diff --git a/utils.lua b/utils.lua index 3f2742a..8ae5aa4 100644 --- a/utils.lua +++ b/utils.lua @@ -68,16 +68,18 @@ end --- @return string? content_type the content type of the attached file, or nil if entry is not a file. --- @return string data the value of the entry. --- We are doing some severe assumptions here. ---- - Firstly we assume that if the first line of a header doesn't start with ---- `Content-Disposition`, it is invalid and we can ignore it. ---- - Secondly we assume that in the headers, any `CR` is always gonna be +--- - Firstly we assume that in the headers, any `CR` is always gonna be --- followed by a `LF` thus we only check for CR and advance by 2 when found ---- - Thirdly we assume that the only headers that can matter are +--- - Secondly we assume that the only headers that can matter are --- `Content-Disposition` (for the field name) and `Content-Type` (if this is a --- file upload for the type of the uploaded file. ---- - Fourthly we assume a field name can't contain a double quote +--- - Thirdly we assume a field name can't contain a double quote, even escaped +--- +--- Additionaly if the entry is bogus or something goes wrong the function may +--- abort and return `"", nil, ""` instead. _m.parse_form_entry = function(entry) - if #entry < 10 then return "", nil, "" end + -- If an entry is less than 32 bytes, it's bogus, skip + if #entry < 32 then return "", nil, "" end local cursor = 3 local name, ctype while true do @@ -99,7 +101,8 @@ _m.parse_form_entry = function(entry) while entry:sub(cursor, cursor) ~= "\r" do cursor = cursor + 1 end cursor = cursor + 2 --[[ CRLF ]] end - if cursor == oldcursor then print(entry) os.exit(1); end + -- If we didn't advance the cursor, something went very wrong, skip + if cursor == oldcursor then print(entry) return "", nil, "" end end return name, ctype, entry:sub(cursor, -1) end diff --git a/yqform.etlua b/yqform.etlua index eac8274..94f0325 100644 --- a/yqform.etlua +++ b/yqform.etlua @@ -6,9 +6,18 @@

Yokoka’s Quest-style Profile generator

THIS IS WORK IN PROGRESS, THIS IS NON FUNCTIONAL, PLEASE DO NOT USE YET

- 
-      <%=data%>
-
+ <% if args %> +

Information Gathered

+

General Information

+
+
Name
+
<%= args.name.v %>
+
Avatar
+
+
Is Leader
+
<% if avatar.isLeader and avatar.isLeader.v == 1 then %>YES<% else %>NO<% end %>
+
+ <% end %>

General Information

diff --git a/yqtemplate.lua b/yqtemplate.lua index 6ca875c..bce4ceb 100644 --- a/yqtemplate.lua +++ b/yqtemplate.lua @@ -10,12 +10,14 @@ return { run = function(fcgi) fcgi.print("Content-Type: text/html; charset=utf-8\r\n\r\n") local data = "" + local args = nil if fcgi.getenv("REQUEST_METHOD") == "POST" then + args = {} local content_type = fcgi.getenv("CONTENT_TYPE") local boundary = content_type:match("; boundary=(.*)$") local post_data = fcgi.post() data = "Content type:" .. content_type .. "\n Boundary: " .. boundary .. "\n" - local args = {} + for w in string.gmatch(post_data, "(.-)" .. boundary) do local name, dtype, value = utils.parse_form_entry(w) args[name] = { t = dtype, v = value } @@ -31,7 +33,8 @@ return { end fcgi.print( form { - data = data, + encoder = utils.tobase64, + args = args, classes = { "Beast", "Swordsman",