From af16cbf9dec8002a416fff240f4e6af515bbf33b Mon Sep 17 00:00:00 2001 From: Krytarik Raido Date: Tue, 29 Jun 2021 19:56:04 +0200 Subject: [PATCH] Also HTML-escape comments on web page, fix a few minor things. --- server.py | 72 +++++++++++++++++++++++++++---------------------------- 1 file changed, 36 insertions(+), 36 deletions(-) diff --git a/server.py b/server.py index 7ac02af..caeeaa5 100644 --- a/server.py +++ b/server.py @@ -15,6 +15,7 @@ channels = [] # empty to allow view of all channels recorded, otherwise restrict auth = '%s:%s' % (username,password) base64string = base64.b64encode(auth.encode('utf-8')).decode('utf-8') + def timeElapsed(elapsed, short=False, leadingZeroes=False, years=True, weeks=True, days=True, hours=True, minutes=True, seconds=True): """Given seconds, returns a string with an English description of @@ -58,6 +59,10 @@ def timeElapsed(elapsed, short=False, leadingZeroes=False, years=True, else: return format('%L', ret) +def htmlEscape(text): + return text.replace('&','&').replace('<','<').replace('>','>').replace('"','"') + + class MyHandler(http.server.BaseHTTPRequestHandler): if not standalone: def log_request(self, *args): @@ -148,11 +153,11 @@ class MyHandler(http.server.BaseHTTPRequestHandler): r = c.fetchall() if len(r): ban = r[0] - (id,channel,oper,kind,mask,begin_at,end_at,removed_at,removed_by) = ban + (bid,channel,oper,kind,mask,begin_at,end_at,removed_at,removed_by) = ban if not channels or channel in channels: body.extend([ - '

#%d

' % id, - '

#%d by %s' % (id,h,q,utils.web.urlencode({'oper':oper}),oper), + '

#%d

' % bid, + '

#%d by %s' % (bid,h,q,utils.web.urlencode({'oper':oper}),oper), 'in %s:' % (h,q,channel.split('#')[1],channel), '+%s %s

' % (kind,h,q,utils.web.urlencode({'mask':mask}),mask), '

Begin at %s

' % time.strftime('%Y-%m-%d %H:%M:%S GMT',time.gmtime(float(begin_at))) @@ -170,28 +175,25 @@ class MyHandler(http.server.BaseHTTPRequestHandler): body.extend(['

Removed after %s' % timeElapsed(float(removed_at)-float(begin_at)), 'on %s' % time.strftime('%Y-%m-%d %H:%M:%S GMT',time.gmtime(float(removed_at))), 'by %s

' % (h,q,utils.web.urlencode({'removed_by':removed_by}),removed_by)]) - c.execute("""SELECT full,log FROM nicks WHERE ban_id=?""",(id,)) + c.execute("""SELECT full,log FROM nicks WHERE ban_id=?""",(bid,)) r = c.fetchall() if len(r): body.append('

Logs

') - for nick in r: - (full,log) = nick + for (full,log) in r: body.append('

for %s

' % full) if log != '': body.append('') - c.execute("""SELECT oper,at,comment FROM comments WHERE ban_id=?""",(id,)) + c.execute("""SELECT oper,at,comment FROM comments WHERE ban_id=?""",(bid,)) r = c.fetchall() if len(r): body.extend(['

Comments

', '') c.close() write(subtitle, body) @@ -223,13 +225,12 @@ class MyHandler(http.server.BaseHTTPRequestHandler): L = [] a = {} if len(r): - d = {} - for ban in r: - (id,full) = ban - if id not in d: - d[id] = id - for id in d: - c.execute("""SELECT id,channel,oper,kind,mask,begin_at,end_at,removed_at,removed_by FROM bans WHERE id=?""",(id,)) + d = [] + for (bid,full) in r: + if bid not in d: + d.append(bid) + for bid in d: + c.execute("""SELECT id,channel,oper,kind,mask,begin_at,end_at,removed_at,removed_by FROM bans WHERE id=?""",(bid,)) r = c.fetchall() if len(r): for ban in r: @@ -261,13 +262,12 @@ class MyHandler(http.server.BaseHTTPRequestHandler): L = [] a = {} if len(r): - d = {} - for ban in r: - (id,full) = ban - if id not in d: - d[id] = id - for id in d: - c.execute("""SELECT id,channel,oper,kind,mask,begin_at,end_at,removed_at,removed_by FROM bans WHERE id=?""",(id,)) + d = [] + for (bid,full) in r: + if bid not in d: + d.append(bid) + for bid in d: + c.execute("""SELECT id,channel,oper,kind,mask,begin_at,end_at,removed_at,removed_by FROM bans WHERE id=?""",(bid,)) r = c.fetchall() if len(r): for ban in r: @@ -285,14 +285,13 @@ class MyHandler(http.server.BaseHTTPRequestHandler): r = c.fetchall() else: r = [] - d = {} if len(r): - for ban in r: - (id,full) = ban - d[id] = id - for id in d: - if id not in a: - c.execute("""SELECT id,channel,oper,kind,mask,begin_at,end_at,removed_at,removed_by FROM bans WHERE id=?""",(id,)) + d = [] + for (bid,full) in r: + d.append(bid) + for bid in d: + if bid not in a: + c.execute("""SELECT id,channel,oper,kind,mask,begin_at,end_at,removed_at,removed_by FROM bans WHERE id=?""",(bid,)) r = c.fetchall() if len(r): for ban in r: @@ -311,12 +310,12 @@ class MyHandler(http.server.BaseHTTPRequestHandler): '' ]) for ban in ar: - (id,channel,oper,kind,mask,begin_at,end_at,removed_at,removed_by) = ban + (bid,channel,oper,kind,mask,begin_at,end_at,removed_at,removed_by) = ban if not channels or channel in channels: s = time.strftime('%Y-%m-%d %H:%M:%S GMT',time.gmtime(float(begin_at))) body.extend([ '', - '%d' % (h,q,id,id), + '%d' % (h,q,bid,bid), '%s' % (h,q,channel.split('#')[1],channel), '%s' % (h,q,utils.web.urlencode({'oper':oper}),oper), '+%s' % kind, @@ -339,7 +338,7 @@ class MyHandler(http.server.BaseHTTPRequestHandler): body.append('') # affected = '' # try: -# c.execute("""SELECT full, log FROM nicks WHERE ban_id=?""",(id,)) +# c.execute("""SELECT full, log FROM nicks WHERE ban_id=?""",(bid,)) # affected = len(c.fetchall()) # except: # affected = '' @@ -383,6 +382,7 @@ class MyHandler(http.server.BaseHTTPRequestHandler): db.commit() return db + def httpd(handler_class=MyHandler, server_address=('', port)): srvr = http.server.HTTPServer(server_address, handler_class) srvr.serve_forever()