Bug and (loosely related) patch: Nagios 3.2.1 config.cgi, commands with $ARGs$

[Jochen Bern]

On 08/29/2010 06:24 PM, Jochen Bern wrote:
> Sorry for the extra work, but there'll be at least one more update - I
> used strtok() where I *should* have used my_strsep() from the cgiutils

Next attempt ...

-- Replaced the offending strtok() with some local code ...
-- ... which also handles the backslash escapes of Nagios 3.x.
-- Tells "(undefined)" and "(empty)" $ARGn$s apart.
-- Warns of $ARGn$s with leading or trailing whitespace ...
-- ... and additionally puts them into "<U>‍...‍</U>" to make
   sure that there'll be *something* displayed with the $ARGn$'s color
   (see the "unused: $ARG5$=" line in the screenshot for an example).
-- Changed a boatload of "printf(...,some_string);" to
   "printf(...,html_encode(some_string,FALSE));".

The whitespace detection is still not quite finished because I hit a
snag in the existing code, namely, in cgi/cgiutils.c::url_encode() :

>                 /* spaces are pluses */
>                 else if((char)input[x]<=(char)' '){
>                         str[y]='+';
>                         y++;
>                         }
> 
>                 /* anything else gets represented by its hex value */
>                 else{

Note the "<=", *not* "==", in the "if" expression; because of that,
whenever a command contains whitespace *other* than spaces, the
hyperlink to config.cgi?type=command&expand=... converts it to spaces
(as seen in $ARG1$ in the screenshot; I currently have the code output
"[WS]" instead of "[SP]" whenever it sees spaces to obscure the problem).

I would like to get and display the *original* whitespace characters (as
simulated, by manually changing the URL, for $ARG2$ and $ARG5$ in the
screenshot), but I don't feel comfortable changing the widely-used
url_encode() just like that ... any opinions?

Another oddity I noticed: It seems that the command_line's are subject
to strip(), but not the individual $ARGn$s. As a result, some (!) kinds
of whitespace get stripped off the end of the *last* $ARGn$, but not the
others.

Kind regards,
								J. Bern
-- 
Jochen Bern, Systemingenieur --- LINworks GmbH <http://www.LINworks.de/>
Postfach 100121, 64201 Darmstadt | Robert-Koch-Str. 9, 64331 Weiterstadt
PGP (1024D/4096g) FP = D18B 41B1 16C0 11BA 7F8C DCF7 E1D5 FAF4 444E 1C27
Tel. +49 6151 9067-231, Zentr. -0, Fax -299 - Amtsg. Darmstadt HRB 85202
Unternehmenssitz Weiterstadt, Geschäftsführer Metin Dogan, Oliver Michel
-------------- next part --------------
A non-text attachment was scrubbed...
Name: CommandExpansion4.png
Type: image/png
Size: 42809 bytes
Desc: not available
URL: <https://www.monitoring-lists.org/archive/developers/attachments/20100831/8e6db25e/attachment.png>
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: nagios-3.2.1-CommandExpand-patch.txt
URL: <https://www.monitoring-lists.org/archive/developers/attachments/20100831/8e6db25e/attachment.txt>
-------------- next part --------------
------------------------------------------------------------------------------
This SF.net Dev2Dev email is sponsored by:

Show off your parallel programming skills.
Enter the Intel(R) Threading Challenge 2010.
http://p.sf.net/sfu/intel-thread-sfd
-------------- next part --------------
_______________________________________________
Nagios-devel mailing list
Nagios-devel at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nagios-devel