According to Berthold Cogel:
> The htdig configuration parser seems to have a bug at least in version 
> 3.1.5:
> 
> We use SSI templates with htdig. In our environment I need to set 
> script_name in allow_in_form. This works fine as long as I don't make 
> the mistake to include script_name twice in allow_in_form. x-(

Yes, that's right.  If you put a name twice in allow_in_form, it will
define that name twice as a CGI parameter in the page button links.
Similarly, if you put a name in allow_in_form for something that htsearch
already defines by itself as a CGI parameter, it will define it twice.

> If this happens, the value of script_name is multiplied with each page 
> of a set of results I call in my browser. This works for the first an 
> the second page of a set. But I'm unable to call a third page.
> 
> If the content of script_name in my search form is 
> '/search/results.shtml', script_name and CGI show the value 
> '/search/results.shtml<some control character>/search/results.shtml' on 
> the second page. Therefor the next call of additional results leads to a 
> 'page not found' message from the webserver.
> 
> I suppose that there is a kind of test needed to avoid this behavior of 
> allow_in_form.
> 
> I don't know whether newer versions are affected or not.

The control character is a Ctrl-A, or SOH control character, which acts
as separator for parameters that have multiple definitions.  I think
this is why you're getting what seems like inconsistent results: you
should get the same effect for every page button you click on, but the
effect gets delayed.  The first page works fine, because you don't get
at it via a page button.  The second page works because it uses the
script_name from the first page to load the second, but on the second
page the script_name has been doubled up from the page button link on
the first page, so it can't load any other page correctly.

The easy fix is not to put anything in allow_in_form more than once, and
not to put anything there that doesn't need to be there.  I suppose we
can add a test in the htsearch code that uses allow_in_form, so it doesn't
add a CGI parameter to the button link if that parameter's already there
-- we'd just need to make sure this wouldn't negatively impact any cases
were parameters can legitimately be multiply-defined.  As far as I know,
3.2.0b5 and 3.1.6 handle allow_in_form the same way 3.1.5 did.

The loop in question is at the end of Display::createURL(), in
htsearch/Display.cc.  It would need somehow to keep track of what's
been added already to the "url" String, or maybe just search that
string for the encoded "s" string followed by an "=", and preceded
by a ";" or "?".

-- 
Gilles R. Detillieux              E-mail: <[EMAIL PROTECTED]>
Spinal Cord Research Centre       WWW:    http://www.scrc.umanitoba.ca/
Dept. Physiology, U. of Manitoba  Winnipeg, MB  R3E 3J7  (Canada)


-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
Does SourceForge.net help you be more productive?  Does it
help you create better code?  SHARE THE LOVE, and help us help
YOU!  Click Here: http://sourceforge.net/donate/
_______________________________________________
ht://Dig general mailing list: <[EMAIL PROTECTED]>
ht://Dig FAQ: http://htdig.sourceforge.net/FAQ.html
List information (subscribe/unsubscribe, etc.)
https://lists.sourceforge.net/lists/listinfo/htdig-general

Reply via email to