Files
httrack/html/server/finished.html
Xavier Roche e2a57d6c07 WebHTTrack settings pages interpolate values into double-quoted attributes unescaped (#1013)
* WebHTTrack settings pages interpolate values into double-quoted attributes unescaped

#988 escaped the templates' element bodies and event handlers but left
attribute values alone, because cat_html_escaped() keeps the double quote
raw on purpose: the tooltips are written title='${html:LANG_x}'. The
settings pages put about seventy values inside double-quoted attributes,
where a " opens a new attribute.

Add a fourth interpolation mode, attr:, escaping < > & ' " as entities and
nothing else, and point the 230 double-quoted attribute positions at it.
file.html's file:// href stays on the html-urlescaped mode, which now emits
%22 for the quote the way unquoted: already did, and step2.html's in-script
literal moves to js:. Test 185 now requires attr: in a double-quoted
attribute and js: inside a script block; 217 drives hostile values through
three templates and a translation.

Closes #989

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Xavier Roche <roche@httrack.com>

* Close the two attribute sites the template sweep could not reach

The liststr: format builds its own <option value="..."> in C, so no
template edit covers it, and it escaped with the helper that leaves the
double quote raw. Its values are the project directory names and the
Category= line of each project's winprofile.ini, both of which can hold
a quote.

The save side kept hex-decoding a backslash plus two hex digits, so a
path typed as C:\ab displayed correctly but was written to ~/.httrack.ini
as C: plus byte 0xAB. The ini writer has no inverse for that escape; the
one caller that needs it is a template literal (${test:proxytype:\3A//}),
so the decode now applies only there.

Test 185 classified attributes with a regex that missed a spaced =, an
unquoted or single-quoted value, a template outside html/server/*.html,
and an output-mode region the file never closes; the counting floors it
asserted also survived a count-preserving rewrite. It now walks tags,
asserts the property on every site it classifies, and proves it can see
each of those forms on a synthetic template first.

Test 217 gains a Latin-1 byte in a translation, the POST-render-POST
round trip, and the two fixes above.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Xavier Roche <roche@httrack.com>

* Trim the comments the last commit added

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Xavier Roche <roche@httrack.com>

---------

Signed-off-by: Xavier Roche <roche@httrack.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-05 08:20:14 +00:00

155 lines
4.2 KiB
HTML

<html xmlns="http://www.w3.org/1999/xhtml" lang="${attr:LANGUAGE_ISO}">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=${attr:LANGUAGE_CHARSET}" />
<meta name="description" content="${attr:LANG_METADESC}" />
<meta name="keywords" content="${attr:LANG_METAKEYW}" />
<title>'${html:projname}' - HTTrack Website Copier</title>
<link rel="stylesheet" type="text/css" media="screen" href="style.css">
<script type="text/javascript" src="ping.js" defer></script>
<script language="javascript">
<!--
function do_load() {
window.status=' ';
}
function do_unload() {
}
function info(str) {
window.status = str;
}
// -->
</script>
</head>
<body onLoad="do_load();" onUnload="do_unload();">
<table width="76%" border="0" align="center" cellspacing="0" cellpadding="0" class="tableWidth">
<tr>
<td><img src="images/wordmark.svg" width="400" height="36" alt="HTTrack Website Copier" title="" border="0" id="title" /></td>
</tr>
</table>
<table width="76%" border="0" align="center" cellspacing="0" cellpadding="3" class="tableWidth">
<tr>
<td width="90%" id="subTitle">${LANG_OSFWB}</td>
<td id="subTitle" align="right">
<a href="/server/file.html" target="_blank"
onClick="window.open('/server/file.html', 'help', 'toolbar=no, location=no, directories=no, status=yes, menubar=no, scrollbars=yes, resizable=yes, width=640, height=480'); return false"
title='${html:LANG_O1}' onMouseOver="info('${js:LANG_O1}'); return true" onMouseOut="info('&nbsp;'); return true"
style="color:#FFFFFF"
>
${LANG_O1}
</a>
</td>
${/* show help only if available */}
${do:if-file-exists:html/index.html}
<td id="subTitle">|</td>
<td id="subTitle" align="right">
<a href="/index.html" target="_blank"
onClick="window.open('/server/help.html', 'help', 'toolbar=no, location=no, directories=no, status=yes, menubar=no, scrollbars=yes, resizable=yes, width=640, height=480'); return false"
title='${html:LANG_TIPHELP}' onMouseOver="info('${js:LANG_TIPHELP}'); return true" onMouseOut="info('&nbsp;'); return true"
style="color:#FFFFFF"
>
${LANG_O5}
</a>
</td>
${do:end-if}
</tr>
</table>
<table width="76%" border="0" align="center" cellspacing="0" cellpadding="0" class="tableWidth">
<tr class="blak">
<td>
<table width="100%" border="0" align="center" cellspacing="1" cellpadding="0">
<tr>
<td colspan="6">
<table width="100%" border="0" align="center" cellspacing="0" cellpadding="10">
<tr>
<td id="pageContent">
<!-- ==================== End prologue ==================== -->
<table border="0" width="100%">
<tr><td width="90%">
<h2 align="center"><em>${LANG_F18b}</em></h2>
</td><td>
<a href="/step3.html" target="_blank">${LANG_TIPHELP}</a>
</td></tr></table>
<br>
<pre>
${do:output-mode:html}${do:if-not-empty:commandReturn}
${LANG_F19}
<font color="red">
${commandReturnMsg}
</font>
${LANG_F20}
<font color="blue">
httrack ${commandReturnCmdl}
</font>
${LANG_F21}
${/* end-if clears the output mode rather than restoring it, so re-arm it */}
${do:end-if}${do:output-mode:html}
${do:if-empty:commandReturn}
${LANG_F22}
${do:end-if}
</pre>
${LANG_G8} :
${/* an http: page cannot navigate to file:, so the mirror is reached through the server */}
<a href="/website/index.html" target="_new">
${html:path}/${html:projname}
</a></li>
<ul>
<li><a href="/website/index.html" target="_new">${LANG_D8}</a></li>
<li><a href="/website/hts-log.txt" target="_new">${LANG_D4}</a></li>
</ul>
<form method="POST" action="exit.html" name="form">
<input type="hidden" name="sid" value="${attr:sid}">
<input type="hidden" name="command" value="quit">
<table border="0" width="100%">
<tr><td>
</td></tr><tr><td>
</td></tr><tr><td>
<table width="100%" border="0"><tr><td align="left">
&nbsp;
</td><td align="right">
<input type="submit" value=" ${attr:LANG_QUIT} "
onClick="form.submit()">
</td></tr></table>
</td></tr>
</table>
</form>
<!-- ==================== Start epilogue ==================== -->
</td>
</tr>
</table>
</td>
</tr>
</table>
</td>
</tr>
</table>
<table width="76%" border="0" align="center" valign="bottom" cellspacing="0" cellpadding="0">
<tr>
<td id="footer"><small><small>&copy; 1998-2026 Xavier Roche & other contributors - Web Design: Leto Kauler.</small></small></td>
</tr>
</table>
</body>
</html>