Re: htsearch wrapper files

[Roger Dingledine <arma@mit.edu>]

> allow_in_form:  mywrapper
> mywrapper:      foo
> search_results_wrapper: ${common_dir}/${mywrapper}wrapper.html
> 
> Then add to each search form:
> 
> <type=hidden name=mywrapper value=[CategoryID]>
> 
> Then generate the appropriate wrapper files:
> 
> /home/htdig/dev/common/[CategoryID]wrapper.html
>             ^^^
>             Change as appropriate
> 
> One minor catch though.  Somone could use this to view any file that the
> webserver has read access to that ends in "wrapper.html".  They'd have to
> know the path of course, but since I doubt we'll have many *wrapper.html
> files, I doubt that this is much of an issue.
 
Not that this actually matters much, but it could well be an issue.
Consider if somebody put some characters like a ; or > or \0 in their
*, so it read whatever file they cared about and ignored the rest of
the string.

Anyway, just wanted to point out that issues like this are rarely as
simple as they seem.
--Roger