bweb: Update some GPL2 notice to AGPL

[bacula/bacula] / gui / bweb / cgi / bresto.pl

diff --git a/gui/bweb/cgi/bresto.pl b/gui/bweb/cgi/bresto.pl
index a0b217cb42b96d47038c6cb7b6055d4cd3c961f0..df92a485990138cbdde7a556c8d5d8ea709c660f 100755 (executable)
--- a/gui/bweb/cgi/bresto.pl
+++ b/gui/bweb/cgi/bresto.pl
@@ -13,25 +13,24 @@ die "bresto is not enabled" if (not $bresto_enable);
    The main author of Bweb is Eric Bollengier.
    The main author of Bacula is Kern Sibbald, with contributions from
    many others, a complete list can be found in the file AUTHORS.
-
    This program is Free Software; you can redistribute it and/or
-   modify it under the terms of version two of the GNU General Public
-   License as published by the Free Software Foundation plus additions
-   that are listed in the file LICENSE.
+   modify it under the terms of version three of the GNU Affero General Public
+   License as published by the Free Software Foundation and included
+   in the file LICENSE.
 
    This program is distributed in the hope that it will be useful, but
    WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-   General Public License for more details.
+   Affero General Public License for more details.
 
-   You should have received a copy of the GNU General Public License
+   You should have received a copy of the GNU Affero General Public License
    along with this program; if not, write to the Free Software
    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
    02110-1301, USA.
 
    Bacula® is a registered trademark of Kern Sibbald.
    The licensor of Bacula is the Free Software Foundation Europe
-   (FSFE), Fiduciary Program, Sumatrastrasse 25, 8006 Zurich,
+   (FSFE), Fiduciary Program, Sumatrastrasse 25, 8006 Zürich,
    Switzerland, email:ftf@fsfeurope.org.
 
 =head1 VERSION
@@ -912,17 +911,14 @@ sub fill_table_for_restore
           FROM File WHERE FileId IN ($fileid))";
     }
 
-    # using this is not good because the sql engine doesn't know
-    # what LIKE will use. It will be better to get Path% in perl
-    # but it doesn't work with accents... :(
     foreach my $dirid (@dirid) {
-      push @union, "
+        my $p = $bvfs->get_path($dirid);
+        $p =~ s/([%_\\])/\\$1/g;  # Escape % and _ for LIKE search
+        $p = $bvfs->dbh_quote($p);
+        push @union, "
   (SELECT File.JobId, File.FileIndex, File.FilenameId, File.PathId $FileId
     FROM Path JOIN File USING (PathId)
-   WHERE Path.Path LIKE
-        (SELECT ". $bvfs->dbh_strcat('Path',"'\%'") ." FROM Path
-          WHERE PathId = $dirid
-        )
+   WHERE Path.Path LIKE " . $bvfs->dbh_strcat($p, "'%'") . "
      AND File.JobId IN ($inclause))";
     }
 
@@ -1073,14 +1069,27 @@ if ($action eq 'restore') {
     print CGI::redirect("bweb.pl?action=dsp_cur_job;jobid=$jobid") ;
     exit 0;
 }
-
 sub escape_quote
 {
     my ($str) = @_;
+    my %esc = (
+        "\n" => '\n',
+        "\r" => '\r',
+        "\t" => '\t',
+        "\f" => '\f',
+        "\b" => '\b',
+        "\"" => '\"',
+        "\\" => '\\\\',
+        "\'" => '\\\'',
+    );
+
     if (!$str) {
         return '';
     }
-    $str =~ s/'/\\'/g;
+
+    $str =~ s/([\x22\x5c\n\r\t\f\b])/$esc{$1}/g;
+    $str =~ s/\//\\\//g;
+    $str =~ s/([\x00-\x08\x0b\x0e-\x1f])/'\\u00' . unpack('H2', $1)/eg;
     return $str;
 }
 
@@ -1101,7 +1110,7 @@ if ($action eq 'list_files_dirs') {
                                0, # filenameid
                                $_->[0], # pathid
                                "'$jids'", # jobid
-                               "'" . escape_quote($_->[1]) . "'", # name
+                                '"' . escape_quote($_->[1]) . '"', # name
                                "'" . $p[7] . "'",                 # size
                                "'" . strftime('%Y-%m-%d %H:%m:%S', localtime($p[11]||0)) .  "'") .
                    ']'; 
@@ -1117,7 +1126,7 @@ if ($action eq 'list_files_dirs') {
                                0, # filenameid
                                $_->[0], # pathid
                                "'$jids'", # jobid
-                               "'" . escape_quote($_->[1]) . "'", # name
+                               '"' . escape_quote($_->[1]) . '"', # name
                                "'" . $p[7] . "'",                 # size
                                "'" . strftime('%Y-%m-%d %H:%m:%S', localtime($p[11]||0)) .  "'") .
                    ']'; 
@@ -1133,7 +1142,7 @@ if ($action eq 'list_files_dirs') {
                                $_->[0],
                                $pathid,
                                $_->[4],
-                               "'" . escape_quote($_->[2]) . "'",
+                                '"' . escape_quote($_->[2]) . '"', # name
                                "'" . $p[7] . "'",
                                "'" . strftime('%Y-%m-%d %H:%m:%S', localtime($p[11])) .  "'") .
                    ']'; 
@@ -1153,7 +1162,7 @@ if ($action eq 'list_files_dirs') {
                                $_->[0],
                                $pathid,
                                $_->[4],
-                               "'" . escape_quote($_->[2]) . "'",
+                                '"' . escape_quote($_->[2]) . '"', # name
                                "'" . $p[7] . "'",
                                "'" . strftime('%Y-%m-%d %H:%m:%S', localtime($p[11])) .  "'") .
                    ']';