--- loncom/xml/run.pm 2003/11/09 01:17:35 1.42 +++ loncom/xml/run.pm 2004/07/13 19:12:46 1.47 @@ -1,6 +1,6 @@ package Apache::run; # -# $Id: run.pm,v 1.42 2003/11/09 01:17:35 albertel Exp $ +# $Id: run.pm,v 1.47 2004/07/13 19:12:46 albertel Exp $ # # Copyright Michigan State University Board of Trustees # @@ -27,13 +27,47 @@ package Apache::run; use HTML::Entities; -$Apache::run::EVALUATE_STRING=<<'ENDEVALUATE'; - my %_LONCAPA_INTERNAL_oldexpressions=(); - while (!$_LONCAPA_INTERNAL_oldexpressions{$_}) { +$Apache::run::EVALUATE_STRING=<<'ENDEVALUATE'; +my %_LONCAPA_INTERNAL_oldexpressions=(); +while (!$_LONCAPA_INTERNAL_oldexpressions{$_}) { $_LONCAPA_INTERNAL_oldexpressions{$_}=1; - $_ =~s/((?:\$|\&)(?:[\#|\$]*[A-Za-z][\w]*|\{[A-Za-z][\w]*\}))([\[\{][^\$\&\]\}]+[\]\}])*?(\([^\$\&\)]+\))*?(?=[^\[\{\(]|$)/eval(defined(eval($1.$2))?eval('$1.$2.$3'):'$1.$2.$3')/seg; + $_ =~s/ # $1 will be the variable reference or subroutine name + ((?:\$|\&) #look for a starting $ or & + (?:[\#|\$]* #support $$ or $#$ etc. + [A-Za-z][\w]*| # get variable name + \{[A-Za-z][\w]*\})) # for ${a} + # $2 is 0 or more array dereferences [] + # or hash dereferences {} + # the ^$ and ^& is because we do this iteratively + # $a[$c] becomes $a[3] which then evaluates + ([\[\{][^\$\&\]\}]+[\]\}])*? + # $3 is the list of arguments + (\([^\$\&\)]+\))*? + # only match the above if there is not { [ ( coming up + # Why? (I.e. this fails &a(1)[2] + (?=[^\[\{\(]|$)/ + my ($__LC__a,$__LC__b,$__LC__c)=($1,$2,$3); + my $__LC__prefix; + my $result; + while (1) { + { + use strict; + no strict "vars"; + if (eval(defined(eval($__LC__a.$__LC__b)))) { + $result= $__LC__prefix.eval($__LC__a.$__LC__b.$__LC__c); + last; + } + } + $__LC__prefix.=substr($__LC__a,0,1,""); + if ($__LC__a!~m-^(\$|&|\#)-) { last; } + } + if (!defined($result)) { + $result=$__LC__prefix.$__LC__a.$__LC__b.$__LC__c; + } + $result; + /sexg; if (scalar(values(%_LONCAPA_INTERNAL_oldexpressions))>10) {last;} - } +} ENDEVALUATE sub evaluate { @@ -48,6 +82,7 @@ sub evaluate { die("timeout"); }; my $innererror; + $safeeval->permit("require"); eval { alarm($Apache::lonnet::perlvar{'lonScriptTimeout'}); $safeeval->reval('{'.$decls.';$_=<<\'EXPRESSION\';'."\n".$expression. @@ -55,6 +90,7 @@ sub evaluate { $innererror=$@; alarm(0); }; + $safeeval->deny("require"); my $error=$@; if ($error eq '' && $innererror eq '' && !$Apache::run::timeout) { $result = $safeeval->reval('return $_;'); @@ -62,15 +98,15 @@ sub evaluate { } else { if ($Apache::run::timeout) { $error = 'Code ran too long. It ran for more than '. - Apache->request->server->timeout.' seconds'; + $Apache::lonnet::perlvar{'lonScriptTimeout'}.' seconds'; } &Apache::lonxml::error('substitution on
'.
-			       &HTML::Entities::encode($expression).
+			       &HTML::Entities::encode($expression,'<>&"').
 			       '
with
'.
-			       &HTML::Entities::encode($decls).
+			       &HTML::Entities::encode($decls,'<>&"').
 			       '
caused
'.
-			       &HTML::Entities::encode($error).' '.
-			       &HTML::Entities::encode($innererror).
+			       &HTML::Entities::encode($error,'<>&"').' '.
+			       &HTML::Entities::encode($innererror,'<>&"').
 			       '
'); } return $result @@ -96,12 +132,12 @@ sub run { if (($Apache::run::timeout || $error ne '' || $innererror ne '') && !$hideerrors) { if ($Apache::run::timeout) { $error = 'Code ran too long. It ran for more than '. - Apache->request->server->timeout.' seconds'; + $Apache::lonnet::perlvar{'lonScriptTimeout'}.' seconds'; } - my $errormsg='
'.&HTML::Entities::encode($error).' '.
-	    &HTML::Entities::encode($innererror).
+	my $errormsg='
'.&HTML::Entities::encode($error,'<>&"').' '.
+	    &HTML::Entities::encode($innererror,'<>&"').
 	    '
occured while running
';
-	$code=&HTML::Entities::encode($code);
+	$code=&HTML::Entities::encode($code,'<>&"');
 	if ($innererror=~/line (\d+)/) {
 	    my $linenumber=$1;
 	    my @code=split("\n",$code);
@@ -138,7 +174,7 @@ sub dump {
 					$symname.'{$_} } sort keys %'.
 					$symname.')').")"
 				    }
-	    if ($line ne '') {$dump.=&HTML::Entities::encode($line)."
";} + if ($line ne '') {$dump.=&HTML::Entities::encode($line,'<>&"')."
";} } } $dump.='';