* Require a debug key to show debugging information

* Call htmlspecialchars() on strings that need it

diff --git a/adserve.inc b/adserve.inc
index 45e927f..c504855 100644 (file)
--- a/adserve.inc
+++ b/adserve.inc
@@ -21,6 +21,10 @@
  */
 //define('DRUPAL_ROOT', '/var/www/html');
 
+// If you need to enable debugging, uncomment this line and set a unique key.
+// Then, add a debug_key parameter to your GET string matching this key.
+// define('AD_DEBUG_KEY', 'CHANGE_ME_BEFORE_UNCOMMENTING');
+
 /**
  * The main adserve logic.
  */
@@ -71,18 +75,25 @@ function adserve_variable($variable, $value = NULL) {
   if (!isset($variables->loaded) || $variable == 'variable_load') {
     if ($variable == 'variable_load' && isset($value)) {
       $values['debug'] = isset($value['debug']) ? $value['debug'] : '';
+      $values['debug_key'] = isset($value['debug_key']) ? $value['debug_key'] : '';
       $values['c'] = isset($value['adcache']) ? $value['adcache'] : '';
       $values['n'] = isset($value['nids']) ? $value['nids'] : '';
       $values['t'] = isset($value['tids']) ? $value['tids'] : '';
       $values['k'] = isset($value['hostid']) ? $value['hostid'] : '';
       $values['q'] = isset($value['quantity']) ? $value['quantity'] : 1;
       $values['m'] = isset($value['ad_display']) ? $value['ad_display'] : 0;
-      unset($value);
     }
     else {
       $values = $_GET;
     }
 
+    // Don't trust the GET parameter for 'debug' unless the debugging key
+    // matches.
+    if (!(defined('AD_DEBUG_KEY') && $values['debug_key'] == AD_DEBUG_KEY && isset($values['debug']))) {
+      $values['debug'] = '';
+    }
+    unset($value);
+
     // Don't use getcwd as path may involve symbolic links
     $variables->ad_dir = dirname($_SERVER['SCRIPT_FILENAME']);
     // 'debug' is an integer.
@@ -114,7 +125,7 @@ function adserve_variable($variable, $value = NULL) {
 
     if ($variables->debug) {
       foreach ($variables as $variable => $val) {
-        echo "$variable: '$val'<br />\n";
+        echo "$variable: '" . htmlspecialchars($val) . "'<br />\n";
       }
       if ($variables->debug == 1) exit;
     }
@@ -131,7 +142,7 @@ function adserve_variable($variable, $value = NULL) {
       foreach ($conf as $var => $val) {
         $variables->$var = $val;
         if ($variables->debug) {
-          echo "Override $var: '$val'<br />\n";
+          echo "Variable $var was overridden by value in settings.php.<br />\n";
         }
       }
       $overridden = TRUE;
@@ -173,7 +184,7 @@ function adserve_variable($variable, $value = NULL) {
     echo "Dumping \$variables:<br />\n";
     echo '<pre>';
     foreach ($variables as $var => $val) {
-      echo "  $var($val)<br />\n";
+      echo "  $var(" . htmlspecialchars($val) . ")<br />\n";
     }
     echo '</pre>';
   }