From 25213dca24dc1c4edfb49fbe070ccea5d2d73399 Mon Sep 17 00:00:00 2001 From: John Mark Bell Date: Fri, 2 Feb 2007 23:08:13 +0000 Subject: Fix handling of cookies in unverifiable transactions caused by a redirect from a fetch into a browser window which was varifiable. svn path=/trunk/netsurf/; revision=3165 --- content/content.c | 7 +++++-- content/fetch.c | 22 +++++++++++++++------- content/fetch.h | 2 +- content/fetchcache.c | 7 ++++--- content/fetchcache.h | 2 +- 5 files changed, 26 insertions(+), 14 deletions(-) (limited to 'content') diff --git a/content/content.c b/content/content.c index d99d02b09..7503e9d28 100644 --- a/content/content.c +++ b/content/content.c @@ -535,6 +535,8 @@ bool content_set_type(struct content *c, content_type type, c->user_list->next->next) { /* type not shareable, and more than one user: split into * a content per user */ + const char *referer = fetch_get_referer(c->fetch); + while (c->user_list->next->next) { clone = content_create(c->url); if (!clone) { @@ -566,10 +568,11 @@ bool content_set_type(struct content *c, content_type type, } content_remove_user(c, callback, p1, p2); content_broadcast(clone, CONTENT_MSG_NEWPTR, msg_data); - fetchcache_go(clone, fetch_get_referer(c->fetch), + fetchcache_go(clone, referer, callback, p1, p2, clone->width, clone->height, - 0, 0, false); + 0, 0, false, + referer ? referer : c->url); } } diff --git a/content/fetch.c b/content/fetch.c index 4ce383397..9ec4595cf 100644 --- a/content/fetch.c +++ b/content/fetch.c @@ -69,6 +69,8 @@ struct fetch { char *url; /**< URL. */ char *referer; /**< URL for Referer header. */ bool send_referer; /**< Valid to send the referer */ + char *parent_fetch_url; /**< URL of parent fetch (not necessarily + * the same as the referer) */ void *p; /**< Private data for callback. */ struct curl_slist *headers; /**< List of request headers. */ char *host; /**< Host part of URL. */ @@ -310,7 +312,7 @@ struct fetch * fetch_start(const char *url, const char *referer, unsigned long size), void *p, bool only_2xx, const char *post_urlenc, struct form_successful_control *post_multipart, - bool verifiable, char *headers[]) + bool verifiable, const char *parent_url, char *headers[]) { char *host; struct fetch *fetch; @@ -372,6 +374,7 @@ struct fetch * fetch_start(const char *url, const char *referer, strcasecmp(ref1, ref2) == 0) fetch->send_referer = true; } + fetch->parent_fetch_url = parent_url ? strdup(parent_url) : 0; fetch->p = p; fetch->headers = 0; fetch->host = host; @@ -404,6 +407,7 @@ struct fetch * fetch_start(const char *url, const char *referer, fetch->r_next = 0; if (!fetch->url || (referer && !fetch->referer) || + (parent_url && !fetch->parent_fetch_url) || (post_urlenc && !fetch->post_urlenc) || (post_multipart && !fetch->post_multipart)) goto failed; @@ -478,6 +482,7 @@ failed: if (ref2) free(ref2); free(fetch->url); + free(fetch->parent_fetch_url); free(fetch->referer); free(fetch->post_urlenc); if (fetch->post_multipart) @@ -794,6 +799,7 @@ void fetch_free(struct fetch *f) curl_easy_cleanup(f->curl_handle); free(f->url); free(f->host); + free(f->parent_fetch_url); free(f->referer); free(f->location); free(f->cookie_string); @@ -1223,15 +1229,17 @@ size_t fetch_curl_header(char *data, size_t size, size_t nmemb, /* extract Set-Cookie header */ SKIP_ST(11); - /* If the fetch is unverifiable and there's no referer, - * err on the side of caution and do not set the cookie */ + /* If the fetch is unverifiable and there's no parent fetch + * url, err on the side of caution and do not set the + cookie */ - if (f->verifiable || f->referer) { + if (f->verifiable || f->parent_fetch_url) { /* If the transaction's verifiable, we don't require - * that the request uri and the referer domain match, - * so don't pass in the referer in this case. */ + * that the request uri and the parent domain match, + * so don't pass in the parent in this case. */ urldb_set_cookie(&data[i], f->url, - f->verifiable ? 0 : f->referer); + f->verifiable ? 0 + : f->parent_fetch_url); } } diff --git a/content/fetch.h b/content/fetch.h index c8a454816..4bf55503c 100644 --- a/content/fetch.h +++ b/content/fetch.h @@ -72,7 +72,7 @@ struct fetch * fetch_start(const char *url, const char *referer, unsigned long size), void *p, bool only_2xx, const char *post_urlenc, struct form_successful_control *post_multipart, - bool verifiable, char *headers[]); + bool verifiable, const char *parent_url, char *headers[]); void fetch_abort(struct fetch *f); void fetch_poll(void); void fetch_quit(void); diff --git a/content/fetchcache.c b/content/fetchcache.c index c6c6e3507..62d81fe15 100644 --- a/content/fetchcache.c +++ b/content/fetchcache.c @@ -204,6 +204,7 @@ struct content * fetchcache(const char *url, * \param post_urlenc url encoded post data, or 0 if none * \param post_multipart multipart post data, or 0 if none * \param verifiable this transaction is verifiable + * \param parent_url URL of fetch which spawned this one, or 0 if none * * Errors will be sent back through the callback. */ @@ -215,7 +216,7 @@ void fetchcache_go(struct content *content, const char *referer, int width, int height, char *post_urlenc, struct form_successful_control *post_multipart, - bool verifiable) + bool verifiable, const char *parent_url) { char error_message[500]; union content_msg_data msg_data; @@ -309,7 +310,7 @@ void fetchcache_go(struct content *content, const char *referer, fetchcache_callback, content, content->no_error_pages, post_urlenc, post_multipart, verifiable, - headers); + parent_url, headers); for (i = 0; headers[i]; i++) free(headers[i]); free(headers); @@ -771,7 +772,7 @@ void fetchcache_notmodified(struct content *c, const void *data) for (u = c->user_list->next; u; u = u->next) { fetchcache_go(c, referer, u->callback, u->p1, u->p2, c->width, c->height, 0, 0, - false); + false, ref ? referer : c->url); } free(referer); diff --git a/content/fetchcache.h b/content/fetchcache.h index 43a6649fe..bb57fba01 100644 --- a/content/fetchcache.h +++ b/content/fetchcache.h @@ -39,6 +39,6 @@ void fetchcache_go(struct content *content, const char *referer, int width, int height, char *post_urlenc, struct form_successful_control *post_multipart, - bool verifiable); + bool verifiable, const char *parent_url); #endif -- cgit v1.2.3