Index: openacs-4/packages/acs-api-browser/tcl/acs-api-documentation-procs.tcl =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/acs-api-browser/tcl/acs-api-documentation-procs.tcl,v diff -u -r1.72.2.42 -r1.72.2.43 --- openacs-4/packages/acs-api-browser/tcl/acs-api-documentation-procs.tcl 23 Aug 2022 12:58:19 -0000 1.72.2.42 +++ openacs-4/packages/acs-api-browser/tcl/acs-api-documentation-procs.tcl 23 Aug 2022 18:44:54 -0000 1.72.2.43 @@ -1495,7 +1495,7 @@ ad_proc -public tcl_to_html {proc_name} { Given a proc name, formats it as HTML, including highlighting syntax in - various colors and creating hyperlinks to other proc definitions.
+ various colors and creating hyperlinks to other proc definitions. The inspiration for this proc was the tcl2html script created by Jeff Hobbs.

Known Issues: @@ -1680,7 +1680,7 @@ ad_proc -public tclcode_to_html {{-scope ""} {-proc_namespace ""} script} { Given a script, this proc formats it as HTML, including highlighting syntax in - various colors and creating hyperlinks to other proc definitions.
+ various colors and creating hyperlinks to other proc definitions. The inspiration for this proc was the tcl2html script created by Jeff Hobbs. @param script script to be formatted in HTML Index: openacs-4/packages/acs-bootstrap-installer/tcl/00-proc-procs.tcl =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/acs-bootstrap-installer/tcl/00-proc-procs.tcl,v diff -u -r1.66.2.27 -r1.66.2.28 --- openacs-4/packages/acs-bootstrap-installer/tcl/00-proc-procs.tcl 22 Aug 2022 17:06:39 -0000 1.66.2.27 +++ openacs-4/packages/acs-bootstrap-installer/tcl/00-proc-procs.tcl 23 Aug 2022 18:44:54 -0000 1.66.2.28 @@ -788,7 +788,7 @@ description), but one cannot read the mind of the original programmer to find out what s/he had in mind. - \@author Roberto Mello + \@author Roberto Mello \@creation-date 2002-01-21 \@param oacs_user If this user is already an OpenACS user. oacs_user_p is defined Index: openacs-4/packages/acs-content-repository/tcl/publish-procs.tcl =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/acs-content-repository/tcl/publish-procs.tcl,v diff -u -r1.19.2.5 -r1.19.2.6 --- openacs-4/packages/acs-content-repository/tcl/publish-procs.tcl 28 Dec 2021 14:36:13 -0000 1.19.2.5 +++ openacs-4/packages/acs-content-repository/tcl/publish-procs.tcl 23 Aug 2022 18:44:54 -0000 1.19.2.6 @@ -356,7 +356,7 @@ ad_proc -public publish::handle::image { item_id args } { The basic image handler. Writes the image blob to the filesystem, - then either merges with the template or provides a default + then either merges with the template or provides a default <img> tag. Uses the title for alt text if no alt text is specified externally. Index: openacs-4/packages/acs-lang/tcl/lang-util-procs.tcl =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/acs-lang/tcl/lang-util-procs.tcl,v diff -u -r1.54.2.14 -r1.54.2.15 --- openacs-4/packages/acs-lang/tcl/lang-util-procs.tcl 15 Feb 2022 16:50:29 -0000 1.54.2.14 +++ openacs-4/packages/acs-lang/tcl/lang-util-procs.tcl 23 Aug 2022 18:44:54 -0000 1.54.2.15 @@ -66,7 +66,7 @@ ad_proc lang::util::message_tag_regexp {} { The regexp expression used by proc get_temporary_tags_indices and elsewhere - to extract temporary message catalog tags (<#...#>) from ADP and Tcl files. + to extract temporary message catalog tags (<#...#>) from ADP and Tcl files. The first sub match of the expression is the whole tag, the second sub match is the message key, and the third sub match is the message text in en_US locale. @@ -88,7 +88,7 @@ Given the contents of an adp file return the indices of the start and end chars of embedded message keys on the syntax: - <#package_key.message_key Some en_US text#> + <#package_key.message_key Some en_US text#> @author Peter marklund (peter@collaboraid.biz) } { @@ -133,14 +133,14 @@ Modify the given ADP or Tcl files by replacing occurencies of message keys with message lookups (i.e. #package_key.message_key# for ADP files and [_ "package_key.message_key"] for Tcl files) and create entries in the - catalog file for each of these keys. If the short hand form <#_ Some en_US text#> - is used then the key will be autogenerated based on the text. + catalog file for each of these keys. If the short hand form <#_ Some en_US text#> + is used then the key will be auto-generated based on the text. Returns the number of replacements done. This procedure only reads from and writes to the catalog file specified (the en_US catalog file per default) of the package that the files belong to, the database is not accessed in any way. - @param file_list A list of paths to adp or Tcl files to do replacements in. The + @param file_list A list of paths to .adp or .tcl files to do replacements in. The paths should be relative to $::acs::rootdir. All files must belong to the same package. @@ -440,7 +440,7 @@ ad_proc -private lang::util::remove_gt_lt { s } { - Removes < > and replaces them with < > + Removes < > and replaces them with &lt &gt; } { regsub -all "<" $s {\<} s regsub -all ">" $s {\>} s Index: openacs-4/packages/acs-mail-lite/tcl/acs-mail-lite-procs.tcl =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/acs-mail-lite/tcl/acs-mail-lite-procs.tcl,v diff -u -r1.108.2.28 -r1.108.2.29 --- openacs-4/packages/acs-mail-lite/tcl/acs-mail-lite-procs.tcl 24 Apr 2022 10:57:08 -0000 1.108.2.28 +++ openacs-4/packages/acs-mail-lite/tcl/acs-mail-lite-procs.tcl 23 Aug 2022 18:44:54 -0000 1.108.2.29 @@ -51,7 +51,9 @@ ad_proc -private parse_email_address { -email:required } { - Extracts the email address out of a mail address (like Joe User ) + Extracts the email address out of a mail address + (like Joe User <joe@user.com>) + @option email mail address to be parsed @return only the email address part of the mail address } { Index: openacs-4/packages/acs-mail-lite/tcl/email-inbound-procs.tcl =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/acs-mail-lite/tcl/email-inbound-procs.tcl,v diff -u -r1.15.2.14 -r1.15.2.15 --- openacs-4/packages/acs-mail-lite/tcl/email-inbound-procs.tcl 15 Feb 2022 18:07:42 -0000 1.15.2.14 +++ openacs-4/packages/acs-mail-lite/tcl/email-inbound-procs.tcl 23 Aug 2022 18:44:54 -0000 1.15.2.15 @@ -1036,7 +1036,7 @@ # h_arr(aml_size_chars) size_chars # h_arr(aml_processed_p) processed_p - # p_arr($section_id,) acs_mail_lite_ie_parts (content of a part) + # p_arr($section_id,<field>) acs_mail_lite_ie_parts (content of a part) # p_arr($section_id,nv_list) acs_mail_lite_part_nv_pairs # p_arr(section_id_list) list of section_ids # @@ -1412,7 +1412,7 @@ Email parts (of body) are kept in a separate array: - p_arr($section_ref,) acs_mail_lite_ie_parts (content of a part) + p_arr($section_ref,<field>) acs_mail_lite_ie_parts (content of a part) p_arr($section_ref,nv_list) acs_mail_lite_part_nv_pairs p_arr(section_ref_list) list of section_refs Index: openacs-4/packages/acs-mail-lite/tcl/legacy-inbound-procs.tcl =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/acs-mail-lite/tcl/legacy-inbound-procs.tcl,v diff -u -r1.2.2.6 -r1.2.2.7 --- openacs-4/packages/acs-mail-lite/tcl/legacy-inbound-procs.tcl 22 Feb 2021 15:05:53 -0000 1.2.2.6 +++ openacs-4/packages/acs-mail-lite/tcl/legacy-inbound-procs.tcl 23 Aug 2022 18:44:54 -0000 1.2.2.7 @@ -24,7 +24,7 @@ [<SitePrefix>][-]<ReplyPrefix>-Whatever@<BounceDomain> [] = optional - <> = Package Parameters + <> = Package Parameters If no SitePrefix is set we assume that there is only one Index: openacs-4/packages/acs-tcl/tcl/deprecated-procs.tcl =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/acs-tcl/tcl/deprecated-procs.tcl,v diff -u -r1.29.2.24 -r1.29.2.25 --- openacs-4/packages/acs-tcl/tcl/deprecated-procs.tcl 13 Jul 2022 09:54:32 -0000 1.29.2.24 +++ openacs-4/packages/acs-tcl/tcl/deprecated-procs.tcl 23 Aug 2022 18:44:55 -0000 1.29.2.25 @@ -3300,19 +3300,20 @@ back from the users if the form looked like - and + <input type=text name=yow> and + <input type=text name=bar> then after you run this function you'll have Tcl vars $foo and $bar set to whatever the user typed in the form - +

this uses the initially nauseating but ultimately delicious Tcl system function "uplevel" that lets a subroutine bash the environment and local vars of its caller. It ain't Common Lisp... - +

This is an ad-hoc check to make sure users aren't trying to pass in "naughty" form variables in an effort to hack the database by passing in SQL. It is called in all instances where a Tcl variable is set from a form variable. - +

Checks the given variable for against known form variable exploits. If it finds anything objectionable, it throws an error. } { Index: openacs-4/packages/acs-tcl/tcl/security-procs.tcl =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/acs-tcl/tcl/security-procs.tcl,v diff -u -r1.126.2.68 -r1.126.2.69 --- openacs-4/packages/acs-tcl/tcl/security-procs.tcl 26 Jun 2022 19:37:55 -0000 1.126.2.68 +++ openacs-4/packages/acs-tcl/tcl/security-procs.tcl 23 Aug 2022 18:44:55 -0000 1.126.2.69 @@ -2997,6 +2997,7 @@ # security::csp::require default-src 'self' security::csp::require script-src 'self' + security::csp::require script-src 'strict-dynamic' security::csp::require style-src 'self' security::csp::require img-src 'self' security::csp::require font-src 'self' @@ -3129,12 +3130,15 @@ Request Forgery). The token is set (and cached) in a global per-thread variable and can be included in forms e.g. via the following command. - - - +

+ 

+        <if @::__csrf_token@ defined>
+            <input type="hidden" name="__csrf_token" value="@::__csrf_token;literal@">
+        </if>
+

The token is automatically cleared together with other global variables at the end of the processing of every request. - +

The optional argument user_id is currently ignored, but it is there, since there are algorithms published to calculate the CSRF token based on a user_id. So far, i found no evidence Index: openacs-4/packages/acs-tcl/tcl/tcl-documentation-procs.tcl =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/acs-tcl/tcl/tcl-documentation-procs.tcl,v diff -u -r1.61.2.28 -r1.61.2.29 --- openacs-4/packages/acs-tcl/tcl/tcl-documentation-procs.tcl 14 Jul 2022 16:58:47 -0000 1.61.2.28 +++ openacs-4/packages/acs-tcl/tcl/tcl-documentation-procs.tcl 23 Aug 2022 18:44:55 -0000 1.61.2.29 @@ -225,22 +225,27 @@ ad_proc -private ad_page_contract_parse_argspec {arg_spec} { - Parse the argument spec: this is a string in the form :[,...] - - is a token made of any non-space, non-tab and non-colon - - is string in the form [([|...])] - - is a string containing arbitrary characters, + Parse the argument spec: this is a string in the form + <name>:<flag_spec>[,<flag_spec>...] +

Examples of valid argspecs: - + +
     - my_page_parameter
     - my_page_parameter:integer
     - my_page_parameter:integer,notnull
     - my_page_parameter:integer,notnull,oneof(1|2|3)
     - another_page_parameter:oneof(this is valid|This, is also valid|This is valid \(as well!\))
-
+
} { set flag_rx [ad_page_contract_argspec_flag_regexp] @@ -271,7 +276,7 @@ Splits the flag parameters from an argespec into a list of values. - Flag parameters are a list of values expressed as |[..] + Flag parameters are a list of values expressed as <value>[|<value> ...] } { # First, unescape the parenthesys @@ -337,14 +342,14 @@ 
ad_page_contract  {
         Some documentation.
         @author me (my@email)
-        @cvs-id $Id$
+        @cvs-id $Id$
     } {
         foo
         bar:integer,notnull,multiple,trim
         {greble:integer {[expr {[lindex $bar 0] + 1}]}}
     } -validate {
         greble_is_in_range -requires {greble:integer} {
-            if { $greble < 1 || $greble > 100 } {
+            if { $greble < 1 || $greble > 100 } {
                 ad_complain
             }
         }
@@ -596,7 +601,7 @@
 
     

 
-    Each validation block can also have a -requires switch, which takes a list of
+    Each validation block can also have a -requires switch, which takes a list of
     validations that must already have been successfully passed, for the validation to get executed.
     The intent is that you want to provide as much feedback as possible at once, but you don't want
     redundant feedback, like "foo must be an integer" and "foo must be in range 10 to 20".
@@ -1349,12 +1354,12 @@
 
 ad_proc ad_include_contract {docstring args} {
 
-    Define interface between a page and an  similar to the
-    page_contract. This is a light-weight implementation based on the
-    ad_page_contract. It allows one to check the passed arguments (types,
-    optionality) and can be used for setting defaults the usual way.
-    Using ad_include_contracts helps to improve documentation of
-    included content.
+    Define an interface between a page and an ADP <include>
+    similar to the page_contract. This is a light-weight
+    implementation based on the ad_page_contract. It allows one to
+    check the passed arguments (types, optionality) and can be used
+    for setting defaults the usual way.  Using ad_include_contracts
+    helps to improve documentation of included content.
 
     @param docstring documentation of the include
     @param args passed parameter
Index: openacs-4/packages/acs-tcl/tcl/utilities-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-tcl/tcl/utilities-procs.tcl,v
diff -u -r1.189.2.131 -r1.189.2.132
--- openacs-4/packages/acs-tcl/tcl/utilities-procs.tcl	11 Aug 2022 13:49:45 -0000	1.189.2.131
+++ openacs-4/packages/acs-tcl/tcl/utilities-procs.tcl	23 Aug 2022 18:44:55 -0000	1.189.2.132
@@ -3776,13 +3776,12 @@
 
 ad_proc util::trim_leading_zeros {
     string
-} {
-    Returns a string w/ leading zeros trimmed.
-    Used to get around Tcl interpreter problems w/ thinking leading
-    zeros are octal.
+} {    
+    Returns a string with leading zeros trimmed.  Used to get around
+    Tcl interpreter problems without thinking leading zeros are octal.
 
-    If string is real and mod(number)<1, then we have pulled off
-    the leading zero; i.e. 0.231 -> .231 -- this is still fine
+    
If string is real and mod(number)<1, then we have pulled off
+    the leading zero; i.e. 0.231 -> .231 - this is still fine
     for Tcl though...
 } {
     if {$string ne ""} {
Index: openacs-4/packages/notifications/tcl/notification-callback-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/notifications/tcl/notification-callback-procs.tcl,v
diff -u -r1.7.2.1 -r1.7.2.2
--- openacs-4/packages/notifications/tcl/notification-callback-procs.tcl	1 Sep 2020 14:04:36 -0000	1.7.2.1
+++ openacs-4/packages/notifications/tcl/notification-callback-procs.tcl	23 Aug 2022 18:44:55 -0000	1.7.2.2
@@ -40,15 +40,23 @@
     -array:required
     -package_id
 } {
-    Implementation of the interface acs_mail_lite::incoming_email for notifications. Notification
-    listens to replies sent out initially from notifications. According to the notification signature
-    -$object_id-$type_id@ it tries to figure out for which notification
-    type the email was from. The type corresponds to the service contract implementation. If the object_id
-    exists notification creates an entry in the table notification_email_hold and tries to inform implementations
-    of acs_mail_lite::incoming_email interested. Since the service contract NotificationType is implemented
-    only once for a package the table acs_mail_lite_reply_prefixes is used simply figure out which package corresponds
-    to the found type_id and has a valid package key. If a package key is found the callback implementation is
-    called.
+    
+    Implementation of the interface acs_mail_lite::incoming_email for
+    notifications. Notification listens to replies sent out initially
+    from notifications. According to the notification signature
+    <EmailReplyAddressPrefix>$object_id-$type_id@<EmailDomain>
+    it tries to figure out for which notification type the email was
+    from.
+    
+    
The type corresponds to the service contract
+    implementation. If the object_id exists notification creates an
+    entry in the table notification_email_hold and tries to inform
+    implementations of acs_mail_lite::incoming_email interested. Since
+    the service contract NotificationType is implemented only once for
+    a package the table acs_mail_lite_reply_prefixes is used simply
+    figure out which package corresponds to the found type_id and has
+    a valid package key. If a package key is found the callback
+    implementation is called.
 
     @author Nima Mazloumi (nima.mazloumi@gmx.de)
     @creation-date 2005-07-15
Index: openacs-4/packages/tsearch2-driver/tcl/tsearch2-driver-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/tsearch2-driver/tcl/tsearch2-driver-procs.tcl,v
diff -u -r1.41.2.10 -r1.41.2.11
--- openacs-4/packages/tsearch2-driver/tcl/tsearch2-driver-procs.tcl	18 Feb 2022 09:29:51 -0000	1.41.2.10
+++ openacs-4/packages/tsearch2-driver/tcl/tsearch2-driver-procs.tcl	23 Aug 2022 18:44:55 -0000	1.41.2.11
@@ -292,7 +292,7 @@
 
 ad_proc -private tsearch2::build_query_postgres { -query } {
     Convert conjunctions to query characters for tsearch2
-    use websearch_to_tsquery which is integrated in postgres >= 11
+    use websearch_to_tsquery which is integrated in postgres >= 11
 
     websearch_to_tsquery creates a tsquery value from querytext using
     an alternative syntax in which simple unformatted text is a valid
@@ -303,9 +303,9 @@
 
     
    
         
  • unquoted text: text not inside quote marks will be converted
-        to terms separated by & operators, as if processed by plainto_tsquery.
    • 
+        to terms separated by & operators, as if processed by plainto_tsquery.
         
  • "quoted text": text inside quote marks will be converted to terms
-        separated by <-> operators, as if processed by phraseto_tsquery.
    • 
+        separated by <-> operators, as if processed by phraseto_tsquery.
         
  • OR: logical or will be converted to the | operator.
    • 
         
  • -: the logical not operator, converted to the ! operator.
    • 
     

@@ -318,7 +318,8 @@
     ad_try {
         db_1row build_querystring {select websearch_to_tsquery(:query) as query from dual}
     } on error {errorMsg} {
-        ns_log warning "tsearch2 websearch_to_tsquery failed, fall back to tcl query builder query was: $query errorMsg: $errorMsg"
+        ns_log warning "tsearch2 websearch_to_tsquery failed," \
+            "fall back to tcl query builder query was: $query errorMsg: $errorMsg"
         set query [tsearch2::build_query_tcl -query $query]
     }
     return $query
Index: openacs-4/packages/xowf/tcl/test-item-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/xowf/tcl/test-item-procs.tcl,v
diff -u -r1.7.2.241 -r1.7.2.242
--- openacs-4/packages/xowf/tcl/test-item-procs.tcl	22 Aug 2022 16:08:55 -0000	1.7.2.241
+++ openacs-4/packages/xowf/tcl/test-item-procs.tcl	23 Aug 2022 18:44:55 -0000	1.7.2.242
@@ -6658,6 +6658,14 @@
     # Method: exam_configuration_render_fields
     #----------------------------------------------------------------------
     :method exam_configuration_render_fields {{-modifiable ""} fields} {
+      #
+      # Render the provided fields via tDOM. Non-modifiable
+      # form-fields are disabled.
+      #
+      # @param modifiable list of field names which are modifiable
+      # @return HTML
+      #
+      
       #ns_log notice "configuration_render called with modifiable <$modifiable>"
       ::xo::require_html_procs