prevent macros coming from commands convert, base64decode, decodeuri

This commit is contained in:
Massimo Melina 2020-06-23 20:16:12 +02:00
parent 308561090f
commit 44f37f92cf

View File

@ -691,7 +691,9 @@ var
result:=''; result:='';
for c in UTF8encode(s) do for c in UTF8encode(s) do
result:=result+intToHex(ord(c)); result:=result+intToHex(ord(c));
end end;
if isFalse(par('macros')) then
result:=noMacrosAllowed(result);
end; // convert end; // convert
procedure encodeuri(); procedure encodeuri();
@ -1999,7 +2001,11 @@ try
if name = 'base64' then if name = 'base64' then
result:=string(base64encode(UTF8encode(p))); result:=string(base64encode(UTF8encode(p)));
if name = 'base64decode' then if name = 'base64decode' then
begin
result:=utf8ToString(base64decode(ansistring(p))); result:=utf8ToString(base64decode(ansistring(p)));
if isFalse(par('macros')) then
result:=noMacrosAllowed(result);
end;
if name = 'md5' then if name = 'md5' then
result:=strMD5(p); result:=strMD5(p);
if name = 'sha1' then if name = 'sha1' then
@ -2078,7 +2084,7 @@ try
encodeuri(); encodeuri();
if name = 'decodeuri' then if name = 'decodeuri' then
result:=decodeURL(ansistring(p)); result:=noMacrosAllowed(decodeURL(ansistring(p)));
if name = 'set cfg' then if name = 'set cfg' then
trueIf(mainfrm.setcfg(p)); trueIf(mainfrm.setcfg(p));