3) {
92                 # output OK and Cancel buttons
93                 &popup_header();
94                 print "<script>\n";
95                 print "function qjoin(l)\n";
96                 print "{\n";
97                 print "rv = \"\";\n";
98                 print "for(i=0; i<l.length; i++) {\n";
99                 print "    if (rv != '') rv += ' ';\n";
100                 print "    if (l[i].indexOf(' ') < 0) rv += l[i];\n";
101                 print "    else rv += '\"'+l[i]+'\"'\n";
102                 print "    }\n";
103                 print "return rv;\n";
104                 print "}\n";
105                 print "</script>\n";
106                 print "<form>\n";
107                 print "<input type=button value=\"$text{'modules_ok'}\" ",
108                       "onClick='top.opener.ifield.value = qjoin(top.sel); ",
109                       "top.close()'>\n";
110                 print "<input type=button value=\"$text{'modules_cancel'}\" ",
111                       "onClick='top.close()'>\n";
112                 print "&nbsp;&nbsp;<input type=button value=\"$text{'modules_clear'}\" onClick='top.sel = new Array(); top.selr = new Array(); top.frames[1].location = top.frames[1].location'>\n";
113                 print "</form>\n";
114                 &popup_footer();
115                 }
116         }
117 else {
118         # selecting just one module .. display a list of all modules to
119         # choose from
120         &popup_header($text{'modules_title2'});
121         print "<script>\n";
122         print "function select(f)\n";
123         print "{\n";
124         print "top.opener.ifield.value = f;\n";
125         print "top.close();\n";
126         print "return false;\n";
127         print "}\n";
128         print "</script>\n";
129         print "<table width=100%>\n";
130         foreach $m (&get_all_module_infos()) {
131                 if ($in{'user'} eq $m->{'dir'}) { print "<tr $cb>\n"; }
132                 else { print "<tr>\n"; }
133                 print "<td width=20%><a href=\"\" onClick='return select(\"$m->{'dir'}\")'>$m->{'dir'}</a></td>\n";
134                 print "<td>$m->{'dir'}</td> </tr>\n";
135                 }
136         print "</table>\n";
137         &popup_footer();
138         }
139
140