changes for long file upload name:

- make the displayName field 255 characters

- validate the length of the displayName

- make sure the on-disk filename doesn't overflow

diff --git a/schema/bse.sql b/schema/bse.sql
index b643f968645567b3474cdb43c0a62748157c5467..ff111c12e58500f4b9b660239f3e891fa7ee059d 100644 (file)
--- a/schema/bse.sql
+++ b/schema/bse.sql
@@ -377,7 +377,7 @@ create table article_files (
   articleId integer not null,
 
   -- the name of the file as displayed
-  displayName varchar(80) not null default '',
+  displayName varchar(255) not null default '',
 
   -- the filename as stored in the repository
   filename varchar(80) not null default '',

diff --git a/site/cgi-bin/admin/add.pl b/site/cgi-bin/admin/add.pl
index c7d0ec48ccc6c8239140b38c17371a207d6de27a..df5e0f1d5e96f84242e82b9911435c8a651b69cf 100755 (executable)
--- a/site/cgi-bin/admin/add.pl
+++ b/site/cgi-bin/admin/add.pl
@@ -1,6 +1,6 @@
 #!/usr/bin/perl -w
 # -d:ptkdb
-BEGIN { $ENV{DISPLAY} = '192.168.32.50:0.0' }
+BEGIN { $ENV{DISPLAY} = '192.168.32.245:0.0' }
 use strict;
 use FindBin;
 use lib "$FindBin::Bin/../modules";

diff --git a/site/cgi-bin/modules/BSE/Edit/Article.pm b/site/cgi-bin/modules/BSE/Edit/Article.pm
index cfd824db058c46155725400b699a6fdd473ecf5d..6f3f4c2c01fbb1d49dab6e862fbeb0f62077a009 100644 (file)
--- a/site/cgi-bin/modules/BSE/Edit/Article.pm
+++ b/site/cgi-bin/modules/BSE/Edit/Article.pm
@@ -10,6 +10,7 @@ use BSE::Arrows;
 use BSE::CfgInfo qw(custom_class admin_base_url cfg_image_dir);
 use BSE::Util::Iterate;
 use BSE::Template;
+use constant MAX_FILE_DISPLAYNAME_LENGTH => 255;
 
 sub not_logged_on {
   my ($self, $req) = @_;
@@ -2784,6 +2785,26 @@ sub filelist {
   return BSE::Template->get_response($template, $req->cfg, \%acts);
 }
 
+my %file_fields =
+  (
+   file => 
+   {
+    maxlength => MAX_FILE_DISPLAYNAME_LENGTH,
+    description => 'Filename'
+   },
+   description =>
+   {
+    rules => 'dh_one_line',
+    maxlength => 255,
+    description => 'Description',
+   },
+   name =>
+   {
+    description => 'Identifier',
+    maxlength => 80,
+   },
+  );
+
 sub fileadd {
   my ($self, $req, $article, $articles) = @_;
 
@@ -2804,6 +2825,10 @@ sub fileadd {
 
   my %errors;
   
+  $req->validate(errors => \%errors,
+                fields => \%file_fields,
+                section => $article->{id} == -1 ? 'Global File Validation' : 'Article File Validation');
+
   $file{forSale}       = 0 + exists $file{forSale};
   $file{articleId}     = $article->{id};
   $file{download}      = 0 + exists $file{download};
@@ -2861,14 +2886,22 @@ sub fileadd {
   $workfile =~ /([ \w.-]+)$/ and $basename = $1;
   $basename =~ tr/ /_/;
 
-  my $filename = time. '_'. $basename;
+  # if the user supplies a really long filename, it can overflow the 
+  # filename field
+
+  my $work_filename = $basename;
+  if (length $work_filename > 60) {
+    $work_filename = substr($work_filename, -60);
+  }
+
+  my $filename = time. '_'. $work_filename;
 
   # for the sysopen() constants
   use Fcntl;
 
   # loop until we have a unique filename
   my $counter="";
-  $filename = time. '_' . $counter . '_' . $basename 
+  $filename = time. '_' . $counter . '_' . $work_filename 
     until sysopen( OUTPUT, "$downloadPath/$filename", 
                   O_WRONLY| O_CREAT| O_EXCL)
       || ++$counter > 100;
@@ -3013,43 +3046,48 @@ sub filesave {
     my $filex = $cgi->param("file_$id");
     my $in_fh = $cgi->upload("file_$id");
     if (defined $filex && length $filex) {
-      if ($in_fh) {
-       if (-s $in_fh) {
-         require DevHelp::FileUpload;
-         my $msg;
-         my ($file_name, $out_fh) = DevHelp::FileUpload->make_img_filename
-           ($download_path, $filex . '', \$msg);
-         if ($file_name) {
-           {
-             local $/ = \8192;
-             my $data;
-             while ($data = <$in_fh>) {
-               print $out_fh $data;
+      if (length $filex <= MAX_FILE_DISPLAYNAME_LENGTH) {
+       if ($in_fh) {
+         if (-s $in_fh) {
+           require DevHelp::FileUpload;
+           my $msg;
+           my ($file_name, $out_fh) = DevHelp::FileUpload->make_img_filename
+             ($download_path, $filex . '', \$msg);
+           if ($file_name) {
+             {
+               local $/ = \8192;
+               my $data;
+               while ($data = <$in_fh>) {
+                 print $out_fh $data;
+               }
+               close $out_fh;
              }
-             close $out_fh;
+             my $display_name = $filex;
+             $display_name =~ s!.*[\\:/]!!;
+             $display_name =~ s/[^\w._-]+/_/g;
+             my $full_name = "$download_path/$file_name";
+             push @old_files, $file->{filename};
+             push @new_files, $file_name;
+             
+             $file->{filename} = $file_name;
+             $file->{sizeInBytes} = -s $full_name;
+             $file->{whenUploaded} = now_datetime();
+             $file->{displayName} = $display_name;
+           }
+           else {
+             $errors{"file_$id"} = $msg;
            }
-           my $display_name = $filex;
-           $display_name =~ s!.*[\\:/]!!;
-           $display_name =~ s/[^\w._-]+/_/g;
-           my $full_name = "$download_path/$file_name";
-           push @old_files, $file->{filename};
-           push @new_files, $file_name;
-
-           $file->{filename} = $file_name;
-           $file->{sizeInBytes} = -s $full_name;
-           $file->{whenUploaded} = now_datetime();
-           $file->{displayName} = $display_name;
          }
          else {
-           $errors{"file_$id"} = $msg;
+           $errors{"file_$id"} = "File is empty";
          }
        }
        else {
-         $errors{"file_$id"} = "File is empty";
+         $errors{"file_$id"} = "No file data received";
        }
       }
       else {
-       $errors{"file_$id"} = "No file data received";
+       $errors{"file_$id"} = "Filename too long";
       }
     }
   }
@@ -3133,6 +3171,11 @@ sub req_save_file {
   my $download_path = $self->{cfg}->entryVar('paths', 'downloads');
 
   my %errors;
+
+  $req->validate(errors => \%errors,
+                fields => \%file_fields,
+                section => $article->{id} == -1 ? 'Global File Validation' : 'Article File Validation');
+
   my $desc = $cgi->param("description");
   defined $desc and $file->{description} = $desc;
   my $type = $cgi->param("contentType");

diff --git a/site/cgi-bin/modules/DevHelp/FileUpload.pm b/site/cgi-bin/modules/DevHelp/FileUpload.pm
index 6e0e9f83d1425626e74844d36ff2bea2a2ed13e0..fec5975652f4109d48785f92d9d3856dddeb8fca 100644 (file)
--- a/site/cgi-bin/modules/DevHelp/FileUpload.pm
+++ b/site/cgi-bin/modules/DevHelp/FileUpload.pm
@@ -59,6 +59,10 @@ sub make_img_filename {
   my $basename = '';
   $name =~ /([\w.-]+)$/ and $basename = $1;
 
+  if (length $basename > 60) {
+    $basename = substr($basename, -60);
+  }
+
   my $filename = time . '_' . $basename;
 
   my $fh;

diff --git a/site/util/mysql.str b/site/util/mysql.str
index b289792a772b3df5f50004a3614bbd241e24f9c8..60bc2dfa5d03e22d3eff6e0a814e777847b5e22c 100644 (file)
--- a/site/util/mysql.str
+++ b/site/util/mysql.str
@@ -70,6 +70,8 @@ Column inherit_siteuser_rights;int(11);NO;1;
 Column metaDescription;varchar(255);NO;;
 Column metaKeywords;varchar(255);NO;;
 Column summaryx;text;NO;;
+Column menu;smallint(5);NO;0;
+Column titleAlias;varchar(60);NO;;
 Index PRIMARY;1;[id]
 Index article_date_index;0;[release;expire;id]
 Index article_displayOrder_index;0;[displayOrder]
@@ -78,7 +80,7 @@ Index article_parentId_index;0;[parentid]
 Table article_files
 Column id;int(11);NO;NULL;auto_increment
 Column articleId;int(11);NO;;
-Column displayName;varchar(80);NO;;
+Column displayName;varchar(255);NO;;
 Column filename;varchar(80);NO;;
 Column sizeInBytes;int(11);NO;;
 Column description;varchar(255);NO;;