diff --git a/updown/fetch.cgi b/updown/fetch.cgi index b17bf2588..0c42790cc 100755 --- a/updown/fetch.cgi +++ b/updown/fetch.cgi @@ -80,14 +80,65 @@ if ($ENV{'PATH_INFO'}) { if (!$fetch_show) { print "Content-Disposition: Attachment\n"; } - @st = stat($file); - print "Content-length: $st[7]\n"; - print "X-Content-Type-Options: nosniff\n"; - print "Content-type: $type\n\n"; - while(read(FILE, $buffer, &get_buffer_size_binary())) { - print("$buffer"); + # Stat file + my @st = stat($file); + my $fsize = $st[7]; + + # Get and analyze the file contents first + my $fdata = ""; + my $dangertypes = $type =~ /html|xml|pdf/i; + my $htmltype = $type =~ /html/i ? 1 : 0; + my $pdftype = $type =~ /pdf/i ? 'pdf' : 0; + my $bsize = + $dangertypes ? $fsize : &get_buffer_size_binary(); + while(read(FILE, $buffer, $bsize)) { + if ($dangertypes) { + my $buffer_filtered = &filter_javascript($buffer, $pdftype); + # If content was changed upon filtering + if ($buffer_filtered ne $buffer) { + # For text simply return filtered but + # tell user that it was filtered out + if ($htmltype) { + # Add a banner showing content was changed + my $prefdata = + &ui_alert_box($text{'ui_jsblocked'}, 'danger'); + # Pass filtered content with the banner + # Insert the banner in HTML body + if ($buffer_filtered =~ s/(