From: Frédéric Marchal <fmarchal@users.sourceforge.net>
Date: Thu, 16 Jul 2009 14:48:32 +0000 (+0000)
Subject: Detect downloaded suffix bigger than 3 characters, don't match the cases and don... 
X-Git-Tag: v2_2_6~55
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=304a739d57084d6201b6b585e7978a9041f1f387;p=thirdparty%2Fsarg.git

Detect downloaded suffix bigger than 3 characters, don't match the cases and don't stop on a partial match.
---

diff --git a/documentation/util.txt b/documentation/util.txt
index d607295..62adb63 100644
--- a/documentation/util.txt
+++ b/documentation/util.txt
@@ -721,3 +721,25 @@ The usertab file must have been read by read_usertab().
 \param name A buffer to write the real name of the user.
 \param namelen The size of the buffer.
 */
+
+
+
+
+
+/*! \fn int is_download_suffix(const char *url)
+Tell if the URL correspond to a downloaded file. The function takes the extension at the end of the
+URL with a maximum of 9 characters and compare it to the list of the download suffix in
+::DownloadSuffix. If the suffix is found in the list, the function reports the URL as the download
+of a file.
+
+\param url The URL to test.
+
+\retval 1 The URL matches a suffix of a download.
+\retval 0 The URL is not a known download.
+
+\note A downloaded file cannot be detected if the file name is embedded in a GET or POST request. Only requests
+that ends with the file name can be detected.
+
+\note A URL embedding another web site's address ending by .com at the end of the URL will match the download
+extension com if it is defined in the ::DownloadSuffix.
+*/
diff --git a/include/conf.h b/include/conf.h
index 907850e..67c310c 100755
--- a/include/conf.h
+++ b/include/conf.h
@@ -272,8 +272,6 @@ char ouser2[255];
 char user2[MAXLEN];
 char wentp[512];
 char addr[MAXLEN];
-char suffix[10];
-char download_url[MAXLEN];
 char Ulimit[6];
 char RealtimeTypes[1024];
 char cmd[255];
@@ -315,7 +313,6 @@ int  SiteUsersReportLimit;
 int  DansGuardianReportLimit;
 int  SquidGuardReportLimit;
 int  UserReportLimit;
-int  download_flag;
 int  dotinuser;
 int  realtime_refresh;
 int  realtime_access_log_lines;
diff --git a/include/defs.h b/include/defs.h
index 9c513c5..e1b46ca 100755
--- a/include/defs.h
+++ b/include/defs.h
@@ -160,3 +160,4 @@ char *get_param_value(const char *param,char *line);
 void read_usertab(const char *UserTabFile);
 void get_usertab_name(const char *user,char *name,int namelen);
 int compar( const void *, const void * );
+int is_download_suffix(const char *url);
diff --git a/log.c b/log.c
index 6bb2bb3..f046e92 100644
--- a/log.c
+++ b/log.c
@@ -122,6 +122,8 @@ int main(int argc,char *argv[])
    unsigned long recs2=0;
    struct rlimit rl;
    int OutputNonZero = REPORT_EVERY_X_LINES ;
+   int download_flag;
+   char download_url[MAXLEN];
 
    BgImage[0]='\0';
    LogoImage[0]='\0';
@@ -1082,17 +1084,10 @@ int main(int argc,char *argv[])
          if(strstr(ReportType,"denied") != 0)
             strcpy(urly,url);
 
-         if(strlen(DownloadSuffix)) {
-            suffix[0]='\0';
-            download_flag=0;
-            if(strncmp(url+strlen(url)-4,".",1) == 0)
-               strcpy(suffix,url+strlen(url)-3);
-            else strcpy(suffix,url+strlen(url)-4);
-            if(strstr(DownloadSuffix,suffix) != 0) {
-               strcpy(download_url,url);
-               download_flag=1;
-               download_count++;
-            }
+         download_flag=is_download_suffix(url);
+         if (download_flag) {
+            strcpy(download_url,url);
+            download_count++;
          }
 
          if (strchr(url,'/')) {
diff --git a/util.c b/util.c
index 675b6a3..a69968c 100644
--- a/util.c
+++ b/util.c
@@ -1466,3 +1466,31 @@ void get_usertab_name(const char *user,char *name,int namelen)
       }
    }
 }
+
+int is_download_suffix(const char *url)
+{
+   int urllen;
+   int i;
+   char suffix[10];
+   const char *str;
+   int suflen;
+
+   if(DownloadSuffix[0]==0) return(0);
+
+   urllen=strlen(url)-1;
+   for (i=0 ; i<sizeof(suffix)-1 && i<urllen ; i++) {
+      if (url[urllen-i]=='.') {
+         if (i==0) return(0); //detect a single trailing dot
+         strcpy(suffix,url+urllen-i+1);
+         suflen=strlen(suffix);
+         for (str=DownloadSuffix ; str ; str=strchr(str,',')) {
+            if (*str==',') str++;
+            if(strncasecmp(str,suffix,suflen)==0 && (str[suflen]==',' || str[suflen]==0))
+               return(1);
+         }
+         return(0);
+      }
+   }
+   return(0);
+}
+