#!/usr/bin/perl

#__________________________________________________________
#
#   File:    handler
#   By:      Matt Ho
#   Date:    7/23/95
#   Purpose: Appropriately packages documents for download
#            or display.
#__________________________________________________________


#__________________________________________________________
#
#   IRIX 6.5 disables the handler script for security
#   reasons. This script will be removed entirely in the
#   next release.
#
#   If you need to restore its functionality, and you are
#   behind a firewall, and trust all others behind that
#   firewall, then change the line below to:
#        $HANDLER_DISABLED = 0 ;
#__________________________________________________________

$HANDLER_DISABLED = 1 ;


#__________________________________________________________
#
#   If handler script is disabled, display a message and
#   exit.
#__________________________________________________________

if ( $HANDLER_DISABLED != 0 ) {
    print <<ENDOFTEXT ;
Content-type: text/html

<HTML>
<HEAD><TITLE>OutBox: Download feature disabled.</TITLE></HEAD>
<BODY><H2>OutBox: Download feature disabled.</H2>
To download a file from an OutBox page, use your web browser's
'Save Link' feature. (In Netscape Navigator move the mouse over the file
and select 'Save Link As' from the popup menu on mouse button 3, or use
the mouse accelerator, &quot;Shift-Button1&quot;)
</BODY>
</HTML>
ENDOFTEXT

    exit ;
}

#__________________________________________________________
#
#	Set some environment variables, we'll need through the
#	script and do some initial error checking.
#__________________________________________________________

$ROOT     = "/var/www/htdocs" ;	# Root directory
$PATH     = $ENV{'PATH_INFO'} ;

# trim off undesirable meta chars.
$PATH =~ s/[|;]//g ;

chop $PATH if substr($PATH, -1) eq "/" ;
@_        = split('/', $PATH) ;
$pathRoot = $_[$#_] ;
$doc      = $ROOT.$PATH ;

&ErrBadPath unless -f $doc ;
&ErrBadPath unless &ValidPath ; # Check for server spoofing

#__________________________________________________________
#
#	Read the form data in (we just may need this)
#__________________________________________________________

if( $ENV{'REQUEST_METHOD'} eq "GET" )
{
   $buffer=$ENV{'QUERY_STRING'} ;
} 
else
{
   read(STDIN, $buffer, $ENV{'CONTENT_LENGTH'}) ;
}

@pairs = split(/&/, $buffer) ;
foreach (@pairs)
{
	tr/+/ / ;	
   ($name,$value) =  split(/=/) ;
    $value        =~ s/%(..)/pack("c",hex($1))/ge ;
    $name         =~ s/%(..)/pack("c",hex($1))/ge ;

	$FORM{$name} = $value ;
}


#__________________________________________________________
#

$data = $FORM{'data'} ;
if( $data eq "Download" )
{
	unless( open(INPUT, $doc) )
	{
		print <<ENDOFTEXT ;
Content-type: text/html

<HEAD><TITLE>404 Not Found</TITLE></HEAD>
<BODY><H1>404 Not Found</H1>
The requested URL was not found on this server: $ENV{'PATH_INFO'}
<P>
</BODY>
ENDOFTEXT
		return ;
	} 
	print <<ENDOFTEXT ;
Content-type: application/octet-stream

ENDOFTEXT

	while( read(INPUT, $buf, 16384) )
	{
    	print $buf ;
	} 

	close(INPUT) ;
}
elsif( $data eq "View" )
{
	substr($PATH, 0, 1) = "/~" ;
	print <<ENDOFTEXT ;
Location: $PATH

ENDOFTEXT
}
else
{
	print <<ENDOFTEXT ;
Content-type: text/html

<HEAD><TITLE>404 Not Found</TITLE></HEAD>
<BODY><H1>404 Not Found</H1>
The requested URL $PATH was not found on this server.<P>
</BODY>
ENDOFTEXT
}

#__________________________________________________________

sub ValidPath
{
    return 1 unless /\.\./ ;
   
    return '' if /^\.\./ ;
    return '' if /\/\.\.\// ;
    return '' if /\.\.$/ ;

    return 1 ;
}

sub ErrBadPath
{
        print <<ENDOFTEXT ;
Content-type: text/html

<HTML>
<HEAD><TITLE>OutBox: File Not Found</TITLE></HEAD>
<BODY><H2>OutBox: File Not Found</H2>
The requested file "$PATH" was not found on this OutBox page.
<P>
ENDOFTEXT

if( defined $ENV{'HTTP_REFERER'} )
{
    $referer = $ENV{'HTTP_REFERER'} ;
    print <<ENDOFTEXT ;
<a href="$referer"><IMG SRC="/outbox/images/go-back.gif" BORDER=0 ALT="Back"></A>
ENDOFTEXT
}

        print <<ENDOFTEXT ;
</BODY>
</HTML>
ENDOFTEXT

        exit ;
}