Reworked fixing unsecure command-line invocation in templates' |program{}

[claws.git] / src / quote_fmt_parse.y

diff --git a/src/quote_fmt_parse.y b/src/quote_fmt_parse.y
index 92e300e03b977ed033255726a6c2903bd8af12e0..a7bed9081b352bcc6b39f7759dcca55259dabe21 100644 (file)
--- a/src/quote_fmt_parse.y
+++ b/src/quote_fmt_parse.y
@@ -1,6 +1,6 @@
 /*
- * Sylpheed -- a GTK+ based, lightweight, and fast e-mail client
- * Copyright (C) 1999-2007 Hiroyuki Yamamoto and the Claws Mail Team
+ * Claws Mail -- a GTK+ based, lightweight, and fast e-mail client
+ * Copyright (C) 1999-2020 The Claws Mail Team and Hiroyuki Yamamoto
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -37,6 +37,7 @@
 #include "quote_fmt.h"
 #include "quote_fmt_lex.h"
 #include "account.h"
+#include "file-utils.h"
 
 /* decl */
 /*
@@ -487,11 +488,11 @@ static void quote_fmt_show_msg(MsgInfo *msginfo, const gchar *body,
        if (fp == NULL)
                g_warning("Can't get text part");
        else {
-               account_signatures_matchlist_create();
+               account_sigsep_matchlist_create();
                while (fgets(buf, sizeof(buf), fp) != NULL) {
                        strcrchomp(buf);
 
-                       if (!signature && account_signatures_matchlist_nchar_found(buf, "%s\n"))
+                       if (!signature && account_sigsep_matchlist_nchar_found(buf, "%s\n"))
                                break;
                
                        if (quoted && quote_str)
@@ -499,7 +500,7 @@ static void quote_fmt_show_msg(MsgInfo *msginfo, const gchar *body,
                        
                        INSERT(buf);
                }
-               account_signatures_matchlist_delete();
+               account_sigsep_matchlist_delete();
                fclose(fp);
        }
 }
@@ -507,7 +508,7 @@ static void quote_fmt_show_msg(MsgInfo *msginfo, const gchar *body,
 static void quote_fmt_insert_file(const gchar *filename)
 {
        FILE *file;
-       char buffer[256];
+       char buffer[PATH_MAX];
        
        if ((file = g_fopen(filename, "rb")) != NULL) {
                while (fgets(buffer, sizeof(buffer), file)) {
@@ -521,40 +522,40 @@ static void quote_fmt_insert_file(const gchar *filename)
 static void quote_fmt_insert_program_output(const gchar *progname)
 {
        FILE *file;
-       char buffer[256];
+       char buffer[BUFFSIZE];
 
-       if ((file = popen(progname, "r")) != NULL) {
+       if ((file = get_command_output_stream(progname)) != NULL) {
                while (fgets(buffer, sizeof(buffer), file)) {
                        INSERT(buffer);
                }
-               pclose(file);
+               close(file);
        }
 }
 
 static void quote_fmt_insert_user_input(const gchar *varname)
 {
-       gchar *buf = NULL;
-       gchar *text = NULL;
-       
-       if (dry_run) 
-               return;
-
-       if ((text = g_hash_table_lookup(var_table, varname)) == NULL) {
-               buf = g_strdup_printf(_("Enter text to replace '%s'"), varname);
-               text = input_dialog(_("Enter variable"), buf, "");
-               g_free(buf);
-               if (!text)
-                       return;
-               g_hash_table_insert(var_table, g_strdup(varname), g_strdup(text));
-       } else {
-               /* don't free the one in hashtable at the end */
-               text = g_strdup(text);
-       }
-
-       if (!text)
-               return;
-       INSERT(text);
-       g_free(text);
+    gchar *buf = NULL;
+    gchar *text = NULL;
+
+    if (dry_run) 
+           return;
+
+    if ((text = g_hash_table_lookup(var_table, varname)) == NULL) {
+           buf = g_strdup_printf(_("Enter text to replace '%s'"), varname);
+           text = input_dialog(_("Enter variable"), buf, "");
+           g_free(buf);
+           if (!text)
+                   return;
+           g_hash_table_insert(var_table, g_strdup(varname), g_strdup(text));
+    } else {
+           /* don't free the one in hashtable at the end */
+           text = g_strdup(text);
+    }
+
+    if (!text)
+           return;
+    INSERT(text);
+    g_free(text);
 }
 
 static void quote_fmt_attach_file(const gchar *filename)
@@ -565,16 +566,16 @@ static void quote_fmt_attach_file(const gchar *filename)
 static void quote_fmt_attach_file_program_output(const gchar *progname)
 {
        FILE *file;
-       char buffer[PATH_MAX];
+       char buffer[BUFFSIZE];
 
-       if ((file = popen(progname, "r")) != NULL) {
+       if ((file = get_command_output_stream(progname)) != NULL) {
                /* get first line only */
                if (fgets(buffer, sizeof(buffer), file)) {
                        /* trim trailing CR/LF */
                        strretchomp(buffer);
                        attachments = g_list_append(attachments, g_strdup(buffer));
                }
-               pclose(file);
+               close(file);
        }
 }