From 559459e71015c8c7a59896e5ef47dfb35202e972 Mon Sep 17 00:00:00 2001
From: Ryan Voots <ryan@voots.org>
Date: Sat, 18 Jun 2016 15:25:34 -0400
Subject: [PATCH] Fix html injections

---
 app.pl                                    |  11 +--
 pastes.db                                 | Bin 8192 -> 9216 bytes
 templates/{editor.html.tt => editor.html} |  54 +++++----------
 templates/viewer.html                     |  78 ++++++++++++++++++++++
 4 files changed, 102 insertions(+), 41 deletions(-)
 rename templates/{editor.html.tt => editor.html} (62%)
 create mode 100755 templates/viewer.html

diff --git a/app.pl b/app.pl
index 677f371..78e57ca 100755
--- a/app.pl
+++ b/app.pl
@@ -87,7 +87,7 @@ sub get_eval {
 
 get '/' => sub {
     my $c    = shift;
-    $c->stash({pastedata => q{}, channels => \%channels, viewing => 0, page_tmpl => 'editor.html.tt'});
+    $c->stash({pastedata => q{}, channels => \%channels, page_tmpl => 'editor.html'});
     $c->render("page");
 };
 get '/pastebin' => sub {$_[0]->redirect_to('/')};
@@ -112,8 +112,8 @@ get '/edit/:pasteid' => sub {
     my $row = $dbh->selectrow_hashref("SELECT * FROM posts WHERE id = ? LIMIT 1", {}, $pasteid);
 
     if ($row->{when}) {
-        $c->stash({pastedata => $row->{paste}, channels => \%channels, viewing => 0});
-        $c->stash({page_tmpl => 'editor.html.tt'});
+        $c->stash({pastedata => $row->{paste}, channels => \%channels});
+        $c->stash({page_tmpl => 'editor.html'});
 
         $c->render('page');
     } else {
@@ -128,9 +128,10 @@ get '/pastebin/:pasteid' => sub {
     my $row = $dbh->selectrow_hashref("SELECT * FROM posts WHERE id = ? LIMIT 1", {}, $pasteid);
 
     if ($row->{when}) {
-        $c->stash({pastedata => $row->{paste}, channels => \%channels, viewing => 1});
         $c->stash($row);
-        $c->stash({page_tmpl => 'editor.html.tt'});
+        $c->stash({page_tmpl => 'viewer.html'});
+        $c->stash({eval => get_eval($pasteid, $row->{paste})});
+        $c->stash({paste_id => $pasteid});
 
         $c->render('page');
     } else {
diff --git a/pastes.db b/pastes.db
index fa175eb7a204c25cac8c51faf4a8051942bcd16d..69022547e335c4ced2e673754483f3153ed1dcaf 100644
GIT binary patch
delta 599
zcmZp0Xz-XI&8o@3z`!|C!JbibW5N<<9wz2*Kmi6$=HJZUHVd#kXJ%nw;85HAo1KM)
zQDYMii+~s>LlFbhKBhJ%J;qOrs~No*bs2Us6iqCQsCQH2U}$9I<>h55POMZ=vMEk3
z$}A{R$VtpgFHKBOwN=VWEK7t4D%mCGq!yKEsHc<`B&uuL=tG3<l)_VI|1DGnnq$kW
z&dX9-oT}iHSzKae6<U&+qfl6`UzD0snw+X{&CA8hRZx_fSE2wBQK(j_PgKxWP)SnI
zSI|&NRL}x4HETgy%uEyv6^xA(j1&yb6igH>6fE?u(~444^YT+tl?zgfa)5Tel2&17
z&_y^s$u2uJ+eSYL?4axM%0LGhgJkhJ2<Rp>7vXS_A<!uxcL1GZY@}};o;u^t=GC&H
zOgy~6kY{4{XJDSk?7vx%!<o6>R|9A>Kf+z;L8^`jQg!4YRY*U)xjZi)HDu@POHc<I
dXG+K;2!9xX0vi~#I6Y!$0QQNI3DhTZ_yOp#saXI3

delta 72
zcmZqhXmFSy&8p16z`!w4!JbihW5N<<E=K0xKmi60=HHw7B;GP_{>{$9!l<-~hed#o
cm2ou#(>|s)COyVajH@>m&Sc!YS~ipk0Eo8}9smFU

diff --git a/templates/editor.html.tt b/templates/editor.html
similarity index 62%
rename from templates/editor.html.tt
rename to templates/editor.html
index e2f054b..fc40a48 100755
--- a/templates/editor.html.tt
+++ b/templates/editor.html
@@ -20,35 +20,23 @@
 
 [% BLOCK page_header %]
 <div class="row">
-  [% IF viewing %]
-    <div class="col-md-3">
-      <b>Who: </b>[% who %]
-    </div>
-    <div class="col-md-3">
-      <b>When: </b>[% when %]
-    </div>
-    <div class="col-md-6">
-      <b>What: </b>[% what %]
-    </div>
-  [% ELSE %]
-    <div class="col-md-3">
-      <label for="name">Who: </label>
-      <input size="20" name="name" placeholder="Anonymous" />
-    </div>
-    <div class="col-md-3">
-      <label for="chan">Where: </label>
-      <select name="chan" id="chan">
-          <option value="">-- IRC Channel --</option>
-      [% FOREACH channel = channels %]
-          <option value="[% channel.key %]">[% channel.value %]</option>
-      [% END %]
-      </select>
-    </div>
-    <div class="col-md-6">
-      <label for="desc">What: </label>
-      <input size="40" name="desc" placeholder="I broke this" />
-    </div>
-  [% END %]
+  <div class="col-md-3">
+    <label for="name">Who: </label>
+    <input size="20" name="name" placeholder="Anonymous" />
+  </div>
+  <div class="col-md-3">
+    <label for="chan">Where: </label>
+    <select name="chan" id="chan">
+        <option value="">-- IRC Channel --</option>
+    [% FOREACH channel = channels %]
+        <option value="[% channel.key %]">[% channel.value %]</option>
+    [% END %]
+    </select>
+  </div>
+  <div class="col-md-6">
+    <label for="desc">What: </label>
+    <input size="40" name="desc" placeholder="I broke this" />
+  </div>
 </div>
 [% END %]
 
@@ -62,14 +50,12 @@
       </div>
       <div class="panel-body">
         <div class="editors">
-        <textarea name="paste" id="paste" cols="80" rows="25">[% pastedata %]</textarea>
+        <textarea name="paste" id="paste" cols="80" rows="25">[% pastedata | html %]</textarea>
         <pre id="editor">
         </pre>
         </div>
         <div class="panel-footer">
-          [% UNLESS viewing %]
           <input value="Submit" type="submit" id="submit" />
-          [% END %]
         </div>
       </div>
     </div>
@@ -84,10 +70,6 @@
     //editor.setTheme("ace/theme/twilight");
     editor.session.setMode("ace/mode/perl");
 
-    [% IF viewing %]
-        editor.setReadOnly(true);
-    [% END %]
-
     function resizeAce() {
       var h = window.innerHeight;
       if (h > 360) {
diff --git a/templates/viewer.html b/templates/viewer.html
new file mode 100755
index 0000000..d5e30b1
--- /dev/null
+++ b/templates/viewer.html
@@ -0,0 +1,78 @@
+[% BLOCK body_style %]
+<style type="text/css" media="screen">
+    #editor {
+      margin: auto;
+      position: relative !important;
+      width: 100%;
+    }
+
+    html, body, #content {
+      width: 100%;
+    }
+  </style>
+[% END %]
+
+[% BLOCK page_header %]
+<div class="row">
+    <div class="col-md-3">
+      <b>Who: </b>[% who | html %]
+    </div>
+    <div class="col-md-3">
+      <b>When: </b>[% when %]
+    </div>
+    <div class="col-md-6">
+      <b>What: </b>[% what | html %]
+    </div>
+</div>
+[% END %]
+
+[% BLOCK body %]
+<form action="/edit/[% paste_id %]" method="GET" id="form">
+    <div id="content" class="container">
+      <div class="panel">
+        <div class="panel-heading">
+         [% PROCESS page_header %]
+        </div>
+      </div>
+      <div class="panel-body">
+        <div class="row">
+          <div class="col-md-6">
+            <pre id="editor">[% paste | html %]</pre>
+          </div>
+          <div id="eval" class="col-md-6">
+            <h3>Program Output:</h3>
+            <pre>[% eval | html %]</pre>
+          </div>
+        </div>
+        <div class="panel-footer">
+          <input value="Fork and Edit" type="submit" id="submit" />
+        </div>
+      </div>
+    </div>
+</form>
+
+<script src="/static/ace/ace.js" type="text/javascript" charset="utf-8"></script>
+<script>
+    var editor = ace.edit("editor");
+    //editor.setTheme("ace/theme/twilight");
+    editor.session.setMode("ace/mode/perl");
+
+    editor.setReadOnly(true);
+
+    function resizeAce() {
+      var h = window.innerHeight;
+      if (h > 360) {
+        $('#editor').css('height', (h - 175).toString() + 'px');
+      }
+    };
+    $(window).on('resize', function () {
+      resizeAce();
+    });
+    resizeAce();
+
+    $("#submit").on('click', function () {
+        $("#paste").text(editor.getValue()); // copy to the textarea
+    });
+
+</script>
+[% END %]