need help with script security

2007-09-03T02:37:00-04:00

Replace the following lines

Code:

foreach i $text {if {([string match "*http://*" $i]) || ([string match "*ftp://*" $i])|| ([string match "*www.*" $i]) || ([string match "*ftp.*" $i])} {set fd [open $urllogfile a+]if {[string match "*www.*" $i] && ![string match "*http://*" $i]} {set i "http://$i"}if {[string match "*ftp.*" $i] && ![string match "*ftp://*" $i]} {set i "ftp://$i"}

to match

Code:

foreach i $text { if {[string match "*http://*" $i] && ![string match "*http://*<*>*" $i] || [string match "*ftp://*" $i] && ![string match "*ftp://*<*>*" $i] || [string match "*www.*" $i] && ![string match "*www.*<*>*" $i] || [string match "*ftp.*" $i] && ![string match "*ftp.*<*>*" $i]} {  set fd [open $urllogfile a+]   if {[string match "*www.*" $i] && ![string match "*http://*" $i]} {    set i "http://$i"   }    if {[string match "*ftp.*" $i] && ![string match "*ftp://*" $i]} {     set i "ftp://$i"    }

should work. (its just a case of checking that the are in the url address).

Statistics: Posted by TCL_no_TK — Mon Sep 03, 2007 2:37 am

need help with script security

2007-08-21T11:32:48-04:00

I needed a script that catches urls from a chan and outputs it to a html file.

I found this script:

## This script catches urls said on channels and set on topics
## and makes a webfile of them.
## 21.7.1997 by Goblet email: goblet@sci.fi

set urllogfile "urls.log"
set urlwebfile "/wwwhome/goblet/public_html/blerp/urllog.html"

bind pubm - * check_if_url
bind topc - * check_if_url

proc check_if_url {nick uhost hand chan text} {
global urllogfile urlwebfile botnick
foreach i $text {
if {([string match "*http://*" $i]) || ([string match "*ftp://*" $i])
|| ([string match "*www.*" $i]) || ([string match "*ftp.*" $i])} {
set fd [open $urllogfile a+]
if {[string match "*www.*" $i] && ![string match "*http://*" $i]} {
set i "http://$i"
}
if {[string match "*ftp.*" $i] && ![string match "*ftp://*" $i]} {
set i "ftp://$i"
}
puts $fd "$i
"
puts $fd "[ctime [unixtime]] $nick ($uhost)
"
close $fd
putlog "URL detected ($nick)"
set fd [open $urlwebfile w]
set fd2 [open $urllogfile r]
puts $fd "Catched URLs"
puts $fd ""
puts $fd "URLs catched by $botnick
"
puts $fd ""
while {![eof $fd2]} {
gets $fd2 foo
puts $fd $foo
}
puts $fd "
© http://www.sci.fi/~goblet/\">"
puts $fd "Goblet 1997
"
puts $fd ""
close $fd
close $fd2
}
}
}
putlog "URL-catcher by Goblet"

The problem is, ppl can inject html/java code into it, i'd like to avoid that. I don't know tcl, wish I did.

This is an example of how you can mess the generated html page up.

http://www.

egghelp/eggheads community

need help with script security

need help with script security