Changed referer handling

diff --git a/CHANGELOG b/CHANGELOG
index c921942..2da6efe 100644 (file)
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -83,3 +83,4 @@ All images, CSS and other static content served by Webmin has an HTTP Expires fo
 Lock files are automatically removed when the process creating them exits.
 NetBSD 4.0 support.
 Italian and Catalan translations contributed for many modules, thanks to Giovanni and Jaume Badiella.
+Changed the error message that appears when Webmin detects a link from another web page, and removed the button to allow the link (which was unreliable anyway).

diff --git a/makedist.pl b/makedist.pl
index a78659b..9a6992e 100755 (executable)
--- a/makedist.pl
+++ b/makedist.pl
@@ -26,7 +26,7 @@ $zipdir = "zips";
          "webmin-init", "webmin-caldera-init", "webmin-daemon",
          "config-openbsd",
          "config-macos", "LICENCE", "PATENTS",
-         "session_login.cgi", "referer_save.cgi", "acl_security.pl",
+         "session_login.cgi", "acl_security.pl",
          "defaultacl", "rpc.cgi", "date_chooser.cgi", "switch_skill.cgi",
          "install-module.pl", "LICENCE.ja", 
          "favicon.ico", "config-netbsd", "fastrpc.cgi",
@@ -37,7 +37,7 @@ $zipdir = "zips";
          "config-lib.pl", "entities_map.txt", "ui-lib.pl",
          "password_form.cgi", "password_change.cgi", "pam_login.cgi",
          "module_chooser.cgi", "config-windows", "xmlrpc.cgi",
-         "uptracker.cgi", "create-module.pl" );
+         "uptracker.cgi", "create-module.pl", "webmin_search.cgi" );
 if ($min) {
        # Only those required by others
        @mlist = ("cron", "init", "inittab", "proc", "webmin", "acl", "servers",
@@ -67,7 +67,7 @@ else {
          "smart-status", "idmapd", "krb5", "smf", "ipfilter", "rbac",
          "tunnel", "zones", "cluster-usermin", "dovecot", "syslog-ng",
          "mailcap", "blue-theme", "ldap-client", "phpini", "filter",
-         "bacula-backup",
+         "bacula-backup", "ldap-server",
          );
        }
 @dirlist = ( "Webmin" );

diff --git a/referer_save.cgi b/referer_save.cgi
deleted file mode 100755 (executable)
index 0688cc6..0000000
--- a/referer_save.cgi
+++ /dev/null
@@ -1,17 +0,0 @@
-#!/usr/local/bin/perl
-# redirect_save.cgi
-# Redirect to the original URL, and optionally save the redirect flag
-
-require './web-lib.pl';
-&init_config();
-&ReadParse();
-
-# ONLY relative URLs are allowed
-$in{'referer_original'} =~ /^\// || &error($text{'referer_eurl'});
-
-if ($in{'referer_again'}) {
-       $gconfig{'referer'} = 1;
-       &write_file("$config_directory/config", \%gconfig);
-       }
-&redirect($in{'referer_original'});
-

diff --git a/web-lib-funcs.pl b/web-lib-funcs.pl
index 646ec0f..147720d 100755 (executable)
--- a/web-lib-funcs.pl
+++ b/web-lib-funcs.pl
@@ -2732,39 +2732,27 @@ if ($0 && $ENV{'SCRIPT_NAME'} !~ /^\/(index.cgi)?$/ &&
     ($referer_site && $referer_site ne $http_host &&
      &indexof($referer_site, @referers) < 0 ||
     !$referer_site && $gconfig{'referers_none'} && !$trust_unknown_referers)) {
-       # Looks like a link from elsewhere ..
-       if ($0 =~ /referer_save.cgi/) {
-               # Referer link direct to ourselves!
-               &error($text{'referer_eself'});
-               }
+       # Looks like a link from elsewhere .. show an error
        &header($text{'referer_title'}, "", undef, 0, 1, 1);
-       print "<hr><center>\n";
-       print "<form action=$gconfig{'webprefix'}/referer_save.cgi>\n";
-       &ReadParse();
-       foreach my $k (keys %in) {
-               next if ($k eq "referer_original" ||
-                        $k eq "referer_again");
-               foreach my $kk (split(/\0/, $in{$k})) {
-                       print "<input type=hidden name=\"".&quote_escape($k).
-                             "\" value=\"".&quote_escape($kk)."\">\n";
-                       }
-               }
-       print "<input type=hidden name=referer_original ",
-             "value=\"".&quote_escape($ENV{'REQUEST_URI'})."\">\n";
 
        $prot = lc($ENV{'HTTPS'}) eq 'on' ? "https" : "http";
        local $url = "<tt>".&html_escape("$prot://$ENV{'HTTP_HOST'}$ENV{'REQUEST_URI'}")."</tt>";
        if ($referer_site) {
-               print "<p>",&text('referer_warn',
-                     "<tt>".&html_escape($ENV{'HTTP_REFERER'})."</tt>", $url),"<p>\n";
+               # From a known host
+               print &text('referer_warn',
+                    "<tt>".&html_escape($ENV{'HTTP_REFERER'})."</tt>", $url);
+               print "<p>\n";
+               print &text('referer_fix1', &html_escape($http_host)),"<p>\n";
+               print &text('referer_fix2', &html_escape($http_host)),"<p>\n";
                }
        else {
-               print "<p>",&text('referer_warn_unknown', $url),"<p>\n";
+               # No referer info given
+               print &text('referer_warn_unknown', $url),"<p>\n";
+               print &text('referer_fix1u'),"<p>\n";
+               print &text('referer_fix2u'),"<p>\n";
                }
-       print "<input type=submit value='$text{'referer_ok'}'><br>\n";
-       print "<input type=checkbox name=referer_again value=1> ",
-             "$text{'referer_again'}<p>\n";
-       print "</form></center><hr>\n";
+       print "<p>\n";
+
        &footer("/", $text{'index'});
        exit;
        }