From: Frédéric Marchal <fmarchal@users.sourceforge.net>
Date: Fri, 14 Aug 2009 05:17:46 +0000 (+0000)
Subject: Protect the reading of the configuration file against buffer overflows.
X-Git-Tag: v2_2_6~41
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4af2f8ff6900a3de7f726ae2dd6ebfb634a2d32e;p=thirdparty%2Fsarg.git

Protect the reading of the configuration file against buffer overflows.
Logo image height taken into account.
Accept longer mail utility name.
---

diff --git a/configure b/configure
index 5c3d8ce..80a2d8c 100755
--- a/configure
+++ b/configure
@@ -4794,12 +4794,13 @@ done
 
 
 
+
 
 
 for ac_header in stdio.h stdlib.h string.h strings.h sys/time.h time.h unistd.h sys/dirent.h \
 		 dirent.h sys/socket.h netdb.h arpa/inet.h sys/types.h netinet/in.h sys/stat.h \
 		 ctype.h gd.h gdfontl.h gdfontt.h gdfonts.h gdfontmb.h gdfontg.h iconv.h \
-		 errno.h sys/resource.h sys/wait.h stdarg.h inttypes.h
+		 errno.h sys/resource.h sys/wait.h stdarg.h inttypes.h limits.h
 do
 as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
 if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
diff --git a/configure.in b/configure.in
index 577aae9..0989801 100644
--- a/configure.in
+++ b/configure.in
@@ -48,7 +48,7 @@ fi
 AC_CHECK_HEADERS(stdio.h stdlib.h string.h strings.h sys/time.h time.h unistd.h sys/dirent.h \
 		 dirent.h sys/socket.h netdb.h arpa/inet.h sys/types.h netinet/in.h sys/stat.h \
 		 ctype.h gd.h gdfontl.h gdfontt.h gdfonts.h gdfontmb.h gdfontg.h iconv.h \
-		 errno.h sys/resource.h sys/wait.h stdarg.h inttypes.h)
+		 errno.h sys/resource.h sys/wait.h stdarg.h inttypes.h limits.h)
 
 AC_CHECK_LIB(gd, gdImagePng,LIBS="-lgd ${LIBS}"; HAVE_GD="yes", HAVE_GD="")
 
diff --git a/documentation/getconf.txt b/documentation/getconf.txt
new file mode 100644
index 0000000..21e43b2
--- /dev/null
+++ b/documentation/getconf.txt
@@ -0,0 +1,66 @@
+/*! \file getconf.c
+\brief Configure sarg.
+*/
+
+
+/*! \fn static int getparam_string(const char *param,char *buf,char *value,int value_size)
+Extract a string value from a line if it it the right parameter.
+
+\param param The name of the parameter to find.
+\param buf The string read from the input file.
+\param value The buffer to store the value.
+\param value_size The size of the output buffer.
+
+\retval 1 Parameter match.
+\retval 0 The line is not for that parameter.
+*/
+
+
+
+
+
+/*! \fn static int getparam_quoted(const char *param,char *buf,char *value,int value_size)
+Extract a quoted string value from a line if it it the right parameter.
+
+\param param The name of the parameter to find.
+\param buf The string read from the input file.
+\param value The buffer to store the value.
+\param value_size The size of the output buffer.
+
+\retval 1 Parameter match.
+\retval 0 The line is not for that parameter.
+*/
+
+
+
+
+
+/*! \fn static int getparam_int(const char *param,char *buf,int *value)
+Extract an integer value from a line if it it the right parameter.
+
+\param param The name of the parameter to find.
+\param buf The string read from the input file.
+\param value The variable to store the value.
+
+\retval 1 Parameter match.
+\retval 0 The line is not for that parameter.
+*/
+
+
+
+
+
+/*! \fn static void parmtest(char *buf)
+Find what parameter is passed in the input buffer and store the value in memory.
+
+\param buf One line of text from the configuration file.
+*/
+
+
+
+
+
+/*! \fn void getconf(void)
+Read the configuration file whose name is in ::ConfigFile.
+*/
+
diff --git a/getconf.c b/getconf.c
index c9d71c3..23a5bba 100644
--- a/getconf.c
+++ b/getconf.c
@@ -28,1067 +28,376 @@
 
 extern numlist hours, weekdays;
 
-char wbuf[MAXLEN];
-char Msg[255];
+static int getparam_string(const char *param,char *buf,char *value,int value_size)
+{
+   int plen;
+
+   plen=strlen(param);
+   if (strncmp(buf,param,plen) != 0) return(0);
+   buf+=plen;
+   if ((unsigned char)*buf>' ') return(0);
+   while (*buf && (unsigned char)*buf<=' ') buf++;
+
+   if (strlen(buf)>=value_size) {
+      printf("SARG: Maybe you have a broken record or garbage in %s parameter.\n",param);
+      exit(1);
+   }
+   strcpy(value,buf);
+   fixnone(value);
+   return(1);
+}
 
-void parmtest(char *buf)
+static int getparam_quoted(const char *param,char *buf,char *value,int value_size)
 {
+   int plen;
+   int i;
 
-      if(strstr(buf,"background_color") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in background_color parameter.\n");
-            exit(1);
-         }
-         strcpy(BgColor,buf);
-         fixnone(BgColor);
-         return;
-      }
+   plen=strlen(param);
+   if (strncmp(buf,param,plen) != 0) return(0);
+   buf+=plen;
+   if ((unsigned char)*buf>' ') return(0);
+   while (*buf && (unsigned char)*buf<=' ') buf++;
 
-      if(strstr(buf,"text_color") != 0) {
-         if(strstr(buf,"logo_text_color") == 0) {
-            if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-               printf("SARG: Maybe you have a broken record or garbage in text_color parameter.\n");
-               exit(1);
-            }
-            strcpy(TxColor,buf);
-            fixnone(TxColor);
-            return;
-         }
-      }
+   if (*buf != '\"') {
+      printf("SARG: Missing double quote after parameter %s.\n",param);
+      exit(1);
+   }
+   buf++;
 
-      if(strstr(buf,"text_bgcolor") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in text_bgcolor parameter.\n");
-            exit(1);
-         }
-         strcpy(TxBgColor,buf);
-         fixnone(TxBgColor);
-         return;
-      }
+   value_size--;
+   for (i=0 ; i<value_size && *buf && *buf!='\"' ; i++) {
+      value[i]=*buf++;
+   }
+   value[i]='\0';
 
-      if(strstr(buf,"title_color") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in title_color parameter.\n");
-            exit(1);
-         }
-         strcpy(TiColor,buf);
-         fixnone(TiColor);
-         return;
-      }
+   if (*buf != '\"') {
+      printf("SARG: Missing double quote after parameter %s or value is more than %d bytes long.\n",param,value_size);
+      exit(1);
+   }
+   fixnone(value);
+   return(1);
+}
 
-      if(strstr(buf,"logo_image") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in logo_image parameter.\n");
-            exit(1);
-         }
-         strcpy(LogoImage,buf);
-         fixnone(LogoImage);
-         return;
-      }
+static int getparam_2words(const char *param,char *buf,char *word1,int word1_size,char *word2,int word2_size)
+{
+   int plen;
+   int i;
+
+   plen=strlen(param);
+   if (strncmp(buf,param,plen) != 0) return(0);
+   buf+=plen;
+   if ((unsigned char)*buf>' ') return(0);
+   while (*buf && (unsigned char)*buf<=' ') buf++;
+
+   for (i=0 ; i<word1_size && *buf && (unsigned char)*buf>' ' ; i++)
+      word1[i]=*buf++;
+   if (i>=word1_size) {
+      printf("SARG: The first word of parameter %s is more than %d bytes long.\n",param,word1_size-1);
+      exit(1);
+   }
+   if (*buf!=' ') {
+      printf("SARG: Missing second word for parameter %s.\n",param);
+      exit(1);
+   }
+   word1[i]=0;
 
-      if(strstr(buf,"logo_text") != 0) {
-         if(strstr(buf,"logo_text_color") == 0) {
-            if (getword(wbuf,sizeof(wbuf),buf,'"')<0) {
-               printf("SARG: Maybe you have a broken record or garbage in logo_text parameter.\n");
-               exit(1);
-            }
-            if (getword(LogoText,sizeof(LogoText),buf,'"')<0) {
-               printf("SARG: Maybe you have a broken record or garbage in logo_text parameter.\n");
-               exit(1);
-            }
-            fixnone(LogoText);
-            return;
-         }
-      }
+   while (*buf && (unsigned char)*buf<=' ') buf++;
 
-      if(strstr(buf,"logo_text_color") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in logo_text_color parameter.\n");
-            exit(1);
-         }
-         strcpy(LogoTextColor,buf);
-         fixnone(LogoTextColor);
-         return;
-      }
+   for (i=0 ; i<word2_size && *buf && (unsigned char)*buf>' ' ; i++)
+      word2[i]=*buf++;
+   if (i>=word2_size) {
+      printf("SARG: The second word of parameter %s is more than %d bytes long.\n",param,word2_size-1);
+      exit(1);
+   }
+   word2[i]=0;
 
-      if(strstr(buf,"background_image") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in background_image parameter.\n");
-            exit(1);
-         }
-         strcpy(BgImage,buf);
-         fixnone(BgImage);
-         return;
-      }
+   fixnone(word1);
+   fixnone(word2);
+   return(1);
+}
 
-      if(strstr(buf,"show_sarg_info") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in show_sarg_info parameter.\n");
-            exit(1);
-         }
-         strcpy(ShowSargInfo,buf);
-         fixnone(ShowSargInfo);
-         return;
-      }
+static int getparam_int(const char *param,char *buf,int *value)
+{
+   int plen;
+   int next;
+
+   plen=strlen(param);
+   if (strncmp(buf,param,plen) != 0) return(0);
+   buf+=plen;
+   if ((unsigned char)*buf>' ') return(0);
+   while (*buf && (unsigned char)*buf<=' ') buf++;
+
+   next=0;
+   if (sscanf(buf,"%d%n",value,&next) != 1 || (unsigned char)buf[next] > ' ') {
+      printf("SARG: Maybe you have a broken record or garbage in %s parameter.\n",param);
+      exit(1);
+   }
+   return(1);
+}
 
-      if(strstr(buf,"show_sarg_logo") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in show_sarg_logo parameter.\n");
-            exit(1);
-         }
-         strcpy(ShowSargLogo,buf);
-         fixnone(ShowSargLogo);
-         return;
-      }
+static void parmtest(char *buf)
+{
+   char wbuf[50];
 
-      if(strstr(buf,"font_face") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in font_face parameter.\n");
-            exit(1);
-         }
-         strcpy(FontFace,buf);
-         fixnone(FontFace);
-         return;
-      }
+   while (*buf && (unsigned char)*buf<=' ') buf++;
 
-      if(strstr(buf,"header_color") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in header_color parameter.\n");
-            exit(1);
-         }
-         strcpy(HeaderColor,buf);
-         fixnone(HeaderColor);
-         return;
-      }
+   if(*buf == '#' || *buf == '\0')
+      return;
 
-      if(strstr(buf,"header_bgcolor") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in header_bgcolor parameter.\n");
-            exit(1);
-         }
-         strcpy(HeaderBgColor,buf);
-         fixnone(HeaderBgColor);
-         return;
-      }
+   if(debugz)
+      printf("SARG: TAG: %s\n",buf);
 
-      if(strstr(buf,"font_size") != 0) {
-         if(strstr(buf,"header_font_size") == 0 && strstr(buf,"title_font_size") == 0) {
-            if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-               printf("SARG: Maybe you have a broken record or garbage in font_size parameter.\n");
-               exit(1);
-            }
-            strcpy(FontSize,buf);
-            fixnone(FontSize);
-            return;
-         }
-      }
+   if (getparam_string("background_color",buf,BgColor,sizeof(BgColor))>0) return;
 
-      if(strstr(buf,"header_font_size") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in header_font_size parameter.\n");
-            exit(1);
-         }
-         strncpy(HeaderFontSize,buf,sizeof(HeaderFontSize)-1);
-         HeaderFontSize[sizeof(HeaderFontSize)-1]=0;
-         fixnone(HeaderFontSize);
-         return;
-      }
+   if (getparam_string("text_color",buf,TxColor,sizeof(TxColor))>0) return;
 
-      if(strstr(buf,"title_font_size") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in title_font_size parameter.\n");
-            exit(1);
-         }
-         strcpy(TitleFontSize,buf);
-         fixnone(TitleFontSize);
-         return;
-      }
+   if (getparam_string("text_bgcolor",buf,TxBgColor,sizeof(TxBgColor))>0) return;
 
-      if(strstr(buf,"image_size") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0 || getword_multisep(Width,sizeof(Width),buf,' ')<0 || getword_multisep(Height,sizeof(Height),Height,0)<0) {
-            printf("SARG: Maybe you have a broken record or garbage in image_size parameter.\n");
-            exit(1);
-         }
-         fixnone(Width);
-         fixnone(Height);
-         return;
-      }
+   if (getparam_string("title_color",buf,TiColor,sizeof(TiColor))>0) return;
 
-      if(strstr(buf,"title") != 0) {
-         if (getword(wbuf,sizeof(wbuf),buf,'"')<0 || getword(Title,sizeof(Title),buf,'"')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in title parameter.\n");
-            exit(1);
-         }
-         fixnone(Title);
-         return;
-      }
+   if (getparam_string("logo_image",buf,LogoImage,sizeof(LogoImage))>0) return;
 
-      if(strstr(buf,"resolve_ip") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in resolve_ip parameter.\n");
-            exit(1);
-         }
-         strcpy(Ip2Name,buf);
-         fixnone(Ip2Name);
-         return;
-      }
+   if (getparam_quoted("logo_text",buf,LogoText,sizeof(LogoText))>0) return;
 
-      if(strstr(buf,"user_ip") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in user_ip parameter.\n");
-            exit(1);
-         }
-         strcpy(UserIp,buf);
-         fixnone(UserIp);
-         return;
-      }
+   if (getparam_string("logo_text_color",buf,LogoTextColor,sizeof(LogoTextColor))>0) return;
 
-      if(strstr(buf,"max_elapsed") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in max_elapsed parameter.\n");
-            exit(1);
-         }
-         strcpy(MaxElapsed,buf);
-         fixnone(MaxElapsed);
-         return;
-      }
+   if (getparam_string("background_image",buf,BgImage,sizeof(BgImage))>0) return;
 
-      if(strstr(buf,"date_format") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in date_format parameter.\n");
-            exit(1);
-         }
-         strncpy(DateFormat,buf,1);
-         fixnone(DateFormat);
-         return;
-      }
+   if (getparam_string("show_sarg_info",buf,ShowSargInfo,sizeof(ShowSargInfo))>0) return;
 
-      if( strstr( buf, "hours" ) != 0 ) {
-         if( getnumlist( buf, &hours, 24, 24 ) ) {
-            fprintf( stderr, "Error: Invalid syntax in hours tag!\n" );
-            exit( 1 );
-         }
-       }
-
-      if( strstr( buf, "weekdays" ) != 0 ) {
-         if( getnumlist( buf, &weekdays, 7, 7 ) ) {
-            fprintf( stderr, "Error: Invalid syntax in weekdays tag!\n" );
-            exit( 1 );
-         }
-      }
+   if (getparam_string("show_sarg_logo",buf,ShowSargLogo,sizeof(ShowSargLogo))>0) return;
 
-      if(strstr(buf,"topuser_sort_field") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0 || getword_multisep(TopuserSortField,sizeof(TopuserSortField),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in topuser_sort_field parameter.\n");
-            exit(1);
-         }
-         strcpy(TopuserSortOrder,buf);
-         fixnone(TopuserSortOrder);
-         return;
-      }
+   if (getparam_string("font_face",buf,FontFace,sizeof(FontFace))>0) return;
 
-      if(strstr(buf,"user_sort_field") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0 || getword_multisep(UserSortField,sizeof(UserSortField),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in user_sort_field parameter.\n");
-            exit(1);
-         }
-         strcpy(UserSortOrder,buf);
-         fixnone(UserSortOrder);
-         return;
-      }
+   if (getparam_string("header_color",buf,HeaderColor,sizeof(HeaderColor))>0) return;
 
-      if(strstr(buf,"access_log") != 0) {
-         if(strstr(buf,"realtime_access_log_lines") == 0) {
-            if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-               printf("SARG: Maybe you have a broken record or garbage in access_log parameter.\n");
-               exit(1);
-            }
-            strcpy(AccessLog,buf);
-            fixnone(AccessLog);
-            return;
-         }
-      }
+   if (getparam_string("header_bgcolor",buf,HeaderBgColor,sizeof(HeaderBgColor))>0) return;
 
-      if(strstr(buf,"useragent_log") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in useragent_log parameter.\n");
-            exit(1);
-         }
-         strcpy(UserAgentLog,buf);
-         fixnone(UserAgentLog);
-         return;
-      }
+   if (getparam_string("font_size",buf,FontSize,sizeof(FontSize))>0) return;
 
-      if(strstr(buf,"exclude_hosts") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in exclude_hosts parameter.\n");
-            exit(1);
-         }
-         strcpy(ExcludeHosts,buf);
-         fixnone(ExcludeHosts);
-         return;
-      }
+   if (getparam_string("header_font_size",buf,HeaderFontSize,sizeof(HeaderFontSize))>0) return;
 
-      if(strstr(buf,"exclude_codes") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in exclude_codes parameter.\n");
-            exit(1);
-         }
-         strcpy(ExcludeCodes,buf);
-         fixnone(ExcludeCodes);
-         return;
-      }
+   if (getparam_string("title_font_size",buf,TitleFontSize,sizeof(TitleFontSize))>0) return;
 
-      if(strstr(buf,"exclude_users") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in exclude_users parameter.\n");
-            exit(1);
-         }
-         strcpy(ExcludeUsers,buf);
-         fixnone(ExcludeUsers);
-         return;
-      }
+   if (getparam_2words("image_size",buf,Width,sizeof(Width),Height,sizeof(Height))>0) return;
 
-      if(strstr(buf,"password") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in password parameter.\n");
-            exit(1);
-         }
-         strcpy(PasswdFile,buf);
-         fixnone(PasswdFile);
-         return;
-      }
+   if (getparam_quoted("title",buf,Title,sizeof(Title))>0) return;
 
-      if(strstr(buf,"temporary_dir") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in temporary_dir parameter.\n");
-            exit(1);
-         }
-         strcpy(TempDir,buf);
-         fixnone(TempDir);
-         return;
-      }
+   if (getparam_string("resolve_ip",buf,Ip2Name,sizeof(Ip2Name))>0) return;
 
-      if(strstr(buf,"report_type") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in report_type parameter.\n");
-            exit(1);
-         }
-         strcpy(ReportType,buf);
-         fixnone(ReportType);
-         return;
-      }
+   if (getparam_string("user_ip",buf,UserIp,sizeof(UserIp))>0) return;
+
+   if (getparam_string("max_elapsed",buf,MaxElapsed,sizeof(MaxElapsed))>0) return;
 
-      if(strstr(buf,"output_dir") != 0) {
-         if(strstr(buf,"output_dir_form") == 0) {
-            if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-               printf("SARG: Maybe you have a broken record or garbage in output_dir parameter.\n");
-               exit(1);
-            }
-            strcpy(OutputDir,buf);
-            fixnone(OutputDir);
-            return;
-         }
+   if(strstr(buf,"date_format") != 0) {
+      if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
+         printf("SARG: Maybe you have a broken record or garbage in date_format parameter.\n");
+         exit(1);
       }
+      strncpy(DateFormat,buf,1);
+      fixnone(DateFormat);
+      return;
+   }
 
-      if(strstr(buf,"output_email") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in output_email parameter.\n");
-            exit(1);
-         }
-         strcpy(OutputEmail,buf);
-         fixnone(OutputEmail);
-         return;
+   if( strstr( buf, "hours" ) != 0 ) {
+      if( getnumlist( buf, &hours, 24, 24 ) ) {
+         fprintf( stderr, "Error: Invalid syntax in hours tag!\n" );
+         exit( 1 );
       }
+   }
 
-      if(strstr(buf,"per_user_limit") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0 || getword_multisep(PerUserLimitFile,sizeof(PerUserLimitFile),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in per_user_limit parameter.\n");
-            exit(1);
-         }
-         strcpy(PerUserLimit,buf);
-         fixnone(PerUserLimitFile);
-         fixnone(PerUserLimit);
-         return;
+   if( strstr( buf, "weekdays" ) != 0 ) {
+      if( getnumlist( buf, &weekdays, 7, 7 ) ) {
+         fprintf( stderr, "Error: Invalid syntax in weekdays tag!\n" );
+         exit( 1 );
       }
+   }
 
+   if (getparam_2words("topuser_sort_field",buf,TopuserSortField,sizeof(TopuserSortField),TopuserSortOrder,sizeof(TopuserSortOrder))>0) return;
 
-      if(strstr(buf,"lastlog") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in lastlog parameter.\n");
-            exit(1);
-         }
-         strcpy(LastLog,buf);
-         fixnone(LastLog);
-         return;
-      }
+   if (getparam_2words("user_sort_field",buf,UserSortField,sizeof(UserSortField),UserSortOrder,sizeof(UserSortOrder))>0) return;
 
-      if(strstr(buf,"remove_temp_files") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in remove_temp_files parameter.\n");
-            exit(1);
-         }
-         strcpy(RemoveTempFiles,buf);
-         fixnone(RemoveTempFiles);
-         return;
-      }
+   if (getparam_string("access_log",buf,AccessLog,sizeof(AccessLog))>0) return;
 
-      if(strstr(buf,"replace_index") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in replace_index parameter.\n");
-            exit(1);
-         }
-         strcpy(ReplaceIndex,buf);
-         fixnone(ReplaceIndex);
-         return;
-      }      
-
-      if(strstr(buf,"index_tree") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in index_tree parameter.\n");
-            exit(1);
-         }
-         strcpy(IndexTree,buf);
-         fixnone(IndexTree);
-         return;
-      }      
-
-      if(strstr(buf,"index") != 0) {
-         if(strstr(buf,"index_sort_order") == 0) {
-            if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-               printf("SARG: Maybe you have a broken record or garbage in index parameter.\n");
-               exit(1);
-            }
-            strcpy(Index,buf);
-            fixnone(Index);
-            return;
-         }
-      }
+   if (getparam_string("useragent_log",buf,UserAgentLog,sizeof(UserAgentLog))>0) return;
 
-      if(strstr(buf,"overwrite_report") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in overwrite_report parameter.\n");
-            exit(1);
-         }
-         strcpy(OverwriteReport,buf);
-         fixnone(OverwriteReport);
-         return;
-      }
+   if (getparam_string("exclude_hosts",buf,ExcludeHosts,sizeof(ExcludeHosts))>0) return;
 
-      if(strstr(buf,"records_without_userid") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in records_without_userid parameter.\n");
-            exit(1);
-         }
-         strcpy(RecordsWithoutUser,buf);
-         fixnone(RecordsWithoutUser);
-         return;
-      }
+   if (getparam_string("exclude_codes",buf,ExcludeCodes,sizeof(ExcludeCodes))>0) return;
 
-      if(strstr(buf,"use_comma") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in use_comma parameter.\n");
-            exit(1);
-         }
-         strcpy(UseComma,buf);
-         fixnone(UseComma);
-         return;
-      }
+   if (getparam_string("exclude_users",buf,ExcludeUsers,sizeof(ExcludeUsers))>0) return;
 
-      if(strstr(buf,"mail_utility") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in mail_utility parameter.\n");
-            exit(1);
-         }
-         strcpy(MailUtility,buf);
-         fixnone(MailUtility);
-         return;
-      }
+   if (getparam_string("password",buf,PasswdFile,sizeof(PasswdFile))>0) return;
 
-      if(strstr(buf,"topsites_num") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in topsites_num parameter.\n");
-            exit(1);
-         }
-         strcpy(TopSitesNum,buf);
-         fixnone(TopSitesNum);
-         return;
-      }
+   if (getparam_string("temporary_dir",buf,TempDir,sizeof(TempDir))>0) return;
 
-      if(strstr(buf,"topuser_num") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in topuser_num parameter.\n");
-            exit(1);
-         }
-         strcpy(TopUsersNum,buf);
-         fixnone(TopUsersNum);
-         return;
-      }
+   if (getparam_string("report_type",buf,ReportType,sizeof(ReportType))>0) return;
 
-      if(strstr(buf,"usertab") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in usertab parameter.\n");
-            exit(1);
-         }
-         strcpy(UserTabFile,buf);
-         fixnone(UserTabFile);
-         return;
-      }
+   if (getparam_string("output_dir",buf,OutputDir,sizeof(OutputDir))>0) return;
 
-      if(strstr(buf,"index_sort_order") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in index_sort_order parameter.\n");
-            exit(1);
-         }
-         strcpy(IndexSortOrder,buf);
-         fixnone(IndexSortOrder);
-         return;
-      }
+   if (getparam_string("output_email",buf,OutputEmail,sizeof(OutputEmail))>0) return;
 
-      if(strstr(buf,"topsites_sort_order") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0 || getword_multisep(TopsitesSortField,sizeof(TopsitesSortField),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in topsites_sort_order parameter.\n");
-            exit(1);
-         }
-         strcpy(TopsitesSortType,buf);
-         fixnone(TopsitesSortField);
-         fixnone(TopsitesSortType);
-         return;
-      }
+   if (getparam_2words("per_user_limit",buf,PerUserLimitFile,sizeof(PerUserLimitFile),PerUserLimit,sizeof(PerUserLimit))>0) return;
 
-      if(strstr(buf,"long_url") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in long_url parameter.\n");
-            exit(1);
-         }
-         strcpy(LongUrl,buf);
-         fixnone(LongUrl);
-         return;
-      }
+   if (getparam_string("lastlog",buf,LastLog,sizeof(LastLog))>0) return;
 
-      if(strstr(buf,"language") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in language parameter.\n");
-            exit(1);
-         }
-         strcpy(language,buf);
-         fixnone(language);
-         return;
-      }
+   if (getparam_string("remove_temp_files",buf,RemoveTempFiles,sizeof(RemoveTempFiles))>0) return;
 
-      if(strstr(buf,"dansguardian_conf") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in dansguardian_conf parameter.\n");
-            exit(1);
-         }
-         strcpy(DansGuardianConf,buf);
-         fixnone(DansGuardianConf);
-         return;
-      }
+   if (getparam_string("replace_index",buf,ReplaceIndex,sizeof(ReplaceIndex))>0) return;
 
-      if(strstr(buf,"squidguard_conf") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in squidguard_conf parameter.\n");
-            exit(1);
-         }
-         strcpy(SquidGuardConf,buf);
-         fixnone(SquidGuardConf);
-         return;
-      }
+   if (getparam_string("index_tree",buf,IndexTree,sizeof(IndexTree))>0) return;
 
-      if(strstr(buf,"date_time_by") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in date_time_by parameter.\n");
-            exit(1);
-         }
-         strcpy(datetimeby,buf);
-         fixnone(datetimeby);
-         return;
-      }
+   if (getparam_string("index",buf,Index,sizeof(Index))>0) return;
 
-      if(strstr(buf,"charset") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in charset parameter.\n");
-            exit(1);
-         }
-         strcpy(CharSet,buf);
-         fixnone(CharSet);
-         ccharset(CharSet);
-         return;
-      }
+   if (getparam_string("overwrite_report",buf,OverwriteReport,sizeof(OverwriteReport))>0) return;
 
-      if(strstr(buf,"user_invalid_char") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,'"')<0 || getword_multisep(UserInvalidChar,sizeof(UserInvalidChar),buf,'"')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in user_invalid_char parameter.\n");
-            exit(1);
-         }
-         fixnone(UserInvalidChar);
-         return;
-      }
+   if (getparam_string("records_without_userid",buf,RecordsWithoutUser,sizeof(RecordsWithoutUser))>0) return;
 
-      if(strstr(buf,"include_users") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,'"')<0 || getword_multisep(wbuf,sizeof(wbuf),buf,'"')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in include_users parameter.\n");
-            exit(1);
-         }
-	 sprintf(IncludeUsers,":%s:",wbuf);
-         fixnone(IncludeUsers);
-         return;
-      }
+   if (getparam_string("use_comma",buf,UseComma,sizeof(UseComma))>0) return;
 
-      if(strstr(buf,"exclude_string") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,'"')<0 || getword_multisep(ExcludeString,sizeof(ExcludeString),buf,'"')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in exclude_string parameter.\n");
-            exit(1);
-         }
-         fixnone(ExcludeString);
-         return;
-      }
+   if (getparam_string("mail_utility",buf,MailUtility,sizeof(MailUtility))>0) return;
 
-      if(strstr(buf,"privacy") != 0) {
-         if(strstr(buf,"privacy_string") == 0 && \
-	    strstr(buf,"privacy_string_color") == 0) {
-            if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-               printf("SARG: Maybe you have a broken record or garbage in privacy parameter.\n");
-               exit(1);
-            }
-            strcpy(Privacy,buf);
-            fixnone(Privacy);
-            return;
-	 }
-      }
+   if (getparam_string("topsites_num",buf,TopSitesNum,sizeof(TopSitesNum))>0) return;
 
-      if(strstr(buf,"privacy_string") != 0) {
-	 if(strstr(buf,"privacy_string_color") == 0) {
-            if (getword_multisep(wbuf,sizeof(wbuf),buf,'"')<0 || getword_multisep(PrivacyString,sizeof(PrivacyString),buf,'"')<0) {
-               printf("SARG: Maybe you have a broken record or garbage in privacy_string parameter.\n");
-               exit(1);
-            }
-            fixnone(PrivacyString);
-            return;
-	 }
-      }
+   if (getparam_string("topuser_num",buf,TopUsersNum,sizeof(TopUsersNum))>0) return;
 
-      if(strstr(buf,"privacy_string_color") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in privacy_string_color parameter.\n");
-            exit(1);
-         }
-         strcpy(PrivacyStringColor,buf);
-         fixnone(PrivacyStringColor);
-         return;
-      }
+   if (getparam_string("usertab",buf,UserTabFile,sizeof(UserTabFile))>0) return;
 
-      if(strstr(buf,"show_successful_message") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in show_successful_message parameter.\n");
-            exit(1);
-         }
-         strcpy(SuccessfulMsg,buf);
-         fixnone(SuccessfulMsg);
-         return;
-      }
+   if (getparam_string("index_sort_order",buf,IndexSortOrder,sizeof(IndexSortOrder))>0) return;
 
-      if(strstr(buf,"show_read_statistics") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in show_read_statistics parameter.\n");
-            exit(1);
-         }
-         strcpy(ShowReadStatistics,buf);
-         fixnone(ShowReadStatistics);
-         return;
-      }
+   if (getparam_2words("topsites_sort_order",buf,TopsitesSortField,sizeof(TopsitesSortField),TopsitesSortType,sizeof(TopsitesSortType))>0) return;
 
-      if(strstr(buf,"topuser_fields") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in topuser_fields parameter.\n");
-            exit(1);
-         }
-         strcpy(TopUserFields,buf);
-         fixnone(TopUserFields);
-         return;
-      }
+   if (getparam_string("long_url",buf,LongUrl,sizeof(LongUrl))>0) return;
 
-      if(strstr(buf,"bytes_in_sites_users_report") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in bytes_in_sites_users_report parameter.\n");
-            exit(1);
-         }
-         strcpy(BytesInSitesUsersReport,buf);
-         fixnone(BytesInSitesUsersReport);
-         return;
-      }
+   if (getparam_string("language",buf,language,sizeof(language))>0) return;
 
-      if(strstr(buf,"user_report_fields") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in user_report_fields parameter.\n");
-            exit(1);
-         }
-         strcpy(UserReportFields,buf);
-         fixnone(UserReportFields);
-         return;
-      }
+   if (getparam_string("dansguardian_conf",buf,DansGuardianConf,sizeof(DansGuardianConf))>0) return;
 
-      if(strstr(buf,"bytes_in_sites_users_report") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in site_user_time_date_type parameter.\n");
-            exit(1);
-         }
-         strcpy(BytesInSitesUsersReport,buf);
-         fixnone(BytesInSitesUsersReport);
-         return;
-      }
+   if (getparam_string("squidguard_conf",buf,SquidGuardConf,sizeof(SquidGuardConf))>0) return;
 
-      if(strstr(buf,"datafile ") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in datafile parameter.\n");
-            exit(1);
-         }
-         strcpy(DataFile,buf);
-         fixnone(DataFile);
-         return;
-      }
+   if (getparam_string("date_time_by",buf,datetimeby,sizeof(datetimeby))>0) return;
 
-      if(strstr(buf,"datafile_delimiter") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0 || getword(wbuf,sizeof(wbuf),buf,'"')<0 ||
-             getword(DataFileDelimiter,sizeof(DataFileDelimiter),buf,'"')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in datafile_delimiter parameter.\n");
-            exit(1);
-         }
-         fixnone(DataFileDelimiter);
-         return;
-      }
+   if (getparam_string("charset",buf,CharSet,sizeof(CharSet))>0) {
+      ccharset(CharSet);
+      return;
+   }
 
-      if(strstr(buf,"datafile_fields") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in datafile_fields parameter.\n");
-            exit(1);
-         }
-         strcpy(DataFileFields,buf);
-         fixnone(DataFileFields);
-         return;
-      }
+   if (getparam_quoted("user_invalid_char",buf,UserInvalidChar,sizeof(UserInvalidChar))>0) return;
 
-      if(strstr(buf,"datafile_url") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in datafile_url parameter.\n");
-            exit(1);
-         }
-         strcpy(DataFileUrl,buf);
-         fixnone(DataFileUrl);
-         return;
-      }
+   if (getparam_quoted("include_users",buf,IncludeUsers+1,sizeof(IncludeUsers)-2)>0) {
+      IncludeUsers[0]=':';
+      strcat(IncludeUsers,":");
+      return;
+   }
 
-      if(strstr(buf,"parsed_output_log") != 0) {
-	 if(strstr(buf,"parsed_output_log_compress") == 0) {
-            if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-               printf("SARG: Maybe you have a broken record or garbage in parsed_output_log parameter.\n");
-               exit(1);
-            }
-            strcpy(ParsedOutputLog,buf);
-            fixnone(ParsedOutputLog);
-            return;
-         }
-      }
+   if (getparam_quoted("exclude_string",buf,ExcludeString,sizeof(ExcludeString))>0) return;
 
-      if(strstr(buf,"parsed_output_log_compress") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in parsed_output_log_compress parameter.\n");
-            exit(1);
-         }
-         strcpy(ParsedOutputLogCompress,buf);
-         fixnone(ParsedOutputLogCompress);
-         return;
-      }
+   if (getparam_string("privacy",buf,Privacy,sizeof(Privacy))>0) return;
 
-      if(strstr(buf,"displayed_values") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in displayed_values parameter.\n");
-            exit(1);
-         }
-         strcpy(DisplayedValues,buf);
-         fixnone(DisplayedValues);
-         return;
-      }
+   if (getparam_quoted("privacy_string",buf,ExcludeString,sizeof(ExcludeString))>0) return;
 
-      if(strstr(buf,"authfail_report_limit") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in authfail_report_limit parameter.\n");
-            exit(1);
-         }
-         AuthfailReportLimit=atoi(buf);
-         return;
-      }
+   if (getparam_string("privacy_string_color",buf,PrivacyStringColor,sizeof(PrivacyStringColor))>0) return;
 
-      if(strstr(buf,"denied_report_limit") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in denied_report_limit parameter.\n");
-            exit(1);
-         }
-         DeniedReportLimit=atoi(buf);
-         return;
-      }
+   if (getparam_string("show_successful_message",buf,SuccessfulMsg,sizeof(SuccessfulMsg))>0) return;
 
-      if(strstr(buf,"siteusers_report_limit") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in siteusers_report_limit parameter.\n");
-            exit(1);
-         }
-         SiteUsersReportLimit=atoi(buf);
-         return;
-      }
+   if (getparam_string("show_read_statistics",buf,ShowReadStatistics,sizeof(ShowReadStatistics))>0) return;
 
-      if(strstr(buf,"dansguardian_report_limit") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in dansguardian_report_limit parameter.\n");
-            exit(1);
-         }
-         DansGuardianReportLimit=atoi(buf);
-         return;
-      }
+   if (getparam_string("topuser_fields",buf,TopUserFields,sizeof(TopUserFields))>0) return;
 
-      if(strstr(buf,"squidguard_report_limit") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in squidguard_report_limit parameter.\n");
-            exit(1);
-         }
-         SquidGuardReportLimit=atoi(buf);
-         return;
-      }
+   if (getparam_string("bytes_in_sites_users_report",buf,BytesInSitesUsersReport,sizeof(BytesInSitesUsersReport))>0) return;
 
-      if(strstr(buf,"user_report_limit") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in user_report_limit parameter.\n");
-            exit(1);
-         }
-         UserReportLimit=atoi(buf);
-         return;
-      }
+   if (getparam_string("user_report_fields",buf,UserReportFields,sizeof(UserReportFields))>0) return;
 
-      if(strstr(buf,"download_report_limit") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in download_report_limit parameter.\n");
-            exit(1);
-         }
-         DownloadReportLimit=atoi(buf);
-         return;
-      }
+   if (getparam_string("bytes_in_sites_users_report",buf,BytesInSitesUsersReport,sizeof(BytesInSitesUsersReport))>0) return;
 
-      if(strstr(buf,"www_document_root") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in www_document_root parameter.\n");
-            exit(1);
-         }
-         strcpy(wwwDocumentRoot,buf);
-         fixnone(wwwDocumentRoot);
-         return;
-      }
+   if (getparam_string("datafile",buf,DataFile,sizeof(DataFile))>0) return;
 
-      if(strstr(buf,"block_it") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in block_it parameter.\n");
-            exit(1);
-         }
-         strcpy(BlockIt,buf);
-         fixnone(BlockIt);
-         return;
-      }
+   if (getparam_quoted("datafile_delimiter",buf,DataFileDelimiter,sizeof(DataFileDelimiter))>0) return;
 
-      if(strstr(buf,"external_css_file") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in external_css_file parameter.\n");
-            exit(1);
-         }
-         strcpy(ExternalCSSFile,buf);
-         fixnone(ExternalCSSFile);
-         return;
-      }
+   if (getparam_string("datafile_fields",buf,DataFileFields,sizeof(DataFileFields))>0) return;
 
-      if(strstr(buf,"user_authentication") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in user_authentication parameter.\n");
-            exit(1);
-         }
-         strcpy(UserAuthentication,buf);
-         fixnone(UserAuthentication);
-         return;
-      }
+   if (getparam_string("datafile_url",buf,DataFileUrl,sizeof(DataFileUrl))>0) return;
 
-      if(strstr(buf,"AuthUserFile") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in AuthUserFile parameter.\n");
-            exit(1);
-         }
-         strcpy(AuthUserFile,buf);
-         fixnone(AuthUserFile);
-         return;
-      }
+   if (getparam_string("parsed_output_log",buf,ParsedOutputLog,sizeof(ParsedOutputLog))>0) return;
 
-      if(strstr(buf,"AuthName") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in AuthName parameter.\n");
-            exit(1);
-         }
-         strcpy(AuthName,buf);
-         fixnone(AuthName);
-         return;
-      }
+   if (getparam_string("parsed_output_log_compress",buf,ParsedOutputLogCompress,sizeof(ParsedOutputLogCompress))>0) return;
 
-      if(strstr(buf,"AuthType") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in AuthType parameter.\n");
-            exit(1);
-         }
-         strcpy(AuthType,buf);
-         fixnone(AuthType);
-         return;
-      }
+   if (getparam_string("displayed_values",buf,DisplayedValues,sizeof(DisplayedValues))>0) return;
 
-      if(strstr(buf,"Require") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in Require parameter.\n");
-            exit(1);
-         }
-         strcpy(Require,buf);
-         fixnone(Require);
-         return;
-      }
+   if (getparam_int("authfail_report_limit",buf,&AuthfailReportLimit)>0) return;
 
-      if(strstr(buf,"download_suffix") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,'"')<0 || getword_multisep(DownloadSuffix,sizeof(DownloadSuffix),buf,'"')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in download_suffix parameter.\n");
-            exit(1);
-         }
-         fixnone(DownloadSuffix);
-         return;
-      }
+   if (getparam_int("denied_report_limit",buf,&DeniedReportLimit)>0) return;
 
-      if(strstr(buf,"graphs") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in graphs parameter.\n");
-            exit(1);
-         }
-         strcpy(Graphs,buf);
-         fixnone(Graphs);
-         return;
-      }
+   if (getparam_int("siteusers_report_limit",buf,&SiteUsersReportLimit)>0) return;
 
-      if(strstr(buf,"graph_days_bytes_bar_color") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in graph_days_bytes_bar_color parameter.\n");
-            exit(1);
-         }
-         strcpy(GraphDaysBytesBarColor,buf);
-         fixnone(GraphDaysBytesBarColor);
-         return;
-      }
+   if (getparam_int("dansguardian_report_limit",buf,&DansGuardianReportLimit)>0) return;
 
-      if(strstr(buf,"squidguard_log_format") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in squidguard_log_format parameter.\n");
-            exit(1);
-         }
-         strcpy(SquidGuardLogFormat,buf);
-         fixnone(SquidGuardLogFormat);
-         return;
-      }
+   if (getparam_int("squidguard_report_limit",buf,&SquidGuardReportLimit)>0) return;
 
-      if(strstr(buf,"squidguard_ignore_date") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in squidguard_ignore_date parameter.\n");
-            exit(1);
-         }
-         strcpy(SquidguardIgnoreDate,buf);
-         fixnone(SquidguardIgnoreDate);
-         return;
-      }
+   if (getparam_int("user_report_limit",buf,&UserReportLimit)>0) return;
 
-      if(strstr(buf,"dansguardian_ignore_date") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in dansguardian_ignore_date parameter.\n");
-            exit(1);
-         }
-         strcpy(DansguardianIgnoreDate,buf);
-         fixnone(DansguardianIgnoreDate);
-         return;
-      }
+   if (getparam_int("download_report_limit",buf,&DownloadReportLimit)>0) return;
 
-      if(strstr(buf,"ulimit") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in ulimit parameter.\n");
-            exit(1);
-         }
-         strcpy(Ulimit,buf);
-         fixnone(Ulimit);
-         return;
-      }
+   if (getparam_string("www_document_root",buf,wwwDocumentRoot,sizeof(wwwDocumentRoot))>0) return;
 
-      if(strstr(buf,"ntlm_user_format") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in ntlm_user_format parameter.\n");
-            exit(1);
-         }
-         strcpy(NtlmUserFormat,buf);
-         fixnone(NtlmUserFormat);
-         return;
-      }
+   if (getparam_string("block_it",buf,BlockIt,sizeof(BlockIt))>0) return;
 
-      if(strstr(buf,"realtime_types") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in realtime_types parameter.\n");
-            exit(1);
-         }
-         strcpy(RealtimeTypes,buf);
-         fixnone(RealtimeTypes);
-         return;
-      }
+   if (getparam_string("external_css_file",buf,ExternalCSSFile,sizeof(ExternalCSSFile))>0) return;
 
-      if(strstr(buf,"realtime_unauthenticated_records") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in realtime_unauthenticated_records parameter.\n");
-            exit(1);
-         }
-         strcpy(RealtimeUnauthRec,buf);
-         fixnone(RealtimeUnauthRec);
-         return;
-      }
+   if (getparam_string("user_authentication",buf,UserAuthentication,sizeof(UserAuthentication))>0) return;
 
-      if(strstr(buf,"realtime_refresh_time") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in realtime_refresh_time parameter.\n");
-            exit(1);
-         }
-         realtime_refresh=atoi(buf);
-         return;
-      }
+   if (getparam_string("AuthUserFile",buf,AuthUserFile,sizeof(AuthUserFile))>0) return;
 
-      if(strstr(buf,"realtime_access_log_lines") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in realtime_access_log_lines parameter.\n");
-            exit(1);
-         }
-         realtime_access_log_lines=atoi(buf);
-         return;
-      }
+   if (getparam_string("AuthName",buf,AuthName,sizeof(AuthName))>0) return;
 
-      if(strstr(buf,"squid24") != 0) {
-         squid24++;
-         return;
-      }
+   if (getparam_string("AuthType",buf,AuthType,sizeof(AuthType))>0) return;
+
+   if (getparam_string("Require",buf,Require,sizeof(Require))>0) return;
+
+   if (getparam_quoted("download_suffix",buf,DownloadSuffix,sizeof(DownloadSuffix))>0) return;
 
-      if(strstr(buf,"byte_cost") != 0) {
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in byte_cost parameter.\n");
-            exit(1);
-         }
-         cost=atol(buf);
-         if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
-            printf("SARG: Maybe you have a broken record or garbage in byte_cost parameter.\n");
-            exit(1);
-         }
-         nocost=my_atoll(buf);
-         return;
+   if (getparam_string("graphs",buf,Graphs,sizeof(Graphs))>0) return;
+
+   if (getparam_string("graph_days_bytes_bar_color",buf,GraphDaysBytesBarColor,sizeof(GraphDaysBytesBarColor))>0) return;
+
+   if (getparam_string("squidguard_log_format",buf,SquidGuardLogFormat,sizeof(SquidGuardLogFormat))>0) return;
+
+   if (getparam_string("squidguard_ignore_date",buf,SquidguardIgnoreDate,sizeof(SquidguardIgnoreDate))>0) return;
+
+   if (getparam_string("dansguardian_ignore_date",buf,DansguardianIgnoreDate,sizeof(DansguardianIgnoreDate))>0) return;
+
+   if (getparam_string("ulimit",buf,Ulimit,sizeof(Ulimit))>0) return;
+
+   if (getparam_string("ntlm_user_format",buf,NtlmUserFormat,sizeof(NtlmUserFormat))>0) return;
+
+   if (getparam_string("realtime_types",buf,RealtimeTypes,sizeof(RealtimeTypes))>0) return;
+
+   if (getparam_string("realtime_unauthenticated_records",buf,RealtimeUnauthRec,sizeof(RealtimeUnauthRec))>0) return;
+
+   if (getparam_int("realtime_refresh_time",buf,&realtime_refresh)>0) return;
+
+   if (getparam_int("realtime_access_log_lines",buf,&realtime_access_log_lines)>0) return;
+
+   if(strstr(buf,"squid24") != 0) {
+      squid24++;
+      return;
+   }
+
+   if(strstr(buf,"byte_cost") != 0) {
+      if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
+         printf("SARG: Maybe you have a broken record or garbage in byte_cost parameter.\n");
+         exit(1);
+      }
+      cost=atol(buf);
+      if (getword_multisep(wbuf,sizeof(wbuf),buf,' ')<0) {
+         printf("SARG: Maybe you have a broken record or garbage in byte_cost parameter.\n");
+         exit(1);
       }
+      nocost=my_atoll(buf);
+      return;
+   }
+
+   printf("SARG: Unknown option %s\n",buf);
 }
 
 void getconf(void)
@@ -1105,19 +414,12 @@ void getconf(void)
       exit(1);
    }
 
-   while (fgets(buf, MAXLEN, fp_in) != NULL) {
-      if(strstr(buf,"\n") != 0)
-         buf[strlen(buf)-1]='\0';
+   while (fgets(buf, sizeof(buf), fp_in) != NULL) {
+      fixendofline(buf);
 
       if(debugm)
          printf("SYSCONFDIR %s",buf);
 
-      if(strncmp(buf,"#",1) == 0 || strlen(buf) < 1)
-         continue;
-
-      if(debugz)
-         printf("SARG: TAG: %s\n",buf);
-
       parmtest(buf);
 
    }
diff --git a/include/conf.h b/include/conf.h
index c7afeaf..9798e54 100755
--- a/include/conf.h
+++ b/include/conf.h
@@ -85,6 +85,9 @@ gdPoint points[4];
 #if HAVE_INTTYPES_H
 #include <inttypes.h>
 #endif
+#if HAVE_LIMITS_H
+#include <limits.h>
+#endif
 
 #if HAVE_FOPEN64
 #define _FILE_OFFSET_BITS 64
@@ -139,7 +142,7 @@ char OverwriteReport[4];
 char u2[255];
 char RecordsWithoutUser[20];
 char UseComma[4];
-char MailUtility[6];
+char MailUtility[PATH_MAX];
 char TopSitesNum[20];
 char TopUsersNum[20];
 char ExcludeCodes[256];
diff --git a/include/info.h b/include/info.h
index 4d7e332..167da33 100755
--- a/include/info.h
+++ b/include/info.h
@@ -1,3 +1,3 @@
-#define VERSION PACKAGE_VERSION" Aug-01-2009"
+#define VERSION PACKAGE_VERSION" Aug-14-2009"
 #define PGM PACKAGE_NAME
 #define URL "http://sarg.sourceforge.net"
diff --git a/log.c b/log.c
index e73b727..0334e0b 100644
--- a/log.c
+++ b/log.c
@@ -322,6 +322,10 @@ int main(int argc,char *argv[])
             iprel++;
             break;
          case 'l':
+            if (narq>=sizeof(warq)/sizeof(warq[0])) {
+               printf("SARG: Too many log files.\n");
+               exit(1);
+            }
             strcpy(warq[narq],optarg);
             narq++;
             break;
@@ -518,7 +522,7 @@ int main(int argc,char *argv[])
       strcpy(DateFormat,"u");
    }
 
-   if(strlen(email)<1 && strlen(OutputEmail)>0) strcpy(email,OutputEmail);
+   if(email[0] == '\0' && OutputEmail[0] != '\0') strcpy(email,OutputEmail);
 
    strcpy(tmp2,tmp);
 
@@ -1027,7 +1031,7 @@ int main(int argc,char *argv[])
          }
 
          // include_users
-         if(strlen(IncludeUsers) > 0) {
+         if(IncludeUsers[0] != '\0') {
             sprintf(val1,":%s:",user);
             if((str=(char *) strstr(IncludeUsers,val1)) == (char *) NULL )
                continue;
diff --git a/totger.c b/totger.c
index 42badb6..41aba9c 100644
--- a/totger.c
+++ b/totger.c
@@ -34,8 +34,8 @@ int totalger(const char *dirname, int debug, const char *outdir)
    long long int telap=0;
    long long int tincache=0, toucache=0;
    char wger[MAXLEN], user[MAXLEN], nacc[16], nbytes[16], url[MAXLEN];
-   char ip[MAXLEN], hora[9], data[11], elap[16];
-   char incac[16], oucac[16];
+   char ip[MAXLEN], hora[9], data[15], elap[16];
+   char incac[30], oucac[30];
    char warea[MAXLEN];
 
    strcpy(wger,dirname);