merge of '174649506cd8a9665ad798c090e39481af967011'

and '67eb724b7638284d33f1b4997183cc9f197d2883'
2015-05-15 14:17:41 +00:00
parent dc777c8de5 1f17d2a149
commit 10556bca75
9 changed files with 80 additions and 27 deletions
--- a/apps/i2psnark/java/src/org/klomp/snark/web/I2PSnarkServlet.java
+++ b/apps/i2psnark/java/src/org/klomp/snark/web/I2PSnarkServlet.java
@@ -1047,19 +1047,20 @@ public class I2PSnarkServlet extends BasicServlet {
                            File f = new File(name);
                            f.delete();
                            _manager.addMessage(_("Torrent file deleted: {0}", f.getAbsolutePath()));
-                            List<List<String>> files = meta.getFiles();
-                            String dataFile = snark.getBaseName();
-                            f = new File(_manager.getDataDir(), dataFile);
-                            if (files == null) { // single file torrent
-                                if (f.delete())
-                                    _manager.addMessage(_("Data file deleted: {0}", f.getAbsolutePath()));
-                                else
-                                    _manager.addMessage(_("Data file could not be deleted: {0}", f.getAbsolutePath()));
-                                break;
-                            }
                            Storage storage = snark.getStorage();
                            if (storage == null)
                                break;
+                            List<List<String>> files = meta.getFiles();
+                            if (files == null) { // single file torrent
+                                for (File df : storage.getFiles()) {
+                                    // should be only one
+                                    if (df.delete())
+                                        _manager.addMessage(_("Data file deleted: {0}", df.getAbsolutePath()));
+                                    else
+                                        _manager.addMessage(_("Data file could not be deleted: {0}", df.getAbsolutePath()));
+                                }
+                                break;
+                            }
                            // step 1 delete files
                            for (File df : storage.getFiles()) {
                                if (df.delete()) {
--- a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/udp/UDPSink.java
+++ b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/udp/UDPSink.java
@@ -14,7 +14,6 @@ import net.i2p.data.Destination;
 public class UDPSink implements Sink {

    /**
-     *  @param src ignored
     *  @throws IllegalArgumentException on DatagramSocket IOException
     */
    public UDPSink(InetAddress host, int port) {
--- a/apps/routerconsole/java/src/net/i2p/router/update/DevSU3UpdateChecker.java
+++ b/apps/routerconsole/java/src/net/i2p/router/update/DevSU3UpdateChecker.java
@@ -76,7 +76,7 @@ class DevSU3UpdateChecker extends UpdateRunner {
            _mgr.notifyVersionAvailable(this, _currentURI, UpdateType.ROUTER_DEV_SU3, "", UpdateMethod.HTTP,
                                        _urls, newVersion, RouterVersion.FULL_VERSION);
        } else {
-            updateStatus("<b>" + _("No new version found at {0}", linkify(url)) + "</b>");
+            //updateStatus("<b>" + _("No new version found at {0}", linkify(url)) + "</b>");
            if (_log.shouldWarn())
                _log.warn("Found old version \"" + newVersion + "\" at " + url);
        }
--- a/apps/routerconsole/java/src/net/i2p/router/web/ConfigHomeHandler.java
+++ b/apps/routerconsole/java/src/net/i2p/router/web/ConfigHomeHandler.java
@@ -58,18 +58,21 @@ public class ConfigHomeHandler extends FormHandler {
            else
                apps = HomeHelper.buildApps(_context, config);
            if (adding) {
-                String name = getJettyString("name");
+                String name = getJettyString("nofilter_name");
                if (name == null || name.length() <= 0) {
                    addFormError(_("No name entered"));
                    return;
                }
-                String url = getJettyString("url");
+                String url = getJettyString("nofilter_url");
                if (url == null || url.length() <= 0) {
                    addFormError(_("No URL entered"));
                    return;
                }
-                name = DataHelper.escapeHTML(name).replace(",", "&#44;");   // HomeHelper.S
-                url = DataHelper.escapeHTML(url).replace(",", "&#44;");
+                // these would get double-escaped so we can't do it this way...
+                //name = DataHelper.escapeHTML(name).replace(",", "&#44;");
+                //url = DataHelper.escapeHTML(url).replace(",", "&#44;");
+                name = name.replace(",", ".");
+                url = url.replace(",", "."); // fail
                HomeHelper.App app = null;
                if ("1".equals(group))
                    app = new HomeHelper.App(name, "", url, "/themes/console/images/eepsite.png");
--- a/apps/routerconsole/java/src/net/i2p/router/web/HomeHelper.java
+++ b/apps/routerconsole/java/src/net/i2p/router/web/HomeHelper.java
@@ -7,6 +7,7 @@ import java.util.List;
 import java.util.Set;
 import java.util.TreeSet;

+import net.i2p.data.DataHelper;
 import net.i2p.router.RouterContext;
 import net.i2p.util.PortMapper;

@@ -209,17 +210,22 @@ public class HomeHelper extends HelperBase {
                buf.append("<img height=\"16\" alt=\"\" src=\"").append(app.icon).append("\">");
            }
            buf.append("</td><td align=\"left\">")
-               .append(app.name)
-               .append("</td><td align=\"left\"><a href=\"")
-               .append(app.url.replace("&", "&amp;"))
-               .append("\">")
-               .append(app.url.replace("&", "&amp;"))
-               .append("</a></td></tr>\n");
+               .append(DataHelper.escapeHTML(app.name))
+               .append("</td><td align=\"left\"><a href=\"");
+            String url = DataHelper.escapeHTML(app.url);
+            buf.append(url)
+               .append("\">");
+            // truncate before escaping
+            if (app.url.length() > 50)
+                buf.append(DataHelper.escapeHTML(app.url.substring(0, 48))).append("&hellip;");
+            else
+                buf.append(url);
+            buf.append("</a></td></tr>\n");
        }
        buf.append("<tr><td colspan=\"2\" align=\"center\"><b>")
           .append(_("Add")).append(":</b>" +
-                   "</td><td align=\"left\"><input type=\"text\" name=\"name\"></td>" +
-                   "<td align=\"left\"><input type=\"text\" size=\"40\" name=\"url\"></td></tr>");
+                   "</td><td align=\"left\"><input type=\"text\" name=\"nofilter_name\"></td>" +
+                   "<td align=\"left\"><input type=\"text\" size=\"40\" name=\"nofilter_url\"></td></tr>");
        buf.append("</table>\n");
        return buf.toString();
    }
--- a/core/java/src/net/i2p/data/PrivateKeyFile.java
+++ b/core/java/src/net/i2p/data/PrivateKeyFile.java
@@ -41,7 +41,7 @@ import net.i2p.util.SecureFileOutputStream;
 *     - Certificate if length != 0
 *  - Private key (256 bytes)
 *  - Signing Private key (20 bytes, or length specified by key certificate)
- * Total 663 bytes
+ * Total: 663 or more bytes
 *</pre>
 *
 * @author welterde, zzz
--- a/history.txt
+++ b/history.txt
@@ -1,3 +1,8 @@
+2015-05-13 zzz
+ * Console: Fix URLs caught in XSS filter on /confighome (ticket #1569)
+ * i2psnark: Fix deletion of single-file torrent outside snark dir (ticket #1544)
+ * NTCP: Catch race in Reader (ticket #1534)
+
 2015-02-12 dg
 * Job Queue/stats: add stat/graph for amount of scheduled jobs (router.tunnelBacklog)
 * FloodfillMonitorJob:
--- a/installer/resources/certificates/plugin/cacapo_at_mail.i2p.crt
+++ b/installer/resources/certificates/plugin/cacapo_at_mail.i2p.crt
@@ -0,0 +1,32 @@
+-----BEGIN CERTIFICATE-----
+MIIFfTCCA2WgAwIBAgIEUTjHEzANBgkqhkiG9w0BAQ0FADBvMQswCQYDVQQGEwJY
+WDELMAkGA1UECBMCWFgxCzAJBgNVBAcTAlhYMR4wHAYDVQQKExVJMlAgQW5vbnlt
+b3VzIE5ldHdvcmsxDDAKBgNVBAsTA0kyUDEYMBYGA1UEAwwPY2FjYXBvQG1haWwu
+aTJwMB4XDTE1MDIwOTEyNTQxOFoXDTI1MDIwODEyNTQxOFowbzELMAkGA1UEBhMC
+WFgxCzAJBgNVBAgTAlhYMQswCQYDVQQHEwJYWDEeMBwGA1UEChMVSTJQIEFub255
+bW91cyBOZXR3b3JrMQwwCgYDVQQLEwNJMlAxGDAWBgNVBAMMD2NhY2Fwb0BtYWls
+LmkycDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJjVqyjEJqCCufjO
+E80hXMPZiQZCiBjSKiA27dTX5rKABI26eLzcKl7e80Ooe9wEGBXEHZCxGIXAFt8x
+EHBP4W2u1dmBLpnz6cGxZRMvlTuCKHAbzdJwsWblruXgRg6EQCrtewJ9yuY5SypM
+WyJEkL68XMiTeg6fsU367ifWeuPnaO9wqL45pjt9raJMYzXZb3dc6WNUIhg0u7w0
+GA4z7X3CZc3f58/4F5ivKOmDd3FqM/suIH6qZJHvQQJZqLtfReLquD5TlqQjcZ1I
+vtfYJWsx3Mx3tyXU4x7CHlXyxM4hEGOgMb041GR8td7AvqM0PLuexvNUHO1wDyWF
+C6lydNlBwOOUXqPZCG5afgjliwAIIt0WoASEUqSFDiRmhaQZyShQ9P7NUg7jo8x1
+SK/YL6agSRfyARvKG+lVoSPlVMdwuP4SGYHW9OA0wlI1fO3aY+q71iP3DFfWsLCh
+hE/KXKzruDdGe0tIQdWaz5Xrv4bLN8Ot5a79TYRFUeY7lCyFP7vqert+l31hiyZS
+gVugjF6zz91F/gtLsjG+y2HdbdlD3TR/+I/dZFuoiZoVPtXGla36CHLrzyTmKPg9
+nZLtrVmOKAfUW1ejYjSeO9Rv05hOsGtPtdi70jw1b7WkUC7Ic8L4HzJE0zDzKwEk
+ESVZiLX9G9b0O9CDQnKxRluuZDmVAgMBAAGjITAfMB0GA1UdDgQWBBT9cbSyt2cH
+nN9RnC6o9TOoPH5QWTANBgkqhkiG9w0BAQ0FAAOCAgEAVMpgq3aTTv4v3ZmSJ1P6
+jZBXX85IdnRUvadXX0HDgqpqs8k3Sm67C0UwpLQHeYw5t6ilSJocCw62pMCgfxwf
+dmJ9VEcFoQSd30BdCMXNmPxAnQ+/INUBPzmcZwe+KlI07IQUsjoEPtRG9LBxwric
+PifjxKzzVgOlPPb5XGNmVLdlncY9Z4v5McZPQx6+hG4CqNULEOrx/xRpQDTsGUem
+AXR/ocHm7dDwUIQrkRPkbPK+urEtqKS+RL5ttQ4myzJWasCiDoAdlDv15X7u2G+i
+E8rTSohtr4Crd4DbNpT11aQHtnympNJCAc7PyRLcQRV3FASXvDUsvwT4dMcPN+M1
+ZR5oatbo9hxy/MPyhQun4awMRvaF7HSKrPI8XJRdJzzufusv662N6A7UX31i5W82
+rnSxfP/haklNfwcBAQ0R3R/MkoURYanJYoHnr2WuAx0yfxNIYlJMX7hfPdWOW6a4
+7nQQAkrgW3knQGlKwCEypjm0tdK0bsUrQ0F91wUUYSUSFuPDPb19ifKXklBoCVlB
+6u3ckHu7LG/YZcHmtsxMRMuT+6LtIs/huFnfs4YhJYggswFJHjEX5PcBfsiQklz+
+ahs+UsJAb+lbMOlWj+LYDdyC4T7ZHT+Ii/JZdBN3WNXiBzNuXGC7bd0KWBgCaFuU
+ZAPV0YlmPjsGRaSl7vfh+cI=
+-----END CERTIFICATE-----
--- a/router/java/src/net/i2p/router/transport/ntcp/Reader.java
+++ b/router/java/src/net/i2p/router/transport/ntcp/Reader.java
@@ -98,8 +98,10 @@ class Reader {
                        if (keepReading) {
                            // keep on reading the same one
                        } else {
-                            _liveReads.remove(con);
-                            con = null;
+                            if (con != null) {
+                                _liveReads.remove(con);
+                                con = null;
+                            }
                            if (_pendingConnections.isEmpty()) {
                                _pendingConnections.wait();
                            } else {
@@ -116,6 +118,10 @@ class Reader {
                        _log.debug("begin read for " + con);
                    try {
                        processRead(con);
+                    } catch (IllegalStateException ise) {
+                        // FailedEstablishState.receive() (race - see below)
+                        if (_log.shouldWarn())
+                            _log.warn("Error in the ntcp reader", ise);
                    } catch (RuntimeException re) {
                        _log.log(Log.CRIT, "Error in the ntcp reader", re);
                    }
@@ -153,6 +159,7 @@ class Reader {
                EventPumper.releaseBuf(buf);
                break;
            }
+            // FIXME call est.isCorrupt() before also? throws ISE here... see above
            est.receive(buf);
            EventPumper.releaseBuf(buf);
            if (est.isCorrupt()) {