From: Frédéric Marchal <fmarchal@users.sourceforge.net>
Date: Wed, 20 Jan 2010 12:38:23 +0000 (+0000)
Subject: Fixed empty entries in squidGuard log when the URL doesn't start with protocol://
X-Git-Tag: v2_2_7~18
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c11e20332a3582032aeb23bce827685b7487ee83;p=thirdparty%2Fsarg.git

Fixed empty entries in squidGuard log when the URL doesn't start with protocol://
---

diff --git a/ChangeLog b/ChangeLog
index 745bc15..74c6acb 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -20,6 +20,7 @@ Jan-20-2010 Version 2.2.7
 		- Fixed exclude_hosts to exclude subdomains and IPv4 subnets.
 		- Replace --enable-htmldir by --enable-sargphp to avoid confusion on the name.
 		- Installation of sarg-php can be disabled with --disable-sargphp.
+		- Fixed empty entries in squidGuard log when the URL doesn't start with protocol://.
 
 Jan-06-2010 Version 2.2.6.1
 		- Remove unnecessary dependency on off_t.
diff --git a/squidguard_log.c b/squidguard_log.c
index 9867aa0..116a4c8 100644
--- a/squidguard_log.c
+++ b/squidguard_log.c
@@ -133,15 +133,28 @@ static void read_log(const char *wentp, FILE *fp_ou)
          if (getword(year,sizeof(year),&gwarea,'-')<0 || getword(mon,sizeof(mon),&gwarea,'-')<0 ||
              getword(day,sizeof(day),&gwarea,' ')<0 || getword(hour,sizeof(hour),&gwarea,' ')<0 ||
              getword_skip(MAXLEN,&gwarea,'/')<0 || getword(list,sizeof(list),&gwarea,'/')<0 ||
-             getword_skip(MAXLEN,&gwarea,'/')<0 || getword_skip(MAXLEN,&gwarea,'/')<0 ||
-             getword(url,sizeof(url),&gwarea,' ')<0 ||
+             getword_skip(MAXLEN,&gwarea,' ')<0 || getword(url,sizeof(url),&gwarea,' ')<0 ||
              getword(ip,sizeof(ip),&gwarea,'/')<0 || getword_skip(MAXLEN,&gwarea,' ')<0 ||
              getword(user,sizeof(user),&gwarea,' ')<0) {
             printf("SARG: Maybe you have a broken record or garbage in your %s file.\n",wentp);
             exit(1);
           }
+          /*
+          The URL may be "http://url:port/data" if the method is GET or simply "url:port/" if the method is CONNECT.
+          The following code removes the protocol:// if it is detected and always truncates the URL after the domain name.
+          It will fail if the URL doesn't start with the protocol and contains two consecutive / in the path (i.e.
+          the URL is not normalized).
+          */
           str=strchr(url,'/');
-          if (str) *str='\0';
+          if (str) {
+             if (str[1]=='/') {
+               str+=2;
+               for (i=0 ; *str && *str!='/' ; i++) url[i]=*str++;
+               url[i]='\0';
+             } else {
+               *str='\0';
+             }
+          }
       }
 
       sprintf(warea,"%s%s%s",year,mon,day);
@@ -155,7 +168,7 @@ static void read_log(const char *wentp, FILE *fp_ou)
 
       if (strcmp(user,"-") == 0) {
          strcpy(user,ip);
-         memset(ip,0,sizeof(ip));
+         ip[0]='\0';
       }
       fprintf(fp_ou,"%s\t%s%s%s\t%s\t%s\t%s\t%s\n",user,year,mon,day,hour,ip,url,list);
       squidguard_count++;