--This module is used to retreive CGI env variables inc POST and GET variables, The variables will
--inserted into a lua table, and parsed from the request information.
module("cgi", package.seeall)

local function uridecode(k)
        return (k or ""):gsub("[\r%+]",
        {['\r']='\n', ["+"]=" "}):gsub("%%(%x%x)",
                function(h)
                return string.char(tonumber(h,16))
                end)
end

function printGetTable()
        local gettblstring = ("\nGET variables table: \n")
        for k,v in pairs(get) do
                gettblstring = gettblstring .. tostring(k) .." : "..tostring(v) .."\n"
        end
        return gettblstring
end

function printPostTable()
        local gettblstring = ("\nPOST variables table: \n")
        for k,v in pairs(post) do
                gettblstring = gettblstring .. tostring(k) .." : "..tostring(v) .."\n"
        end
        return gettblstring
end

function printCookiesTable()
        local gettblstring = ("\nCookie table: \n")
        for k,v in pairs(cookie) do
                gettblstring = gettblstring .. tostring(k) .." : "..tostring(v) .."\n"
        end
        return gettblstring
end

-- CGI Environment Variables
query_string            =       os.getenv("QUERY_STRING") or "N/A"
content_type            =       os.getenv("CONTENT_TYPE") or "N/A"
content_length  =       os.getenv("CONTENT_LENGTH") or "0"
document_root           =       os.getenv("DOCUMENT_ROOT") or "N/A"
http_referer            =       os.getenv("HTTP_REFERER") or "N/A"
http_user_agent         =       os.getenv("HTTP_USER_AGENT") or "N/A"
path_info                       =       os.getenv("PATH_INFO") or "N/A"
path_translated =       os.getenv("PATH_TRANSLATED") or "N/A"
remote_add                      =       os.getenv("REMOTE_ADDR") or "N/A"
remote_host             =       os.getenv("REMOTE_HOST") or "N/A"
request_method  =       os.getenv("REQUEST_METHOD") or "N/A"
script_name             =       os.getenv("SCRIPT_NAME") or "N/A"
server_name             =       os.getenv("SERVER_NAME") or "N/A"
server_port             =       os.getenv("SERVER_PORT") or "N/A"
cookies                                 =       os.getenv("HTTP_COOKIE") or "N/A"

function stringofALLenv()
        s = "\nALL ENV VARIABLES:\n"
        s = s.."query_string:"..query_string.."\n"
        s = s.."content_type:"..content_type.."\n"
        s = s.."content_length:"..content_length.."\n"
        s = s.."document_root:"..document_root.."\n"
        s = s.."http_referer:"..http_referer.."\n"
        s = s.."http_user_agent:"..http_user_agent.."\n"
        s = s.."path_info:"..query_string.."\n"
        s = s.."path_translated:"..path_translated.."\n"
        s = s.."remote_add:"..remote_add.."\n"
        s = s.."remote_host:"..remote_host.."\n"
        s = s.."request_method:"..request_method.."\n"
        s = s.."script_name:"..script_name.."\n"
        s = s.."server_name:"..server_name.."\n"
        s = s.."server_port:"..server_port.."\n"
        s = s.."cookies:"..cookies.."\n"
        return s
end

--------------------------------
-- Modified 20 March 2013 --
-- sam@kses.net             --
--------------------------------------------------------------------
-- Prevents HTML injection by substituting "<" with "&lt;" etc.   --
--------------------------------------------------------------------

local encodings = { [ "<" ] = "&lt;", [ ">" ] = "&gt;", [ "&" ] = "&amp;", [ '"' ] = "&quot;" }

--Extract variables from get request and insert into a table.
get, q = {}, os.getenv("QUERY_STRING") or ""

for k, v in q:gmatch("([^&=]+)=([^&=]*)") do
    get[uridecode(k)] = string.gsub(uridecode(v), "%W", encodings)
end

--Extract variables from post request and insert into a table.
if (content_length ~= "0") and  (content_length ~= "N/A") then

        post, q = {}, io.read(tonumber(os.getenv("CONTENT_LENGTH")))
        rawPost = q

        for k, v in q:gmatch("([^&=]+)=([^&=]*)") do
                post[uridecode(k)] = string.gsub(uridecode(v), "%W", encodings)
   end
else
    post = {a="empty",b="empty"}
end

--------------------------------------------------------------------
-- End of modification                                            --
--------------------------------------------------------------------

if cookies ~= "N/A" then
        cookie, q = {}, cookies
        for k, v in q:gmatch("([^;=%s]+)=([^;%s]+)") do
                cookie[k] = v
        end
end
