From 8bc98059b0a7bbeecdbeac5faef5fae10a870b3c Mon Sep 17 00:00:00 2001
From: vondo <>
Date: Fri, 28 Aug 2009 19:18:37 +0000
Subject: [PATCH 001/163] - instead of spaces to deliniate levels in topics
 list

---
 DocDB/cgi/DocDBVersion.pm | 2 +-
 DocDB/cgi/TopicHTML.pm    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/DocDB/cgi/DocDBVersion.pm b/DocDB/cgi/DocDBVersion.pm
index 88dd2b4c..89d10696 100644
--- a/DocDB/cgi/DocDBVersion.pm
+++ b/DocDB/cgi/DocDBVersion.pm
@@ -20,6 +20,6 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-$DocDBVersion = "8.7.10";
+$DocDBVersion = "8.7.11";
 
 1;
diff --git a/DocDB/cgi/TopicHTML.pm b/DocDB/cgi/TopicHTML.pm
index 60c771a7..795b59a5 100644
--- a/DocDB/cgi/TopicHTML.pm
+++ b/DocDB/cgi/TopicHTML.pm
@@ -377,7 +377,7 @@ sub TopicScroll ($) {
 #  my @ActiveIDs = @TopicIDs; # Later can select single root topics, etc.
 
   foreach my $ID (@TopicIDs) {
-    my $Spaces = '&nbsp;&nbsp;'x(1*(scalar(@{$TopicProvenance{$ID}})-1));
+    my $Spaces = '-'x(1*(scalar(@{$TopicProvenance{$ID}})-1));
     if ($ItemFormat eq "short") {
       $TopicLabels{$ID} = $Spaces.CGI::escapeHTML($Topics{$ID}{Short});
     } elsif ($ItemFormat eq "long") {

From 2f14bda57e6af89be0ac98e53e1069add1f4963e Mon Sep 17 00:00:00 2001
From: vondo <>
Date: Tue, 1 Sep 2009 19:13:33 +0000
Subject: [PATCH 002/163] Fix caching and wording problem for administering
 institutions

---
 DocDB/cgi/AuthorSQL.pm          | 6 ++++++
 DocDB/cgi/InstitutionAdminister | 9 +++++----
 DocDB/doc/CHANGES               | 7 +++++++
 3 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/DocDB/cgi/AuthorSQL.pm b/DocDB/cgi/AuthorSQL.pm
index d65222e0..d067f417 100644
--- a/DocDB/cgi/AuthorSQL.pm
+++ b/DocDB/cgi/AuthorSQL.pm
@@ -143,6 +143,12 @@ sub GetInstitutions { # Creates/fills a hash $Institutions{$InstitutionID}{} wit
   $HaveAllInstitutions = 1;
 }
 
+sub ClearInstitutions {
+  %Institutions = ();
+  $HaveAllInstitutions = 0;
+  return;
+}
+
 sub FetchInstitution { # Creates/fills a hash $Institutions{$InstitutionID}{} with all Institutions
   my ($InstitutionID) = @_;
   if ($Institutions{$InstitutionID}{InstitutionID}) {
diff --git a/DocDB/cgi/InstitutionAdminister b/DocDB/cgi/InstitutionAdminister
index 51d62959..3380c513 100755
--- a/DocDB/cgi/InstitutionAdminister
+++ b/DocDB/cgi/InstitutionAdminister
@@ -92,13 +92,13 @@ if      ($Action eq "Delete") { # Delete institutions
 # Deal with name changes     
 
   if ($ShortName) { 
-    print "<b>Updating short topic name.</b><br>\n";
+    print "<b>Updating short institution name.</b><br>\n";
     my $InstitutionUpdate = $dbh->prepare(
        "update Institution set ShortName=? where InstitutionID=?");
     $InstitutionUpdate -> execute($ShortName,$InstitutionID);
   }
   if ($LongName) { 
-    print "<b>Updating long topic name.</b><br>\n";
+    print "<b>Updating long institution name.</b><br>\n";
     my $InstitutionUpdate = $dbh->prepare(
        "update Institution set LongName=? where InstitutionID=?");
     $InstitutionUpdate -> execute($LongName,$InstitutionID);
@@ -117,11 +117,12 @@ if      ($Action eq "Delete") { # Delete institutions
 
 # For modify or new fetch institution information and display.
 
+ClearInstitutions();
 if ($Action eq "Modify" || $Action eq "New") {
   &FetchInstitution($InstitutionID);
   print "<p><b>Here are the results of your modification:<br>\n";
-  print "Short name: $Institutions{$InstitutionID}{SHORT}<br>\n";
-  print "Long name:  $Institutions{$InstitutionID}{LONG}<br>\n";
+  print "Short institution name: $Institutions{$InstitutionID}{SHORT}<br>\n";
+  print "Long institution name:  $Institutions{$InstitutionID}{LONG}<br>\n";
   print "</b><p>\n";
 }  
 
diff --git a/DocDB/doc/CHANGES b/DocDB/doc/CHANGES
index 894f2710..05dfee8d 100644
--- a/DocDB/doc/CHANGES
+++ b/DocDB/doc/CHANGES
@@ -1,3 +1,10 @@
+
+ Fix caching and wording problem for administering institutions 
+
+8.7.11
+ 
+ Use dash instead of spaces to deliniate levels in topics
+
 8.7.10
 
  Some fixes to topic administration

From 5b390ee1e18db828c6c6ce3ac1874dbb76ac2250 Mon Sep 17 00:00:00 2001
From: vondo <>
Date: Mon, 7 Dec 2009 17:10:57 +0000
Subject: [PATCH 003/163] Switch to Sun-compatible ps, Nova changes for
 signature dates

---
 DocDB/cgi/DocumentAddForm     |  2 +-
 DocDB/cgi/DocumentHTML.pm     |  7 ++++++-
 DocDB/cgi/EmailAdminister     |  2 +-
 DocDB/cgi/EmailCreate         |  2 +-
 DocDB/cgi/FSUtilities.pm      |  2 +-
 DocDB/cgi/RevisionHTML.pm     | 12 ++++++++++--
 DocDB/cgi/SQLUtilities.pm     | 15 +++++++++------
 DocDB/cgi/SelectEmailPrefs    |  2 +-
 DocDB/cgi/SignoffHTML.pm      | 24 +++++++++++++++++++-----
 DocDB/cgi/SignoffUtilities.pm | 22 ++++++++++++++++++++++
 10 files changed, 71 insertions(+), 19 deletions(-)

diff --git a/DocDB/cgi/DocumentAddForm b/DocDB/cgi/DocumentAddForm
index f9253771..4a2cb0ec 100755
--- a/DocDB/cgi/DocumentAddForm
+++ b/DocDB/cgi/DocumentAddForm
@@ -276,7 +276,7 @@ print $query -> hidden(-name => 'docid',     -default => $DocumentID);
 print $query -> hidden(-name => 'oldversion',-default => $Version);
 
 # Generate unique ID to disallow multiple posting
-srand (time ^ $$ ^ unpack "%32L*", `ps axww`);
+srand (time ^ $$ ^ unpack "%32L*", `ps -eaf`);
 my $UniqueID = time."-".(int rand (2**31-1));
 print $query -> hidden(-name => 'uniqueid',  -default => $UniqueID);
 
diff --git a/DocDB/cgi/DocumentHTML.pm b/DocDB/cgi/DocumentHTML.pm
index e1f53144..f1a90eff 100644
--- a/DocDB/cgi/DocumentHTML.pm
+++ b/DocDB/cgi/DocumentHTML.pm
@@ -389,7 +389,12 @@ sub DocumentLink (%) {
       my ($ApprovalStatus,$LastApproved) = RevisionStatus($DocRevID);
       unless ($ApprovalStatus eq "Unmanaged") {
         $Link .= "<br/>($ApprovalStatus";
-        if ($ApprovalStatus eq "Unapproved") {
+        if($ApprovalStatus eq "Approved") {
+          my $LastApproved = RevisionSignoffDate($DocRevID);
+          my $ApprovalDateTime = ConvertToDateTime({-MySQLTimeStamp => $LastApproved, });
+          my $ApprovalTime  = DateTimeString({ -DateTime => $ApprovalDateTime, -ShowTime => $FALSE, });
+          $Link .= " - $ApprovalTime";
+        } elsif ($ApprovalStatus eq "Unapproved") {
           if (defined $LastApproved) {
             my $DocumentID = $DocRevisions{$LastApproved}{DOCID};
             my $Version    = $DocRevisions{$LastApproved}{Version};
diff --git a/DocDB/cgi/EmailAdminister b/DocDB/cgi/EmailAdminister
index c7765775..99dcccdb 100755
--- a/DocDB/cgi/EmailAdminister
+++ b/DocDB/cgi/EmailAdminister
@@ -108,7 +108,7 @@ if      ($Action eq "Delete") { # Delete user
   FetchEmailUser($EmailUserID);
 
   if ($NewPassword) { 
-    srand (time ^ $$ ^ unpack "%32L*", `ps axww`);
+    srand (time ^ $$ ^ unpack "%32L*", `ps -eaf`);
 
     my $Salt = ((0..9,'a'..'z','A'..'Z','.','/')[(int rand (64))]).
                ((0..9,'a'..'z','A'..'Z','.','/')[(int rand (64))]);
diff --git a/DocDB/cgi/EmailCreate b/DocDB/cgi/EmailCreate
index daaba2ec..466937a5 100755
--- a/DocDB/cgi/EmailCreate
+++ b/DocDB/cgi/EmailCreate
@@ -72,7 +72,7 @@ print $query -> header( -charset => $HTTP_ENCODING );
 # Everything is OK, create the account
 
 unless (@ErrorStack) {
-  srand (time ^ $$ ^ unpack "%32L*", `ps axww`);
+  srand (time ^ $$ ^ unpack "%32L*", `ps -eaf`);
   
   my $Salt = ((0..9,'a'..'z','A'..'Z','.','/')[(int rand (64))]).
              ((0..9,'a'..'z','A'..'Z','.','/')[(int rand (64))]);
diff --git a/DocDB/cgi/FSUtilities.pm b/DocDB/cgi/FSUtilities.pm
index fd98d3a0..8bb54106 100644
--- a/DocDB/cgi/FSUtilities.pm
+++ b/DocDB/cgi/FSUtilities.pm
@@ -332,7 +332,7 @@ sub DownloadURLs (%) {
 }
 
 sub MakeTmpSubDir {
-  my $TmpSubDir = $TmpDir."/".(time ^ $$ ^ unpack "%32L*", `ps axww`);
+  my $TmpSubDir = $TmpDir."/".(time ^ $$ ^ unpack "%32L*", `ps -eaf`);
   mkdir $TmpSubDir, oct 755 or die "Could not make temporary directory";
   return $TmpSubDir;
 }
diff --git a/DocDB/cgi/RevisionHTML.pm b/DocDB/cgi/RevisionHTML.pm
index ff1cfbd9..282c51bc 100644
--- a/DocDB/cgi/RevisionHTML.pm
+++ b/DocDB/cgi/RevisionHTML.pm
@@ -413,22 +413,30 @@ sub PrintPubInfo ($) {
 
 sub PrintModTimes {
   require "SQLUtilities.pm";
+  require "SignoffUtilities.pm";
 
   my ($DocRevID) = @_;
   my $DocumentID = $DocRevisions{$DocRevID}{DOCID};
   $DocTime     = &EuroDateHM($Documents{$DocumentID}{Date});
   $RevTime     = &EuroDateHM($DocRevisions{$DocRevID}{DATE});
   $VersionTime = &EuroDateHM($DocRevisions{$DocRevID}{VersionDate});
-  
+
   my $ActualDateTime = ConvertToDateTime({-MySQLTimeStamp => $DocRevisions{$DocRevID}{TimeStamp}, });
   my $ActualTime  = DateTimeString({ -DateTime => $ActualDateTime });
-  
+
   print "<dt>Document Created:</dt>\n<dd>$DocTime</dd>\n";
   print "<dt>Contents Revised:</dt>\n<dd>$VersionTime</dd>\n";
   print "<dt>DB Info Revised:</dt>\n<dd>$RevTime</dd>\n";
   if ($ActualTime ne $RevTime) {
     print "<dt>Actually Revised:</dt>\n<dd>$ActualTime</dd>\n";
   }
+
+  my $LastApproved = RevisionSignoffDate($DocRevID);
+  if ($LastApproved) {
+    my $ApprovalDateTime = ConvertToDateTime({-MySQLTimeStamp => $LastApproved, });
+    my $ApprovalTime  = DateTimeString({ -DateTime => $ApprovalDateTime });
+    print "<dt>Last Signed:</dt>\n<dd>$ApprovalTime</dd>\n";
+  }
 }
 
 sub OtherVersionLinks {
diff --git a/DocDB/cgi/SQLUtilities.pm b/DocDB/cgi/SQLUtilities.pm
index 9c388655..63968bbe 100644
--- a/DocDB/cgi/SQLUtilities.pm
+++ b/DocDB/cgi/SQLUtilities.pm
@@ -118,13 +118,16 @@ sub DateTimeString {
   my ($ArgRef) = @_;
 
   my $ShowSeconds = exists $ArgRef->{-ShowSeconds} ? $ArgRef->{-ShowSeconds} : $FALSE;
-  my $DateTime    = exists $ArgRef->{-DateTime} ? $ArgRef->{-DateTime} : DateTime->now();
-
-  my $Format = "%d %b %Y, ";
-  if ($ShowSeconds) {
-    $Format .= "%T";
+  my $ShowTime    = exists $ArgRef->{-ShowTime}    ? $ArgRef->{-ShowTime}    : $TRUE;
+  my $DateTime    = exists $ArgRef->{-DateTime}    ? $ArgRef->{-DateTime}    : DateTime->now();
+
+  my $Format = "%d %b %Y";
+  if (not $ShowTime) {
+    # Do nothing
+  } elsif ($ShowSeconds) {
+    $Format .= ", %T";
   } else {
-    $Format .= "%R";
+    $Format .= ", %R";
   }
 
   my $String = $DateTime->strftime($Format);
diff --git a/DocDB/cgi/SelectEmailPrefs b/DocDB/cgi/SelectEmailPrefs
index 5dd32082..d610ef8a 100755
--- a/DocDB/cgi/SelectEmailPrefs
+++ b/DocDB/cgi/SelectEmailPrefs
@@ -143,7 +143,7 @@ if ($Mode eq "newuser") {
     print "<p/>\n";
     EndPage();
   } else { # Everything OK, lets create the user
-    srand (time ^ $$ ^ unpack "%32L*", `ps axww`);
+    srand (time ^ $$ ^ unpack "%32L*", `ps -eaf`);
 
     my $Salt = ((0..9,'a'..'z','A'..'Z','.','/')[(int rand (64))]).
                ((0..9,'a'..'z','A'..'Z','.','/')[(int rand (64))]);
diff --git a/DocDB/cgi/SignoffHTML.pm b/DocDB/cgi/SignoffHTML.pm
index fe117784..812531b3 100644
--- a/DocDB/cgi/SignoffHTML.pm
+++ b/DocDB/cgi/SignoffHTML.pm
@@ -118,7 +118,7 @@ sub PrintSignatureInfo ($) {
       # Otherwise, note that it's waiting
 
       my $SignatureText = "";
-      my $SignatureLink = &SignatureLink($EmailUserID);
+      my $SignatureLink = &SignatureLink($EmailUserID,$SignatureID);
       if ($Status eq "Ready" || $Status eq "Signed") {
         if ($Status eq "Ready") {
           $Action = "sign";
@@ -173,12 +173,26 @@ sub PrintSignatureInfo ($) {
 
 sub SignatureLink ($) {
   require "NotificationSQL.pm";
-  my ($EmailUserID) = @_;
+  require "SQLUtilities.pm";
+  require "SignoffSQL.pm";
+  my ($EmailUserID,$SignatureID) = @_;
 
   &FetchEmailUser($EmailUserID);
-  my $Link = "<a href=\"$SignatureReport?emailuserid=$EmailUserID\">";
-     $Link .= $EmailUser{$EmailUserID}{Name};
-     $Link .= "</a>";
+  my $Link = "<a href=\"$SignatureReport?emailuserid=$EmailUserID\"";
+  if ($SignatureID) {
+    FetchSignature($SignatureID);
+    if ($Signatures{$SignatureID}{Signed}) {
+      my $SignatureTimestamp = $Signatures{$SignatureID}{TimeStamp};
+      my $SignatureDateTime = ConvertToDateTime({-MySQLTimeStamp => $SignatureTimestamp, });
+      my $SignatureTime  = DateTimeString({ -DateTime => $SignatureDateTime });
+
+
+      $Link .= " title=\"$SignatureTime\"";
+    }
+  }#title=\"$InstitutionName\"
+  $Link .= ">";
+  $Link .= $EmailUser{$EmailUserID}{Name};
+  $Link .= "</a>";
   return $Link;
 }
 1;
diff --git a/DocDB/cgi/SignoffUtilities.pm b/DocDB/cgi/SignoffUtilities.pm
index 174bb2e0..902e35f1 100644
--- a/DocDB/cgi/SignoffUtilities.pm
+++ b/DocDB/cgi/SignoffUtilities.pm
@@ -156,6 +156,28 @@ sub RevisionStatus ($) { # Return the approval status of a revision
   return ($Status,$LastDocRevID);
 }
 
+sub RevisionSignoffDate ($) {
+  require "SignoffSQL.pm";
+  require "RevisionSQL.pm";
+  require "Sorts.pm";
+
+  my ($DocRevID) = @_;
+  FetchDocRevisionByID($DocRevID);
+  my $LastTimeStamp = 0;
+  my @SignoffIDs = GetAllSignoffsByDocRevID($DocRevID);
+  foreach my $SignoffID (@SignoffIDs) {
+    # Copy the signoff
+    my @SignatureIDs = GetSignatures($SignoffID);
+    foreach my $SignatureID (@SignatureIDs) {
+      FetchSignature($SignatureID);
+      if ($Signatures{$SignatureID}{Signed} && $Signatures{$SignatureID}{TimeStamp} > $LastTimeStamp) {
+        $LastTimeStamp = $Signatures{$SignatureID}{TimeStamp};
+      }
+    }
+  }
+  return $LastTimeStamp;
+}
+
 sub BuildSignoffDefault ($) {
   require "SignoffSQL.pm";
   require "NotificationSQL.pm";

From ff93dd5cc446b45240b7b801eb4ede9cef43a11d Mon Sep 17 00:00:00 2001
From: vondo <>
Date: Tue, 8 Dec 2009 12:33:09 +0000
Subject: [PATCH 004/163] Preserve timestamp when copying

---
 DocDB/cgi/SignoffSQL.pm | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/DocDB/cgi/SignoffSQL.pm b/DocDB/cgi/SignoffSQL.pm
index c1436d16..f1569321 100644
--- a/DocDB/cgi/SignoffSQL.pm
+++ b/DocDB/cgi/SignoffSQL.pm
@@ -312,8 +312,8 @@ sub CopyRevisionSignoffs { # CopySignoffs from one revision to another
 
   my $SignoffInsert    = $dbh -> prepare("insert into Signoff (SignoffID,DocRevID,Note) ".
                                          "values (0,?,?)");
-  my $SignatureInsert  = $dbh -> prepare("insert into Signature (SignatureID,EmailUserID,SignoffID,Note,Signed) ".
-                                         "values (0,?,?,?,?)");
+  my $SignatureInsert  = $dbh -> prepare("insert into Signature (SignatureID,EmailUserID,SignoffID,Note,Signed,TimeStamp) ".
+                                         "values (0,?,?,?,?,?)");
 
   my %SignoffMap   = ();
 
@@ -330,11 +330,14 @@ sub CopyRevisionSignoffs { # CopySignoffs from one revision to another
       FetchSignature($OldSignatureID);
       # Copy Signatures
       my $Signed = $Signatures{$OldSignatureID}{Signed};
+      my $TimeStamp = $Signatures{$OldSignatureID}{TimeStamp};
       if (!$CopySignatures) {
         $Signed = $FALSE;
+	$TimeStamp = 0;
       }
       $SignatureInsert->execute($Signatures{$OldSignatureID}{EmailUserID}, $NewSignoffID,
-                                $Signatures{$OldSignatureID}{Note},        $Signed);
+                                $Signatures{$OldSignatureID}{Note},        $Signed,
+				$TimeStamp);
     }
   }
   my $DependencyInsert = $dbh -> prepare("insert into SignoffDependency (SignoffDependencyID,PreSignoffID,SignoffID) ".

From aa58757b553636f3913c281f3edf987861a8db6d Mon Sep 17 00:00:00 2001
From: vondo <>
Date: Wed, 9 Dec 2009 09:09:41 +0000
Subject: [PATCH 005/163] Missing require

---
 DocDB/cgi/DocumentHTML.pm | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/DocDB/cgi/DocumentHTML.pm b/DocDB/cgi/DocumentHTML.pm
index f1a90eff..f221b40e 100644
--- a/DocDB/cgi/DocumentHTML.pm
+++ b/DocDB/cgi/DocumentHTML.pm
@@ -386,6 +386,8 @@ sub DocumentLink (%) {
     $Link .= $EndElement;
     if ($UseSignoffs && !$NoApprovalStatus) { # Put document status on next line
       require "SignoffUtilities.pm";
+      require "SignoffSQL.pm";
+      require "SQLUtilities.pm";
       my ($ApprovalStatus,$LastApproved) = RevisionStatus($DocRevID);
       unless ($ApprovalStatus eq "Unmanaged") {
         $Link .= "<br/>($ApprovalStatus";

From 503c9bbbb0b87e5b1cfef72a87bc123c43389e29 Mon Sep 17 00:00:00 2001
From: vondo <>
Date: Mon, 28 Dec 2009 17:40:08 +0000
Subject: [PATCH 006/163] Add signed/not signed to popup

---
 DocDB/cgi/SignoffHTML.pm | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/DocDB/cgi/SignoffHTML.pm b/DocDB/cgi/SignoffHTML.pm
index 812531b3..63f6d2d8 100644
--- a/DocDB/cgi/SignoffHTML.pm
+++ b/DocDB/cgi/SignoffHTML.pm
@@ -187,7 +187,9 @@ sub SignatureLink ($) {
       my $SignatureTime  = DateTimeString({ -DateTime => $SignatureDateTime });
 
 
-      $Link .= " title=\"$SignatureTime\"";
+      $Link .= " title=\"Signed $SignatureTime\"";
+    } else {
+      $Link .= " title=\"Not signed\"";
     }
   }#title=\"$InstitutionName\"
   $Link .= ">";

From 6a06af2eb305bac611151320d6e79a0a51eab682 Mon Sep 17 00:00:00 2001
From: vondo <>
Date: Mon, 28 Dec 2009 17:41:59 +0000
Subject: [PATCH 007/163] If the user can't modify the document, only show
 signagtures, don't provide the ability to sign.

---
 DocDB/cgi/SignoffHTML.pm | 93 ++++++++++++++++++++++++----------------
 1 file changed, 55 insertions(+), 38 deletions(-)

diff --git a/DocDB/cgi/SignoffHTML.pm b/DocDB/cgi/SignoffHTML.pm
index 63f6d2d8..cdf2e6d2 100644
--- a/DocDB/cgi/SignoffHTML.pm
+++ b/DocDB/cgi/SignoffHTML.pm
@@ -47,12 +47,17 @@ sub PrintRevisionSignoffInfo ($) { # FIXME: Handle more complicated topologies?
   my $DocumentID = $DocRevisions{$DocRevID}{DOCID};
   my $Version    = $DocRevisions{$DocRevID}{Version};
 
-  # Don't display anything unless the user is logged into a group that can
-  # modify the DB. Maybe we want to display but not provide signature boxes?
+  # Don't display anything if the user is logged in as public.
+  # If the user can't modify the document, only show signatures,
+  # don't provide the ability to sign.
 
-  unless (&CanModify($DocumentID,$Version)) {
+  if ($Public) {
     return;
   }
+  my $UserCanSign = $FALSE;
+  if (CanModify($DocumentID,$Version)) {
+    $UserCanSign = $TRUE;
+  }
 
   my @RootSignoffIDs = &GetRootSignoffs($DocRevID);
   if (@RootSignoffIDs) {
@@ -63,7 +68,7 @@ sub PrintRevisionSignoffInfo ($) { # FIXME: Handle more complicated topologies?
 
     print "<ul>\n";
     foreach my $RootSignoffID (@RootSignoffIDs) {
-      &PrintSignoffInfo($RootSignoffID);
+      PrintSignoffInfo($RootSignoffID,$UserCanSign);
     }
     print "</ul>\n";
     print "</div>\n";
@@ -73,17 +78,17 @@ sub PrintRevisionSignoffInfo ($) { # FIXME: Handle more complicated topologies?
 sub PrintSignoffInfo ($) {
   require "SignoffSQL.pm";
 
-  my ($SignoffID) = @_;
+  my ($SignoffID,$UserCanSign) = @_;
 
   if ($Public) { return; }
 
   my @SubSignoffIDs = &GetSubSignoffs($SignoffID);
   print "<li>";
-  &PrintSignatureInfo($SignoffID);
+  PrintSignatureInfo($SignoffID,$UserCanSign);
   if (@SubSignoffIDs) {
     print "<ul>\n";
     foreach my $SubSignoffID (@SubSignoffIDs) {
-      &PrintSignoffInfo($SubSignoffID);
+      PrintSignoffInfo($SubSignoffID,$UserCanSign);
     }
     print "</ul>\n";
   }
@@ -96,7 +101,7 @@ sub PrintSignatureInfo ($) {
   require "SignoffUtilities.pm";
   require "NotificationSQL.pm";
 
-  my ($SignoffID) = @_;
+  my ($SignoffID,$UserCanSign) = @_;
 
   if ($Public) { return; }
 
@@ -119,49 +124,61 @@ sub PrintSignatureInfo ($) {
 
       my $SignatureText = "";
       my $SignatureLink = &SignatureLink($EmailUserID,$SignatureID);
-      if ($Status eq "Ready" || $Status eq "Signed") {
-        if ($Status eq "Ready") {
-          $Action = "sign";
-          $ActionText = "Sign Document"
-        } else {
-          $Action = "unsign";
-          $ActionText = "Remove Signature"
-        }
-        if ($UserValidation eq "certificate") {
-          if (FetchEmailUserIDByCert() == $EmailUserID) {
+      if ($UserCanSign) {
+        if ($Status eq "Ready" || $Status eq "Signed") {
+          if ($Status eq "Ready") {
+            $Action = "sign";
+            $ActionText = "Sign Document"
+          } else {
+            $Action = "unsign";
+            $ActionText = "Remove Signature"
+          }
+          if ($UserValidation eq "certificate") {
+            if (FetchEmailUserIDByCert() == $EmailUserID) {
+              $SignatureText .= $query -> start_multipart_form('POST',"$SignRevision");
+              $SignatureText .= "<div>\n";
+              $SignatureText .= "$SignatureLink ";
+              $SignatureText .= $query -> hidden(-name => 'signatureid',   -default => $SignatureID);
+              $SignatureText .= $query -> hidden(-name => 'emailuserid',   -default => $EmailUserID);
+              $SignatureText .= $query -> hidden(-name => 'action',   -default => $Action);
+              $SignatureText .= $query -> submit (-value => $ActionText);
+              $SignatureText .= "</div>\n";
+              $SignatureText .= $query -> end_multipart_form;
+            } else {
+              if ($Status eq "Signed") {
+                $SignatureText .= "$SignatureLink (signature complete)";
+              } else {
+                $SignatureText .= "$SignatureLink (waiting for signature)";
+              }
+            }
+          } else {
             $SignatureText .= $query -> start_multipart_form('POST',"$SignRevision");
             $SignatureText .= "<div>\n";
             $SignatureText .= "$SignatureLink ";
             $SignatureText .= $query -> hidden(-name => 'signatureid',   -default => $SignatureID);
             $SignatureText .= $query -> hidden(-name => 'emailuserid',   -default => $EmailUserID);
             $SignatureText .= $query -> hidden(-name => 'action',   -default => $Action);
+            $SignatureText .= $query -> password_field(-name => "password-$EmailUserID", -size => 16, -maxlength => 32);
+            $SignatureText .= " ";
             $SignatureText .= $query -> submit (-value => $ActionText);
             $SignatureText .= "</div>\n";
             $SignatureText .= $query -> end_multipart_form;
-          } else {
-            if ($Status eq "Signed") {
-              $SignatureText .= "$SignatureLink (signature complete)";
-            } else {
-              $SignatureText .= "$SignatureLink (waiting for signature)";
-            }
           }
+        } elsif ($Status eq "NotReady") {
+          $SignatureText .= "$SignatureLink (waiting for other signatures)";
         } else {
-          $SignatureText .= $query -> start_multipart_form('POST',"$SignRevision");
-          $SignatureText .= "<div>\n";
-          $SignatureText .= "$SignatureLink ";
-          $SignatureText .= $query -> hidden(-name => 'signatureid',   -default => $SignatureID);
-          $SignatureText .= $query -> hidden(-name => 'emailuserid',   -default => $EmailUserID);
-          $SignatureText .= $query -> hidden(-name => 'action',   -default => $Action);
-          $SignatureText .= $query -> password_field(-name => "password-$EmailUserID", -size => 16, -maxlength => 32);
-          $SignatureText .= " ";
-          $SignatureText .= $query -> submit (-value => $ActionText);
-          $SignatureText .= "</div>\n";
-          $SignatureText .= $query -> end_multipart_form;
+          $SignatureText .= "$SignatureLink (unknown status)";
         }
-      } elsif ($Status eq "NotReady") {
-        $SignatureText .= "$SignatureLink (waiting for other signatures)";
       } else {
-        $SignatureText .= "$SignatureLink (unknown status)";
+        if ($Status eq "Ready") {
+          $SignatureText .= "$SignatureLink (waiting for signature)";
+        } elsif ($Status eq "Signed"){
+          $SignatureText .= "$SignatureLink (signature complete)";
+        } elsif ($Status eq "NotReady") {
+          $SignatureText .= "$SignatureLink (waiting for other signatures)";
+        } else {
+          $SignatureText .= "$SignatureLink (unknown status)";
+        }
       }
       push @SignatureSnippets,$SignatureText;
     } # if ($SignatureIDOK)

From e6534b136e6865e72d70ddce682dfd2f1b13f6cc Mon Sep 17 00:00:00 2001
From: vondo <>
Date: Mon, 28 Dec 2009 20:10:09 +0000
Subject: [PATCH 008/163] Bump version, documentation changes

---
 DocDB/cgi/DocDBVersion.pm    | 2 +-
 DocDB/doc/CHANGES            | 4 +++-
 DocDB/doc/GetDocDB.txt       | 2 +-
 DocDB/doc/install-docdb.html | 3 ++-
 4 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/DocDB/cgi/DocDBVersion.pm b/DocDB/cgi/DocDBVersion.pm
index 89d10696..563d6fa6 100644
--- a/DocDB/cgi/DocDBVersion.pm
+++ b/DocDB/cgi/DocDBVersion.pm
@@ -20,6 +20,6 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-$DocDBVersion = "8.7.11";
+$DocDBVersion = "8.7.12";
 
 1;
diff --git a/DocDB/doc/CHANGES b/DocDB/doc/CHANGES
index 05dfee8d..948d7e6c 100644
--- a/DocDB/doc/CHANGES
+++ b/DocDB/doc/CHANGES
@@ -1,4 +1,6 @@
-
+8.7.12
+ Show the times when a document is signed in left bar, document list, and popups 
+ in document view. 
  Fix caching and wording problem for administering institutions 
 
 8.7.11
diff --git a/DocDB/doc/GetDocDB.txt b/DocDB/doc/GetDocDB.txt
index c10cad28..793b4575 100644
--- a/DocDB/doc/GetDocDB.txt
+++ b/DocDB/doc/GetDocDB.txt
@@ -2,7 +2,7 @@ DocDB is released often and .tar or .zip files are not usually made.  The best
 way to get DocDB is to check out the latest stable version from the CVS
 repository into a special account for the document database. Set the
 environment variable CVSROOT to
-":pserver:anony@docdb.fnal.gov:/local/cvs/doccvs/cvs" (No password or cvs login
+":pserver:docdb-v.cvs.sourceforge.net:/cvsroot/docdb-v" (No password or cvs login
 is required.  Only DocDB is available in this repository.)
 
 Check out DocDB with the command "cvs co -r stable DocDB"
diff --git a/DocDB/doc/install-docdb.html b/DocDB/doc/install-docdb.html
index 4eb8a148..75c2fb09 100644
--- a/DocDB/doc/install-docdb.html
+++ b/DocDB/doc/install-docdb.html
@@ -32,7 +32,8 @@
 DocDB is released often and .tar or .zip files are not usually made. 
 The best way to get DocDB is to check out the latest stable version from the CVS
 repository into a special account for the document database. Set the environment variable <b>CVSROOT</b> to
-<tt>:pserver:anony@docdb.fnal.gov:/local/cvs/doccvs/cvs</tt>
+<tt>:pserver:docdb-v.cvs.sourceforge.net:/cvsroot/docdb-v</tt>
+
 (No password or cvs login is required.  Only DocDB is available
 in this repository.)<br/>
 

From 3c6d5506d6097d92b8a8f7ba4413990fe53aa06d Mon Sep 17 00:00:00 2001
From: vondo <>
Date: Fri, 26 Feb 2010 21:02:28 +0000
Subject: [PATCH 009/163] Fix author sorting

---
 DocDB/cgi/DocDBVersion.pm |  2 +-
 DocDB/cgi/Sorts.pm        |  8 ++++----
 DocDB/doc/CHANGES         | 13 +++++++++----
 3 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/DocDB/cgi/DocDBVersion.pm b/DocDB/cgi/DocDBVersion.pm
index 563d6fa6..de6fdc32 100644
--- a/DocDB/cgi/DocDBVersion.pm
+++ b/DocDB/cgi/DocDBVersion.pm
@@ -20,6 +20,6 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-$DocDBVersion = "8.7.12";
+$DocDBVersion = "8.7.13";
 
 1;
diff --git a/DocDB/cgi/Sorts.pm b/DocDB/cgi/Sorts.pm
index b782096c..7c886b17 100644
--- a/DocDB/cgi/Sorts.pm
+++ b/DocDB/cgi/Sorts.pm
@@ -87,12 +87,12 @@ sub byLastName { # Obsolete
 sub AuthorRevIDsByOrder {
   require "AuthorSQL.pm";
 
-  if ($AuthorRevIDs{$a}{AuthorOrder} || $AuthorRevIDs{$b}{AuthorOrder}) {
-    return $a <=> $b;
+  if ($RevisionAuthors{$a}{AuthorOrder} || $RevisionAuthors{$b}{AuthorOrder}) {
+    return $RevisionAuthors{$a}{AuthorOrder} <=> $RevisionAuthors{$b}{AuthorOrder};
   }
 
-  my $AID = $AuthorRevIDs{$a}{AuthorID};
-  my $BID = $AuthorRevIDs{$b}{AuthorID};
+  my $AID = $RevisionAuthors{$a}{AuthorID};
+  my $BID = $RevisionAuthors{$b}{AuthorID};
 
   unless ($Authors{$AID}{LastName}) {
     FetchAuthor($AID);
diff --git a/DocDB/doc/CHANGES b/DocDB/doc/CHANGES
index 948d7e6c..3e5ceb10 100644
--- a/DocDB/doc/CHANGES
+++ b/DocDB/doc/CHANGES
@@ -1,10 +1,15 @@
+8.7.13
+ Fix an old bug where authors were essentially unsorted. Only did the right
+ thing by accident.
+
+
 8.7.12
- Show the times when a document is signed in left bar, document list, and popups 
- in document view. 
- Fix caching and wording problem for administering institutions 
+ Show the times when a document is signed in left bar, document list, and popups
+ in document view.
+ Fix caching and wording problem for administering institutions
 
 8.7.11
- 
+
  Use dash instead of spaces to deliniate levels in topics
 
 8.7.10

From 0e09b7e9baca2784e76a0228420e590999127913 Mon Sep 17 00:00:00 2001
From: vondo <>
Date: Fri, 26 Feb 2010 22:37:37 +0000
Subject: [PATCH 010/163] Fix Minerva bug for event/session location

---
 DocDB/cgi/MeetingHTML.pm | 6 +++---
 DocDB/doc/CHANGES        | 3 ++-
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/DocDB/cgi/MeetingHTML.pm b/DocDB/cgi/MeetingHTML.pm
index 5b656a39..5c1c8cbf 100644
--- a/DocDB/cgi/MeetingHTML.pm
+++ b/DocDB/cgi/MeetingHTML.pm
@@ -694,7 +694,7 @@ sub EventHeader ($) {
                       "External URL","Event Info","Event Wrapup");
 
   if ($DisplayMode eq "SingleSession") {
-    @Fields       = ("Full Title","Date &amp; Time","Location","Alt. Location",
+    @Fields       = ("Full Title","Date &amp; Time","Event Location","Alt. Event Location",
                      "Event Topic(s)","Event Moderator(s)","External URL","Session Info");
     %RenameFields = ( "Session Info" => "Event Info",);
   }
@@ -752,11 +752,11 @@ sub EventHeader ($) {
     $Fields{"Date &amp; Time"} = EuroDate($SeparatorStartTime)." at ".EuroTimeHM($SeparatorStartTime);
   }
 
-  if ($Sessions{$SessionID}{Location}) {
+  if ($Sessions{$SessionID}{Location} && $DisplayMode ne "SingleSession") {
     $Fields{"Location"} = $Sessions{$SessionID}{Location};
   }
 
-  if ($Sessions{$SessionID}{AltLocation}) {
+  if ($Sessions{$SessionID}{AltLocation} && $DisplayMode ne "SingleSession") {
     $Fields{"Alt. Location"} = $Sessions{$SessionID}{AltLocation};
   }
 
diff --git a/DocDB/doc/CHANGES b/DocDB/doc/CHANGES
index 3e5ceb10..2ca92dde 100644
--- a/DocDB/doc/CHANGES
+++ b/DocDB/doc/CHANGES
@@ -1,7 +1,8 @@
 8.7.13
  Fix an old bug where authors were essentially unsorted. Only did the right
  thing by accident.
-
+ Fix a bug where single session events showed the session location, but
+ editing the event edited the event location. Now use event location.
 
 8.7.12
  Show the times when a document is signed in left bar, document list, and popups

From 23ca993a5c1b5f489b63736e6e1cb2b7f5cc512e Mon Sep 17 00:00:00 2001
From: vondo <>
Date: Fri, 5 Nov 2010 19:50:35 +0000
Subject: [PATCH 011/163] Suggested clarification from Anne Heavey

---
 DocDB/cgi/GeneralInstructions.pm | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/DocDB/cgi/GeneralInstructions.pm b/DocDB/cgi/GeneralInstructions.pm
index 4514a69b..11a53f10 100644
--- a/DocDB/cgi/GeneralInstructions.pm
+++ b/DocDB/cgi/GeneralInstructions.pm
@@ -360,10 +360,14 @@ HTML
 
   <p>
   When <strong>updating</strong> a document, you can change all the information above.
-  However, all the forms should be pre-filled for you with the information from
-  the previous version. You will either have to supply <i>all</i> the files you want to
-  be in the new version, or choose to have unchanged files copied to the next version.</p>
-
+  However, all the forms should be pre-filled for you with the information from the previous version.
+  For documents with multiple files, you may update just some of the files or all of them. In either case,
+  the version number will be incremented. DocDB assumes the new document revision will include the same set
+  (hence, the same number) of files. Therefore, for each file listed, you need to either provide an updated file
+  (using Browse), or explicitly copy the previous version of the file to the new version of the document.
+  To copy a file, click the box to the right of the line: <q>Copy filename from previous version:</q>
+  If you want to drop a file from the new version, leave its box unchecked, and at the end of the
+  list of files click the box in front of <q>New version has fewer files</q>. </p>
   <p>
   Finally, <strong>updating the database information</strong> about the document is similar to
   updating the document except for two things. First, you can't supply new

From 2eb8dd171dab48f5daf1d834e6a7bf30ed4cb2c5 Mon Sep 17 00:00:00 2001
From: vondo <>
Date: Tue, 9 Nov 2010 15:58:04 +0000
Subject: [PATCH 012/163] Obsolete = 0 backport

---
 DocDB/cgi/Search.pm | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/DocDB/cgi/Search.pm b/DocDB/cgi/Search.pm
index 5ff7b2ad..5cc56265 100644
--- a/DocDB/cgi/Search.pm
+++ b/DocDB/cgi/Search.pm
@@ -241,7 +241,7 @@ sub LocalSearch ($) {
   ### Get Documents from DocumentRevision that match
 
     my @RevisionPhrases = ();
-    my $RevisionQuery   = "select DocumentID from DocumentRevision where Obsolete=0 and ";
+    my $RevisionQuery   = "select DocumentID from DocumentRevision where Obsolete=0 and (";
 
     if ($TitlePhrase       ) {push @RevisionPhrases,$TitlePhrase       ;}
     if ($AbstractPhrase    ) {push @RevisionPhrases,$AbstractPhrase    ;}
@@ -253,7 +253,8 @@ sub LocalSearch ($) {
     if ($StartDatePhrase   ) {push @RevisionPhrases,$StartDatePhrase   ;}
 
     $RevisionQuery .= join $OuterLogic,@RevisionPhrases;
-
+    $RevisionQuery .= ")";
+    push @DebugStack,"Revision query is $RevisionQuery";
     my %RevisionDocumentIDs = ();
 
     my $document_list = $dbh -> prepare($RevisionQuery);
@@ -266,6 +267,7 @@ sub LocalSearch ($) {
       $RevisionDocumentIDs{$DocumentID} = 1; # Hash removes duplicates
     }
     @RevisionDocumentIDs = keys %RevisionDocumentIDs;
+    push @DebugStack,"Found document IDs are ".join ' ',@RevisionDocumentIDs;
   }
 
   ### Topics (if any)

From ed4aa84179beec10bd3b3b7d7ce57bdcbe232ddf Mon Sep 17 00:00:00 2001
From: vondo <>
Date: Wed, 10 Nov 2010 20:17:02 +0000
Subject: [PATCH 013/163] Fix for obsolete groups

---
 DocDB/cgi/ListBy | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/DocDB/cgi/ListBy b/DocDB/cgi/ListBy
index 61a5afda..94c3d93d 100755
--- a/DocDB/cgi/ListBy
+++ b/DocDB/cgi/ListBy
@@ -210,7 +210,8 @@ if ($Days) {
              $SecurityGroups{$GroupID}{NAME}</span> are available:";
 
   $List = $dbh -> prepare("select DISTINCT(DocumentRevision.DocumentID) from ".
-           "DocumentRevision,RevisionSecurity where DocumentRevision.DocRevID=RevisionSecurity.DocRevID and RevisionSecurity.GroupID=?");
+           "DocumentRevision,RevisionSecurity where DocumentRevision.DocRevID=RevisionSecurity.DocRevID ".
+           "and DocumentRevision.Obsolete=0 and RevisionSecurity.GroupID=?");
   $List -> execute($GroupID);
 } elsif ($AllPubs) {
   $Title   = "$Project Publications";

From 34b5422429aedcec3cb7d891316ed28919492efe Mon Sep 17 00:00:00 2001
From: vondo <>
Date: Fri, 12 Nov 2010 18:51:49 +0000
Subject: [PATCH 014/163] Provide a way to override AuthName

---
 DocDB/cgi/DocDBGlobals.pm | 2 ++
 DocDB/cgi/FSUtilities.pm  | 3 +++
 2 files changed, 5 insertions(+)

diff --git a/DocDB/cgi/DocDBGlobals.pm b/DocDB/cgi/DocDBGlobals.pm
index c3aecf41..dde0def7 100644
--- a/DocDB/cgi/DocDBGlobals.pm
+++ b/DocDB/cgi/DocDBGlobals.pm
@@ -89,6 +89,8 @@ $Preferences{Security}{Certificates}{FNALKCA} = $FALSE;      # TRUE or FALSE - s
 $Preferences{Security}{Certificates}{DOEGrids} = $FALSE;     # TRUE or FALSE - show DOEgrid certificate instructions
 $Preferences{Security}{Certificates}{ShowCertInstructions} = $FALSE;  # TRUE or FALSE - show certificate instructions even on non-cert version
 
+$Preferences{Security}{AuthName} = "";  # Set to override default AuthName of group1 or group2, etc.
+
 $Preferences{Options}{DynamicFullList}{Private} = $FALSE; # Generate Full document list by dynamically for private db
 $Preferences{Options}{DynamicFullList}{Public}  = $FALSE; # Generate Full document list by dynamically for public db
 
diff --git a/DocDB/cgi/FSUtilities.pm b/DocDB/cgi/FSUtilities.pm
index 8bb54106..86b25a9d 100644
--- a/DocDB/cgi/FSUtilities.pm
+++ b/DocDB/cgi/FSUtilities.pm
@@ -162,6 +162,9 @@ sub ProtectDirectory { # Write (or delete) correct .htaccess file in directory
   }
 
   my $AuthName = join ' or ',@users;
+  if ($Preferences{Security}{AuthName}) {
+     $AuthName = $Preferences{Security}{AuthName};
+  }
 
   my $directory = &GetDirectory($documentID,$version);
   if (@users) {

From 1b39a0d11ffc5f103ab1bb4a39d7a60a126b0ec1 Mon Sep 17 00:00:00 2001
From: vondo <>
Date: Wed, 27 Jul 2011 20:34:00 +0000
Subject: [PATCH 015/163] Merge in changes from cd_1105

---
 DocDB/cgi/DocDBGlobals.pm     |   8 +-
 DocDB/cgi/DocDBVersion.pm     |   2 +-
 DocDB/cgi/DocumentAddForm     |  10 +-
 DocDB/cgi/DocumentHTML.pm     |   3 +-
 DocDB/cgi/EmailAdministerForm |   6 +-
 DocDB/cgi/FileHTML.pm         | 144 ++++++++++++------------
 DocDB/cgi/MailNotification.pm | 202 ++++++++++++++++++----------------
 DocDB/cgi/MeetingHTML.pm      |  12 +-
 DocDB/cgi/ProcessDocumentAdd  |   9 +-
 DocDB/cgi/RevisionHTML.pm     |   7 +-
 DocDB/cgi/Sorts.pm            |  12 +-
 DocDB/doc/CHANGES             |   6 +
 12 files changed, 236 insertions(+), 185 deletions(-)

diff --git a/DocDB/cgi/DocDBGlobals.pm b/DocDB/cgi/DocDBGlobals.pm
index dde0def7..db83aab6 100644
--- a/DocDB/cgi/DocDBGlobals.pm
+++ b/DocDB/cgi/DocDBGlobals.pm
@@ -1,4 +1,4 @@
-#
+#        Name: $RCSfile$
 # Description: Configuration file for the DocDB. Sets default
 #              values and script names. Do not change this file,
 #              specific local settings are in ProjectGlobals.pm.
@@ -7,7 +7,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified:
 #
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
@@ -98,6 +98,10 @@ $Preferences{Options}{AlwaysRetrieveFile}       = $FALSE; # Always use RetrieveF
 
 $Preferences{Options}{SubmitAgree}              = ""; # "Put text here to make users agree to a privacy statement or some-such. <br/><b>I agree:</b>"
 
+# On updates of documents, require an entry in the note field and/or zero out the submitter and require a new entry
+$Preferences{Options}{Update}{RequireNote}      = $FALSE;
+$Preferences{Options}{Update}{RequireSubmitter} = $FALSE;
+
 $Preferences{Components}{iCal}  = $TRUE; # Display links to iCal calendars
 
 $Preferences{Topics}{MinLevel}{Document} = 1;
diff --git a/DocDB/cgi/DocDBVersion.pm b/DocDB/cgi/DocDBVersion.pm
index de6fdc32..fb14b645 100644
--- a/DocDB/cgi/DocDBVersion.pm
+++ b/DocDB/cgi/DocDBVersion.pm
@@ -20,6 +20,6 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-$DocDBVersion = "8.7.13";
+$DocDBVersion = "8.7.14";
 
 1;
diff --git a/DocDB/cgi/DocumentAddForm b/DocDB/cgi/DocumentAddForm
index 4a2cb0ec..b095334e 100755
--- a/DocDB/cgi/DocumentAddForm
+++ b/DocDB/cgi/DocumentAddForm
@@ -8,7 +8,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
@@ -140,6 +140,10 @@ if ($mode eq "reserve") {
   $RequiredEntries{Abstract}  = 0;
 }
 
+if ($Preferences{Options}{Update}{RequireNote} && ($mode eq "update" || $mode eq "updatedb")){
+  $RequiredEntries{Note} = 1;
+}
+
 my $DocRevID;
 
 if ($mode eq "update" || $mode eq "updatedb") {
@@ -177,7 +181,9 @@ if ($mode eq "update" || $mode eq "updatedb") { # Need to read in last version v
   $TitleDefault        = $DocRevisions{$DocRevID}{Title};
   $PubInfoDefault      = $DocRevisions{$DocRevID}{PUBINFO};
   $AbstractDefault     = $DocRevisions{$DocRevID}{Abstract};
-  $RequesterDefault    = $DocRevisions{$DocRevID}{Submitter};
+  if (not $Preferences{Options}{Update}{RequireSubmitter}) {
+    $RequesterDefault  = $DocRevisions{$DocRevID}{Submitter};
+  }
   $KeywordsDefault     = $DocRevisions{$DocRevID}{Keywords};
   $RevisionNoteDefault = $DocRevisions{$DocRevID}{Note};
   $DocTypeIDDefault    = $DocRevisions{$DocRevID}{DocTypeID};
diff --git a/DocDB/cgi/DocumentHTML.pm b/DocDB/cgi/DocumentHTML.pm
index f221b40e..688455c0 100644
--- a/DocDB/cgi/DocumentHTML.pm
+++ b/DocDB/cgi/DocumentHTML.pm
@@ -41,6 +41,7 @@ sub DocumentTable (%) {
   my $MaxDocs         =   $Params{-maxdocs};
   my $NoneBehavior    =   $Params{-nonebehavior} || "skip";  # skip|
   my $TalkID          =   $Params{-talkid} || 0;
+  my $SkipVersions    =   $Params{-skipversions} || $False;
   my @DocumentIDs     = @{$Params{-docids}};
   my @SessionOrderIDs = @{$Params{-sessionorderids}};
   my %FieldList       = %{$Params{-fieldlist}};
@@ -266,7 +267,7 @@ sub DocumentTable (%) {
         print AddLineBreaks(URLify($DocRevisions{$DocRevID}{Note}));
       } elsif ($Field eq "Files") {    # Files in document
         require "FileHTML.pm";
-        ShortFileListByRevID($DocRevID);
+        ShortFileListByRevID($DocRevID, $SkipVersions);
       } elsif ($Field eq "Confirm") {
         print $query -> start_multipart_form('POST',$ConfirmTalkHint);
         print "<div>\n";
diff --git a/DocDB/cgi/EmailAdministerForm b/DocDB/cgi/EmailAdministerForm
index ae879737..e5469ae5 100755
--- a/DocDB/cgi/EmailAdministerForm
+++ b/DocDB/cgi/EmailAdministerForm
@@ -10,7 +10,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
@@ -192,7 +192,7 @@ if ($EmailUserID) {
 
 ### Display of existing groups
 
-  my @EmailUserIDs = sort EmailUserIDsByName GetEmailUserIDs();
+  my @EmailUserIDs = sort EmailUserIDsByUsername GetEmailUserIDs();
 
   print "<table class=\"DocumentList Alternating\">\n";
   print "<tr><th>Name</th><th>Username</th><th>Verified?</th><th>Can Sign?</th><th>Groups</th></tr>\n";
@@ -246,7 +246,7 @@ if ($EmailUserID) {
   my @SecurityGroups = sort keys %SecurityIDs;
 
   foreach my $SecurityGroup (@SecurityGroups) {
-    my @EmailUserIDs = sort EmailUserIDsByName FetchEmailUserIDsBySecurityGroup($SecurityIDs{$SecurityGroup});
+    my @EmailUserIDs = sort EmailUserIDsByUsername FetchEmailUserIDsBySecurityGroup($SecurityIDs{$SecurityGroup});
     if (@EmailUserIDs) {
       print "<p><a name=\"$SecurityGroup\" /><strong>$SecurityGroup has these members:</strong></p>\n<ul>\n";
       foreach my $EmailUserID (@EmailUserIDs) {
diff --git a/DocDB/cgi/FileHTML.pm b/DocDB/cgi/FileHTML.pm
index 4c999a79..470a22cb 100644
--- a/DocDB/cgi/FileHTML.pm
+++ b/DocDB/cgi/FileHTML.pm
@@ -1,9 +1,9 @@
 #
-# Description: Subroutines to provide links for files, groups of 
+# Description: Subroutines to provide links for files, groups of
 #              files and archives.
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified: 
+#    Modified:
 #
 
 # Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
@@ -11,7 +11,7 @@
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -44,22 +44,22 @@ sub FileListByRevID {
         push @RootFiles,$FileID;
       } else {
         push @OtherFiles,$FileID;
-      }  
+      }
     }
     if (@RootFiles) {
       print "<dd class=\"FileList\">\n";
       &FileListByFileID(@RootFiles);
       print "</dd>\n";
-    }   
+    }
     if (@OtherFiles) {
       print "<dd class=\"FileList\"><em>Other Files:</em>\n";
       &FileListByFileID(@OtherFiles);
       print "</dd>\n";
-    } 
-    unless ($Public) {  
+    }
+    unless ($Public) {
       my $ArchiveLink = &ArchiveLink($DocumentID,$Version);
       print "<dd class=\"FileList\"><em>$ArchiveLink</em></dd>\n";
-    }  
+    }
   } else {
     print "<dd>None</dd>\n";
   }
@@ -69,7 +69,7 @@ sub FileListByRevID {
 
 sub ShortFileListByRevID {
   require "MiscSQL.pm";
-  my ($DocRevID) = @_;
+  my ($DocRevID, $SkipVersions) = @_;
 
   my @FileIDs  = &FetchDocFiles($DocRevID);
   my $DocumentID = $DocRevisions{$DocRevID}{DOCID};
@@ -79,10 +79,10 @@ sub ShortFileListByRevID {
   foreach $File (@FileIDs) {
     if ($DocFiles{$File}{ROOT}) {
       push @RootFiles,$File
-    }  
+    }
   }
   if (@RootFiles) {
-    &ShortFileListByFileID(@RootFiles);
+    ShortFileListByFileID({-files => \@RootFiles, -skipversions => $SkipVersions, });
   } else {
     print "None<br/>\n";
   }
@@ -90,14 +90,14 @@ sub ShortFileListByRevID {
 
 sub FileListByFileID {
   require "Sorts.pm";
-  
+
   my (@Files) = @_;
   unless (@Files) {
     return;
-  }  
-  
+  }
+
   @Files = sort FilesByDescription @Files;
-  
+
   print "<ul>\n";
   foreach my $FileID (@Files) {
     my $DocRevID   = $DocFiles{$FileID}{DOCREVID};
@@ -107,31 +107,33 @@ sub FileListByFileID {
                           -shortname   => $DocFiles{$FileID}{NAME},
                           -description => $DocFiles{$FileID}{DESCRIPTION}} );
     print "<li>$Link</li>\n";
-  }  
+  }
   print "</ul>\n";
 }
 
 sub ShortFileListByFileID { # FIXME: Make special case of FileListByFileID
   require "Sorts.pm";
-  
-  my (@Files) = @_;
-  
+
+  my ($ArgRef) = @_;
+  my @Files        = exists $ArgRef->{-files}        ? @{$ArgRef->{-files}}       : ();
+  my $SkipVersions = exists $ArgRef->{-skipversions} ?   $ArgRef->{-skipversions} : $FALSE;
+
   @Files = sort FilesByDescription @Files;
-  
+
   foreach my $FileID (@Files) {
     my $DocRevID   = $DocFiles{$FileID}{DOCREVID};
     my $Version    = $DocRevisions{$DocRevID}{VERSION};
     my $DocumentID = $DocRevisions{$DocRevID}{DOCID};
     my $Link = FileLink( {-maxlength => 20, -format => "short", -docid => $DocumentID, -version => $Version,
-                          -shortname   => $DocFiles{$FileID}{NAME},
+                          -shortname   => $DocFiles{$FileID}{NAME}, -skipversions => $SkipVersions,
                           -description => $DocFiles{$FileID}{DESCRIPTION}} );
     print "$Link<br/>\n";
-  }  
+  }
 }
 
 sub FileLink ($) {
   my ($ArgRef) = @_;
-  
+
   my $DocumentID  = exists $ArgRef->{-docid}       ? $ArgRef->{-docid}       : 0;
   my $Version     = exists $ArgRef->{-version}     ? $ArgRef->{-version}     : 0;
   my $ShortName   = exists $ArgRef->{-shortname}   ? $ArgRef->{-shortname}   : "";
@@ -139,6 +141,7 @@ sub FileLink ($) {
   my $MaxLength   = exists $ArgRef->{-maxlength}   ? $ArgRef->{-maxlength}   : 60;
   my $MaxExt      = exists $ArgRef->{-maxext}      ? $ArgRef->{-maxext}      : 4;
   my $Format      = exists $ArgRef->{-format}      ? $ArgRef->{-format}      : "long";
+  my $SkipVersions = exists $ArgRef->{-skipversions} ? $ArgRef->{-skipversions} : $FALSE;
 
   require "FSUtilities.pm";
   require "FileUtilities.pm";
@@ -148,20 +151,23 @@ sub FileLink ($) {
   my $FileSize  = FileSize(FullFile($DocumentID,$Version,$ShortName));
 
   $FileSize =~ s/^\s+//; # Chop off leading spaces
-  
-  my $PrintedName = $ShortName; 
-  if ($MaxLength) { 
+
+  my $PrintedName = $ShortName;
+  if ($MaxLength) {
     $PrintedName = AbbreviateFileName(-filename  => $ShortName,
                                       -maxlength => $MaxLength, -maxext => $MaxExt);
-  }  
+  }
 
   my $URL = $BaseURL.$ShortFile;
-  if ($UserValidation eq "certificate" || $Preferences{Options}{AlwaysRetrieveFile}) {                                          
-    $URL = $RetrieveFile."?docid=".$DocumentID."&amp;version=".$Version."&amp;filename=".$ShortFile;
+  if ($UserValidation eq "certificate" || $Preferences{Options}{AlwaysRetrieveFile}) {
+    $URL = $RetrieveFile."?docid=".$DocumentID.";filename=".$ShortFile;
+    unless ($SkipVersions) {
+        $URL .= ";version=".$Version;
+    }
   }
-  
+
   my $Link = "";
-  
+
   if ($Format eq "short") {
     if ($Description) {
       return "<a href=\"$URL\" title=\"$ShortName\">$Description</a>";
@@ -179,25 +185,25 @@ sub FileLink ($) {
 
 sub ArchiveLink {
   my ($DocumentID,$Version) = @_;
-  
+
   my @Types = ("tar.gz");
   if ($Zip) {push @Types,"zip";}
-  
+
   @Types = sort @Types;
-  
+
   my $link  = "Get all files as \n";
   @LinkParts = ();
   foreach my $Type (@Types) {
     push @LinkParts,"<a href=\"$RetrieveArchive?docid=$DocumentID\&amp;version=$Version\&amp;type=$Type\">$Type</a>";
-  }  
+  }
   $link .= join ', ',@LinkParts;
   $link .= ".";
-  
+
   return $link;
 }
 
 sub FileUploadBox (%) {
-  my (%Params) = @_; 
+  my (%Params) = @_;
 
   my $Type        = $Params{-type}        || "file";
   my $DescOnly    = $Params{-desconly}    || 0;
@@ -208,16 +214,16 @@ sub FileUploadBox (%) {
   my $Required    = $Params{-required}    || 0;
   my $FileSize    = $Params{-filesize}    || 60;
   my $FileMaxSize = $Params{-filemaxsize} || 250;
-  
+
   my @FileIDs = @{$Params{-fileids}};
-  
+
   require "Sorts.pm";
-  
+
   if ($DocRevID) {
     require "MiscSQL.pm";
     @FileIDs = &FetchDocFiles($DocRevID);
   }
-  
+
   my @RootFiles  = ();
   my @OtherFiles = ();
 
@@ -226,9 +232,9 @@ sub FileUploadBox (%) {
       push @RootFiles,$FileID;
     } else {
       push @OtherFiles,$FileID;
-    }  
+    }
   }
-  
+
   @RootFiles  = sort FilesByDescription @RootFiles;
   @OtherFiles = sort FilesByDescription @OtherFiles;
   @FileIDs    = (@RootFiles,@OtherFiles);
@@ -236,22 +242,22 @@ sub FileUploadBox (%) {
   unless ($MaxFiles) {
     if (@FileIDs) {
       $MaxFiles = @FileIDs + $AddFiles;
-      
+
     } elsif ($NumberUploads) {
-      $MaxFiles = $NumberUploads;	  
+      $MaxFiles = $NumberUploads;
     } elsif ($UserPreferences{NumFiles}) {
       $MaxFiles = $UserPreferences{NumFiles};
     } else {
-      $MaxFiles = 1;   
-    }   
-  }   
+      $MaxFiles = 1;
+    }
+  }
 
   print "<div>\n";
   print $query -> hidden(-name => 'maxfiles', -default => $MaxFiles);
   print "</div>\n";
 
   print "<table class=\"LowPaddedTable LeftHeader\">\n";
- 
+
   my ($HelpLink,$HelpText,$FileHelpLink,$FileHelpText,$DescHelpLink,$DescHelpText);
   if ($Type eq "file") {
     $HelpLink = "fileupload";
@@ -264,21 +270,21 @@ sub FileUploadBox (%) {
     $FileHelpLink = "remoteurl";
     $FileHelpText = "URL";
   }
-  
+
   if ($DescOnly) {
     $HelpLink = "filechar";
     $HelpText = "Update File Characteristics";
   }
-    
+
   $DescHelpLink = "description";
   $DescHelpText = "Description";
-  
+
   my $BoxTitle = FormElementTitle(-helplink => $HelpLink, -helptext => $HelpText,
                                   -required => $Required);
-  print '<tr><td colspan="2">'; 
+  print '<tr><td colspan="2">';
   print $BoxTitle;
   print "</td></tr>\n";
-  
+
   for (my $i = 1; $i <= $MaxFiles; ++$i) {
     my $FileID = shift @FileIDs;
     my $ElementName = "upload$i";
@@ -288,13 +294,13 @@ sub FileUploadBox (%) {
     my $CopyName    = "copyfile$i";
     my $URLName     = "url$i";
     my $NewName     = "newname$i";
-   
+
     my $FileHelp        = FormElementTitle(-helplink => $FileHelpLink, -helptext => $FileHelpText);
     my $DescriptionHelp = FormElementTitle(-helplink => $DescHelpLink, -helptext => $DescHelpText);
     my $NewNameHelp     = FormElementTitle(-helplink => "newfilename", -helptext => "New Filename");
     my $MainHelp        = FormElementTitle(-helplink => "main", -helptext => "Main?", -nocolon => $TRUE, -nobold => $TRUE);
     my $DefaultDesc = $DocFiles{$FileID}{DESCRIPTION};
-    
+
     if ($DescOnly) {
       print "<tr>\n";
       print "<th>Filename:</th>";
@@ -313,29 +319,29 @@ sub FileUploadBox (%) {
         print $query -> filefield(-name      => $ElementName, -size => $FileSize,
                                   -maxlength => $FileMaxSize);
       } elsif ($Type eq "http") {
-        print $query -> textfield(-name      => $URLName,     -size => $FileSize, 
+        print $query -> textfield(-name      => $URLName,     -size => $FileSize,
                                   -maxlength => $FileMaxSize);
       }
       print "</td>\n";
       print "</tr>\n";
-      
+
       if ($Type eq "http") {
         print "<tr><th>\n";
         print $NewNameHelp;
         print "</th>\n";
 
         print "<td>\n";
-        print $query -> textfield(-name      => $NewName, -size => $FileSize, 
+        print $query -> textfield(-name      => $NewName, -size => $FileSize,
                                   -maxlength => $FileMaxSize);
         print "</td>\n";
         print "</tr>\n";
       }
-    }  
+    }
     print "<tr><th>\n";
     print $DescriptionHelp;
     print "</th>\n";
     print "<td>\n";
-    print $query -> textfield (-name      => $DescName, -size    => 60, 
+    print $query -> textfield (-name      => $DescName, -size    => 60,
                                -maxlength => 128,       -default => $DefaultDesc);
 
     if ($DocFiles{$FileID}{ROOT} || !$FileID) {
@@ -343,7 +349,7 @@ sub FileUploadBox (%) {
     } else {
       print $query -> checkbox(-name => $MainName, -label => '');
     }
-    
+
     print $MainHelp;
     print "</td></tr>\n";
     if ($FileID && $AllowCopy && !$DescOnly) {
@@ -352,13 +358,13 @@ sub FileUploadBox (%) {
       print $query -> hidden(-name => $FileIDName, -value => $FileID);
       print $query -> checkbox(-name => $CopyName, -label => '');
       print "</td></tr>\n";
-    }  
+    }
     print "<tr><td colspan=\"3\"></td></tr>\n";
   }
   if ($AllowCopy && $NOrigFiles) {
-    print '<tr><td colspan="2">'; 
-    print $query -> checkbox(-name => 'LessFiles', -label => '');    
-    print FormElementTitle(-helplink => "LessFiles", -helptext => "New version has fewer files", 
+    print '<tr><td colspan="2">';
+    print $query -> checkbox(-name => 'LessFiles', -label => '');
+    print FormElementTitle(-helplink => "LessFiles", -helptext => "New version has fewer files",
                            -nocolon  => $TRUE,       -nobold   => $TRUE);;
     print "</td></tr>\n";
   }
@@ -372,10 +378,10 @@ sub FileUploadBox (%) {
   }
   print "</table>\n";
 }
-   
+
 sub ArchiveUploadBox (%)  {
-  my (%Params) = @_; 
-  
+  my (%Params) = @_;
+
   my $Required   = $Params{-required}   || 0;        # short, long, full
 
   print "<table class=\"LowPaddedTable LeftHeader\">\n";
diff --git a/DocDB/cgi/MailNotification.pm b/DocDB/cgi/MailNotification.pm
index d9984bdc..719f555f 100644
--- a/DocDB/cgi/MailNotification.pm
+++ b/DocDB/cgi/MailNotification.pm
@@ -1,9 +1,19 @@
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+#        Name: $RCSfile$
+# Description: This script provides a form to administer users receiving
+#              e-mail notifications and shows the complete list of who is
+#              receiving what.
+#
+#    Revision: $Revision$
+#    Modified: $Author$ on $Date$
+#
+#      Author: Eric Vaandering (ewv@fnal.gov)
+
+# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -19,7 +29,7 @@ sub MailNotices (%) {
 
   unless ($MailInstalled) {
     return;
-  }  
+  }
 
   require Mail::Send;
   require Mail::Mailer;
@@ -29,21 +39,21 @@ sub MailNotices (%) {
   require "ResponseElements.pm";
   require "Utilities.pm";
   require "Security.pm";
-  
+
   my (%Params) = @_;
 
   my $DocRevID     =   $Params{-docrevid};
   my $Type         =   $Params{-type}      || "updateunknown";
   my @EmailUserIDs = @{$Params{-emailids}};
-  
+
   FetchDocRevisionByID($DocRevID);
   my $DocumentID = $DocRevisions{$DocRevID}{DOCID};
   my $Version    = $DocRevisions{$DocRevID}{Version};
-  
-# Figure out who cares 
+
+# Figure out who cares
 
   my @Addressees = ();
-  if ($Type eq "update"  || $Type eq "updatedb" || $Type eq "add" || 
+  if ($Type eq "update"  || $Type eq "updatedb" || $Type eq "add" ||
       $Type eq "reserve" || $Type eq "addfiles" || $Type eq "updateunknown") {
     @Addressees = UsersToNotify($DocRevID,{-period => "Immediate"} );
   } elsif ($Type eq "signature") {
@@ -51,7 +61,7 @@ sub MailNotices (%) {
       FetchEmailUser($EmailUserID);
       push @Addressees,$EmailUser{$EmailUserID}{EmailAddress};
     }
-  } elsif ($Type eq "approved") { 
+  } elsif ($Type eq "approved") {
     @Addressees = UsersToNotify($DocRevID,{-period => "Immediate"} );
     my %EmailUsers = ();
     my @SignoffIDs = GetAllSignoffsByDocRevID($DocRevID);
@@ -61,12 +71,12 @@ sub MailNotices (%) {
         my $EmailUserID = $Signatures{$SignatureID}{EmailUserID};
         FetchEmailUser($EmailUserID);
         push @Addressees,$EmailUser{$EmailUserID}{EmailAddress};
-      }  
-    }  
-  } 
-  
+      }
+    }
+  }
+
   @Addressees = Unique(@Addressees);
-  
+
 # If anyone, open the mailer
 
   if (@Addressees) {
@@ -78,13 +88,13 @@ sub MailNotices (%) {
     my $Title  = $DocRevisions{$DocRevID}{Title};
 
     my ($Subject,$Message,$Feedback);
-    
-    if ($Type eq "update"  || $Type eq "updatedb" || $Type eq "add" || 
+
+    if ($Type eq "update"  || $Type eq "updatedb" || $Type eq "add" ||
         $Type eq "reserve" || $Type eq "addfiles" || $Type eq "updateunknown") {
       $Subject  = "$FullID: $Title";
       $Message  = "The following document was added or updated ".
                   "in the $Project Document Database:\n\n";
-      $Feedback = "<b>E-mail sent to: </b>";        
+      $Feedback = "<b>E-mail sent to: </b>";
       if      ($Type eq "update") {
         $Message  = "The following document was updated ".
                     "in the $Project Document Database:\n\n";
@@ -100,7 +110,7 @@ sub MailNotices (%) {
       } elsif ($Type eq "addfiles") {
         $Message  = "Files were added to the following document ".
              "in the $Project Document Database:\n\n";
-      }  
+      }
     } elsif ($Type eq "signature") {
       $Subject  = "Ready for signature: $FullID: $Title";
       $Message  = "The following document ".
@@ -108,14 +118,14 @@ sub MailNotices (%) {
                   "is ready for your signature:\n".
                   "(Note that you may not be able to sign if you share ".
                   "signature authority with someone who has already signed.)\n\n";
-      $Feedback = "<b>Signature(s) requested from: </b>";           
+      $Feedback = "<b>Signature(s) requested from: </b>";
     } elsif ($Type eq "approved") {
       $Subject  = "Approved: $FullID: $Title";
       $Message  = "The following document ".
                   "in the $Project Document Database ".
                   "has been approved (received all necessary signatures).\n\n";
-      $Feedback = "<b>Approval notification sent to: </b>";           
-    }  
+      $Feedback = "<b>Approval notification sent to: </b>";
+    }
 
     $Headers{To} = \@Addressees;
     $Headers{From} = "$Project Document Database <$DBWebMasterEmail>";
@@ -129,9 +139,9 @@ sub MailNotices (%) {
     $Addressees =~ s/\&/\&amp\;/g;
     $Addressees =~ s/</\&lt\;/g;
     $Addressees =~ s/>/\&gt\;/g;
-    
+
     print $Feedback,$Addressees,"<p>";
-  }  
+  }
 }
 
 sub RevisionMailBody ($) {
@@ -144,11 +154,11 @@ sub RevisionMailBody ($) {
   require "Sorts.pm";
 
   FetchDocRevisionByID($DocRevID);
-  
+
   my $Title  = $DocRevisions{$DocRevID}{Title};
   my $FullID = FullDocumentID($DocRevisions{$DocRevID}{DOCID},$DocRevisions{$DocRevID}{VERSION});
   my $URL    = DocumentURL($DocRevisions{$DocRevID}{DOCID});
-  
+
   FetchAuthor($DocRevisions{$DocRevID}{Submitter});
   my $Submitter = $Authors{$DocRevisions{$DocRevID}{Submitter}}{FULLNAME};
 
@@ -157,9 +167,9 @@ sub RevisionMailBody ($) {
   my @AuthorIDs    = AuthorRevIDsToAuthorIDs({ -authorrevids => \@AuthorRevIDs, });
   my @TopicIDs     = GetRevisionTopics({-docrevid => $DocRevID});
   my @EventIDs     = GetRevisionEvents($DocRevID);
-  
-# Build list of authors  
-  
+
+# Build list of authors
+
   my @Authors = ();
   foreach $AuthorID (@AuthorIDs) {
     FetchAuthor($AuthorID);
@@ -169,9 +179,9 @@ sub RevisionMailBody ($) {
     push @Authors,$Authors{$AuthorID}{FULLNAME};
   }
   my $Authors = join ', ',@Authors;
-  
+
 # Build list of topics
-  
+
   my @Topics = ();
   foreach $TopicID (@TopicIDs) {
     FetchTopic({-topicid => $TopicID});
@@ -181,9 +191,9 @@ sub RevisionMailBody ($) {
     push @Topics,$Topics{$TopicID}{Long};
   }
   my $Topics = join ', ',@Topics;
-  
-# Build list of events  
-  
+
+# Build list of events
+
   my @Events = ();
   foreach $EventID (@EventIDs) {
     FetchConferenceByConferenceID($EventID);
@@ -194,10 +204,10 @@ sub RevisionMailBody ($) {
          " (".EuroDate($Conferences{$EventID}{StartDate}).")";
   }
   my $Events = join ', ',@Events;
-  
-  
+
+
   # Construct the mail body
-  
+
   print $Mailer "       Title: ",$DocRevisions{$DocRevID}{Title},"\n";
   print $Mailer " Document ID: ",$FullID,"\n";
   print $Mailer "         URL: ",$URL,"\n";
@@ -207,12 +217,12 @@ sub RevisionMailBody ($) {
   print $Mailer "      Topics: ",$Topics,"\n";
   if ($Events) {
     print $Mailer "      Events: ",$Events,"\n";
-  } 
+  }
   print $Mailer "    Keywords: ",$DocRevisions{$DocRevID}{Keywords},"\n";
   print $Mailer "    Abstract: ",$DocRevisions{$DocRevID}{Abstract},"\n";
   if ($DocRevisions{$DocRevID}{Note}) {
     print $Mailer "       Notes: ",$DocRevisions{$DocRevID}{Note},"\n";
-  }  
+  }
 }
 
 sub UsersToNotify ($$) {
@@ -223,14 +233,14 @@ sub UsersToNotify ($$) {
   require "MeetingSQL.pm";
   require "NotificationSQL.pm";
   require "TopicSQL.pm";
-  
+
   require "Security.pm";
   require "Utilities.pm";
   require "AuthorUtilities.pm";
 
   unless ($Period eq "Immediate" || $Period eq "Daily" || $Period eq "Weekly") {
     return undef;
-  }  
+  }
 
   GetTopics();
 
@@ -248,12 +258,12 @@ sub UsersToNotify ($$) {
     "select EmailUserID from Notification where Period=? and Type=? and TextKey=?");
 
 # Get users interested in this particular document (only immediate)
- 
+
   if ($Period eq "Immediate") {
     $Fetch -> execute("Immediate","Document",$DocumentID);
     $Fetch -> bind_columns(undef,\($UserID));
     while ($Fetch -> fetch) {
-      $UserIDs{$UserID} = 1; 
+      $UserIDs{$UserID} = 1;
     }
   }
 
@@ -263,12 +273,12 @@ sub UsersToNotify ($$) {
   $Fetch -> execute($Period,"AllDocuments",1);
   $Fetch -> bind_columns(undef,\($UserID));
   while ($Fetch -> fetch) {
-    $UserIDs{$UserID} = 1; 
+    $UserIDs{$UserID} = 1;
   }
   $Fetch -> execute($Period,"AllDocuments",0);
   $Fetch -> bind_columns(undef,\($UserID));
   while ($Fetch -> fetch) {
-    $UserIDs{$UserID} = 1; 
+    $UserIDs{$UserID} = 1;
   }
 
 # Get users interested in topics for this reporting period
@@ -276,7 +286,7 @@ sub UsersToNotify ($$) {
   GetTopics();
   my @TopicIDs = ();
   my @InitialTopicIDs = GetRevisionTopics( {-docrevid => $DocRevID} );
-  
+
   foreach my $TopicID (@InitialTopicIDs) {
     push @TopicIDs,@{$TopicProvenance{$TopicID}}; # Add ancestors to list
   }
@@ -285,10 +295,10 @@ sub UsersToNotify ($$) {
     $Fetch -> execute($Period,"Topic",$TopicID);
     $Fetch -> bind_columns(undef,\($UserID));
     while ($Fetch -> fetch) {
-      $UserIDs{$UserID} = 1; 
+      $UserIDs{$UserID} = 1;
     }
-  }  
-    
+  }
+
 # Get users interested in events for this reporting period
 
   my @EventIDs = GetRevisionEvents($DocRevID);
@@ -297,17 +307,17 @@ sub UsersToNotify ($$) {
     $Fetch -> execute($Period,"Event",$EventID);
     $Fetch -> bind_columns(undef,\($UserID));
     while ($Fetch -> fetch) {
-      $UserIDs{$UserID} = 1; 
+      $UserIDs{$UserID} = 1;
     }
 
     my $EventGroupID = $Conferences{$EventID}{EventGroupID};
-    
+
     $Fetch -> execute($Period,"EventGroup",$EventGroupID);
     $Fetch -> bind_columns(undef,\($UserID));
     while ($Fetch -> fetch) {
-      $UserIDs{$UserID} = 1; 
+      $UserIDs{$UserID} = 1;
     }
-  }  
+  }
 
 # Get users interested in authors for this reporting period
 
@@ -317,12 +327,12 @@ sub UsersToNotify ($$) {
     $Fetch -> execute($Period,"Author",$AuthorID);
     $Fetch -> bind_columns(undef,\($UserID));
     while ($Fetch -> fetch) {
-      $UserIDs{$UserID} = 1; 
+      $UserIDs{$UserID} = 1;
     }
-  }  
+  }
 
 # Get users interested in keywords for this reporting period
-    
+
   FetchDocRevisionByID($DocRevID);
   my @Keywords = split /,*\s+/,$DocRevisions{$DocRevID}{Keywords}; # Comma and/or space separated
 
@@ -331,13 +341,13 @@ sub UsersToNotify ($$) {
     $TextFetch -> execute($Period,"Keyword",$Keyword);
     $TextFetch -> bind_columns(undef,\($UserID));
     while ($TextFetch -> fetch) {
-      $UserIDs{$UserID} = 1; 
+      $UserIDs{$UserID} = 1;
     }
-  }  
+  }
 
-# Translate UserIDs into E-mail addresses, 
+# Translate UserIDs into E-mail addresses,
 # verify user is allowed to receive notification
-   
+
   foreach $UserID (keys %UserIDs) {
     my $EmailUserID = FetchEmailUser($UserID);
     if ($EmailUserID && CanAccess($DocumentID,$Version,$EmailUserID)) {
@@ -347,8 +357,8 @@ sub UsersToNotify ($$) {
         push @Addressees,$EmailAddress;
       }
     }
-  } 
-  
+  }
+
   return @Addressees;
 }
 
@@ -360,12 +370,12 @@ sub EmailKeywordForm ($) {
 
   require "FormElements.pm";
 
-  print FormElementTitle(-helplink  => "notifykeyword", -helptext => $Period, 
+  print FormElementTitle(-helplink  => "notifykeyword", -helptext => $Period,
                          -extratext => "(separate with spaces)");
 
   my $Keywords = join ' ',sort @Defaults;
 
-  print $query -> textfield (-name => $Name , -default   => $Keywords, 
+  print $query -> textfield (-name => $Name , -default   => $Keywords,
                              -size => 80,     -maxlength => 400);
 }
 
@@ -378,7 +388,7 @@ sub EmailAllForm ($) {
     print $query -> checkbox(-name => $Name, -checked => 'checked', -value => 1, -label => 'All Documents');
   } else {
     print $query -> checkbox(-name => $Name, -value => 1, -label => 'All Documents');
-  }                             
+  }
 }
 
 sub DisplayNotification ($$;$) {
@@ -398,38 +408,38 @@ sub DisplayNotification ($$;$) {
   my @EventGroupIDs = @{$Notifications{$EmailUserID}{"EventGroup_".$Set}};
   my @Keywords      = @{$Notifications{$EmailUserID}{"Keyword_".$Set}};
   my @AllDocuments  = @{$Notifications{$EmailUserID}{"AllDocuments_".$Set}};
-  
+
   my $NewNotify = (@AllDocuments || @AuthorIDs || @TopicIDs || @EventIDs || @EventGroupIDs || @Keywords);
-                    
+
   if ($NotifyAllTopics || $NewNotify) {
-    print "<b>$Set notifications:</b>\n";  
-    print "<ul>\n";  
+    print "<b>$Set notifications:</b>\n";
+    print "<ul>\n";
   } elsif ($Always) {
-    print "<b>$Set notifications:</b>\n";  
-    print "<ul>\n";  
-    print "<li>None</li>\n";  
+    print "<b>$Set notifications:</b>\n";
+    print "<ul>\n";
+    print "<li>None</li>\n";
     print "</ul>\n";
     return;
   } else {
     return;
   }
-  
-  if (@AllDocuments) { 
-    print "<li>All documents</li>\n";  
-  }  
-  
+
+  if (@AllDocuments) {
+    print "<li>All documents</li>\n";
+  }
+
   foreach my $TopicID (@TopicIDs) {
     print "<li>Topic: ",TopicLink({ -topicid => $TopicID }),"</li>";
   }
-    
+
   foreach my $AuthorID (@AuthorIDs) {
     print "<li> Author: ",AuthorLink($AuthorID),"</li>";
   }
-    
+
   foreach my $EventID (@EventIDs) {
     print "<li>Event: ",EventLink(-eventid => $EventID),"</li>";
   }
-    
+
   foreach my $EventGroupID (@EventGroupIDs) {
     print "<li>Event Group: ",EventGroupLink(-eventgroupid => $EventGroupID),"</li>";
   }
@@ -437,37 +447,37 @@ sub DisplayNotification ($$;$) {
   foreach my $Keyword (@Keywords) {
     print "<li>Keyword: ",KeywordLink($Keyword),"</li>";
   }
-     
-  print "</ul>\n";  
+
+  print "</ul>\n";
 }
 
 sub EmailUserSelect (%) {
   require "Sorts.pm";
   my (%Params) = @_;
-  
+
   my $Disabled = $Params{-disabled}  || "0";
-  my @Defaults = @{$Params{-default}}; 
+  my @Defaults = @{$Params{-default}};
 
   my %Options = ();
   if ($Disabled) {
     $Options{-disabled} = "disabled";
-  }  
-  
+  }
+
   my @EmailUserIDs = &GetEmailUserIDs;
   foreach my $EmailUserID (@EmailUserIDs) {
-    &FetchEmailUser($EmailUserID);  
+    &FetchEmailUser($EmailUserID);
     $EmailUserLabels{$EmailUserID} = $EmailUser{$EmailUserID}{Username};
-  }  
-  
-  @EmailUserIDs = sort EmailUserIDsByName @EmailUserIDs;
-  
-  print FormElementTitle(-helplink => "emailuser", -helptext => "Username"); 
-  print $query -> scrolling_list(-name   => 'emailuserid', 
-                                 -values => \@EmailUserIDs, 
-                                 -labels => \%EmailUserLabels, 
-                                 -size   => 10, -default => \@Defaults, 
+  }
+
+  @EmailUserIDs = sort EmailUserIDsByUsername @EmailUserIDs;
+
+  print FormElementTitle(-helplink => "emailuser", -helptext => "Username");
+  print $query -> scrolling_list(-name   => 'emailuserid',
+                                 -values => \@EmailUserIDs,
+                                 -labels => \%EmailUserLabels,
+                                 -size   => 10, -default => \@Defaults,
                                  %Options);
 
 }
-  
+
 1;
diff --git a/DocDB/cgi/MeetingHTML.pm b/DocDB/cgi/MeetingHTML.pm
index 5c1c8cbf..86da2198 100644
--- a/DocDB/cgi/MeetingHTML.pm
+++ b/DocDB/cgi/MeetingHTML.pm
@@ -202,12 +202,11 @@ sub SessionEntryForm (%) {
 
     print "<td rowspan=\"2\">";
     if ($OffsetDays) {  # We are copying, not modifiying the original
-      $query -> param('meetingorderid',"n$SessionOrder"); #FIXME: Try to remove
-      print $query -> hidden(-name => 'meetingorderid', -default => "n$SessionOrder");
-    } else {
-      $query -> param('meetingorderid',$MeetingOrderID); #FIXME: Try to remove
-      print $query -> hidden(-name => 'meetingorderid', -default => $MeetingOrderID);
+      $MeetingOrderID = "n$SessionOrder";
     }
+    $query -> param('meetingorderid',$MeetingOrderID); #FIXME: Try to remove
+    print $query -> hidden(-name => 'meetingorderid', -default => $MeetingOrderID);
+
     SessionOrder();                     print "<br/>\n";
     SessionModifyLink($MeetingOrderID); print "<br/>\n";
     SessionDelete($MeetingOrderID);     print "<br/>\n";
@@ -277,6 +276,7 @@ sub SessionSeparator ($) {
 
   if ($SessionSeparatorDefault eq "Yes") {
     print "Break\n";
+    print $query -> hidden(-name => "sessionseparator", -default => "$MeetingOrderID");
   } elsif ($SessionSeparatorDefault eq "No") {
     print "\n";
   } else {
@@ -455,7 +455,7 @@ sub PrintSession (%) {
   if (@SessionOrderIDs) {
     my %FieldListOptions = (-default => "Event Agenda", -eventid => $EventID, -eventgroupid => $EventGroupID);
     my %FieldList = PrepareFieldList(%FieldListOptions);
-    DocumentTable(-sessionorderids => \@SessionOrderIDs, -fieldlist => \%FieldList);
+    DocumentTable(-sessionorderids => \@SessionOrderIDs, -fieldlist => \%FieldList, -skipversions => $TRUE);
   } else {
     if ($OnlyTalks) {
       print "<strong>No agenda yet</strong>\n";
diff --git a/DocDB/cgi/ProcessDocumentAdd b/DocDB/cgi/ProcessDocumentAdd
index 9ec2f704..07230025 100755
--- a/DocDB/cgi/ProcessDocumentAdd
+++ b/DocDB/cgi/ProcessDocumentAdd
@@ -2,12 +2,13 @@
 #
 #        Name: $RCSfile$
 # Description: Receives the output of DocumentAddForm and creates or updates the document
+#
 #    Revision: $Revision$
 #    Modified: $Author$ on $Date$
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
@@ -223,6 +224,12 @@ unless ($params{title}) {
   push @ErrorStack,"You must supply a title for this document.";
 }
 
+if ($mode eq "update" || $mode eq "updatedb") {
+  if ($Preferences{Options}{Update}{RequireNote} && !$RevisionNote) {
+    push @ErrorStack,"You must supply a note when updating this document.";
+  }
+}
+
 if (@JournalIDs || @Volumes || @Pages) {
   my @TestJournalIDs = @JournalIDs;
   my @TestVolumes    = @Volumes;
diff --git a/DocDB/cgi/RevisionHTML.pm b/DocDB/cgi/RevisionHTML.pm
index 282c51bc..692f7c59 100644
--- a/DocDB/cgi/RevisionHTML.pm
+++ b/DocDB/cgi/RevisionHTML.pm
@@ -1,12 +1,12 @@
 #        Name: $RCSfile$
-# Description: 
+# Description:
+#
 #    Revision: $Revision$
 #    Modified: $Author$ on $Date$
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
@@ -60,6 +60,7 @@ sub RevisionNoteBox {
   my (%Params) = @_;
   my $Default  = $Params{-default}  || "";
   my $JSInsert = $Params{-jsinsert} || "";
+  my $Required = $Params{-required} || 0;
   print "<a name=\"RevisionNote\" />";
 
   my $ExtraText = "";
diff --git a/DocDB/cgi/Sorts.pm b/DocDB/cgi/Sorts.pm
index 7c886b17..3657a727 100644
--- a/DocDB/cgi/Sorts.pm
+++ b/DocDB/cgi/Sorts.pm
@@ -7,7 +7,7 @@
 #
 # Author Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
@@ -414,6 +414,16 @@ sub EmailUserIDsByName {
   $afirst cmp $bfirst;
 }
 
+sub EmailUserIDsByUsername {
+  my $an = $EmailUser{$a}{Username};
+  my $bn = $EmailUser{$b}{Username};
+
+  $an  =~ tr/[A-Z]/[a-z]/;
+  $bn  =~ tr/[A-Z]/[a-z]/;
+
+  $an cmp $bn;
+}
+
 sub EventsByDate { # Do sort by date
   my $adate = $Conferences{$a}{StartDate};
   my $bdate = $Conferences{$b}{StartDate};
diff --git a/DocDB/doc/CHANGES b/DocDB/doc/CHANGES
index 2ca92dde..83f7ec48 100644
--- a/DocDB/doc/CHANGES
+++ b/DocDB/doc/CHANGES
@@ -1,3 +1,9 @@
+8.7.14
+ Don't put versions on files in meeting display mode
+ Fix issue where "Schedule Similar" mixed data between sessions
+ Sort list of personal accounts
+ Add options (see DocDBGlobals) for additional requirements on updated docs
+
 8.7.13
  Fix an old bug where authors were essentially unsorted. Only did the right
  thing by accident.

From d2b1083392a66910996e9ac144a5a347c1319e15 Mon Sep 17 00:00:00 2001
From: vondo <>
Date: Fri, 13 Jan 2012 22:08:42 +0000
Subject: [PATCH 016/163] Merge in cd_1111 changes

---
 DocDB/cgi/AddFiles                |  5 +-
 DocDB/cgi/CalendarHTML.pm         |  2 +-
 DocDB/cgi/CertificateUtilities.pm | 52 +++++++++----------
 DocDB/cgi/Defaults.pm             | 40 +++++++--------
 DocDB/cgi/DocDBGlobals.pm         |  2 +
 DocDB/cgi/DocDBVersion.pm         |  4 +-
 DocDB/cgi/FileUtilities.pm        | 15 ++++--
 DocDB/cgi/GeneralInstructions.pm  | 85 ++++++++++++++++++++++---------
 DocDB/cgi/MeetingModify           |  5 +-
 DocDB/cgi/ProcessDocumentAdd      |  9 +++-
 DocDB/cgi/RetrieveArchive         | 11 ++--
 DocDB/cgi/SQLUtilities.pm         |  4 +-
 DocDB/cgi/Search                  |  5 +-
 DocDB/cgi/SelectPrefs             |  4 +-
 DocDB/cgi/SessionModify           |  5 +-
 DocDB/cgi/ShowCalendar            |  2 +-
 DocDB/cgi/UserAccessApply         | 38 +++++++-------
 DocDB/cgi/XMLUpload               |  5 +-
 DocDB/doc/CHANGES                 |  8 +++
 19 files changed, 188 insertions(+), 113 deletions(-)

diff --git a/DocDB/cgi/AddFiles b/DocDB/cgi/AddFiles
index 9d4e17d6..3715971a 100755
--- a/DocDB/cgi/AddFiles
+++ b/DocDB/cgi/AddFiles
@@ -8,7 +8,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified:
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
@@ -62,6 +62,9 @@ $dbh   = DBI -> connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rwuser,$db_rwpass
 ### Set up, give user initial information
 
 %params = $query -> Vars;
+foreach my $Keyword (keys %params) {
+  $params{$Keyword} = CGI::escapeHTML($params{$Keyword});
+}
 
 print $query -> header( -charset => $HTTP_ENCODING );
 &DocDBHeader("$Project File Addition Results","File Addition Results");
diff --git a/DocDB/cgi/CalendarHTML.pm b/DocDB/cgi/CalendarHTML.pm
index a0e84444..25a78da7 100644
--- a/DocDB/cgi/CalendarHTML.pm
+++ b/DocDB/cgi/CalendarHTML.pm
@@ -70,7 +70,7 @@ sub PrintCalendar {
   my $DaysInMonth = DateTime -> last_day_of_month(year => $Year, month => $Month) -> day();
   my $FirstDay    = DateTime -> new(year => $Year, month => $Month, day => 1);
   my $MonthName   = $FirstDay -> month_name();
-  my $Today       = DateTime ->today(time_zone => 'local');
+  my $Today       = DateTime ->today(time_zone => $LocalTimezone);
 
   my $Class = "ByMonth";
   if ($Type eq "year") {
diff --git a/DocDB/cgi/CertificateUtilities.pm b/DocDB/cgi/CertificateUtilities.pm
index b343ff5a..f68e8843 100644
--- a/DocDB/cgi/CertificateUtilities.pm
+++ b/DocDB/cgi/CertificateUtilities.pm
@@ -1,14 +1,14 @@
-# Description: Various routines to deal with certificates 
+# Description: Various routines to deal with certificates
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified: 
+#    Modified:
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -21,15 +21,15 @@
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
 sub FetchSecurityGroupsByCert (%) {
-  require "SecuritySQL.pm"; 
+  require "SecuritySQL.pm";
   my %Params = @_;
   my $EmailUserID  = FetchEmailUserIDByCert(%Params);
   if ($EmailUser{$EmailUserID}{Verified} != 1) {
     push @DebugStack,"User is not verified";
-    push @WarnStack,"You have a valid certificate, but have are not yet allowed to access to DocDB. 
+    push @WarnStack,"You have a valid certificate, but are not yet allowed to access to DocDB.
                    <a href=\"$CertificateApplyForm\">Apply for access.</a>";
     return;
-  }  
+  }
   my @UserGroupIDs = FetchUserGroupIDs($EmailUserID);
   return @UserGroupIDs;
 }
@@ -38,15 +38,15 @@ sub FetchEmailUserIDByCert (%) {
   my %Params = @_;
 
   my $IgnoreVerification = $Params{-ignoreverification};
- 
-  require "SecuritySQL.pm"; 
-  require "NotificationSQL.pm"; 
+
+  require "SecuritySQL.pm";
+  require "NotificationSQL.pm";
 
   my $CertEmail = $ENV{SSL_CLIENT_S_DN_Email};
   my $CertCN    = $ENV{SSL_CLIENT_S_DN_CN};
 
-  $CertificateCN    = $CertCN; 
-  $CertificateEmail = $CertEmail; 
+  $CertificateCN    = $CertCN;
+  $CertificateEmail = $CertEmail;
 
   push @DebugStack,"Finding EmailUserID by certificate $CertCN";
 
@@ -56,19 +56,19 @@ sub FetchEmailUserIDByCert (%) {
   if ($IgnoreVerification) {
     $EmailUserSelect = $dbh->prepare("select EmailUserID from EmailUser ".
                                      "where Name=?");
-  } else {                                   
+  } else {
     $EmailUserSelect = $dbh->prepare("select EmailUserID from EmailUser ".
                                      "where Verified=1 and Name=?");
   }
   $EmailUserSelect -> execute($CertCN);
 
-  my ($EmailUserID) = $EmailUserSelect -> fetchrow_array; 
+  my ($EmailUserID) = $EmailUserSelect -> fetchrow_array;
   push @DebugStack,"Found e-mail user: $EmailUserID";
 
   if ($EmailUserID) {
     FetchEmailUser($EmailUserID)
   }
-  
+
   return $EmailUserID;
 }
 
@@ -83,37 +83,37 @@ sub CertificateStatus () {
   # nocert     --  no certificate was presented (not sure if this can work)
 
   my $CertificateStatus = "";
- 
+
   my $CertEmail = $ENV{SSL_CLIENT_S_DN_Email};
   my $CertCN    = $ENV{SSL_CLIENT_S_DN_CN};
-  
+
   push @DebugStack,"Finding Status by certificate";
-  
+
   unless ($CertCN) {
     $CertificateStatus = "nocert";
     push @DebugStack,"Certificate Status: $CertificateStatus";
     return $CertificateStatus;
-  } 
-    
+  }
+
   my $EmailUserSelect;
   $EmailUserSelect = $dbh->prepare("select EmailUserID,Verified from EmailUser ".
                                      "where Name=?");
   $EmailUserSelect -> execute($CertCN);
-  my ($EmailUserID,$Verified) = $EmailUserSelect -> fetchrow_array; 
+  my ($EmailUserID,$Verified) = $EmailUserSelect -> fetchrow_array;
   push @DebugStack,"Checking user $CertCN by CN";
-  
+
   if ($Verified) {
     $CertificateStatus = "verified";
     push @DebugStack,"Certificate Status: $CertificateStatus";
     return $CertificateStatus;
-  } 
-  
+  }
+
   if ($EmailUserID) {
     $CertificateStatus = "unverified";
     push @DebugStack,"Certificate Status: $CertificateStatus";
     return $CertificateStatus;
-  } 
-  
+  }
+
   $CertificateStatus = "noapp";
   push @DebugStack,"Certificate Status: $CertificateStatus";
   return $CertificateStatus;
diff --git a/DocDB/cgi/Defaults.pm b/DocDB/cgi/Defaults.pm
index 5a4f89e6..55aaddba 100644
--- a/DocDB/cgi/Defaults.pm
+++ b/DocDB/cgi/Defaults.pm
@@ -4,20 +4,20 @@
 #    (in that order)
 #
 #  Functions in this file:
-#    
+#
 #    SetAuthorMode:    Selectable list or free-form text field
-#    SetTopicMode:     Single or multiple selectable lists 
+#    SetTopicMode:     Single or multiple selectable lists
 #    SetUploadMethod:  File upload or HTTP fetch
-#    SetDateOverride:  Allows over-riding modification date  
-#    SetAuthorDefault: Sets Author and Requester defaults to cookie value
+#    SetDateOverride:  Allows over-riding modification date
+#    SetAuthorDefault: Sets Author and Submitter defaults to cookie value
 #    SetFileOptions:   Sets archive mode and number of uploads
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -35,7 +35,7 @@ sub SetAuthorMode {
     $AuthorMode = $params{authormode};
   } else {
     $AuthorMode = $AuthorModePref;
-  }    
+  }
   if ($AuthorMode ne "list" && $AuthorMode ne "field") {
     $AuthorMode = "list";
   }
@@ -49,7 +49,7 @@ sub SetTopicMode {
   }
   if ($TopicMode ne "single" && $TopicMode ne "multi") {
     $TopicMode = "multi";
-  }  
+  }
 }
 
 sub SetUploadMethod {
@@ -57,10 +57,10 @@ sub SetUploadMethod {
     $Upload = $params{upload};
   } else {
     $Upload = $UploadMethodPref;
-  }  
+  }
   if ($Upload ne "http" && $Upload ne "file") {
     $Upload = "file";
-  }  
+  }
 }
 
 sub SetDateOverride {
@@ -68,7 +68,7 @@ sub SetDateOverride {
     $Overdate = $params{overdate};
   } else {
     $Overdate = $DateOverridePref;
-  }  
+  }
 }
 
 sub SetFileOptions {
@@ -78,26 +78,26 @@ sub SetFileOptions {
     $Archive = $params{archive};
   } else {
     $Archive = $UploadTypePref
-  }  
+  }
 
   if ($Archive eq "single") {$NumberUploads = 3;}  # Make sure
   if ($Archive eq "multi")  {$Archive = "single";} # No real difference
   if ($Archive ne "archive" && $Archive ne "single") {
     $Archive = "single";
-  }  
-  
+  }
+
   if ($params{numfile}) {               # User has selected
     $NumberUploads = $params{numfile};
   } elsif ($NumFilesPref && $mode ne "update") {             # User has a pref
     if ($Meeting  || $OtherMeeting) {
       if ($NumFilesPref < 3) {
         $NumberUploads = 3;
-      } else {   
+      } else {
         $NumberUploads = $NumFilesPref;
-      }  
-    } else {  
+      }
+    } else {
       $NumberUploads = $NumFilesPref;
-    }   
+    }
   } else {                              # No selection, no pref
     if ($Meeting  || $OtherMeeting) {
       $NumberUploads = 3;
@@ -106,10 +106,10 @@ sub SetFileOptions {
       $NumberUploads = @DocFiles; # FIXME: One line with scalar
       unless ($NumberUploads) { # Gyrations to handle docs that have 0 files
         $NumberUploads = 3;
-      }  
+      }
     } else {
       $NumberUploads = 3;
-    }  
+    }
   }
 }
 
diff --git a/DocDB/cgi/DocDBGlobals.pm b/DocDB/cgi/DocDBGlobals.pm
index db83aab6..98821844 100644
--- a/DocDB/cgi/DocDBGlobals.pm
+++ b/DocDB/cgi/DocDBGlobals.pm
@@ -26,6 +26,8 @@
 
 # Constants
 
+use DateTime;
+$LocalTimezone = DateTime::TimeZone->new(name => 'local');
 $TRUE  = 1;
 $FALSE = 0;
 
diff --git a/DocDB/cgi/DocDBVersion.pm b/DocDB/cgi/DocDBVersion.pm
index fb14b645..f49a10a2 100644
--- a/DocDB/cgi/DocDBVersion.pm
+++ b/DocDB/cgi/DocDBVersion.pm
@@ -3,7 +3,7 @@
 #    Revision: $Revision$
 #    Modified: $Author$ on $Date$
 #
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
@@ -20,6 +20,6 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-$DocDBVersion = "8.7.14";
+$DocDBVersion = "8.7.15";
 
 1;
diff --git a/DocDB/cgi/FileUtilities.pm b/DocDB/cgi/FileUtilities.pm
index edc9278c..df1c1ec1 100644
--- a/DocDB/cgi/FileUtilities.pm
+++ b/DocDB/cgi/FileUtilities.pm
@@ -1,5 +1,5 @@
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
@@ -196,12 +196,13 @@ sub StreamFile (%) {
 
     my @Parts = split /\//,$File;
     my $ShortFile = pop @Parts;
-    select STDOUT;
-    $| = 1;
     print "Content-Type: $MimeType\n", # Print header
           "Content-Disposition: filename=\"$ShortFile\"\n",
           "Content-Length: $Size\n\n";
 
+    select STDOUT;
+    $| = 1;
+
     open OUT, "<$File" or die "Cannot open File\n";
     binmode OUT if -B $File;
     my $BlockSize = (stat OUT)[11] || 16384;
@@ -210,11 +211,15 @@ sub StreamFile (%) {
       next unless defined $Length;
 
       my $Offset = 0;
-      while ($Length) {
-        my $Written = syswrite STDOUT, $Buffer, $Length, $Offset;
+      my $Written= 1;
+      while ($Length && $Written > 0) {
+        print STDOUT $Buffer;
+        $Written = $Length;
+        last unless defined($Written);
         $Length -= $Written;
         $Offset += $Written;
       }
+      last unless defined($Written);
     }
     close OUT;
   } else {
diff --git a/DocDB/cgi/GeneralInstructions.pm b/DocDB/cgi/GeneralInstructions.pm
index 11a53f10..837a3344 100644
--- a/DocDB/cgi/GeneralInstructions.pm
+++ b/DocDB/cgi/GeneralInstructions.pm
@@ -6,7 +6,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified:
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
 #    Additional Text: Marcia Teckenbrock
 
 #    This file is part of DocDB.
@@ -335,7 +335,7 @@ HTML
   When <strong>reserving</strong> a document, you must supply:</p>
   <ul>
    <li>A title </li>
-   <li>A requester (who is requesting the document?)</li>
+   <li>A submitter (who is requesting or uoloading the document?)</li>
    <li>A document type (talk, note, etc.)</li>
   </ul>
 
@@ -475,7 +475,7 @@ HTML
   forms to your liking and to save some typing by telling the database who you
   are. </p>
 
-  <p>Once the database knows who you are, your name will be pre-selected as the requester and
+  <p>Once the database knows who you are, your name will be pre-selected as the submitter and
   author of new documents. You can, of course, change this setting to enter
   documents by people other than (or in addition to) yourself.</p>
 
@@ -504,7 +504,7 @@ HTML
   if ($UseSignoffs) {
    print "<a name=\"signoff\" /><h1>Document Signoffs</h1>\n";
 
-   print "<p>An optional component of DocDB is to allow some documents to be <q>signed</q>
+   print "<p>An optional component of DocDB is to allow some documents to be <q>signed</q> or <q>approved</q>
    by a group of people before becoming <q>approved.</q> People with <strong>Personal
    Accounts</strong> can sign documents. The list of people needing to approve a
    document is editable by the same groups that can edit the document itself.</p>
@@ -512,21 +512,13 @@ HTML
    To <q>freeze</q> a document and its meta-information such that only
    <q>managers</q> can modify it or unfreeze it, ask the
    <a href=\"mailto:$DBWebMasterEmail\">DocDB
-   administrators</a> for the procedure.</p>\n";
+   administrators</a> for the procedure. The administrators can also add or subtract from the list of possible approvers.</p>\n";
 
    print "<p>When displaying document version(s) in a list, there are obvious indications of
   which documents are approved, which are unapproved, and which are obsolete
-  (even if they were approved at some time). All information about who <q>signed</q>'
+  (even if they were approved at some time). All information about who <q>signed</q>
   each version of each document is kept.</p>\n";
 
-   print "<p>DocDB contains the ability to allow any number of approval <q>topologies.</q>
-  For instance, person A or person B might be allowed to sign at the first step,
-  followed by person C at the second step. Or, person A and person B may both have to
-  sign (but in parallel) before person C can sign. However, the current DocDB code only
-  allows one topology (an ordered list). When a document under control is
-  updated, the signoff list structure is preserved, but the approvals themselves
-  are cleared.</p>\n";
-
    print "<p>The signoff system provides a number of additional convieniences:</p>
   <ul>
     <li>Email notifications to signatories when a document is ready for their
@@ -535,16 +527,61 @@ HTML
     <li>List of all documents a person is a signatory (actual or requested) on</li>
   </ul>\n";
 
-   print "<p>A number of other features are planned and will be added as needed:</p>
-  <ul>
-    <li>Email reports of outstanding signatures needed (to desired signatory and
-      other signatories of documents)</li>
-    <li>More complicated approval topolgies (OR's, parallel paths, etc.)</li>
-    <li>Reminders if a document goes unsigned for a while</li>
-    <li>Restricting the list of people who may sign documents to a sub-set of those with
-    personal accounts</li>
-  </ul>\n";
-  }
+   print <<HTML;
+
+   <p>How signature lists work varies a bit based on the action you are taking with a document.</p>
+   <h2>New Documents</h2>
+
+    <p>On the new document page is a box labeled <q>Signoffs</q>.
+    There is also a link (<q>Signoff Chooser</q>) to the list of all people that have
+    been enabled to be approvers for DocDB.</p>
+
+    <p>If the submitter chooses to enable signoffs for a document, click the
+    <q>Signoff Chooser</q>
+    link and pick one or more individuals to approve the document.  You can
+    do this by selecting the names on the pop-up window in the order in which
+    the approvals should occur.  Approvers will be sent e-mail in that order.</p>
+
+    <p>The status of the document will be <q>Unapproved</q> until signoffs are
+    completed.  The list of selected approvers is at the bottom of the DocDB
+    page for the document, and includes the status of the signoff process.</p>
+
+
+   <h2>Updating Documents</h2>
+
+    <p>When updating a document, you are allowed to change the approvers required,
+    including
+    removing all approvers.  Then update the document as needed and any signoffs
+    will be
+    handled as for new documents. All necessary approvals are set to unapproved
+    for the new version of the document.</p>
+
+
+   <h2>Updating Metadata</h2>
+    <p>When updating metadata, you are allowed to change the approvers required,
+    including
+    removing all approvers.  Then update the metadata as needed. All necessary approvals are set to unapproved
+    for the document.</p>
+
+
+
+    <h2>Adding Files to a Document</h2>
+    <p>Adding a file does not allow any changes to the list of approvers.
+    All necessary approvals are set to unapproved
+    for the document.</p>
+
+
+    <h2>Approvers</h2>
+    <p>Approvers will receive an e-mail requesting they sign the document. A URL
+    of the document page
+    is included in the e-mail. This document page contains a button to press
+    (and possibly a password to enter) next
+    to the name of the approver.  Once all approvers have signed the document, the status
+    will change to <q>Approved</q>.</p>
+
+HTML
+
+}
 
   print <<HTML;
 
diff --git a/DocDB/cgi/MeetingModify b/DocDB/cgi/MeetingModify
index 28722c24..55e335bd 100755
--- a/DocDB/cgi/MeetingModify
+++ b/DocDB/cgi/MeetingModify
@@ -7,7 +7,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
@@ -49,6 +49,9 @@ require "WebUtilities.pm";
 $query = new CGI;  # Global for subroutines
 
 %params = $query -> Vars;
+foreach my $Keyword (keys %params) {
+  $params{$Keyword} = CGI::escapeHTML($params{$Keyword});
+}
 $query -> delete_all(); # Stop program from caching variable from script to script
 
 my $Mode               = $params{mode};
diff --git a/DocDB/cgi/ProcessDocumentAdd b/DocDB/cgi/ProcessDocumentAdd
index 07230025..19a61702 100755
--- a/DocDB/cgi/ProcessDocumentAdd
+++ b/DocDB/cgi/ProcessDocumentAdd
@@ -71,6 +71,9 @@ GetSecurityGroups();
 ### Set up, give user initial information
 
 %params = $query -> Vars;
+foreach my $Keyword (keys %params) {
+  $params{$Keyword} = CGI::escapeHTML($params{$Keyword});
+}
 $mode = $params{mode}; #FIXME: Remove
 $Mode = $params{mode};
 
@@ -218,7 +221,7 @@ if ($PreserveSigs && $mode ne "updatedb") {
   push @ErrorStack,'Signatures may only be preserved when modifying document meta-data.';
 }
 unless ($params{requester}) {
-  push @ErrorStack,"You must supply a requester for this document.";
+  push @ErrorStack,"You must supply a submitter for this document.";
 }
 unless ($params{title}) {
   push @ErrorStack,"You must supply a title for this document.";
@@ -341,6 +344,10 @@ if ($#securities > 0) {
   }
 }
 
+if ($#securities < 0) {
+  @securities = FindUsersGroups();
+}
+
 my $ViewCheck = "create"; # Create/view are the same, check for more restrictive
 if ($EnhancedSecurity) {
   $ViewCheck = "view";
diff --git a/DocDB/cgi/RetrieveArchive b/DocDB/cgi/RetrieveArchive
index 482bb784..af4b9e40 100755
--- a/DocDB/cgi/RetrieveArchive
+++ b/DocDB/cgi/RetrieveArchive
@@ -7,7 +7,7 @@
 #    Modified:
 #
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
@@ -103,14 +103,14 @@ unless (@ErrorStack) {
 
   if ($Type eq "tar.gz") {
     if ($GTar) {
-      $Status = system("$GTar czf $TmpFile -C $Directory .");
+      $Status = system("$GTar czf $TmpFile --exclude='.htaccess' -C $Directory .");
     } elsif ($Tar && $GZip) {
-      $Status = system("$Tar cf - $Directory | $GZip > $TmpFile");
+      $Status = system("$Tar cf - --exclude='.htaccess' $Directory | $GZip > $TmpFile");
     }
   } elsif ($Type eq "tar") {
-    $Status = system("$Tar cf $TmpFile $Directory");
+    $Status = system("$Tar cf --exclude='.htaccess' $TmpFile $Directory");
   } elsif ($Type eq "zip") {
-    $Status = system("$Zip $TmpFile $Directory/*");
+    $Status = system("$Zip $TmpFile --exclude .htaccess $Directory/*");
   }
   if ($Status) {
     push @ErrorStack,"There was a problem creating the archive. Please contact an administrator.";
@@ -126,5 +126,6 @@ if (@ErrorStack || @WarnStack) { # There was a problem. Warn the user.
   DocDBFooter($DBWebMasterEmail,$DBWebMasterName);
 } else {
   StreamFile(-file => $TmpFile);
+  unlink($TmpFile);
 }
 
diff --git a/DocDB/cgi/SQLUtilities.pm b/DocDB/cgi/SQLUtilities.pm
index 63968bbe..987ae8dd 100644
--- a/DocDB/cgi/SQLUtilities.pm
+++ b/DocDB/cgi/SQLUtilities.pm
@@ -96,7 +96,7 @@ sub ConvertToDateTime {
     }
     $DateTime = DateTime -> new(year => $Year, month  => $Month,  day => $Day,
                                 hour => $Hour, minute => $Min, second => $Sec,
-                                time_zone => 'local');
+                                time_zone => $LocalTimezone);
   } elsif ($OldTimeStamp) {
     my $Year  = substr  $OldTimeStamp,0,4;
     my $Month = substr  $OldTimeStamp,4,2;
@@ -106,7 +106,7 @@ sub ConvertToDateTime {
     my $Sec   = substr  $OldTimeStamp,12,2;
     $DateTime = DateTime -> new(year => $Year, month  => $Month,  day => $Day,
                                 hour => $Hour, minute => $Min, second => $Sec,
-                                time_zone => 'local');
+                                time_zone => $LocalTimezone);
   }
 
   return $DateTime;
diff --git a/DocDB/cgi/Search b/DocDB/cgi/Search
index 1ad17129..4778ba0a 100755
--- a/DocDB/cgi/Search
+++ b/DocDB/cgi/Search
@@ -8,7 +8,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
@@ -40,6 +40,9 @@ $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 ### Set up, give user initial information
 
 my %CGIParams = $query -> Vars;
+foreach my $Keyword (keys %CGIParams) {
+  $CGIParams{$Keyword} = CGI::escapeHTML($CGIParams{$Keyword});
+}
 
 ### Pull info out of params into local variables
 
diff --git a/DocDB/cgi/SelectPrefs b/DocDB/cgi/SelectPrefs
index 6b58fd06..979b0293 100755
--- a/DocDB/cgi/SelectPrefs
+++ b/DocDB/cgi/SelectPrefs
@@ -3,12 +3,12 @@
 # Author:  Adam Bryant
 #
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
diff --git a/DocDB/cgi/SessionModify b/DocDB/cgi/SessionModify
index c3daad42..1f0ecb47 100755
--- a/DocDB/cgi/SessionModify
+++ b/DocDB/cgi/SessionModify
@@ -8,7 +8,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
@@ -62,6 +62,9 @@ $query = new CGI;  # Global for subroutines
 ### Gather parameters
 
 %params = $query -> Vars;
+foreach my $Keyword (keys %params) {
+  $params{$Keyword} = CGI::escapeHTML($params{$Keyword});
+}
 $query -> delete_all(); # Stop program from caching variable from script to script
 
 my $SessionID          = $params{sessionid};
diff --git a/DocDB/cgi/ShowCalendar b/DocDB/cgi/ShowCalendar
index dd0b6acf..cddaa748 100755
--- a/DocDB/cgi/ShowCalendar
+++ b/DocDB/cgi/ShowCalendar
@@ -69,7 +69,7 @@ my $WindowStart;
 my $WindowEnd;
 my $WindowDays;
 my $EventTableStart;
-my $Today = DateTime -> now(time_zone => 'local');
+my $Today = DateTime -> now(time_zone => $LocalTimezone);
 
 push @DebugStack, "Today is ".$Today -> iso8601;
 
diff --git a/DocDB/cgi/UserAccessApply b/DocDB/cgi/UserAccessApply
index 845af869..a8a9eb9b 100755
--- a/DocDB/cgi/UserAccessApply
+++ b/DocDB/cgi/UserAccessApply
@@ -2,12 +2,12 @@
 #
 # Author Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -51,12 +51,12 @@ EndPage();
 my $CertificateStatus = &CertificateStatus();
 my $CertEmail = $params{email};
 
-unless ($CertEmail) { 
+unless ($CertEmail) {
   push @ErrorStack,"You must supply an e-mail address.";
 }
 
 EndPage();
-    
+
 my $CertCN    = $ENV{SSL_CLIENT_S_DN_CN};
 
 if ($CertificateStatus eq "verified") {
@@ -71,15 +71,15 @@ if ($CertificateStatus eq "verified") {
     }
   } else {
     print "<li>None: Contact an adminstrator if this is incorrect</li>\n";
-  }       
+  }
   print "</ul>\n";
-} elsif ($CertificateStatus eq "unverified") {  
+} elsif ($CertificateStatus eq "unverified") {
   print "<b>You have already applied for access to documents. A new request has not been generated.
          If you believe your request has been misplaced or neglected, contact an administator.</b>";
   print "The following information may be helpful:<br>\n";
   print "<b>Certificate Common Name (CN):</b> $CertCN<br>\n";
   print "<b>Certificate E-mail Address:</b> $CertEmail<br>\n";
-} elsif ($CertificateStatus eq "mismatch") {  
+} elsif ($CertificateStatus eq "mismatch") {
   print "<b>Your certificate is valid but a similar certificate already exists
          for  either your e-mail address or your name (CN). Only one
          certificate is allowed per person. Contact an administrator if you
@@ -87,8 +87,8 @@ if ($CertificateStatus eq "verified") {
   print "The following information may be helpful:<br>\n";
   print "<b>Certificate Common Name (CN):</b> $CertCN<br>\n";
   print "<b>Certificate E-mail Address:</b> $CertEmail<br>\n";
-} elsif ($CertificateStatus eq "nocert") {  
-  print "<b>You didn't present a certificate. Make sure your browser is supplying one and contact an administrator if are supplying one.</b>";
+} elsif ($CertificateStatus eq "nocert") {
+  print "<b>You didn't present a certificate. Make sure your browser is supplying one and contact an administrator if you are supplying one.</b>";
 } elsif ($CertificateStatus eq "noapp") {
 
 ### Get additional parameters
@@ -97,7 +97,7 @@ if ($CertificateStatus eq "verified") {
   my @RequestedGroupIDs = split /\0/,$params{reqgroups};
   my $UserName = $CertCN;
      $UserName =~ s/\W//g;
-     
+
 ### Fill in DB tables
 
   my $UserInsert = $dbh -> prepare(
@@ -105,17 +105,17 @@ if ($CertificateStatus eq "verified") {
       "            values (0,?,?,?,0,'x')");
      $UserInsert -> execute($UserName,$CertCN,$CertEmail);
   my $EmailUserID = $UserInsert -> {mysql_insertid}; # Works with MySQL only
-  
+
   my $UsersGroupInsert = $dbh -> prepare(
       "insert into UsersGroup (UsersGroupID,EmailUserID,GroupID) ".
       "            values (0,?,?)");
   foreach my $GroupID (@RequestedGroupIDs) {
     $UsersGroupInsert -> execute($EmailUserID,$GroupID);
-  }  
+  }
 
 ### Notify applicant and administrator
 
-  
+
   print "You ($CertCN with e-mail address $CertEmail) have requested ";
   print "access to $Project DocDB. ";
   print "You have requested membership in the following groups:\n";
@@ -123,14 +123,14 @@ if ($CertificateStatus eq "verified") {
   foreach my $GroupID (@RequestedGroupIDs) {
     &FetchSecurityGroup($GroupID);
     print "<li>",$SecurityGroups{$GroupID}{NAME},"</li>\n";
-  }  
+  }
   print "</ul>\n";
 
   if ($MailInstalled) {
     require "EmailUtilities.pm";
-    
+
     print "An e-mail has been sent to the administrators and a confirmation e-mail has been sent to you.<p/>\n";
-    
+
     my @To      = ($DBWebMasterEmail);
     my $Subject = "$CertCN requests access to $Project DocDB";
     my $Body    = "$CertCN with e-mail address $CertEmail has requested ";
@@ -139,7 +139,7 @@ if ($CertificateStatus eq "verified") {
     foreach my $GroupID (@RequestedGroupIDs) {
       &FetchSecurityGroup($GroupID);
       $Body .= "  ".$SecurityGroups{$GroupID}{NAME}."\n";
-    }  
+    }
     $Body .= "\n";
     $Body .= "If this is correct, please visit $EmailAdministerForm, ";
     $Body .= "select \"Modify\", select the user, check \"Verify\", and click to Submit.\n\n";
@@ -147,7 +147,7 @@ if ($CertificateStatus eq "verified") {
     if ($CertNote) {
       $Body .= "The user attached this note to their application:\n";
       $Body .= $CertNote;
-    }  
+    }
     &SendEmail(-body => $Body, -to => \@To, -subject => $Subject);
 
     my @To      = ($CertEmail);
@@ -161,7 +161,7 @@ if ($CertificateStatus eq "verified") {
     $Body      .= "Thank you.";
 
     &SendEmail(-body => $Body, -to => \@To, -subject => $Subject);
-  }    
+  }
 
 }
 
diff --git a/DocDB/cgi/XMLUpload b/DocDB/cgi/XMLUpload
index 5a3875bb..2ff86155 100755
--- a/DocDB/cgi/XMLUpload
+++ b/DocDB/cgi/XMLUpload
@@ -11,7 +11,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
@@ -44,6 +44,9 @@ require "Security.pm";
 my $Twig = XML::Twig -> new();
 $query = new CGI;  # Global for subroutines
 my %CGIParams = $query -> Vars;
+foreach my $Keyword (keys %CGIParams) {
+  $CGIParams{$Keyword} = CGI::escapeHTML($CGIParams{$Keyword});
+}
 CreateConnection(-type => "rw");
 
 my $XMLText = $query -> param("XMLFile");;
diff --git a/DocDB/doc/CHANGES b/DocDB/doc/CHANGES
index 83f7ec48..35315af1 100644
--- a/DocDB/doc/CHANGES
+++ b/DocDB/doc/CHANGES
@@ -1,3 +1,11 @@
+8.7.15
+ Cache timezone name, fix apparent issues with DateTime constructor
+ Fix consistentcy issues between submitter and requester
+ No security by default should default to user's security, not public
+ StreamFile: change to using 'print' instead of 'sysprint' in the StreamFile routine
+ Fix several possible instances of XSS
+ Improved signoff instructions from Eileen Berman
+
 8.7.14
  Don't put versions on files in meeting display mode
  Fix issue where "Schedule Similar" mixed data between sessions

From 705c93107fe7278873f3a225ca497db435476e47 Mon Sep 17 00:00:00 2001
From: vondo <>
Date: Tue, 20 Mar 2012 20:22:31 +0000
Subject: [PATCH 017/163] Fold in cd_1203c

---
 DocDB/cgi/AddFiles           | 5 +----
 DocDB/cgi/DocDBVersion.pm    | 4 ++--
 DocDB/cgi/DocumentAddForm    | 4 ++--
 DocDB/cgi/MeetingModify      | 5 +----
 DocDB/cgi/ProcessDocumentAdd | 5 +----
 DocDB/cgi/RetrieveArchive    | 4 ++--
 DocDB/cgi/Search             | 5 +----
 DocDB/cgi/SessionModify      | 5 +----
 DocDB/cgi/XMLUpload          | 5 +----
 DocDB/doc/CHANGES            | 5 +++++
 10 files changed, 17 insertions(+), 30 deletions(-)

diff --git a/DocDB/cgi/AddFiles b/DocDB/cgi/AddFiles
index 3715971a..1550ff1f 100755
--- a/DocDB/cgi/AddFiles
+++ b/DocDB/cgi/AddFiles
@@ -8,7 +8,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified:
 
-# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2012 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
@@ -62,9 +62,6 @@ $dbh   = DBI -> connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rwuser,$db_rwpass
 ### Set up, give user initial information
 
 %params = $query -> Vars;
-foreach my $Keyword (keys %params) {
-  $params{$Keyword} = CGI::escapeHTML($params{$Keyword});
-}
 
 print $query -> header( -charset => $HTTP_ENCODING );
 &DocDBHeader("$Project File Addition Results","File Addition Results");
diff --git a/DocDB/cgi/DocDBVersion.pm b/DocDB/cgi/DocDBVersion.pm
index f49a10a2..e0eeb61f 100644
--- a/DocDB/cgi/DocDBVersion.pm
+++ b/DocDB/cgi/DocDBVersion.pm
@@ -3,7 +3,7 @@
 #    Revision: $Revision$
 #    Modified: $Author$ on $Date$
 #
-# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2012 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
@@ -20,6 +20,6 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-$DocDBVersion = "8.7.15";
+$DocDBVersion = "8.7.16";
 
 1;
diff --git a/DocDB/cgi/DocumentAddForm b/DocDB/cgi/DocumentAddForm
index b095334e..61c442cf 100755
--- a/DocDB/cgi/DocumentAddForm
+++ b/DocDB/cgi/DocumentAddForm
@@ -8,7 +8,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2012 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
@@ -520,7 +520,7 @@ print "</td></tr>\n";
 
 print "<tr><td colspan=\"4\">\n";
 TextField(-name     => 'xrefs', -size => 40,
-          -default  => $XRefDefault,
+          -default  => $XRefDefault, -maxlength => 2048,
           -helplink => 'xrefentry', -helptext => 'Related Documents');
 print "</td></tr>\n";
 
diff --git a/DocDB/cgi/MeetingModify b/DocDB/cgi/MeetingModify
index 55e335bd..1f611d00 100755
--- a/DocDB/cgi/MeetingModify
+++ b/DocDB/cgi/MeetingModify
@@ -7,7 +7,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2012 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
@@ -49,9 +49,6 @@ require "WebUtilities.pm";
 $query = new CGI;  # Global for subroutines
 
 %params = $query -> Vars;
-foreach my $Keyword (keys %params) {
-  $params{$Keyword} = CGI::escapeHTML($params{$Keyword});
-}
 $query -> delete_all(); # Stop program from caching variable from script to script
 
 my $Mode               = $params{mode};
diff --git a/DocDB/cgi/ProcessDocumentAdd b/DocDB/cgi/ProcessDocumentAdd
index 19a61702..b84aa938 100755
--- a/DocDB/cgi/ProcessDocumentAdd
+++ b/DocDB/cgi/ProcessDocumentAdd
@@ -8,7 +8,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2012 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
@@ -71,9 +71,6 @@ GetSecurityGroups();
 ### Set up, give user initial information
 
 %params = $query -> Vars;
-foreach my $Keyword (keys %params) {
-  $params{$Keyword} = CGI::escapeHTML($params{$Keyword});
-}
 $mode = $params{mode}; #FIXME: Remove
 $Mode = $params{mode};
 
diff --git a/DocDB/cgi/RetrieveArchive b/DocDB/cgi/RetrieveArchive
index af4b9e40..4e3e4712 100755
--- a/DocDB/cgi/RetrieveArchive
+++ b/DocDB/cgi/RetrieveArchive
@@ -7,7 +7,7 @@
 #    Modified:
 #
 
-# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2012 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
@@ -110,7 +110,7 @@ unless (@ErrorStack) {
   } elsif ($Type eq "tar") {
     $Status = system("$Tar cf --exclude='.htaccess' $TmpFile $Directory");
   } elsif ($Type eq "zip") {
-    $Status = system("$Zip $TmpFile --exclude .htaccess $Directory/*");
+    $Status = system("$Zip $TmpFile $Directory/* -x .htaccess ");
   }
   if ($Status) {
     push @ErrorStack,"There was a problem creating the archive. Please contact an administrator.";
diff --git a/DocDB/cgi/Search b/DocDB/cgi/Search
index 4778ba0a..d21eee17 100755
--- a/DocDB/cgi/Search
+++ b/DocDB/cgi/Search
@@ -8,7 +8,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2012 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
@@ -40,9 +40,6 @@ $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 ### Set up, give user initial information
 
 my %CGIParams = $query -> Vars;
-foreach my $Keyword (keys %CGIParams) {
-  $CGIParams{$Keyword} = CGI::escapeHTML($CGIParams{$Keyword});
-}
 
 ### Pull info out of params into local variables
 
diff --git a/DocDB/cgi/SessionModify b/DocDB/cgi/SessionModify
index 1f0ecb47..6dc77f73 100755
--- a/DocDB/cgi/SessionModify
+++ b/DocDB/cgi/SessionModify
@@ -8,7 +8,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2012 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
@@ -62,9 +62,6 @@ $query = new CGI;  # Global for subroutines
 ### Gather parameters
 
 %params = $query -> Vars;
-foreach my $Keyword (keys %params) {
-  $params{$Keyword} = CGI::escapeHTML($params{$Keyword});
-}
 $query -> delete_all(); # Stop program from caching variable from script to script
 
 my $SessionID          = $params{sessionid};
diff --git a/DocDB/cgi/XMLUpload b/DocDB/cgi/XMLUpload
index 2ff86155..8b982014 100755
--- a/DocDB/cgi/XMLUpload
+++ b/DocDB/cgi/XMLUpload
@@ -11,7 +11,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2012 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
@@ -44,9 +44,6 @@ require "Security.pm";
 my $Twig = XML::Twig -> new();
 $query = new CGI;  # Global for subroutines
 my %CGIParams = $query -> Vars;
-foreach my $Keyword (keys %CGIParams) {
-  $CGIParams{$Keyword} = CGI::escapeHTML($CGIParams{$Keyword});
-}
 CreateConnection(-type => "rw");
 
 my $XMLText = $query -> param("XMLFile");;
diff --git a/DocDB/doc/CHANGES b/DocDB/doc/CHANGES
index 35315af1..e77e4f88 100644
--- a/DocDB/doc/CHANGES
+++ b/DocDB/doc/CHANGES
@@ -1,3 +1,8 @@
+8.7.16
+ Fix exclusion list for zip files
+ Increase limit on related documents
+ Back out XSS patches from 8.7.15, need a more robust solution
+
 8.7.15
  Cache timezone name, fix apparent issues with DateTime constructor
  Fix consistentcy issues between submitter and requester

From 48c24e27bc3d71e333e65502ad1a42e9e054d3ed Mon Sep 17 00:00:00 2001
From: vondo <>
Date: Tue, 24 Apr 2012 15:12:57 +0000
Subject: [PATCH 018/163] Don't loose security when updating public docs

---
 DocDB/cgi/DocDBVersion.pm |  2 +-
 DocDB/cgi/DocumentAddForm |  3 +++
 DocDB/doc/CHANGES         |  4 ++++
 DocDB/scripts/Resecure    | 13 ++++++++-----
 4 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/DocDB/cgi/DocDBVersion.pm b/DocDB/cgi/DocDBVersion.pm
index e0eeb61f..f820c80c 100644
--- a/DocDB/cgi/DocDBVersion.pm
+++ b/DocDB/cgi/DocDBVersion.pm
@@ -20,6 +20,6 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-$DocDBVersion = "8.7.16";
+$DocDBVersion = "8.7.17";
 
 1;
diff --git a/DocDB/cgi/DocumentAddForm b/DocDB/cgi/DocumentAddForm
index 61c442cf..27e0bd22 100755
--- a/DocDB/cgi/DocumentAddForm
+++ b/DocDB/cgi/DocumentAddForm
@@ -188,6 +188,9 @@ if ($mode eq "update" || $mode eq "updatedb") { # Need to read in last version v
   $RevisionNoteDefault = $DocRevisions{$DocRevID}{Note};
   $DocTypeIDDefault    = $DocRevisions{$DocRevID}{DocTypeID};
   @SecurityDefaults    = GetRevisionSecurityGroups($DocRevID);
+  unless (@SecurityDefaults) {
+    @SecurityDefaults = (0);	
+  }
   my @AuthorRevIDs     = GetRevisionAuthors($DocRevID);
      @AuthorRevIDs     = sort AuthorRevIDsByOrder @AuthorRevIDs;
   $AuthorListOrdered   = IsAuthorListOrdered({     -authorrevids => \@AuthorRevIDs, });
diff --git a/DocDB/doc/CHANGES b/DocDB/doc/CHANGES
index e77e4f88..d594b9d8 100644
--- a/DocDB/doc/CHANGES
+++ b/DocDB/doc/CHANGES
@@ -1,3 +1,7 @@
+8.7.17
+ Don't loose security when updating public docs
+ Modified Resecure from Laura
+ 
 8.7.16
  Fix exclusion list for zip files
  Increase limit on related documents
diff --git a/DocDB/scripts/Resecure b/DocDB/scripts/Resecure
index 08b9ca71..cac9c0e1 100755
--- a/DocDB/scripts/Resecure
+++ b/DocDB/scripts/Resecure
@@ -86,7 +86,7 @@ if ($Days || $Hours) {
     "from DocumentRevision where Obsolete=0 and DocRevID=?");
   my @AllRevisions = sort numerically keys %AllRevision;
   foreach $RevID (@AllRevisions) {
-    unless ($RevID) {next;}
+    unless (defined ($RevID)) {next;}
     $revision_list -> execute($RevID);
     ($DocRevID,$DocumentID,$VersionNumber) = $revision_list -> fetchrow_array;
     $Revision{$DocRevID}{DocRevID}      = $DocRevID;
@@ -98,7 +98,7 @@ if ($Days || $Hours) {
 my @Revisions = sort numerically keys %Revision;
 
 foreach $RevisionID (@Revisions) {
-  unless ($Revision{$RevisionID}{VersionNumber}) {next;} # No directories for v0 documents
+  #unless ($Revision{$RevisionID}{VersionNumber}) {next;} # No directories for v0 documents
   my $security_list = $dbh -> prepare(
     "select GroupID ".
     "from RevisionSecurity where DocRevID=?");
@@ -114,9 +114,12 @@ foreach $RevisionID (@Revisions) {
   foreach $GroupID (@GroupIDs) {
     print " $GroupID";
   }
-  &ProtectDirectory($Revision{$RevisionID}{DocumentID},
-                    $Revision{$RevisionID}{VersionNumber},
-                    @GroupIDs);
+  my $Directory = &GetDirectory($Revision{$RevisionID}{DocumentID},$Revision{$RevisionID}{VersionNumber});
+  if (-d $Directory) { 
+     &ProtectDirectory($Revision{$RevisionID}{DocumentID},
+                      $Revision{$RevisionID}{VersionNumber},
+                      @GroupIDs);
+  }                    
   print "\n"; 
 }
  

From 2357e72de93962698d0647d1d16c11bf615862ff Mon Sep 17 00:00:00 2001
From: vondo <>
Date: Mon, 28 Jan 2013 17:04:16 +0000
Subject: [PATCH 019/163] Fix spelling of administrator

---
 DocDB/cgi/AdministerElements.pm |  4 +--
 DocDB/cgi/AuthorAddForm         | 14 ++++-----
 DocDB/cgi/CertificateApplyForm  | 26 ++++++++--------
 DocDB/cgi/DeleteConfirm         |  6 ++--
 DocDB/cgi/DeleteDocument        | 32 +++++++++----------
 DocDB/cgi/DocDBInstructions     | 16 +++++-----
 DocDB/cgi/EmailAdminister       | 54 ++++++++++++++++-----------------
 DocDB/cgi/FSUtilities.pm        |  4 +--
 DocDB/cgi/ListKeywords          | 14 ++++-----
 DocDB/cgi/Messages.pm           | 16 +++++-----
 DocDB/cgi/UserAccessApply       |  8 ++---
 11 files changed, 97 insertions(+), 97 deletions(-)

diff --git a/DocDB/cgi/AdministerElements.pm b/DocDB/cgi/AdministerElements.pm
index 2d8eaef1..ab523199 100644
--- a/DocDB/cgi/AdministerElements.pm
+++ b/DocDB/cgi/AdministerElements.pm
@@ -1,5 +1,5 @@
 #        Name: $RCSfile$
-# Description: Various routines which supply input forms for adminstrative
+# Description: Various routines which supply input forms for administrative
 #              functions
 #
 #    Revision: $Revision$
@@ -7,7 +7,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/AuthorAddForm b/DocDB/cgi/AuthorAddForm
index 8ce3eeb8..39eafe51 100755
--- a/DocDB/cgi/AuthorAddForm
+++ b/DocDB/cgi/AuthorAddForm
@@ -3,15 +3,15 @@
 # Description: A simple for to allow new author addition (no changes possible)
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified: 
+#    Modified:
 #
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -24,7 +24,7 @@
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
 
-use CGI qw(-nosticky);                                                                                      
+use CGI qw(-nosticky);
 use DBI;
 
 require "DocDBGlobals.pm";
@@ -50,10 +50,10 @@ print $query -> start_multipart_form('POST',"$AuthorAdd");
 print "<p><strong>You are about to add an author to the $Project document
 database.</strong> Anyone is allowed to add authors. <strong>Please be
 careful</strong> and make sure to put the authors first name, last name, and
-middle initials (with periods) in the right place. If you make a mistake, 
+middle initials (with periods) in the right place. If you make a mistake,
 <span class=\"Warning\">DO NOT</span> enter the author again. Contact an
-<a href=\"mailto:$DBWebMasterEmail\">adminstrator</a> and explain the problem.
-Required fields are denoted by $RequiredMark.  Click any 
+<a href=\"mailto:$DBWebMasterEmail\">administrator</a> and explain the problem.
+Required fields are denoted by $RequiredMark.  Click any
 <span class=\"Help\">highlighted link</span> for quick help.</p>\n";
 
 print "<table class=\"CenteredTable HighPaddedTable\">\n";
diff --git a/DocDB/cgi/CertificateApplyForm b/DocDB/cgi/CertificateApplyForm
index 7d8179de..1425a439 100755
--- a/DocDB/cgi/CertificateApplyForm
+++ b/DocDB/cgi/CertificateApplyForm
@@ -2,12 +2,12 @@
 #
 # Author Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -63,16 +63,16 @@ if ($CertificateStatus eq "verified") {
       print "<li>",$SecurityGroups{$GroupID}{NAME},"</li>\n";
     }
   } else {
-    print "<li><b>None.</b> Contact an adminstrator if this is incorrect</li>\n";
-  }       
+    print "<li><b>None.</b> Contact an administrator if this is incorrect</li>\n";
+  }
   print "</ul>\n";
-} elsif ($CertificateStatus eq "unverified") {  
-  print "<b>Your certificate is valid and you have applied for access to documents. 
+} elsif ($CertificateStatus eq "unverified") {
+  print "<b>Your certificate is valid and you have applied for access to documents.
          If you believe your request has been misplaced or neglected, contact an administator.</b><p/>";
   print "The following information may be helpful:<br>\n";
   print "<b>Certificate Common Name (CN):</b> $CertCN<br/>\n";
   print "<b>Certificate E-mail Address:</b> $CertEmail<br/>\n";
-} elsif ($CertificateStatus eq "mismatch") {  
+} elsif ($CertificateStatus eq "mismatch") {
   print "<b>Your certificate is valid but a similar certificate already exists
          for  either your e-mail address or your name (CN). Only one
          certificate is allowed per person. Contact an administrator if you
@@ -80,14 +80,14 @@ if ($CertificateStatus eq "verified") {
   print "The following information may be helpful:<br/>\n";
   print "<b>Certificate Common Name (CN):</b> $CertCN<br/>\n";
   print "<b>Certificate E-mail Address:</b> $CertEmail<br/>\n";
-} elsif ($CertificateStatus eq "nocert") {  
+} elsif ($CertificateStatus eq "nocert") {
   print "<b>You didn't present a certificate. Make sure your browser is supplying one and contact an administrator if are supplying one.</b><p/>";
 } elsif ($CertificateStatus eq "noapp") {
   require "SecurityHTML.pm";
   require "FormElements.pm";
   print "<p><b>Your certificate is valid but you have never applied for access to
-         documents.<br/>Fill out the form below to apply for access. 
-         Select the groups which you think you belong to from the list. 
+         documents.<br/>Fill out the form below to apply for access.
+         Select the groups which you think you belong to from the list.
          Your selection(s) will be verified by an administrator.</b></p>";
   print "<center>\n";
   print $query -> start_multipart_form('POST',$UserAccessApply);
@@ -104,14 +104,14 @@ if ($CertificateStatus eq "verified") {
   print "<tr>\n";
   print "</td></tr>\n";
   print "<tr><td colspan=\"2\">\n";
-  TextArea(-helplink  => "certnote", -helptext => "Notes", 
+  TextArea(-helplink  => "certnote", -helptext => "Notes",
            -extratext => "(Identify yourself or other notes if needed.)",
-           -name      => "certnote");    
+           -name      => "certnote");
   print "</td></tr>";
   print "<tr><td colspan=2 align=center>\n";
   print $query -> submit (-value => "Apply for access");
   print "</td></tr>";
-  print "</table>\n";       
+  print "</table>\n";
   print "</center>\n";
 }
 
diff --git a/DocDB/cgi/DeleteConfirm b/DocDB/cgi/DeleteConfirm
index 6b7c9c8e..b460031a 100755
--- a/DocDB/cgi/DeleteConfirm
+++ b/DocDB/cgi/DeleteConfirm
@@ -8,7 +8,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
@@ -58,7 +58,7 @@ unless ($DocumentID) {
   push @ErrorStack,"You are must supply a document number to delete.";
 }
 unless (&CanAdminister) {
-  push @ErrorStack,"You must be logged in as the adminstrator to delete
+  push @ErrorStack,"You must be logged in as the administrator to delete
   documents";
 }
 
@@ -80,7 +80,7 @@ unless ($DocRevID) {
 
 EndPage(@ErrorStack);
 
-print "<p><center><b>To delete this document, you must supply the adminstrator
+print "<p><center><b>To delete this document, you must supply the administrator
           username and password:</b>";
 
 print $query -> startform('POST',$DeleteDocument);
diff --git a/DocDB/cgi/DeleteDocument b/DocDB/cgi/DeleteDocument
index 86218712..3dfef2c4 100755
--- a/DocDB/cgi/DeleteDocument
+++ b/DocDB/cgi/DeleteDocument
@@ -1,18 +1,18 @@
 #! /usr/bin/env perl
 #
 # Description: This script is called by DeleteConfirm to actually delete
-#              the requested document, all associated entries in the DB, 
-#              and the actual files as well. 
+#              the requested document, all associated entries in the DB,
+#              and the actual files as well.
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified: 
+#    Modified:
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -50,7 +50,7 @@ $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$Username,$Password);
 
 unless ($dbh) {
   push @ErrorStack,"Unable to connect to the database. Check the password.";
-}         
+}
 
 print $query -> header( -charset => $HTTP_ENCODING );
 &DocDBHeader("Deleting Document $DocumentID");
@@ -59,11 +59,11 @@ EndPage(@ErrorStack);
 
 unless ($DocumentID) {
   push @ErrorStack,"You are must supply a document number to delete.";
-}  
+}
 unless (&CanAdminister) {
-  push @ErrorStack,"You must be logged in as the adminstrator to delete
+  push @ErrorStack,"You must be logged in as the administrator to delete
   documents";
-}  
+}
 
 EndPage(@ErrorStack);
 
@@ -92,10 +92,10 @@ my @Revisions = keys %Revision;
 unless (@Revisions) {
   print "Document $DocumentID does not exist.\n";
   exit;
-}  
-  
-# Delete stuff from files and linking tables  
-  
+}
+
+# Delete stuff from files and linking tables
+
 foreach $RevisionID (@Revisions) {
   $author_delete   -> execute($RevisionID);
   $topic_delete    -> execute($RevisionID);
@@ -107,16 +107,16 @@ foreach $RevisionID (@Revisions) {
 
 $document_delete -> execute($DocumentID);
 $revision_delete -> execute($DocumentID);
- 
+
 # Delete stuff from file system
 
 $command = "rm -rf $Directory/*";
 system ($command);
- 
+
 print "<b>Document $DocumentID has been deleted.</b><p>";
 
 &DocDBNavBar;
 &DocDBFooter($DBWebMasterEmail,$DBWebMasterName);
 
- 
+
 exit;
diff --git a/DocDB/cgi/DocDBInstructions b/DocDB/cgi/DocDBInstructions
index 45c4cdfe..2bcd8b58 100755
--- a/DocDB/cgi/DocDBInstructions
+++ b/DocDB/cgi/DocDBInstructions
@@ -1,19 +1,19 @@
 #! /usr/bin/env perl
 #
-# Description: The instructions for DocDB. This is mostly HTML, but making 
+# Description: The instructions for DocDB. This is mostly HTML, but making
 #              it a script allows us to eliminate parts of it that we don't want
 #              and get it following everyone's style, and allows groups to add
 #              to it with ProjectMessages.
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified: 
+#    Modified:
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -25,8 +25,8 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-use CGI;                                                      
-use DBI;                                                      
+use CGI;
+use DBI;
 
 require "DocDBGlobals.pm";
 require "HTMLUtilities.pm";
@@ -39,7 +39,7 @@ $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 
 &GetSecurityGroups;
 
-%params = $query -> Vars; 
+%params = $query -> Vars;
 $InstructionSet = $params{set} || "general";
 
 # Title
@@ -77,7 +77,7 @@ if ($InstructionSet eq "general") {
   $PageTitle = "Advanced Users &amp; XML Interface";
   $HTMLTitle = $PageTitle;
 } elsif ($InstructionSet eq "admin") {
-  $PageTitle = "Adminstration Instructions";
+  $PageTitle = "Administration Instructions";
   $HTMLTitle = $PageTitle;
 }
 print $query->header( -charset => $HTTP_ENCODING );
diff --git a/DocDB/cgi/EmailAdminister b/DocDB/cgi/EmailAdminister
index 99dcccdb..1a406ab4 100755
--- a/DocDB/cgi/EmailAdminister
+++ b/DocDB/cgi/EmailAdminister
@@ -1,23 +1,23 @@
 #! /usr/bin/env perl
 #
-#        Name: EmailAdminister 
-# Description: This script is called by EmailAdministerForm and does 
+#        Name: EmailAdminister
+# Description: This script is called by EmailAdministerForm and does
 #              administration on users who have signed up for email from the
 #              DB. Since users can change almost everything, it really just
 #              deletes users and changes their passwords in case they forget.
-#              It also displays all the users and their notification 
+#              It also displays all the users and their notification
 #              preferences.
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified: 
+#    Modified:
 #
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -43,7 +43,7 @@ require "EmailUserHTML.pm";
 
 $query = new CGI;  # Global for subroutines
 
-# Parameters to script 
+# Parameters to script
 
 %params = $query -> Vars;
 my $Password      = $params{password};
@@ -63,7 +63,7 @@ $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$Username,$Password);
 
 unless ($dbh) {
   push @ErrorStack,$Msg_AdminNoConnect;
-}         
+}
 
 print $query -> header( -charset => $HTTP_ENCODING );
 DocDBHeader("Modified E-mail Users");
@@ -73,7 +73,7 @@ GetSecurityGroups();
 
 unless (CanAdminister()) {
   push @ErrorStack,$Msg_AdminNoLogin;
-}  
+}
 EndPage();
 
 if      ($Action eq "Delete") { # Delete user
@@ -94,20 +94,20 @@ if      ($Action eq "Delete") { # Delete user
         my $Table = "Email$NotifyType$NotifyTime";
         my $NotifyDelete = $dbh -> prepare("delete from $Table where EmailUserID=?");
            $NotifyDelete -> execute($EmailUserID);
-      }  
+      }
     }
     push @ActionStack,"The user was deleted.";
   }
   ActionReport();
-} elsif ($Action eq "Modify") { 
-  unless ($EmailUserID) { # Deal with password changes 
+} elsif ($Action eq "Modify") {
+  unless ($EmailUserID) { # Deal with password changes
     push @ErrorStack,$Msg_ModEUserEmpty;
   }
   EndPage();
 
   FetchEmailUser($EmailUserID);
 
-  if ($NewPassword) { 
+  if ($NewPassword) {
     srand (time ^ $$ ^ unpack "%32L*", `ps -eaf`);
 
     my $Salt = ((0..9,'a'..'z','A'..'Z','.','/')[(int rand (64))]).
@@ -126,9 +126,9 @@ if      ($Action eq "Delete") { # Delete user
   if ($ClearUser || $SingleUser) {
     my $UserUpdate = $dbh -> prepare("update EmailUser set CanSign=0,Verified=0 where EmailUserID=?");
        $UserUpdate -> execute($EmailUserID);
-    unless ($SingleUser) {   
+    unless ($SingleUser) {
       push @ActionStack,"The user is no longer verified and cannot sign documents.";
-    }  
+    }
   }
   if ($UserSign) {
     my $UserUpdate = $dbh -> prepare("update EmailUser set CanSign=1 where EmailUserID=?");
@@ -139,13 +139,13 @@ if      ($Action eq "Delete") { # Delete user
     my $UserUpdate = $dbh -> prepare("update EmailUser set Verified=1 where EmailUserID=?");
        $UserUpdate -> execute($EmailUserID);
     push @ActionStack,"The user is verified.";
-    
+
     if ($MailInstalled && $UserValidation eq "certificate") {
       require "EmailUtilities.pm";
 
       my @To      = ($EmailUser{$EmailUserID}{EmailAddress},$DBWebMasterEmail);
       my $Subject = "DocDB account for $EmailUser{$EmailUserID}{Name} activated";
-      my $Body    = "An adminstrator has approved the request for ";
+      my $Body    = "An administrator has approved the request for ";
       $Body      .= "$EmailUser{$EmailUserID}{Name} for access to $Project DocDB. ";
       $Body      .= "If you did not request access to $Project DocDB, ";
       $Body      .= "please contact $DBWebMasterEmail immediately.";
@@ -154,35 +154,35 @@ if      ($Action eq "Delete") { # Delete user
   }
   foreach my $UsersGroupID (@UsersGroupIDs) {
     my $UsersGroupSelect = $dbh -> prepare("select UsersGroupID from UsersGroup where EmailUserID=? and GroupID=?");
-       $UsersGroupSelect -> execute($EmailUserID,$UsersGroupID); 
+       $UsersGroupSelect -> execute($EmailUserID,$UsersGroupID);
     my ($ComboExists) = $UsersGroupSelect -> fetchrow_array;
-    unless ($ComboExists) {  
+    unless ($ComboExists) {
       my $UsersGroupUpdate = $dbh -> prepare("insert into UsersGroup (UsersGroupID,EmailUserID,GroupID) ".
                                              " values (0,?,?)");
-         $UsersGroupUpdate -> execute($EmailUserID,$UsersGroupID); 
+         $UsersGroupUpdate -> execute($EmailUserID,$UsersGroupID);
       FetchSecurityGroup($UsersGroupID);
       push @ActionStack,"Added user to $SecurityGroups{$UsersGroupID}{NAME}";
-    }  
-  }  
-  
+    }
+  }
+
   ClearEmailUsers();
   FetchEmailUser($EmailUserID);
   ActionReport();
-                           
+
   print "<h3>The user now has the following information:</h3>";
   print "<table class=\"LowPaddedTable\">\n";
   PrintEmailUserInfo($EmailUserID);
   print "</table>\n";
-} elsif ($Action eq "New") { 
+} elsif ($Action eq "New") {
   push @ErrorStack,"You can't create new users here. Do it the normal way.";
 } else {
   push @ErrorStack,"No valid action was specified.";
-}  
+}
 
 EndPage();
 WarnPage();
 
 DocDBNavBar();
 DocDBFooter($DBWebMasterEmail,$DBWebMasterName);
- 
+
 exit;
diff --git a/DocDB/cgi/FSUtilities.pm b/DocDB/cgi/FSUtilities.pm
index 86b25a9d..f59226a4 100644
--- a/DocDB/cgi/FSUtilities.pm
+++ b/DocDB/cgi/FSUtilities.pm
@@ -5,7 +5,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified:
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
@@ -260,7 +260,7 @@ sub ExtractArchive {
     system ($Command);
   } else {
     print "Could not unpack the archive; contact an
-    <a href=\"mailto:$DBWebMasterEmail\">adminstrator</a>. <br>\n";
+    <a href=\"mailto:$DBWebMasterEmail\">administrator</a>. <br>\n";
   }
   chdir $current_dir;
 }
diff --git a/DocDB/cgi/ListKeywords b/DocDB/cgi/ListKeywords
index 9aaf669c..6137acbf 100755
--- a/DocDB/cgi/ListKeywords
+++ b/DocDB/cgi/ListKeywords
@@ -1,20 +1,20 @@
 #! /usr/bin/env perl
 #
 #        Name: ListKeywords
-# Description: Lists the managed keywords. 
+# Description: Lists the managed keywords.
 #              In the first mode, links perform a search
-#              In chooser mode, links insert the keyword into the 
+#              In chooser mode, links insert the keyword into the
 #              form on the calling page
 #
 #      Author: Lynn Garren (garren@fnal.gov)
 #    Modified: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -26,7 +26,7 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-use CGI;                                                                                      
+use CGI;
 use DBI;
 
 require "DocDBGlobals.pm";
@@ -57,7 +57,7 @@ if ($Mode eq "chooser") {
   print "<p>\n";
   print "Please use the following keywords to facilitate searches. Note that
   spaces are NOT allowed in keywords.  To suggest additional keywords, send mail
-  to an <a href=\"mailto:$DBWebMasterEmail\">adminstrator</a>. The links below
+  to an <a href=\"mailto:$DBWebMasterEmail\">administrator</a>. The links below
   will search the database for all instances of a single keyword. Use the
   <a href=\"$SearchForm\" target=\"_blank\">search form</a>  to do a more
   complicated search.</p>\n";
@@ -67,7 +67,7 @@ if ($Mode eq "chooser") {
   } elsif ($Format eq "long") {
     print "<p>The <a href=\"$ListKeywords?format=short\">abbreviated listing</a>
     lists all the keywords compactly.\n</p>";
-  }  
+  }
   if ($KeywordAddendumText) {
     print "<p>$KeywordAddendumText</p>\n";
   }
diff --git a/DocDB/cgi/Messages.pm b/DocDB/cgi/Messages.pm
index 6484633d..7c820237 100644
--- a/DocDB/cgi/Messages.pm
+++ b/DocDB/cgi/Messages.pm
@@ -1,17 +1,17 @@
 #
-# Description: Central location for many of the error messages for the DocDB 
-#              since many programs return the same errors. 
+# Description: Central location for many of the error messages for the DocDB
+#              since many programs return the same errors.
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified: Lynn Garren (garren@fnal.gov)
 #
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -26,7 +26,7 @@
 $Msg_NoConnect        = "Unable to connect to the database. Please alert an administrator.";
 
 $Msg_AdminNoConnect   = "Unable to connect to the database. Make sure you use the correct password.";
-$Msg_AdminNoLogin     = "You must be logged in as the adminstrator to perform this action.";
+$Msg_AdminNoLogin     = "You must be logged in as the administrator to perform this action.";
 $Msg_AdminNoPass      = "You must supply a username and password to perform administration actions.";
 
 $Msg_ModInstEmpty     = "You must select an institution to modify or delete.";
@@ -48,8 +48,8 @@ $Msg_DelFullEvent     = "This event has associated documents. Not deleted.";
 
 # Messages for document creation, modification, display
 
-$Msg_DocNoAccess      = "Either you are not authorized to view this document 
-                         (with the username and password you supplied)  
+$Msg_DocNoAccess      = "Either you are not authorized to view this document
+                         (with the username and password you supplied)
                          or the document does not exist.";
 
 
@@ -91,6 +91,6 @@ $Msg_WarnModManaged = "Warning: You are about to modify a managed document. This
 if (-e "ProjectMessages.pm") {
   require "ProjectMessages.pm";
   push @DebugStack,"Included Project Messages";
-}  
+}
 
 1;
diff --git a/DocDB/cgi/UserAccessApply b/DocDB/cgi/UserAccessApply
index a8a9eb9b..ca2b2ced 100755
--- a/DocDB/cgi/UserAccessApply
+++ b/DocDB/cgi/UserAccessApply
@@ -2,7 +2,7 @@
 #
 # Author Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
@@ -70,12 +70,12 @@ if ($CertificateStatus eq "verified") {
       print "<li>",$SecurityGroups{$GroupID}{NAME},"</li>\n";
     }
   } else {
-    print "<li>None: Contact an adminstrator if this is incorrect</li>\n";
+    print "<li>None: Contact an administrator if this is incorrect</li>\n";
   }
   print "</ul>\n";
 } elsif ($CertificateStatus eq "unverified") {
   print "<b>You have already applied for access to documents. A new request has not been generated.
-         If you believe your request has been misplaced or neglected, contact an administator.</b>";
+         If you believe your request has been misplaced or neglected, contact an administrator.</b>";
   print "The following information may be helpful:<br>\n";
   print "<b>Certificate Common Name (CN):</b> $CertCN<br>\n";
   print "<b>Certificate E-mail Address:</b> $CertEmail<br>\n";
@@ -157,7 +157,7 @@ if ($CertificateStatus eq "verified") {
     $Body      .= "access to $Project DocDB. If you did not initiate this request, ";
     $Body      .= "please contact the DocDB administrators at $DBWebMasterEmail immediately.\n\n";
     $Body      .= "If you did request this access, please give the ";
-    $Body      .= "adminstrators a few business days to respond to your request.\n";
+    $Body      .= "administrators a few business days to respond to your request.\n";
     $Body      .= "Thank you.";
 
     &SendEmail(-body => $Body, -to => \@To, -subject => $Subject);

From d2f99194c219e7fe2474cdaada8362512b216b6f Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ewv@fnal.gov>
Date: Fri, 3 May 2013 16:29:53 -0500
Subject: [PATCH 020/163] Non-FNAL specific change to certificate authorization

Switch from using the first CN of a cert for authorization to using the full DN.
We assume the DN is stored in the Username field of the database. You must couple
this with an increase in the size of the field:
   alter table EmailUser modify Username  text;
---
 DocDB/cgi/BulkCertificateInsert   | 19 +++++++++++--------
 DocDB/cgi/CertificateApplyForm    | 16 +++++++---------
 DocDB/cgi/CertificateUtilities.pm | 28 +++++++++++++---------------
 DocDB/cgi/DocDBHelp.xml           | 15 ++++++++++++---
 DocDB/cgi/DocDBVersion.pm         |  2 +-
 DocDB/cgi/EmailAdministerForm     | 13 +++++++++----
 DocDB/cgi/GroupAdminister         |  4 ++--
 DocDB/cgi/MailNotification.pm     | 10 ++++++----
 DocDB/cgi/TopicAdminister         |  6 +++---
 DocDB/cgi/UserAccessApply         | 17 +++++------------
 10 files changed, 69 insertions(+), 61 deletions(-)

diff --git a/DocDB/cgi/BulkCertificateInsert b/DocDB/cgi/BulkCertificateInsert
index 16ad462a..271acc8f 100755
--- a/DocDB/cgi/BulkCertificateInsert
+++ b/DocDB/cgi/BulkCertificateInsert
@@ -5,7 +5,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified:
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
@@ -95,17 +95,16 @@ if ($Action eq "Insert") {
   my $UsersGroupInsert = $dbh -> prepare("insert into UsersGroup (UsersGroupID,EmailUserID,GroupID) values (0,?,?)");
 
   foreach my $Row (1..$MaxUsers) {
-    my $Name     = $Untaint -> extract (-as_printable => "name$Row")  || "";
+    my $Username = $Untaint -> extract (-as_printable => "name$Row")  || "";
+    my $Name     = $Untaint -> extract (-as_printable => "commonname$Row")  || "";
     my $Email    = $Untaint -> extract (-as_printable => "email$Row") || "";
-    my $Username = $Name;
-       $Username =~ s/\W//g;
 
     if ($Username) {
       if ($Usernames{$Username}) {
         push @WarnStack,"The user $Name already exists. Not inserted.";
         next;
       }
-      unless ($Email) {
+      unless ($Email && $Name) {
         push @WarnStack,"You must supply a name and e-mail address for the user $Name. Not inserted.";
         next;
       }
@@ -157,20 +156,24 @@ if ($UseSignoffs) {
 print "</td></tr>\n";
 
 print "<tr><th>";
-print FormElementTitle(-helplink => 'certname',  -helptext => 'Certificate CN');
+print FormElementTitle(-helplink => 'usersname',  -helptext => "User's Name");
+print "</th><th>";
+print FormElementTitle(-helplink => 'certname',  -helptext => 'Certificate DN');
 print "</th><th>";
 print FormElementTitle(-helplink => 'certemail', -helptext => 'E-mail Address');
 print "</th></tr>\n";
 
 foreach my $Row (1..$MaxUsers) {
   print "<tr><td>\n";
-  TextField(-name => "name$Row",  -size => 40, -maxlength => $DBColumnSize{EmailUser}{Name}        );
+  TextField(-name => "commonname$Row",  -size => 40, -maxlength => $DBColumnSize{EmailUser}{Name}        );
+  print "</td><td>\n";
+  TextField(-name => "name$Row",  -size => 40, -maxlength => 2048);
   print "</td><td>\n";
   TextField(-name => "email$Row", -size => 30, -maxlength => $DBColumnSize{EmailUser}{EmailAddress});
   print "</td></tr>\n";
 }
 
-print '<tr><td colspan="2" class="SubmitCell">';
+print '<tr><td colspan="3" class="SubmitCell">';
 print $query -> submit (-value => "Insert Users");
 print "</td></tr>\n";
 
diff --git a/DocDB/cgi/CertificateApplyForm b/DocDB/cgi/CertificateApplyForm
index 1425a439..a2819099 100755
--- a/DocDB/cgi/CertificateApplyForm
+++ b/DocDB/cgi/CertificateApplyForm
@@ -52,6 +52,9 @@ print $query -> header( -charset => $HTTP_ENCODING );
 my $CertificateStatus = &CertificateStatus();
 my $CertEmail = $ENV{SSL_CLIENT_S_DN_Email};
 my $CertCN    = $ENV{SSL_CLIENT_S_DN_CN};
+my $CertDN    = $ENV{SSL_CLIENT_S_DN};
+
+push @DebugStack, "DN is $CertDN, CN is $CertCN";
 
 if ($CertificateStatus eq "verified") {
   print "<b>Your certificate has been verified and you have access to documents from these groups:</b>";
@@ -70,14 +73,7 @@ if ($CertificateStatus eq "verified") {
   print "<b>Your certificate is valid and you have applied for access to documents.
          If you believe your request has been misplaced or neglected, contact an administator.</b><p/>";
   print "The following information may be helpful:<br>\n";
-  print "<b>Certificate Common Name (CN):</b> $CertCN<br/>\n";
-  print "<b>Certificate E-mail Address:</b> $CertEmail<br/>\n";
-} elsif ($CertificateStatus eq "mismatch") {
-  print "<b>Your certificate is valid but a similar certificate already exists
-         for  either your e-mail address or your name (CN). Only one
-         certificate is allowed per person. Contact an administrator if you
-         don't know what to do.</b><p/>";
-  print "The following information may be helpful:<br/>\n";
+  print "<b>Certificate Distinguished Name (DN):</b> $CertDN<br/>\n";
   print "<b>Certificate Common Name (CN):</b> $CertCN<br/>\n";
   print "<b>Certificate E-mail Address:</b> $CertEmail<br/>\n";
 } elsif ($CertificateStatus eq "nocert") {
@@ -93,7 +89,9 @@ if ($CertificateStatus eq "verified") {
   print $query -> start_multipart_form('POST',$UserAccessApply);
   print "<table class=\"MedPaddedTable CenteredTable\">\n";
   print "<tr>\n";
-  print "<td><b>Your name (Certificate CN):</b><br/>&nbsp;&nbsp;$CertCN<p/>\n";
+  print "<td colspan=\"2\"><b>Your certificate DN:</b><br/>&nbsp;&nbsp;$CertDN<p/>\n";
+  print "</tr><tr>\n";
+  print "<td><b>Your name (certificate CN):</b><br/>&nbsp;&nbsp;$CertCN<p/>\n";
   TextField(-name => "email", -helplink  => "email", -helptext => "Your E-mail",
             -size => 20,      -maxlength => 64,      -default  => $CertEmail);
   print "</td>\n";
diff --git a/DocDB/cgi/CertificateUtilities.pm b/DocDB/cgi/CertificateUtilities.pm
index f68e8843..ba52c9e3 100644
--- a/DocDB/cgi/CertificateUtilities.pm
+++ b/DocDB/cgi/CertificateUtilities.pm
@@ -3,7 +3,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified:
 
-# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
@@ -44,23 +44,21 @@ sub FetchEmailUserIDByCert (%) {
 
   my $CertEmail = $ENV{SSL_CLIENT_S_DN_Email};
   my $CertCN    = $ENV{SSL_CLIENT_S_DN_CN};
-
-  $CertificateCN    = $CertCN;
-  $CertificateEmail = $CertEmail;
-
-  push @DebugStack,"Finding EmailUserID by certificate $CertCN";
+  my $CertDN    = $ENV{SSL_CLIENT_S_DN};
 
   # If we do http basic with users, this routine will function with minor modifications
 
   my $EmailUserSelect;
+  
+  push @DebugStack, "Finding EmailUserID and groups by DN $CertDN";
   if ($IgnoreVerification) {
     $EmailUserSelect = $dbh->prepare("select EmailUserID from EmailUser ".
-                                     "where Name=?");
+                   "where Username=?");
   } else {
     $EmailUserSelect = $dbh->prepare("select EmailUserID from EmailUser ".
-                                     "where Verified=1 and Name=?");
+                   "where Verified=1 and Username=?");
   }
-  $EmailUserSelect -> execute($CertCN);
+  $EmailUserSelect -> execute($CertDN);
 
   my ($EmailUserID) = $EmailUserSelect -> fetchrow_array;
   push @DebugStack,"Found e-mail user: $EmailUserID";
@@ -86,9 +84,8 @@ sub CertificateStatus () {
 
   my $CertEmail = $ENV{SSL_CLIENT_S_DN_Email};
   my $CertCN    = $ENV{SSL_CLIENT_S_DN_CN};
-
-  push @DebugStack,"Finding Status by certificate";
-
+  my $CertDN    = $ENV{SSL_CLIENT_S_DN};
+  
   unless ($CertCN) {
     $CertificateStatus = "nocert";
     push @DebugStack,"Certificate Status: $CertificateStatus";
@@ -96,11 +93,12 @@ sub CertificateStatus () {
   }
 
   my $EmailUserSelect;
+  push @DebugStack, "Finding status by DN $CertDN";
   $EmailUserSelect = $dbh->prepare("select EmailUserID,Verified from EmailUser ".
-                                     "where Name=?");
-  $EmailUserSelect -> execute($CertCN);
+                                     "where Username=?");
+  $EmailUserSelect -> execute($CertDN);
+  
   my ($EmailUserID,$Verified) = $EmailUserSelect -> fetchrow_array;
-  push @DebugStack,"Checking user $CertCN by CN";
 
   if ($Verified) {
     $CertificateStatus = "verified";
diff --git a/DocDB/cgi/DocDBHelp.xml b/DocDB/cgi/DocDBHelp.xml
index 45fa90ba..db11f729 100644
--- a/DocDB/cgi/DocDBHelp.xml
+++ b/DocDB/cgi/DocDBHelp.xml
@@ -1248,14 +1248,23 @@ or may not be the same as the web username and password.
 
  <entry>
   <key>certname</key>
-  <title>Certificate Common Name (CN)</title>
+  <title>Certificate Distinguished Name (DN)</title>
   <text>
-   This is a unique identifier in the user's client certificate. It is usually
-   the user's name or login. It must be entered exactly or the user will not be
+   This is the unique identifier (subject or DN) in the user's client certificate. 
+   It must be entered exactly or the user will not be
    authenticated when they  present their client certificate to DocDB.
   </text>
  </entry>
 
+ <entry>
+  <key>usersname</key>
+  <title>User's Name (CN)</title>
+  <text>   
+   Enter the user's common name. Often this is present in a CN section of the certificate DN, but it need
+   not be entered exactly; it is not used for authentication.
+  </text>
+ </entry>
+
  <entry>
   <key>certemail</key>
   <title>E-Mail Address for Certificate User</title>
diff --git a/DocDB/cgi/DocDBVersion.pm b/DocDB/cgi/DocDBVersion.pm
index f820c80c..31b0cb14 100644
--- a/DocDB/cgi/DocDBVersion.pm
+++ b/DocDB/cgi/DocDBVersion.pm
@@ -20,6 +20,6 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-$DocDBVersion = "8.7.17";
+$DocDBVersion = "8.7.18";
 
 1;
diff --git a/DocDB/cgi/EmailAdministerForm b/DocDB/cgi/EmailAdministerForm
index e5469ae5..fe36d4af 100755
--- a/DocDB/cgi/EmailAdministerForm
+++ b/DocDB/cgi/EmailAdministerForm
@@ -65,6 +65,11 @@ unless (CanAdminister()) {
 
 EndPage();
 
+my $UsernameHeader = "Username";
+if ($UserValidation eq "certificate") {
+  $UsernameHeader = "Certificate DN"
+}
+
 if ($EmailUserID) {
   print "<p>This form allows you to delete the user, change which groups the
          user belongs to, ";
@@ -121,7 +126,7 @@ print "</tr>\n";
 print "<tr>\n";
 
 print "<td>\n";
- EmailUserSelect(-disabled => $TRUE, -default => [$EmailUserID]);
+ EmailUserSelect(-disabled => $TRUE, -default => [$EmailUserID], -helptext => $UsernameHeader);
 print "</td>\n";
 
 print "<td>\n";
@@ -192,10 +197,10 @@ if ($EmailUserID) {
 
 ### Display of existing groups
 
-  my @EmailUserIDs = sort EmailUserIDsByUsername GetEmailUserIDs();
+  my @EmailUserIDs = sort EmailUserIDsByName GetEmailUserIDs();
 
   print "<table class=\"DocumentList Alternating\">\n";
-  print "<tr><th>Name</th><th>Username</th><th>Verified?</th><th>Can Sign?</th><th>Groups</th></tr>\n";
+  print "<tr><th>Name</th><th>$UsernameHeader</th><th>Verified?</th><th>Can Sign?</th><th>Groups</th></tr>\n";
   #print "<th>Notifications</th>\n";
 
   my $Row = 0;
@@ -246,7 +251,7 @@ if ($EmailUserID) {
   my @SecurityGroups = sort keys %SecurityIDs;
 
   foreach my $SecurityGroup (@SecurityGroups) {
-    my @EmailUserIDs = sort EmailUserIDsByUsername FetchEmailUserIDsBySecurityGroup($SecurityIDs{$SecurityGroup});
+    my @EmailUserIDs = sort EmailUserIDsByName FetchEmailUserIDsBySecurityGroup($SecurityIDs{$SecurityGroup});
     if (@EmailUserIDs) {
       print "<p><a name=\"$SecurityGroup\" /><strong>$SecurityGroup has these members:</strong></p>\n<ul>\n";
       foreach my $EmailUserID (@EmailUserIDs) {
diff --git a/DocDB/cgi/GroupAdminister b/DocDB/cgi/GroupAdminister
index 5334e481..2d4d5a15 100755
--- a/DocDB/cgi/GroupAdminister
+++ b/DocDB/cgi/GroupAdminister
@@ -9,7 +9,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified: 
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
@@ -249,7 +249,7 @@ if      ($Action eq "Delete") { # Delete group
    "insert into GroupHierarchy (HierarchyID,ChildID,ParentID) ".
                        "values (0,?,?)");
   foreach my $ChildID (@ChildIDs) {
-    if ($ChildID) {
+    if ($ChildID && $ChildID != $ParentID) {
       $HierarchyInsert -> execute($ChildID,$ParentID);
     }
   }     
diff --git a/DocDB/cgi/MailNotification.pm b/DocDB/cgi/MailNotification.pm
index 719f555f..41ca89aa 100644
--- a/DocDB/cgi/MailNotification.pm
+++ b/DocDB/cgi/MailNotification.pm
@@ -8,7 +8,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
@@ -455,6 +455,7 @@ sub EmailUserSelect (%) {
   require "Sorts.pm";
   my (%Params) = @_;
 
+  my $HelpText = $Params{-helptext}  || "Username";
   my $Disabled = $Params{-disabled}  || "0";
   my @Defaults = @{$Params{-default}};
 
@@ -466,12 +467,13 @@ sub EmailUserSelect (%) {
   my @EmailUserIDs = &GetEmailUserIDs;
   foreach my $EmailUserID (@EmailUserIDs) {
     &FetchEmailUser($EmailUserID);
-    $EmailUserLabels{$EmailUserID} = $EmailUser{$EmailUserID}{Username};
+    $EmailUserLabels{$EmailUserID} = $EmailUser{$EmailUserID}{Name}.
+                                     ' ['.$EmailUser{$EmailUserID}{Username}.']';
   }
 
-  @EmailUserIDs = sort EmailUserIDsByUsername @EmailUserIDs;
+  @EmailUserIDs = sort EmailUserIDsByName @EmailUserIDs;
 
-  print FormElementTitle(-helplink => "emailuser", -helptext => "Username");
+  print FormElementTitle(-helplink => "emailuser", -helptext => $HelpText);
   print $query -> scrolling_list(-name   => 'emailuserid',
                                  -values => \@EmailUserIDs,
                                  -labels => \%EmailUserLabels,
diff --git a/DocDB/cgi/TopicAdminister b/DocDB/cgi/TopicAdminister
index d4939ec3..9ba14288 100755
--- a/DocDB/cgi/TopicAdminister
+++ b/DocDB/cgi/TopicAdminister
@@ -8,7 +8,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified: 
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
@@ -113,7 +113,7 @@ if ($Action eq "Delete") {
 
 # Deal with parent changes   
 
-  if ($ParentTopicID && $ParentTopicID == $TopicID) {
+  if ($TopicID && $ParentTopicID && $ParentTopicID == $TopicID) {
     push @WarnStack,"You cannot set a topic to be its own parent. No action taken.";
   }  
 
@@ -141,7 +141,7 @@ if ($Action eq "Delete") {
 
     $TopicInsert -> execute($ShortName,$LongName);
     my $TopicID = $TopicInsert -> {mysql_insertid};
-    if ($ParentTopicID) {
+    if ($ParentTopicID && $TopicID && $ParentTopicID != $TopicID) {
       my $Insert = $dbh -> prepare("insert into TopicHierarchy (TopicHierarchyID,TopicID,ParentTopicID) values (0,?,?)");
       $Insert -> execute($TopicID,$ParentTopicID);
       push @ActionStack,"New sub-topic created with descriptions $ShortName and $LongName.";
diff --git a/DocDB/cgi/UserAccessApply b/DocDB/cgi/UserAccessApply
index ca2b2ced..483d2074 100755
--- a/DocDB/cgi/UserAccessApply
+++ b/DocDB/cgi/UserAccessApply
@@ -58,6 +58,7 @@ unless ($CertEmail) {
 EndPage();
 
 my $CertCN    = $ENV{SSL_CLIENT_S_DN_CN};
+my $CertDN    = $ENV{SSL_CLIENT_S_DN};
 
 if ($CertificateStatus eq "verified") {
   print "<b>Your certificate has already been verified. A new request has NOT been generated.<br>".
@@ -77,14 +78,7 @@ if ($CertificateStatus eq "verified") {
   print "<b>You have already applied for access to documents. A new request has not been generated.
          If you believe your request has been misplaced or neglected, contact an administrator.</b>";
   print "The following information may be helpful:<br>\n";
-  print "<b>Certificate Common Name (CN):</b> $CertCN<br>\n";
-  print "<b>Certificate E-mail Address:</b> $CertEmail<br>\n";
-} elsif ($CertificateStatus eq "mismatch") {
-  print "<b>Your certificate is valid but a similar certificate already exists
-         for  either your e-mail address or your name (CN). Only one
-         certificate is allowed per person. Contact an administrator if you
-         don't know what to do.</b>";
-  print "The following information may be helpful:<br>\n";
+  print "<b>Certificate Distinguished Name (DN):</b> $CertDN<br>\n";
   print "<b>Certificate Common Name (CN):</b> $CertCN<br>\n";
   print "<b>Certificate E-mail Address:</b> $CertEmail<br>\n";
 } elsif ($CertificateStatus eq "nocert") {
@@ -95,8 +89,7 @@ if ($CertificateStatus eq "verified") {
 
   my $CertNote          = $params{certnote};
   my @RequestedGroupIDs = split /\0/,$params{reqgroups};
-  my $UserName = $CertCN;
-     $UserName =~ s/\W//g;
+  my $UserName = $CertDN;
 
 ### Fill in DB tables
 
@@ -116,7 +109,7 @@ if ($CertificateStatus eq "verified") {
 ### Notify applicant and administrator
 
 
-  print "You ($CertCN with e-mail address $CertEmail) have requested ";
+  print "You ($CertDN with e-mail address $CertEmail) have requested ";
   print "access to $Project DocDB. ";
   print "You have requested membership in the following groups:\n";
   print "<ul>\n";
@@ -133,7 +126,7 @@ if ($CertificateStatus eq "verified") {
 
     my @To      = ($DBWebMasterEmail);
     my $Subject = "$CertCN requests access to $Project DocDB";
-    my $Body    = "$CertCN with e-mail address $CertEmail has requested ";
+    my $Body    = "$CertCN (Certificate DN $CertDN) with e-mail address $CertEmail has requested ";
     $Body      .= "access to $Project DocDB. ";
     $Body      .= "He or she requests membership in the following groups:\n";
     foreach my $GroupID (@RequestedGroupIDs) {

From e9e84b0a4e0e1bf581a1ab6c01b410ece462362b Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ewv@fnal.gov>
Date: Wed, 19 Jun 2013 10:14:20 -0500
Subject: [PATCH 021/163] update 2009 to 2013

---
 DocDB/cgi/AddFilesForm                | 2 +-
 DocDB/cgi/AdministerForm              | 2 +-
 DocDB/cgi/AdministerHome              | 2 +-
 DocDB/cgi/AdministerIntructions.pm    | 2 +-
 DocDB/cgi/AdvancedInstructions.pm     | 2 +-
 DocDB/cgi/AuthorAdd                   | 2 +-
 DocDB/cgi/AuthorAdminister            | 2 +-
 DocDB/cgi/AuthorHTML.pm               | 2 +-
 DocDB/cgi/AuthorSQL.pm                | 2 +-
 DocDB/cgi/AuthorUtilities.pm          | 2 +-
 DocDB/cgi/CalendarHTML.pm             | 2 +-
 DocDB/cgi/CertificateInstructions.pm  | 2 +-
 DocDB/cgi/ConfigSQL.pm                | 2 +-
 DocDB/cgi/ConfirmTalkHint             | 2 +-
 DocDB/cgi/Cookies.pm                  | 2 +-
 DocDB/cgi/CustomListForm              | 2 +-
 DocDB/cgi/DBColumnSizes.pm            | 2 +-
 DocDB/cgi/DBUtilities.pm              | 2 +-
 DocDB/cgi/Debug.pm                    | 2 +-
 DocDB/cgi/DisplayMeeting              | 2 +-
 DocDB/cgi/DocDBFields.pm              | 2 +-
 DocDB/cgi/DocDBHelp                   | 2 +-
 DocDB/cgi/DocDBHelp.xml               | 2 +-
 DocDB/cgi/DocTypeAdminister           | 2 +-
 DocDB/cgi/DocTypeHTML.pm              | 2 +-
 DocDB/cgi/DocumentDatabase            | 2 +-
 DocDB/cgi/DocumentHTML.pm             | 2 +-
 DocDB/cgi/DocumentSQL.pm              | 2 +-
 DocDB/cgi/DocumentUtilities.pm        | 2 +-
 DocDB/cgi/EditTalkInfo                | 2 +-
 DocDB/cgi/EmailCreate                 | 2 +-
 DocDB/cgi/EmailLogin                  | 2 +-
 DocDB/cgi/EmailSecurity.pm            | 2 +-
 DocDB/cgi/EmailUserHTML.pm            | 2 +-
 DocDB/cgi/EmailUtilities.pm           | 2 +-
 DocDB/cgi/EventAdministerForm         | 2 +-
 DocDB/cgi/EventInstructions.pm        | 2 +-
 DocDB/cgi/EventUtilities.pm           | 2 +-
 DocDB/cgi/ExternalDocDBAdministerForm | 2 +-
 DocDB/cgi/FileHTML.pm                 | 2 +-
 DocDB/cgi/FileSQL.pm                  | 2 +-
 DocDB/cgi/FormElements.pm             | 2 +-
 DocDB/cgi/GroupAdministerForm         | 2 +-
 DocDB/cgi/GroupHTML.pm                | 2 +-
 DocDB/cgi/HTMLUtilities.pm            | 2 +-
 DocDB/cgi/Images.pm                   | 2 +-
 DocDB/cgi/InstitutionAdminister       | 2 +-
 DocDB/cgi/JournalAdminister           | 2 +-
 DocDB/cgi/JournalHTML.pm              | 2 +-
 DocDB/cgi/KeywordAdministerForm       | 2 +-
 DocDB/cgi/KeywordGroupAdminister      | 2 +-
 DocDB/cgi/KeywordHTML.pm              | 2 +-
 DocDB/cgi/KeywordListAdminister       | 2 +-
 DocDB/cgi/KeywordSQL.pm               | 2 +-
 DocDB/cgi/ListAllMeetings             | 2 +-
 DocDB/cgi/ListAuthors                 | 2 +-
 DocDB/cgi/ListBy                      | 2 +-
 DocDB/cgi/ListEventsBy                | 2 +-
 DocDB/cgi/ListGroupUsers              | 2 +-
 DocDB/cgi/ListGroups                  | 2 +-
 DocDB/cgi/ListManagedDocuments        | 2 +-
 DocDB/cgi/ListTopics                  | 2 +-
 DocDB/cgi/ListTypes                   | 2 +-
 DocDB/cgi/MeetingHTML.pm              | 2 +-
 DocDB/cgi/MeetingSQL.pm               | 2 +-
 DocDB/cgi/MeetingSecuritySQL.pm       | 2 +-
 DocDB/cgi/MeetingSecurityUtilities.pm | 2 +-
 DocDB/cgi/MiscSQL.pm                  | 2 +-
 DocDB/cgi/ModifyHome                  | 2 +-
 DocDB/cgi/NotificationHTML.pm         | 2 +-
 DocDB/cgi/NotificationSQL.pm          | 2 +-
 DocDB/cgi/ProjectGlobals.pm.template  | 2 +-
 DocDB/cgi/ProjectMessages.pm.template | 2 +-
 DocDB/cgi/ProjectRoutines.pm.template | 2 +-
 DocDB/cgi/ReferenceLinks.pm           | 2 +-
 DocDB/cgi/ResponseElements.pm         | 2 +-
 DocDB/cgi/RetrieveFile                | 2 +-
 DocDB/cgi/RevisionSQL.pm              | 2 +-
 DocDB/cgi/RevisionUtilities.pm        | 2 +-
 DocDB/cgi/SQLChecks.pm                | 2 +-
 DocDB/cgi/SQLUtilities.pm             | 2 +-
 DocDB/cgi/Scripts.pm                  | 2 +-
 DocDB/cgi/Search.pm                   | 2 +-
 DocDB/cgi/SearchAtoms.pm              | 2 +-
 DocDB/cgi/SearchForm                  | 2 +-
 DocDB/cgi/SearchFormElements.pm       | 2 +-
 DocDB/cgi/SearchModes.pm              | 2 +-
 DocDB/cgi/Security.pm                 | 2 +-
 DocDB/cgi/SecurityHTML.pm             | 2 +-
 DocDB/cgi/SecuritySQL.pm              | 2 +-
 DocDB/cgi/SelectEmailPrefs            | 2 +-
 DocDB/cgi/SelectGroups                | 2 +-
 DocDB/cgi/SetGroups                   | 2 +-
 DocDB/cgi/SetPrefs                    | 2 +-
 DocDB/cgi/ShowCalendar                | 2 +-
 DocDB/cgi/ShowDocument                | 2 +-
 DocDB/cgi/ShowTalkNote                | 2 +-
 DocDB/cgi/SignRevision                | 2 +-
 DocDB/cgi/SignatureReport             | 2 +-
 DocDB/cgi/SignoffChooser              | 2 +-
 DocDB/cgi/SignoffHTML.pm              | 2 +-
 DocDB/cgi/SignoffSQL.pm               | 2 +-
 DocDB/cgi/SignoffUtilities.pm         | 2 +-
 DocDB/cgi/Statistics                  | 2 +-
 DocDB/cgi/TalkHTML.pm                 | 2 +-
 DocDB/cgi/TalkHintSQL.pm              | 2 +-
 DocDB/cgi/TalkHintUtilities.pm        | 2 +-
 DocDB/cgi/TalkSQL.pm                  | 2 +-
 DocDB/cgi/TopicHTML.pm                | 2 +-
 DocDB/cgi/TopicSQL.pm                 | 2 +-
 DocDB/cgi/TopicUtilities.pm           | 2 +-
 DocDB/cgi/Utilities.pm                | 2 +-
 DocDB/cgi/VEntryOutput.pm             | 2 +-
 DocDB/cgi/WatchDocument               | 2 +-
 DocDB/cgi/WebUtilities.pm             | 2 +-
 DocDB/cgi/XMLOutput.pm                | 2 +-
 DocDB/cgi/XRefHTML.pm                 | 2 +-
 DocDB/cgi/XRefSQL.pm                  | 2 +-
 DocDB/cgi/XRefUtilities.pm            | 2 +-
 DocDB/cgi/XSearch                     | 2 +-
 DocDB/cgi/XSearch.pm                  | 2 +-
 121 files changed, 121 insertions(+), 121 deletions(-)

diff --git a/DocDB/cgi/AddFilesForm b/DocDB/cgi/AddFilesForm
index b05abade..8af0c11d 100755
--- a/DocDB/cgi/AddFilesForm
+++ b/DocDB/cgi/AddFilesForm
@@ -9,7 +9,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified:
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/AdministerForm b/DocDB/cgi/AdministerForm
index 727d7b96..1e98992e 100755
--- a/DocDB/cgi/AdministerForm
+++ b/DocDB/cgi/AdministerForm
@@ -9,7 +9,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/AdministerHome b/DocDB/cgi/AdministerHome
index f2036d1a..9f8fb540 100755
--- a/DocDB/cgi/AdministerHome
+++ b/DocDB/cgi/AdministerHome
@@ -3,7 +3,7 @@
 #      Author: Lynn Garren (garren@fnal.gov)
 #    Modified: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/AdministerIntructions.pm b/DocDB/cgi/AdministerIntructions.pm
index 5e9320a0..ac103260 100644
--- a/DocDB/cgi/AdministerIntructions.pm
+++ b/DocDB/cgi/AdministerIntructions.pm
@@ -6,7 +6,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified: 
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/AdvancedInstructions.pm b/DocDB/cgi/AdvancedInstructions.pm
index ae40ca23..171cdacc 100644
--- a/DocDB/cgi/AdvancedInstructions.pm
+++ b/DocDB/cgi/AdvancedInstructions.pm
@@ -6,7 +6,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified: 
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/AuthorAdd b/DocDB/cgi/AuthorAdd
index 652eedba..7d1d74a1 100755
--- a/DocDB/cgi/AuthorAdd
+++ b/DocDB/cgi/AuthorAdd
@@ -7,7 +7,7 @@
 #    Modified: 
 #
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/AuthorAdminister b/DocDB/cgi/AuthorAdminister
index f5d4a587..f44acd79 100755
--- a/DocDB/cgi/AuthorAdminister
+++ b/DocDB/cgi/AuthorAdminister
@@ -9,7 +9,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/AuthorHTML.pm b/DocDB/cgi/AuthorHTML.pm
index 9e7316f7..cb4293e4 100644
--- a/DocDB/cgi/AuthorHTML.pm
+++ b/DocDB/cgi/AuthorHTML.pm
@@ -5,7 +5,7 @@
 #    Modified:
 #
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/AuthorSQL.pm b/DocDB/cgi/AuthorSQL.pm
index d067f417..f98aa382 100644
--- a/DocDB/cgi/AuthorSQL.pm
+++ b/DocDB/cgi/AuthorSQL.pm
@@ -5,7 +5,7 @@
 #    Modified: 
 #
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/AuthorUtilities.pm b/DocDB/cgi/AuthorUtilities.pm
index 3ddb8891..c93d567a 100644
--- a/DocDB/cgi/AuthorUtilities.pm
+++ b/DocDB/cgi/AuthorUtilities.pm
@@ -4,7 +4,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified: 
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/CalendarHTML.pm b/DocDB/cgi/CalendarHTML.pm
index 25a78da7..ae32f596 100644
--- a/DocDB/cgi/CalendarHTML.pm
+++ b/DocDB/cgi/CalendarHTML.pm
@@ -8,7 +8,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/CertificateInstructions.pm b/DocDB/cgi/CertificateInstructions.pm
index 50e40a0a..9cf705b5 100644
--- a/DocDB/cgi/CertificateInstructions.pm
+++ b/DocDB/cgi/CertificateInstructions.pm
@@ -11,7 +11,7 @@
 # is set, there may be some issues. Please feel free to send patches if you find
 # FNAL specific information remaining.
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/ConfigSQL.pm b/DocDB/cgi/ConfigSQL.pm
index 0ebdfb36..e9ec1dfd 100644
--- a/DocDB/cgi/ConfigSQL.pm
+++ b/DocDB/cgi/ConfigSQL.pm
@@ -4,7 +4,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified: 
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/ConfirmTalkHint b/DocDB/cgi/ConfirmTalkHint
index 296fe414..0288fc32 100755
--- a/DocDB/cgi/ConfirmTalkHint
+++ b/DocDB/cgi/ConfirmTalkHint
@@ -7,7 +7,7 @@
 #    Modified: 
 #
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/Cookies.pm b/DocDB/cgi/Cookies.pm
index ac63afb4..e1f88d0b 100644
--- a/DocDB/cgi/Cookies.pm
+++ b/DocDB/cgi/Cookies.pm
@@ -5,7 +5,7 @@
 #    Modified:
 #
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/CustomListForm b/DocDB/cgi/CustomListForm
index e9dd03b3..8053ad56 100755
--- a/DocDB/cgi/CustomListForm
+++ b/DocDB/cgi/CustomListForm
@@ -9,7 +9,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/DBColumnSizes.pm b/DocDB/cgi/DBColumnSizes.pm
index 3ec49b86..f7d82124 100644
--- a/DocDB/cgi/DBColumnSizes.pm
+++ b/DocDB/cgi/DBColumnSizes.pm
@@ -7,7 +7,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/DBUtilities.pm b/DocDB/cgi/DBUtilities.pm
index d6e34ac8..a589e925 100644
--- a/DocDB/cgi/DBUtilities.pm
+++ b/DocDB/cgi/DBUtilities.pm
@@ -5,7 +5,7 @@
 #    Modified: 
 #
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/Debug.pm b/DocDB/cgi/Debug.pm
index 0af275d0..f127fed5 100644
--- a/DocDB/cgi/Debug.pm
+++ b/DocDB/cgi/Debug.pm
@@ -1,5 +1,5 @@
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/DisplayMeeting b/DocDB/cgi/DisplayMeeting
index 2259e97e..550f1782 100755
--- a/DocDB/cgi/DisplayMeeting
+++ b/DocDB/cgi/DisplayMeeting
@@ -8,7 +8,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/DocDBFields.pm b/DocDB/cgi/DocDBFields.pm
index d09622b7..c11dd1c0 100644
--- a/DocDB/cgi/DocDBFields.pm
+++ b/DocDB/cgi/DocDBFields.pm
@@ -6,7 +6,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/DocDBHelp b/DocDB/cgi/DocDBHelp
index 86e89f33..7f74adea 100755
--- a/DocDB/cgi/DocDBHelp
+++ b/DocDB/cgi/DocDBHelp
@@ -6,7 +6,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified: 
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/DocDBHelp.xml b/DocDB/cgi/DocDBHelp.xml
index db11f729..fa35bd13 100644
--- a/DocDB/cgi/DocDBHelp.xml
+++ b/DocDB/cgi/DocDBHelp.xml
@@ -10,7 +10,7 @@
 
       Author: Eric Vaandering (ewv@fnal.gov)
 
- Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+ Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
     This file is part of DocDB.
 
diff --git a/DocDB/cgi/DocTypeAdminister b/DocDB/cgi/DocTypeAdminister
index 4eff62cb..a834e61b 100755
--- a/DocDB/cgi/DocTypeAdminister
+++ b/DocDB/cgi/DocTypeAdminister
@@ -8,7 +8,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified: 
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/DocTypeHTML.pm b/DocDB/cgi/DocTypeHTML.pm
index 68fae91d..312e7355 100644
--- a/DocDB/cgi/DocTypeHTML.pm
+++ b/DocDB/cgi/DocTypeHTML.pm
@@ -6,7 +6,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified: 
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/DocumentDatabase b/DocDB/cgi/DocumentDatabase
index 8122aa48..92c54bdd 100755
--- a/DocDB/cgi/DocumentDatabase
+++ b/DocDB/cgi/DocumentDatabase
@@ -11,7 +11,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/DocumentHTML.pm b/DocDB/cgi/DocumentHTML.pm
index 688455c0..85dcd1d1 100644
--- a/DocDB/cgi/DocumentHTML.pm
+++ b/DocDB/cgi/DocumentHTML.pm
@@ -6,7 +6,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/DocumentSQL.pm b/DocDB/cgi/DocumentSQL.pm
index 1b2591be..7f8fc7d3 100644
--- a/DocDB/cgi/DocumentSQL.pm
+++ b/DocDB/cgi/DocumentSQL.pm
@@ -1,5 +1,5 @@
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/DocumentUtilities.pm b/DocDB/cgi/DocumentUtilities.pm
index 0b34f677..beb0d086 100644
--- a/DocDB/cgi/DocumentUtilities.pm
+++ b/DocDB/cgi/DocumentUtilities.pm
@@ -8,7 +8,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified:
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/EditTalkInfo b/DocDB/cgi/EditTalkInfo
index a84e4f00..69c193dc 100755
--- a/DocDB/cgi/EditTalkInfo
+++ b/DocDB/cgi/EditTalkInfo
@@ -7,7 +7,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified: 
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/EmailCreate b/DocDB/cgi/EmailCreate
index 466937a5..be00e04b 100755
--- a/DocDB/cgi/EmailCreate
+++ b/DocDB/cgi/EmailCreate
@@ -6,7 +6,7 @@
 #    Modified: 
 #
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/EmailLogin b/DocDB/cgi/EmailLogin
index 7f9ee8ea..33aa12b7 100755
--- a/DocDB/cgi/EmailLogin
+++ b/DocDB/cgi/EmailLogin
@@ -6,7 +6,7 @@
 #    Modified: 
 #
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/EmailSecurity.pm b/DocDB/cgi/EmailSecurity.pm
index bdbad545..a4b5a8d5 100644
--- a/DocDB/cgi/EmailSecurity.pm
+++ b/DocDB/cgi/EmailSecurity.pm
@@ -8,7 +8,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/EmailUserHTML.pm b/DocDB/cgi/EmailUserHTML.pm
index 2a046d3d..65ab7fdd 100644
--- a/DocDB/cgi/EmailUserHTML.pm
+++ b/DocDB/cgi/EmailUserHTML.pm
@@ -1,5 +1,5 @@
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/EmailUtilities.pm b/DocDB/cgi/EmailUtilities.pm
index b02de41f..fcb32b13 100644
--- a/DocDB/cgi/EmailUtilities.pm
+++ b/DocDB/cgi/EmailUtilities.pm
@@ -1,4 +1,4 @@
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/EventAdministerForm b/DocDB/cgi/EventAdministerForm
index 153824ee..9e874cc6 100755
--- a/DocDB/cgi/EventAdministerForm
+++ b/DocDB/cgi/EventAdministerForm
@@ -9,7 +9,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/EventInstructions.pm b/DocDB/cgi/EventInstructions.pm
index d7f289fa..2b727c65 100644
--- a/DocDB/cgi/EventInstructions.pm
+++ b/DocDB/cgi/EventInstructions.pm
@@ -6,7 +6,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified:
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/EventUtilities.pm b/DocDB/cgi/EventUtilities.pm
index 42cf87fe..22eea1c6 100644
--- a/DocDB/cgi/EventUtilities.pm
+++ b/DocDB/cgi/EventUtilities.pm
@@ -7,7 +7,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/ExternalDocDBAdministerForm b/DocDB/cgi/ExternalDocDBAdministerForm
index 0170b727..27f79e26 100755
--- a/DocDB/cgi/ExternalDocDBAdministerForm
+++ b/DocDB/cgi/ExternalDocDBAdministerForm
@@ -7,7 +7,7 @@
 #    Modified: 
 #
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/FileHTML.pm b/DocDB/cgi/FileHTML.pm
index 470a22cb..24296d4f 100644
--- a/DocDB/cgi/FileHTML.pm
+++ b/DocDB/cgi/FileHTML.pm
@@ -6,7 +6,7 @@
 #    Modified:
 #
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/FileSQL.pm b/DocDB/cgi/FileSQL.pm
index 174e08f6..fb9660bd 100644
--- a/DocDB/cgi/FileSQL.pm
+++ b/DocDB/cgi/FileSQL.pm
@@ -1,6 +1,6 @@
 # FIXME: Should grab stuff from MiscSQL.pm
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/FormElements.pm b/DocDB/cgi/FormElements.pm
index 615cf226..0d84357e 100644
--- a/DocDB/cgi/FormElements.pm
+++ b/DocDB/cgi/FormElements.pm
@@ -8,7 +8,7 @@
 #    Modified: 
 #
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/GroupAdministerForm b/DocDB/cgi/GroupAdministerForm
index 0c932c72..e295cfca 100755
--- a/DocDB/cgi/GroupAdministerForm
+++ b/DocDB/cgi/GroupAdministerForm
@@ -6,7 +6,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified: 
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/GroupHTML.pm b/DocDB/cgi/GroupHTML.pm
index ad6abb67..cf1bb378 100644
--- a/DocDB/cgi/GroupHTML.pm
+++ b/DocDB/cgi/GroupHTML.pm
@@ -1,5 +1,5 @@
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/HTMLUtilities.pm b/DocDB/cgi/HTMLUtilities.pm
index 9274504c..060abd52 100644
--- a/DocDB/cgi/HTMLUtilities.pm
+++ b/DocDB/cgi/HTMLUtilities.pm
@@ -5,7 +5,7 @@
 #    Modified: 
 #
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/Images.pm b/DocDB/cgi/Images.pm
index f59f8e5d..67b2f236 100644
--- a/DocDB/cgi/Images.pm
+++ b/DocDB/cgi/Images.pm
@@ -5,7 +5,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified: 
 #
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/InstitutionAdminister b/DocDB/cgi/InstitutionAdminister
index 3380c513..79652e2c 100755
--- a/DocDB/cgi/InstitutionAdminister
+++ b/DocDB/cgi/InstitutionAdminister
@@ -8,7 +8,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified: 
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/JournalAdminister b/DocDB/cgi/JournalAdminister
index d96d68dd..e059b30c 100755
--- a/DocDB/cgi/JournalAdminister
+++ b/DocDB/cgi/JournalAdminister
@@ -7,7 +7,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified: 
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/JournalHTML.pm b/DocDB/cgi/JournalHTML.pm
index b1da4841..9f4513e6 100644
--- a/DocDB/cgi/JournalHTML.pm
+++ b/DocDB/cgi/JournalHTML.pm
@@ -5,7 +5,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified: 
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/KeywordAdministerForm b/DocDB/cgi/KeywordAdministerForm
index c8dd4820..4657b629 100755
--- a/DocDB/cgi/KeywordAdministerForm
+++ b/DocDB/cgi/KeywordAdministerForm
@@ -6,7 +6,7 @@
 #      Author: Lynn Garren (garren@fnal.gov)
 #    Modified: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/KeywordGroupAdminister b/DocDB/cgi/KeywordGroupAdminister
index a495ef0b..37fc9225 100755
--- a/DocDB/cgi/KeywordGroupAdminister
+++ b/DocDB/cgi/KeywordGroupAdminister
@@ -8,7 +8,7 @@
 #      Author: Lynn Garren (garren@fnal.gov)
 #    Modified: 
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/KeywordHTML.pm b/DocDB/cgi/KeywordHTML.pm
index 53df0eca..171bc752 100644
--- a/DocDB/cgi/KeywordHTML.pm
+++ b/DocDB/cgi/KeywordHTML.pm
@@ -7,7 +7,7 @@
 #    Modified: Eric Vaandering (ewv@fnal.gov)
 #
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/KeywordListAdminister b/DocDB/cgi/KeywordListAdminister
index 6022b8a4..fbf292c9 100755
--- a/DocDB/cgi/KeywordListAdminister
+++ b/DocDB/cgi/KeywordListAdminister
@@ -6,7 +6,7 @@
 #      Author: Lynn Garren (garren@fnal.gov)
 #    Modified: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/KeywordSQL.pm b/DocDB/cgi/KeywordSQL.pm
index 4d3507d8..9b7a05c2 100644
--- a/DocDB/cgi/KeywordSQL.pm
+++ b/DocDB/cgi/KeywordSQL.pm
@@ -5,7 +5,7 @@
 #      Author: Lynn Garren (garren@fnal.gov)
 #    Modified: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/ListAllMeetings b/DocDB/cgi/ListAllMeetings
index 2d48c63a..71a1fb8d 100755
--- a/DocDB/cgi/ListAllMeetings
+++ b/DocDB/cgi/ListAllMeetings
@@ -8,7 +8,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/ListAuthors b/DocDB/cgi/ListAuthors
index 96e16878..cd0eaa55 100755
--- a/DocDB/cgi/ListAuthors
+++ b/DocDB/cgi/ListAuthors
@@ -2,7 +2,7 @@
 #
 # Author Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/ListBy b/DocDB/cgi/ListBy
index 94c3d93d..7e68a495 100755
--- a/DocDB/cgi/ListBy
+++ b/DocDB/cgi/ListBy
@@ -8,7 +8,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/ListEventsBy b/DocDB/cgi/ListEventsBy
index b7e0ce06..a9d493ec 100755
--- a/DocDB/cgi/ListEventsBy
+++ b/DocDB/cgi/ListEventsBy
@@ -9,7 +9,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/ListGroupUsers b/DocDB/cgi/ListGroupUsers
index 1d12505c..56e69fb7 100755
--- a/DocDB/cgi/ListGroupUsers
+++ b/DocDB/cgi/ListGroupUsers
@@ -9,7 +9,7 @@
 #    Modified: 
 #
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/ListGroups b/DocDB/cgi/ListGroups
index 50afb95e..c94e877f 100755
--- a/DocDB/cgi/ListGroups
+++ b/DocDB/cgi/ListGroups
@@ -2,7 +2,7 @@
 #
 # Author Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/ListManagedDocuments b/DocDB/cgi/ListManagedDocuments
index afe7aaa9..df83a010 100755
--- a/DocDB/cgi/ListManagedDocuments
+++ b/DocDB/cgi/ListManagedDocuments
@@ -2,7 +2,7 @@
 #
 # Author Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/ListTopics b/DocDB/cgi/ListTopics
index 352333e1..1ed68742 100755
--- a/DocDB/cgi/ListTopics
+++ b/DocDB/cgi/ListTopics
@@ -2,7 +2,7 @@
 #
 # Author Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/ListTypes b/DocDB/cgi/ListTypes
index 6d7fc85d..132c1d56 100755
--- a/DocDB/cgi/ListTypes
+++ b/DocDB/cgi/ListTypes
@@ -2,7 +2,7 @@
 #
 # Author Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/MeetingHTML.pm b/DocDB/cgi/MeetingHTML.pm
index 86da2198..897f6496 100644
--- a/DocDB/cgi/MeetingHTML.pm
+++ b/DocDB/cgi/MeetingHTML.pm
@@ -7,7 +7,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified: Stephen Wood (saw@jlab.org), Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/MeetingSQL.pm b/DocDB/cgi/MeetingSQL.pm
index be8c6776..ab409376 100644
--- a/DocDB/cgi/MeetingSQL.pm
+++ b/DocDB/cgi/MeetingSQL.pm
@@ -7,7 +7,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/MeetingSecuritySQL.pm b/DocDB/cgi/MeetingSecuritySQL.pm
index e2dc1fbc..f4a086a3 100644
--- a/DocDB/cgi/MeetingSecuritySQL.pm
+++ b/DocDB/cgi/MeetingSecuritySQL.pm
@@ -4,7 +4,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified: 
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/MeetingSecurityUtilities.pm b/DocDB/cgi/MeetingSecurityUtilities.pm
index eceac78f..fde0cec8 100644
--- a/DocDB/cgi/MeetingSecurityUtilities.pm
+++ b/DocDB/cgi/MeetingSecurityUtilities.pm
@@ -4,7 +4,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified: 
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/MiscSQL.pm b/DocDB/cgi/MiscSQL.pm
index 7b8a9992..d979fe91 100644
--- a/DocDB/cgi/MiscSQL.pm
+++ b/DocDB/cgi/MiscSQL.pm
@@ -7,7 +7,7 @@
 #    Modified: 
 #
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/ModifyHome b/DocDB/cgi/ModifyHome
index ef919f25..8296db7f 100755
--- a/DocDB/cgi/ModifyHome
+++ b/DocDB/cgi/ModifyHome
@@ -3,7 +3,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified: 
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/NotificationHTML.pm b/DocDB/cgi/NotificationHTML.pm
index 3ebe07a5..4b32cdfb 100644
--- a/DocDB/cgi/NotificationHTML.pm
+++ b/DocDB/cgi/NotificationHTML.pm
@@ -1,4 +1,4 @@
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/NotificationSQL.pm b/DocDB/cgi/NotificationSQL.pm
index 9cc77968..073e2bbb 100644
--- a/DocDB/cgi/NotificationSQL.pm
+++ b/DocDB/cgi/NotificationSQL.pm
@@ -1,4 +1,4 @@
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/ProjectGlobals.pm.template b/DocDB/cgi/ProjectGlobals.pm.template
index 708c0dc6..3167fcec 100644
--- a/DocDB/cgi/ProjectGlobals.pm.template
+++ b/DocDB/cgi/ProjectGlobals.pm.template
@@ -9,7 +9,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified: 
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/ProjectMessages.pm.template b/DocDB/cgi/ProjectMessages.pm.template
index f45c49c2..5bffbb9d 100644
--- a/DocDB/cgi/ProjectMessages.pm.template
+++ b/DocDB/cgi/ProjectMessages.pm.template
@@ -5,7 +5,7 @@
 # project. 
 
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/ProjectRoutines.pm.template b/DocDB/cgi/ProjectRoutines.pm.template
index ca1172a3..28303c80 100644
--- a/DocDB/cgi/ProjectRoutines.pm.template
+++ b/DocDB/cgi/ProjectRoutines.pm.template
@@ -13,7 +13,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified: 
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/ReferenceLinks.pm b/DocDB/cgi/ReferenceLinks.pm
index f6b952dd..4085e0e5 100644
--- a/DocDB/cgi/ReferenceLinks.pm
+++ b/DocDB/cgi/ReferenceLinks.pm
@@ -1,5 +1,5 @@
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/ResponseElements.pm b/DocDB/cgi/ResponseElements.pm
index ba55bc7c..7504b964 100644
--- a/DocDB/cgi/ResponseElements.pm
+++ b/DocDB/cgi/ResponseElements.pm
@@ -7,7 +7,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified:
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/RetrieveFile b/DocDB/cgi/RetrieveFile
index c9cb821a..10822ddf 100755
--- a/DocDB/cgi/RetrieveFile
+++ b/DocDB/cgi/RetrieveFile
@@ -3,7 +3,7 @@
 # Author Eric Vaandering (ewv@fnal.gov)
 #
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/RevisionSQL.pm b/DocDB/cgi/RevisionSQL.pm
index 38642a32..57375713 100644
--- a/DocDB/cgi/RevisionSQL.pm
+++ b/DocDB/cgi/RevisionSQL.pm
@@ -8,7 +8,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified:
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/RevisionUtilities.pm b/DocDB/cgi/RevisionUtilities.pm
index 6047c932..75cdfe49 100644
--- a/DocDB/cgi/RevisionUtilities.pm
+++ b/DocDB/cgi/RevisionUtilities.pm
@@ -1,4 +1,4 @@
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/SQLChecks.pm b/DocDB/cgi/SQLChecks.pm
index c0f9d2ee..d65b4927 100644
--- a/DocDB/cgi/SQLChecks.pm
+++ b/DocDB/cgi/SQLChecks.pm
@@ -1,5 +1,5 @@
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/SQLUtilities.pm b/DocDB/cgi/SQLUtilities.pm
index 987ae8dd..380667da 100644
--- a/DocDB/cgi/SQLUtilities.pm
+++ b/DocDB/cgi/SQLUtilities.pm
@@ -6,7 +6,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/Scripts.pm b/DocDB/cgi/Scripts.pm
index ae014a46..d34f8ef1 100644
--- a/DocDB/cgi/Scripts.pm
+++ b/DocDB/cgi/Scripts.pm
@@ -7,7 +7,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/Search.pm b/DocDB/cgi/Search.pm
index 5cc56265..57a2fa21 100644
--- a/DocDB/cgi/Search.pm
+++ b/DocDB/cgi/Search.pm
@@ -10,7 +10,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/SearchAtoms.pm b/DocDB/cgi/SearchAtoms.pm
index 1d03945b..27eceaa6 100644
--- a/DocDB/cgi/SearchAtoms.pm
+++ b/DocDB/cgi/SearchAtoms.pm
@@ -6,7 +6,7 @@
 #
 # Author Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/SearchForm b/DocDB/cgi/SearchForm
index 76cf3d7e..5f6fc4ef 100755
--- a/DocDB/cgi/SearchForm
+++ b/DocDB/cgi/SearchForm
@@ -9,7 +9,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/SearchFormElements.pm b/DocDB/cgi/SearchFormElements.pm
index 97c55afc..99b97f33 100644
--- a/DocDB/cgi/SearchFormElements.pm
+++ b/DocDB/cgi/SearchFormElements.pm
@@ -44,7 +44,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/SearchModes.pm b/DocDB/cgi/SearchModes.pm
index 39d864d9..1942a766 100644
--- a/DocDB/cgi/SearchModes.pm
+++ b/DocDB/cgi/SearchModes.pm
@@ -1,5 +1,5 @@
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/Security.pm b/DocDB/cgi/Security.pm
index 7079c49f..9e8b1206 100644
--- a/DocDB/cgi/Security.pm
+++ b/DocDB/cgi/Security.pm
@@ -8,7 +8,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/SecurityHTML.pm b/DocDB/cgi/SecurityHTML.pm
index f6b49caf..9b540913 100644
--- a/DocDB/cgi/SecurityHTML.pm
+++ b/DocDB/cgi/SecurityHTML.pm
@@ -5,7 +5,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified: 
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/SecuritySQL.pm b/DocDB/cgi/SecuritySQL.pm
index 72e24bab..4bb30536 100644
--- a/DocDB/cgi/SecuritySQL.pm
+++ b/DocDB/cgi/SecuritySQL.pm
@@ -1,4 +1,4 @@
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/SelectEmailPrefs b/DocDB/cgi/SelectEmailPrefs
index d610ef8a..52e8df06 100755
--- a/DocDB/cgi/SelectEmailPrefs
+++ b/DocDB/cgi/SelectEmailPrefs
@@ -7,7 +7,7 @@
 #    Modified: 
 #
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/SelectGroups b/DocDB/cgi/SelectGroups
index ee76be83..58a7ffd3 100755
--- a/DocDB/cgi/SelectGroups
+++ b/DocDB/cgi/SelectGroups
@@ -6,7 +6,7 @@
 # Allow a user to choose to limit their membership to certain groups 
 # for a period of time
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/SetGroups b/DocDB/cgi/SetGroups
index 05eaae4f..d7c467b3 100755
--- a/DocDB/cgi/SetGroups
+++ b/DocDB/cgi/SetGroups
@@ -6,7 +6,7 @@
 # Allow a user to choose to limit their membership to certain groups
 # for a period of time
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/SetPrefs b/DocDB/cgi/SetPrefs
index 7a3bc249..511db715 100755
--- a/DocDB/cgi/SetPrefs
+++ b/DocDB/cgi/SetPrefs
@@ -9,7 +9,7 @@
 #      Author:  Adam Bryant
 #        Date:  24 March 2002
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/ShowCalendar b/DocDB/cgi/ShowCalendar
index cddaa748..63949cb5 100755
--- a/DocDB/cgi/ShowCalendar
+++ b/DocDB/cgi/ShowCalendar
@@ -9,7 +9,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/ShowDocument b/DocDB/cgi/ShowDocument
index 27e37875..d96f80a8 100755
--- a/DocDB/cgi/ShowDocument
+++ b/DocDB/cgi/ShowDocument
@@ -3,7 +3,7 @@
 # Author Eric Vaandering (ewv@fnal.gov)
 #
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/ShowTalkNote b/DocDB/cgi/ShowTalkNote
index 5b350cd6..c93bc1cb 100755
--- a/DocDB/cgi/ShowTalkNote
+++ b/DocDB/cgi/ShowTalkNote
@@ -7,7 +7,7 @@
 #    Revision: $Revision$
 #    Modified: $Author$ on $Date$
 #
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/SignRevision b/DocDB/cgi/SignRevision
index dc8b64c3..370bf4ee 100755
--- a/DocDB/cgi/SignRevision
+++ b/DocDB/cgi/SignRevision
@@ -7,7 +7,7 @@
 #    Modified: 
 #
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/SignatureReport b/DocDB/cgi/SignatureReport
index 87dd1b65..31af77d4 100755
--- a/DocDB/cgi/SignatureReport
+++ b/DocDB/cgi/SignatureReport
@@ -2,7 +2,7 @@
 #
 # Author Eric Vaandering (ewv@fnal.gov)
 #
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/SignoffChooser b/DocDB/cgi/SignoffChooser
index 1ddd03e9..ce4229c8 100755
--- a/DocDB/cgi/SignoffChooser
+++ b/DocDB/cgi/SignoffChooser
@@ -10,7 +10,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/SignoffHTML.pm b/DocDB/cgi/SignoffHTML.pm
index cdf2e6d2..83a36efa 100644
--- a/DocDB/cgi/SignoffHTML.pm
+++ b/DocDB/cgi/SignoffHTML.pm
@@ -6,7 +6,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/SignoffSQL.pm b/DocDB/cgi/SignoffSQL.pm
index f1569321..e7f37c77 100644
--- a/DocDB/cgi/SignoffSQL.pm
+++ b/DocDB/cgi/SignoffSQL.pm
@@ -5,7 +5,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/SignoffUtilities.pm b/DocDB/cgi/SignoffUtilities.pm
index 902e35f1..be4d19bd 100644
--- a/DocDB/cgi/SignoffUtilities.pm
+++ b/DocDB/cgi/SignoffUtilities.pm
@@ -5,7 +5,7 @@
 #    Revision: $Revision$
 #    Modified: $Author$ on $Date$
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/Statistics b/DocDB/cgi/Statistics
index f3e02cd3..8ba354ee 100755
--- a/DocDB/cgi/Statistics
+++ b/DocDB/cgi/Statistics
@@ -5,7 +5,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified: 
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/TalkHTML.pm b/DocDB/cgi/TalkHTML.pm
index d749eaa7..b133e0c2 100644
--- a/DocDB/cgi/TalkHTML.pm
+++ b/DocDB/cgi/TalkHTML.pm
@@ -4,7 +4,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified: Stephen Wood (saw@jlab.org)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/TalkHintSQL.pm b/DocDB/cgi/TalkHintSQL.pm
index 1334e642..67defa21 100644
--- a/DocDB/cgi/TalkHintSQL.pm
+++ b/DocDB/cgi/TalkHintSQL.pm
@@ -5,7 +5,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified: 
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/TalkHintUtilities.pm b/DocDB/cgi/TalkHintUtilities.pm
index beef355f..bac5d07b 100644
--- a/DocDB/cgi/TalkHintUtilities.pm
+++ b/DocDB/cgi/TalkHintUtilities.pm
@@ -5,7 +5,7 @@
 #    Modified: 
 #
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/TalkSQL.pm b/DocDB/cgi/TalkSQL.pm
index d9dc8f68..b87fd161 100644
--- a/DocDB/cgi/TalkSQL.pm
+++ b/DocDB/cgi/TalkSQL.pm
@@ -6,7 +6,7 @@
 #    Modified: 
 #
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/TopicHTML.pm b/DocDB/cgi/TopicHTML.pm
index 795b59a5..682e95cd 100644
--- a/DocDB/cgi/TopicHTML.pm
+++ b/DocDB/cgi/TopicHTML.pm
@@ -7,7 +7,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/TopicSQL.pm b/DocDB/cgi/TopicSQL.pm
index f8cd84b1..29b0ae33 100644
--- a/DocDB/cgi/TopicSQL.pm
+++ b/DocDB/cgi/TopicSQL.pm
@@ -7,7 +7,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified:
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/TopicUtilities.pm b/DocDB/cgi/TopicUtilities.pm
index ccf94cfd..23415cbe 100644
--- a/DocDB/cgi/TopicUtilities.pm
+++ b/DocDB/cgi/TopicUtilities.pm
@@ -1,7 +1,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified: 
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/Utilities.pm b/DocDB/cgi/Utilities.pm
index 458d2858..98b79bb4 100644
--- a/DocDB/cgi/Utilities.pm
+++ b/DocDB/cgi/Utilities.pm
@@ -1,4 +1,4 @@
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/VEntryOutput.pm b/DocDB/cgi/VEntryOutput.pm
index d7177bff..41153109 100644
--- a/DocDB/cgi/VEntryOutput.pm
+++ b/DocDB/cgi/VEntryOutput.pm
@@ -9,7 +9,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/WatchDocument b/DocDB/cgi/WatchDocument
index 3ce7273d..43d73311 100755
--- a/DocDB/cgi/WatchDocument
+++ b/DocDB/cgi/WatchDocument
@@ -7,7 +7,7 @@
 #    Modified:
 #
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/WebUtilities.pm b/DocDB/cgi/WebUtilities.pm
index 8b3d2f9d..cfccf428 100644
--- a/DocDB/cgi/WebUtilities.pm
+++ b/DocDB/cgi/WebUtilities.pm
@@ -1,4 +1,4 @@
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/XMLOutput.pm b/DocDB/cgi/XMLOutput.pm
index a9f3f986..29cc07bf 100644
--- a/DocDB/cgi/XMLOutput.pm
+++ b/DocDB/cgi/XMLOutput.pm
@@ -2,7 +2,7 @@
 # Author Eric Vaandering (ewv@fnal.gov)
 #
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/XRefHTML.pm b/DocDB/cgi/XRefHTML.pm
index 3d272532..f5b34454 100644
--- a/DocDB/cgi/XRefHTML.pm
+++ b/DocDB/cgi/XRefHTML.pm
@@ -4,7 +4,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified:
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/XRefSQL.pm b/DocDB/cgi/XRefSQL.pm
index 6d83b119..c861a0ff 100644
--- a/DocDB/cgi/XRefSQL.pm
+++ b/DocDB/cgi/XRefSQL.pm
@@ -4,7 +4,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified: 
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/XRefUtilities.pm b/DocDB/cgi/XRefUtilities.pm
index f8337e43..0e275aef 100644
--- a/DocDB/cgi/XRefUtilities.pm
+++ b/DocDB/cgi/XRefUtilities.pm
@@ -4,7 +4,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified: 
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/XSearch b/DocDB/cgi/XSearch
index 1423183c..daf60fb1 100755
--- a/DocDB/cgi/XSearch
+++ b/DocDB/cgi/XSearch
@@ -3,7 +3,7 @@
 # Author Eric Vaandering (ewv@fnal.gov)
 #
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/XSearch.pm b/DocDB/cgi/XSearch.pm
index 9f3caec3..3d12cc92 100644
--- a/DocDB/cgi/XSearch.pm
+++ b/DocDB/cgi/XSearch.pm
@@ -7,7 +7,7 @@
 #
 # Author Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 

From 538ef579b5c62455938f005dadd4535c0e1a7296 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ewv@fnal.gov>
Date: Wed, 19 Jun 2013 10:16:12 -0500
Subject: [PATCH 022/163] update 2011/12 to 2013

---
 DocDB/cgi/AddFiles               | 2 +-
 DocDB/cgi/Defaults.pm            | 2 +-
 DocDB/cgi/DocDBGlobals.pm        | 2 +-
 DocDB/cgi/DocDBVersion.pm        | 2 +-
 DocDB/cgi/DocumentAddForm        | 2 +-
 DocDB/cgi/EmailAdministerForm    | 2 +-
 DocDB/cgi/FileUtilities.pm       | 2 +-
 DocDB/cgi/GeneralInstructions.pm | 2 +-
 DocDB/cgi/MeetingModify          | 2 +-
 DocDB/cgi/ProcessDocumentAdd     | 2 +-
 DocDB/cgi/RetrieveArchive        | 2 +-
 DocDB/cgi/RevisionHTML.pm        | 2 +-
 DocDB/cgi/Search                 | 2 +-
 DocDB/cgi/SelectPrefs            | 2 +-
 DocDB/cgi/SessionModify          | 2 +-
 DocDB/cgi/Sorts.pm               | 2 +-
 DocDB/cgi/XMLUpload              | 2 +-
 17 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/DocDB/cgi/AddFiles b/DocDB/cgi/AddFiles
index 1550ff1f..aaa9dbb8 100755
--- a/DocDB/cgi/AddFiles
+++ b/DocDB/cgi/AddFiles
@@ -8,7 +8,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified:
 
-# Copyright 2001-2012 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/Defaults.pm b/DocDB/cgi/Defaults.pm
index 55aaddba..43419ce3 100644
--- a/DocDB/cgi/Defaults.pm
+++ b/DocDB/cgi/Defaults.pm
@@ -12,7 +12,7 @@
 #    SetAuthorDefault: Sets Author and Submitter defaults to cookie value
 #    SetFileOptions:   Sets archive mode and number of uploads
 
-# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/DocDBGlobals.pm b/DocDB/cgi/DocDBGlobals.pm
index 98821844..12ab8805 100644
--- a/DocDB/cgi/DocDBGlobals.pm
+++ b/DocDB/cgi/DocDBGlobals.pm
@@ -7,7 +7,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified:
 #
-# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/DocDBVersion.pm b/DocDB/cgi/DocDBVersion.pm
index 31b0cb14..1f04abb4 100644
--- a/DocDB/cgi/DocDBVersion.pm
+++ b/DocDB/cgi/DocDBVersion.pm
@@ -3,7 +3,7 @@
 #    Revision: $Revision$
 #    Modified: $Author$ on $Date$
 #
-# Copyright 2001-2012 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/DocumentAddForm b/DocDB/cgi/DocumentAddForm
index 27e0bd22..9e9424cb 100755
--- a/DocDB/cgi/DocumentAddForm
+++ b/DocDB/cgi/DocumentAddForm
@@ -8,7 +8,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2012 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/EmailAdministerForm b/DocDB/cgi/EmailAdministerForm
index fe36d4af..7fce2bf0 100755
--- a/DocDB/cgi/EmailAdministerForm
+++ b/DocDB/cgi/EmailAdministerForm
@@ -10,7 +10,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/FileUtilities.pm b/DocDB/cgi/FileUtilities.pm
index df1c1ec1..75ecb94e 100644
--- a/DocDB/cgi/FileUtilities.pm
+++ b/DocDB/cgi/FileUtilities.pm
@@ -1,5 +1,5 @@
 
-# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/GeneralInstructions.pm b/DocDB/cgi/GeneralInstructions.pm
index 837a3344..0bb7469d 100644
--- a/DocDB/cgi/GeneralInstructions.pm
+++ b/DocDB/cgi/GeneralInstructions.pm
@@ -6,7 +6,7 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified:
 
-# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 #    Additional Text: Marcia Teckenbrock
 
 #    This file is part of DocDB.
diff --git a/DocDB/cgi/MeetingModify b/DocDB/cgi/MeetingModify
index 1f611d00..b0ce0122 100755
--- a/DocDB/cgi/MeetingModify
+++ b/DocDB/cgi/MeetingModify
@@ -7,7 +7,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2012 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/ProcessDocumentAdd b/DocDB/cgi/ProcessDocumentAdd
index b84aa938..10faee40 100755
--- a/DocDB/cgi/ProcessDocumentAdd
+++ b/DocDB/cgi/ProcessDocumentAdd
@@ -8,7 +8,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2012 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/RetrieveArchive b/DocDB/cgi/RetrieveArchive
index 4e3e4712..6ac7eb55 100755
--- a/DocDB/cgi/RetrieveArchive
+++ b/DocDB/cgi/RetrieveArchive
@@ -7,7 +7,7 @@
 #    Modified:
 #
 
-# Copyright 2001-2012 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/RevisionHTML.pm b/DocDB/cgi/RevisionHTML.pm
index 692f7c59..816a4698 100644
--- a/DocDB/cgi/RevisionHTML.pm
+++ b/DocDB/cgi/RevisionHTML.pm
@@ -6,7 +6,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/Search b/DocDB/cgi/Search
index d21eee17..0a6a13ed 100755
--- a/DocDB/cgi/Search
+++ b/DocDB/cgi/Search
@@ -8,7 +8,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2012 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/SelectPrefs b/DocDB/cgi/SelectPrefs
index 979b0293..0ba81b7b 100755
--- a/DocDB/cgi/SelectPrefs
+++ b/DocDB/cgi/SelectPrefs
@@ -3,7 +3,7 @@
 # Author:  Adam Bryant
 #
 
-# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/SessionModify b/DocDB/cgi/SessionModify
index 6dc77f73..d2ca72a3 100755
--- a/DocDB/cgi/SessionModify
+++ b/DocDB/cgi/SessionModify
@@ -8,7 +8,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2012 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/Sorts.pm b/DocDB/cgi/Sorts.pm
index 3657a727..73128538 100644
--- a/DocDB/cgi/Sorts.pm
+++ b/DocDB/cgi/Sorts.pm
@@ -7,7 +7,7 @@
 #
 # Author Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2011 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
diff --git a/DocDB/cgi/XMLUpload b/DocDB/cgi/XMLUpload
index 8b982014..903404f2 100755
--- a/DocDB/cgi/XMLUpload
+++ b/DocDB/cgi/XMLUpload
@@ -11,7 +11,7 @@
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 
-# Copyright 2001-2012 Eric Vaandering, Lynn Garren, Adam Bryant
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 

From bdd5df0f6f9d47392f3ce36c43389df07ace090b Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ewv@fnal.gov>
Date: Wed, 26 Jun 2013 14:50:17 -0500
Subject: [PATCH 023/163] Add CGI::Untaint classes for escaped HTML (safehtml)
 and integers with leading/trailing spaces (typedint)

---
 DocDB/cgi/UntaintHTML.pm    | 39 +++++++++++++++++++++++++++++++++
 DocDB/cgi/UntaintInteger.pm | 43 +++++++++++++++++++++++++++++++++++++
 2 files changed, 82 insertions(+)
 create mode 100644 DocDB/cgi/UntaintHTML.pm
 create mode 100644 DocDB/cgi/UntaintInteger.pm

diff --git a/DocDB/cgi/UntaintHTML.pm b/DocDB/cgi/UntaintHTML.pm
new file mode 100644
index 00000000..f9bef105
--- /dev/null
+++ b/DocDB/cgi/UntaintHTML.pm
@@ -0,0 +1,39 @@
+#        Name: UntaintHTML.pm
+# Description: Turns user input into escaped HTML
+#
+#    Modified: Eric Vaandering (ewv@fnal.gov)
+#
+#      Author: Eric Vaandering (ewv@fnal.gov)
+
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
+
+#    This file is part of DocDB.
+
+#    DocDB is free software; you can redistribute it and/or modify
+#    it under the terms of version 2 of the GNU General Public License
+#    as published by the Free Software Foundation.
+
+#    DocDB is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+
+#    You should have received a copy of the GNU General Public License
+#    along with DocDB; if not, write to the Free Software
+#    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+
+package CGI::Untaint::safehtml;
+
+$VERSION = '1.00';
+
+use strict;
+use base 'CGI::Untaint::printable';
+use HTML::Entities qw(encode_entities_numeric);
+
+sub is_valid {
+  my $self = shift;
+  my $EscapedHTML = encode_entities_numeric($self->value); 
+  $self->value($EscapedHTML);
+}
+
+1;
\ No newline at end of file
diff --git a/DocDB/cgi/UntaintInteger.pm b/DocDB/cgi/UntaintInteger.pm
new file mode 100644
index 00000000..4ea05ee0
--- /dev/null
+++ b/DocDB/cgi/UntaintInteger.pm
@@ -0,0 +1,43 @@
+#        Name: UntaintInteger.pm
+# Description: Allows an integer with leading/trailing whitespace
+#
+#    Modified: Eric Vaandering (ewv@fnal.gov)
+#
+#      Author: Eric Vaandering (ewv@fnal.gov)
+
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
+
+#    This file is part of DocDB.
+
+#    DocDB is free software; you can redistribute it and/or modify
+#    it under the terms of version 2 of the GNU General Public License
+#    as published by the Free Software Foundation.
+
+#    DocDB is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+
+#    You should have received a copy of the GNU General Public License
+#    along with DocDB; if not, write to the Free Software
+#    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+
+package CGI::Untaint::typedint;
+
+$VERSION = '1.00';
+
+use strict;
+use base 'CGI::Untaint::object';
+
+sub _untaint_re { qr/^\s+([+-]?\d+)\s+$/ }
+
+sub is_valid {
+  my $self = shift;
+  my $NewInt = $self->value;
+     $NewInt =~ s/^\s+//; # Remove leading and trailing spaces
+     $NewInt =~ s/\s+$//;
+
+  $self->value($NewInt);
+}
+
+1;
\ No newline at end of file

From 9d243fdd51e26ed0743f7040857d996affc7e05a Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ewv@fnal.gov>
Date: Wed, 26 Jun 2013 14:56:24 -0500
Subject: [PATCH 024/163] Remove CVS variables, add description to ShowDocument

---
 DocDB/cgi/DocumentAddForm    | 6 ++----
 DocDB/cgi/ProcessDocumentAdd | 6 ++----
 DocDB/cgi/ShowDocument       | 5 ++++-
 3 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/DocDB/cgi/DocumentAddForm b/DocDB/cgi/DocumentAddForm
index 9e9424cb..dc411738 100755
--- a/DocDB/cgi/DocumentAddForm
+++ b/DocDB/cgi/DocumentAddForm
@@ -1,12 +1,10 @@
 #! /usr/bin/env perl
 #
-#        Name: $RCSfile$
+#        Name: DocumentAddForm
 # Description: The main form to add or modify documents or metadata
 #
-#    Revision: $Revision$
-#    Modified: $Author$ on $Date$
-#
 #      Author: Eric Vaandering (ewv@fnal.gov)
+#    Modified: Eric Vaandering (ewv@fnal.gov)
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
diff --git a/DocDB/cgi/ProcessDocumentAdd b/DocDB/cgi/ProcessDocumentAdd
index 10faee40..938a49d8 100755
--- a/DocDB/cgi/ProcessDocumentAdd
+++ b/DocDB/cgi/ProcessDocumentAdd
@@ -1,12 +1,10 @@
 #! /usr/bin/env perl
 #
-#        Name: $RCSfile$
+#        Name: ProcessDocumentAdd
 # Description: Receives the output of DocumentAddForm and creates or updates the document
 #
-#    Revision: $Revision$
-#    Modified: $Author$ on $Date$
-#
 #      Author: Eric Vaandering (ewv@fnal.gov)
+#    Modified: Eric Vaandering (ewv@fnal.gov)
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
diff --git a/DocDB/cgi/ShowDocument b/DocDB/cgi/ShowDocument
index d96f80a8..8b7764b0 100755
--- a/DocDB/cgi/ShowDocument
+++ b/DocDB/cgi/ShowDocument
@@ -1,7 +1,10 @@
 #! /usr/bin/env perl
 #
-# Author Eric Vaandering (ewv@fnal.gov)
+#        Name: ShowDocument
+# Description: Display a document, its metadata, links to other versions and links to the files
 #
+#      Author: Eric Vaandering (ewv@fnal.gov)
+#    Modified: Eric Vaandering (ewv@fnal.gov)
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 

From a3c715f7e332f4bcc5b9ae3962e7e1094d83664e Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ewv@fnal.gov>
Date: Wed, 26 Jun 2013 15:23:54 -0500
Subject: [PATCH 025/163] Minor cleanups to Untaint routines

---
 DocDB/cgi/UntaintHTML.pm    | 5 ++---
 DocDB/cgi/UntaintInteger.pm | 5 ++---
 2 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/DocDB/cgi/UntaintHTML.pm b/DocDB/cgi/UntaintHTML.pm
index f9bef105..ade7fe8a 100644
--- a/DocDB/cgi/UntaintHTML.pm
+++ b/DocDB/cgi/UntaintHTML.pm
@@ -1,9 +1,8 @@
 #        Name: UntaintHTML.pm
 # Description: Turns user input into escaped HTML
 #
-#    Modified: Eric Vaandering (ewv@fnal.gov)
-#
 #      Author: Eric Vaandering (ewv@fnal.gov)
+#    Modified: Eric Vaandering (ewv@fnal.gov)
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
@@ -36,4 +35,4 @@ sub is_valid {
   $self->value($EscapedHTML);
 }
 
-1;
\ No newline at end of file
+1;
diff --git a/DocDB/cgi/UntaintInteger.pm b/DocDB/cgi/UntaintInteger.pm
index 4ea05ee0..cfda06c2 100644
--- a/DocDB/cgi/UntaintInteger.pm
+++ b/DocDB/cgi/UntaintInteger.pm
@@ -1,9 +1,8 @@
 #        Name: UntaintInteger.pm
 # Description: Allows an integer with leading/trailing whitespace
 #
-#    Modified: Eric Vaandering (ewv@fnal.gov)
-#
 #      Author: Eric Vaandering (ewv@fnal.gov)
+#    Modified: Eric Vaandering (ewv@fnal.gov)
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
@@ -40,4 +39,4 @@ sub is_valid {
   $self->value($NewInt);
 }
 
-1;
\ No newline at end of file
+1;

From e97bd3f416fd3d6158efeee97606517a6c39ca36 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Thu, 27 Jun 2013 14:44:37 -0500
Subject: [PATCH 026/163] Start cleanup of adding documents

---
 DocDB/cgi/DocumentAddForm    | 1 +
 DocDB/cgi/HTMLUtilities.pm   | 6 ++++++
 DocDB/cgi/ProcessDocumentAdd | 6 ++++--
 3 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/DocDB/cgi/DocumentAddForm b/DocDB/cgi/DocumentAddForm
index 9e9424cb..d43058a4 100755
--- a/DocDB/cgi/DocumentAddForm
+++ b/DocDB/cgi/DocumentAddForm
@@ -61,6 +61,7 @@ require "SignoffHTML.pm";
 require "TalkHTML.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 
 &GetAuthors;
diff --git a/DocDB/cgi/HTMLUtilities.pm b/DocDB/cgi/HTMLUtilities.pm
index 060abd52..825e7e26 100644
--- a/DocDB/cgi/HTMLUtilities.pm
+++ b/DocDB/cgi/HTMLUtilities.pm
@@ -23,6 +23,12 @@
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
 
+# Make available these handlers to every script that needs them
+
+use CGI::Untaint;
+require "UntaintHTML.pm";
+require "UntaintInteger.pm";
+
 require "ProjectRoutines.pm";
 
 sub PrettyHTML ($) {
diff --git a/DocDB/cgi/ProcessDocumentAdd b/DocDB/cgi/ProcessDocumentAdd
index 10faee40..4fd4fdb8 100755
--- a/DocDB/cgi/ProcessDocumentAdd
+++ b/DocDB/cgi/ProcessDocumentAdd
@@ -71,6 +71,8 @@ GetSecurityGroups();
 ### Set up, give user initial information
 
 %params = $query -> Vars;
+my $Untaint   = CGI::Untaint -> new($query -> Vars);
+
 $mode = $params{mode}; #FIXME: Remove
 $Mode = $params{mode};
 
@@ -88,9 +90,9 @@ if ($Mode eq "reserve") {
 ### FIXME: Any reason all of these can't be "my"?
 
 my $Archive       = $params{archive};
-my $DocTypeID     = $params{doctype};
+my $DocTypeID = $Untaint -> extract (-as_integer => "doctype")  || 0;
 my $Title         = $params{title};
-my $Abstract      = $params{abstract};
+my $Abstract = $Untaint -> extract (-as_safehtml => "abstract")  || "";
 my $PubInfo       = $params{pubinfo};
 my $AuthorMode    = $params{authormode};
    $Overdate      = $params{overdate};

From c9ef59c30a39ab3fe1d7e7eb60ddb0aed38aa8e9 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Thu, 27 Jun 2013 16:30:40 -0500
Subject: [PATCH 027/163] Update the easy things in ProcessDocumentAdd

---
 DocDB/cgi/ProcessDocumentAdd | 75 +++++++++++++++++++++++-------------
 1 file changed, 48 insertions(+), 27 deletions(-)

diff --git a/DocDB/cgi/ProcessDocumentAdd b/DocDB/cgi/ProcessDocumentAdd
index 4fd4fdb8..939cabdf 100755
--- a/DocDB/cgi/ProcessDocumentAdd
+++ b/DocDB/cgi/ProcessDocumentAdd
@@ -70,7 +70,7 @@ GetSecurityGroups();
 
 ### Set up, give user initial information
 
-%params = $query -> Vars;
+%params = $query -> Vars; # TODO remove
 my $Untaint   = CGI::Untaint -> new($query -> Vars);
 
 $mode = $params{mode}; #FIXME: Remove
@@ -89,37 +89,58 @@ if ($Mode eq "reserve") {
 ### FIXME: Get all the params here, too confusing later on to be using $param
 ### FIXME: Any reason all of these can't be "my"?
 
-my $Archive       = $params{archive};
-my $DocTypeID = $Untaint -> extract (-as_integer => "doctype")  || 0;
-my $Title         = $params{title};
-my $Abstract = $Untaint -> extract (-as_safehtml => "abstract")  || "";
-my $PubInfo       = $params{pubinfo};
-my $AuthorMode    = $params{authormode};
-   $Overdate      = $params{overdate};
-   $Overday       = $params{overday};
-   $Overmonth     = $params{overmonth};
-   $Overyear      = $params{overyear};
-   $Overmin       = $params{overmin};
-   $Overhour      = $params{overhour};
-   @JournalIDs    = split /\0/,$params{journal};
-   @Volumes       = split /\0/,$params{volume};
-   @Pages         = split /\0/,$params{page};
-   $Keywords      = $params{keywords};
-   $Requester     = $params{requester}; #FIXME: Replace with RequesterID
-my $RequesterID   = $params{requester};
+# "Hidden" things
+
+my $Archive = $Untaint -> extract(-as_printable => "archive") || "";
+my $AuthorMode = $Untaint -> extract(-as_printable => "authormode") || "";
+my $OldVersion = $Untaint -> extract(-as_printable => "oldversion") || "";
+my $MaxFiles = $Untaint -> extract(-as_printable => "maxfiles") || "";
+my $UniqueID = $Untaint -> extract(-as_printable => "uniqueid") || "";
+
+# Text fields
+
+my $Title = $Untaint -> extract(-as_safehtml => "title") || "";
+my $Abstract = $Untaint -> extract(-as_safehtml => "abstract") || "";
+my $PubInfo = $Untaint -> extract(-as_safehtml => "pubinfo") || "";
+my $Keywords = $Untaint -> extract(-as_safehtml => "keywords") || "";
+my $RevisionNote = $Untaint -> extract(-as_safehtml => "revisionnote") || "";
+my $SignoffList = $Untaint -> extract(-as_safehtml => "signofflist") || "";
+
+# Checkboxes
+
+my $SubmitAgree = $Untaint -> extract(-as_printable => "submitagree") || "";
+my $PreserveSigs = $Untaint -> extract(-as_printable => "preservesigs") || "";
+my $LessFiles = $Untaint -> extract(-as_printable => "LessFiles") || "";
+
+# ID numbers and numerical fields
+
+my $DocTypeID = $Untaint -> extract(-as_integer => "doctype") || 0;
+my $RequesterID = $Untaint -> extract(-as_integer => "requester") || 0;
 my $SessionTalkID = $params{sessiontalkid};
-my $RevisionNote  = $params{revisionnote};
-my $SignoffList   = $params{signofflist};
-my $OldVersion    = $params{oldversion};
-my $SubmitAgree   = $params{submitagree};
-my $PreserveSigs  = $params{preservesigs};
-my $LessFiles     = $params{LessFiles};
-my $MaxFiles      = $params{maxfiles};
-my $UniqueID      = $params{uniqueid};
+
+my $Overdate = $Untaint -> extract(-as_integer => "overdate") || 0;
+my $Overday = $Untaint -> extract(-as_integer => "overday") || 0;
+my $Overmonth = $Untaint -> extract(-as_integer => "overmonth") || 0;
+my $Overyear = $Untaint -> extract(-as_integer => "overyear") || 0;
+my $Overmin = $Untaint -> extract(-as_integer => "overmin") || 0;
+my $Overhour = $Untaint -> extract(-as_integer => "overhour") || 0;
+
+# Stuff to fix
+
+my   @JournalIDs    = split /\0/,$params{journal};
+my   @Volumes       = split /\0/,$params{volume};
+my   @Pages         = split /\0/,$params{page};
+
+$Requester     = $RequesterID; #FIXME: Replace with RequesterID
+
 my @XRefs         = split /,*\s+/,$params{xrefs}; # Can be comma or space separated
 my @EventIDs          = $query -> param('events');
 my @RequestedTopicIDs = $query -> param('topics');
 
+# FIXME: All the file stuff (maybe can keep looping through like below
+# FIXME: Authors. Extract to two fields with untaint, pass through to figure out IDs
+
+
 if ($Archive eq "multi") {$Archive = "single";} # No real difference
 
 # Fill in file hash

From c3a57933b58256f7f42444290dfafbaf088b38e3 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Mon, 1 Jul 2013 15:22:17 -0500
Subject: [PATCH 028/163] Minimal SmartHTML for testing

---
 DocDB/cgi/HTMLUtilities.pm | 37 +++++++++++++++++++++++++++++++++++++
 DocDB/cgi/RevisionHTML.pm  |  9 ++++++---
 2 files changed, 43 insertions(+), 3 deletions(-)

diff --git a/DocDB/cgi/HTMLUtilities.pm b/DocDB/cgi/HTMLUtilities.pm
index 825e7e26..88f93bc9 100644
--- a/DocDB/cgi/HTMLUtilities.pm
+++ b/DocDB/cgi/HTMLUtilities.pm
@@ -31,6 +31,43 @@ require "UntaintInteger.pm";
 
 require "ProjectRoutines.pm";
 
+sub SmartHTML ($) {
+  my ($ArgRef) = @_;
+  my $Text          = exists $ArgRef->{-text}          ?  $ArgRef->{-text}          : "";
+  my $MakeURLs      = exists $ArgRef->{-makeURLs}      ?  $ArgRef->{-makeURLs}      : $FALSE;
+  my $AddLineBreaks = exists $ArgRef->{-addLineBreaks} ?  $ArgRef->{-addLineBreaks} : $FALSE;
+  $MakeURLs = $FALSE;
+  $AddLineBreaks = $FALSE;
+  if ($MakeURLs) {
+
+    my $urls = '(http|telnet|gopher|file|wais|ftp|https)';
+    my $ltrs = '\w';
+    my $gunk = '/#~:.?+=&%@!\-';
+    my $punc = '.:?\-';
+    my $any  = "${ltrs}${gunk}${punc}";
+    $Text =~ s{
+              \b                    # start at word boundary
+              (                     # begin $1  {
+               $urls     :          # need resource and a colon
+               [$any] +?            # followed by on or more
+                                    #  of any valid character, but
+                                    #  be conservative and take only
+                                    #  what you need to....
+              )                     # end   $1  }
+              (?=                   # look-ahead non-consumptive assertion
+               [$punc]*             # either 0 or more punctuation
+               [^$any]              #   followed by a non-url char
+               |                    # or else
+               $                    #   then end of the string
+              )
+             }{<a href="$1">$1</a>}igox;
+  }
+
+  $Text =~ s{([^\w\s&#;]|&(?!#\d+;))}{"&#".unpack(U,$1).";"}ge;
+
+  return $Text;
+}
+
 sub PrettyHTML ($) {
   my ($HTML) = @_;
   
diff --git a/DocDB/cgi/RevisionHTML.pm b/DocDB/cgi/RevisionHTML.pm
index 816a4698..a6ee8b8e 100644
--- a/DocDB/cgi/RevisionHTML.pm
+++ b/DocDB/cgi/RevisionHTML.pm
@@ -23,6 +23,8 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
+require "HTMLUtilities.pm";
+
 sub TitleBox (%) {
   my (%Params) = @_;
   #FIXME: Get rid of global default
@@ -234,9 +236,10 @@ sub PrintAbstract ($;$) {
   my $Format = exists $ArgRef->{-format} ? $ArgRef->{-format} : "div";
 
   if ($Abstract) {
-    $Abstract = &URLify($Abstract);
-    $Abstract =~ s/\n\n/<p\/>/g;
-    $Abstract =~ s/\n/<br\/>/g;
+#     $Abstract = &URLify($Abstract);
+#     $Abstract =~ s/\n\n/<p\/>/g;
+#     $Abstract =~ s/\n/<br\/>/g;
+    $Abstract = SmartHTML( {-text => $Abstract, -makeURLs => $TRUE, -addLineBreaks => $TRUE} );
   } else {
     $Abstract = "None";
   }

From 7b9ae97ad16ffcef19bfdae99a1e5c278091a18c Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Mon, 1 Jul 2013 15:38:03 -0500
Subject: [PATCH 029/163] Add line breaks back in

---
 DocDB/cgi/HTMLUtilities.pm | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/DocDB/cgi/HTMLUtilities.pm b/DocDB/cgi/HTMLUtilities.pm
index 88f93bc9..617221fb 100644
--- a/DocDB/cgi/HTMLUtilities.pm
+++ b/DocDB/cgi/HTMLUtilities.pm
@@ -37,7 +37,7 @@ sub SmartHTML ($) {
   my $MakeURLs      = exists $ArgRef->{-makeURLs}      ?  $ArgRef->{-makeURLs}      : $FALSE;
   my $AddLineBreaks = exists $ArgRef->{-addLineBreaks} ?  $ArgRef->{-addLineBreaks} : $FALSE;
   $MakeURLs = $FALSE;
-  $AddLineBreaks = $FALSE;
+#  $AddLineBreaks = $TRUE;
   if ($MakeURLs) {
 
     my $urls = '(http|telnet|gopher|file|wais|ftp|https)';
@@ -64,6 +64,11 @@ sub SmartHTML ($) {
   }
 
   $Text =~ s{([^\w\s&#;]|&(?!#\d+;))}{"&#".unpack(U,$1).";"}ge;
+  
+  if ($AddLineBreaks) {
+    $Text =~ s/\n\n/<p\/>/g;
+    $Text =~ s/\n/<br\/>/g;
+  }
 
   return $Text;
 }

From a72baecacaec2a0308a92328ef4e1b49c916a75b Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Mon, 1 Jul 2013 15:53:46 -0500
Subject: [PATCH 030/163] Try URL parsing

---
 DocDB/cgi/HTMLUtilities.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/DocDB/cgi/HTMLUtilities.pm b/DocDB/cgi/HTMLUtilities.pm
index 617221fb..3c6045f9 100644
--- a/DocDB/cgi/HTMLUtilities.pm
+++ b/DocDB/cgi/HTMLUtilities.pm
@@ -36,7 +36,7 @@ sub SmartHTML ($) {
   my $Text          = exists $ArgRef->{-text}          ?  $ArgRef->{-text}          : "";
   my $MakeURLs      = exists $ArgRef->{-makeURLs}      ?  $ArgRef->{-makeURLs}      : $FALSE;
   my $AddLineBreaks = exists $ArgRef->{-addLineBreaks} ?  $ArgRef->{-addLineBreaks} : $FALSE;
-  $MakeURLs = $FALSE;
+#  $MakeURLs = $FALSE;
 #  $AddLineBreaks = $TRUE;
   if ($MakeURLs) {
 

From 858c928c102a7de2a04e89625e6c6f9f91d9766d Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Mon, 1 Jul 2013 15:54:48 -0500
Subject: [PATCH 031/163] Try URL parsing, reverse order

---
 DocDB/cgi/HTMLUtilities.pm | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/DocDB/cgi/HTMLUtilities.pm b/DocDB/cgi/HTMLUtilities.pm
index 3c6045f9..0675be1e 100644
--- a/DocDB/cgi/HTMLUtilities.pm
+++ b/DocDB/cgi/HTMLUtilities.pm
@@ -38,6 +38,9 @@ sub SmartHTML ($) {
   my $AddLineBreaks = exists $ArgRef->{-addLineBreaks} ?  $ArgRef->{-addLineBreaks} : $FALSE;
 #  $MakeURLs = $FALSE;
 #  $AddLineBreaks = $TRUE;
+
+  $Text =~ s{([^\w\s&#;]|&(?!#\d+;))}{"&#".unpack(U,$1).";"}ge;
+  
   if ($MakeURLs) {
 
     my $urls = '(http|telnet|gopher|file|wais|ftp|https)';
@@ -63,8 +66,6 @@ sub SmartHTML ($) {
              }{<a href="$1">$1</a>}igox;
   }
 
-  $Text =~ s{([^\w\s&#;]|&(?!#\d+;))}{"&#".unpack(U,$1).";"}ge;
-  
   if ($AddLineBreaks) {
     $Text =~ s/\n\n/<p\/>/g;
     $Text =~ s/\n/<br\/>/g;

From 8b2a07fd6fd76c187e7b5450d898bc2a6634d299 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Sun, 7 Jul 2013 09:27:15 -0500
Subject: [PATCH 032/163] Ignore %, -, and use hex form

---
 DocDB/cgi/HTMLUtilities.pm | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/DocDB/cgi/HTMLUtilities.pm b/DocDB/cgi/HTMLUtilities.pm
index 0675be1e..236a738b 100644
--- a/DocDB/cgi/HTMLUtilities.pm
+++ b/DocDB/cgi/HTMLUtilities.pm
@@ -36,13 +36,12 @@ sub SmartHTML ($) {
   my $Text          = exists $ArgRef->{-text}          ?  $ArgRef->{-text}          : "";
   my $MakeURLs      = exists $ArgRef->{-makeURLs}      ?  $ArgRef->{-makeURLs}      : $FALSE;
   my $AddLineBreaks = exists $ArgRef->{-addLineBreaks} ?  $ArgRef->{-addLineBreaks} : $FALSE;
-#  $MakeURLs = $FALSE;
-#  $AddLineBreaks = $TRUE;
 
-  $Text =~ s{([^\w\s&#;]|&(?!#\d+;))}{"&#".unpack(U,$1).";"}ge;
-  
-  if ($MakeURLs) {
+  # Escape text into &x1234; format ignoring a alphanumerics and a few special characters
+  $Text =~ s{([^\:\/\.\-\w\s&#%;]|&(?!#?\w+;))}{"&#x".sprintf("%x", unpack(U,$1)).";"}ge;
 
+  # Turn found URLs into hyperlinks, adapted from Perl Cookbook, 6.21
+  if ($MakeURLs) {
     my $urls = '(http|telnet|gopher|file|wais|ftp|https)';
     my $ltrs = '\w';
     my $gunk = '/#~:.?+=&%@!\-';
@@ -66,6 +65,7 @@ sub SmartHTML ($) {
              }{<a href="$1">$1</a>}igox;
   }
 
+  # Make two line-feeds into a paragraph break and one into a line break in HTML
   if ($AddLineBreaks) {
     $Text =~ s/\n\n/<p\/>/g;
     $Text =~ s/\n/<br\/>/g;

From 0273b951f0fc6cf54de071bf416e9d303815aa74 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Sun, 7 Jul 2013 17:30:33 +0200
Subject: [PATCH 033/163] Refactor untaint, add list of ints

---
 DocDB/cgi/HTMLUtilities.pm     | 71 +++++++++++++++-------------------
 DocDB/cgi/ProcessDocumentAdd   |  5 +++
 DocDB/cgi/UntaintInput.pm      | 30 ++++++++++++++
 DocDB/cgi/UntaintListOfInts.pm | 41 ++++++++++++++++++++
 4 files changed, 108 insertions(+), 39 deletions(-)
 create mode 100644 DocDB/cgi/UntaintInput.pm
 create mode 100644 DocDB/cgi/UntaintListOfInts.pm

diff --git a/DocDB/cgi/HTMLUtilities.pm b/DocDB/cgi/HTMLUtilities.pm
index 236a738b..989e67a2 100644
--- a/DocDB/cgi/HTMLUtilities.pm
+++ b/DocDB/cgi/HTMLUtilities.pm
@@ -1,8 +1,8 @@
 #
-# Description: Routines to output headers, footers, navigation bars, etc. 
+# Description: Routines to output headers, footers, navigation bars, etc.
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified: 
+#    Modified:
 #
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
@@ -10,7 +10,7 @@
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -22,13 +22,6 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-
-# Make available these handlers to every script that needs them
-
-use CGI::Untaint;
-require "UntaintHTML.pm";
-require "UntaintInteger.pm";
-
 require "ProjectRoutines.pm";
 
 sub SmartHTML ($) {
@@ -76,19 +69,19 @@ sub SmartHTML ($) {
 
 sub PrettyHTML ($) {
   my ($HTML) = @_;
-  
+
   # This function is supposed to pretty-up any valid (X)HTML, but
-  # it doesn't work particularly well. As written, things like &nbsp; are not 
+  # it doesn't work particularly well. As written, things like &nbsp; are not
   # valid XML. One possibility is to use HTML::Entities::encode_numeric in some way
   # which should produce safe entities or to use a subsitution map
-  
+
   return $HTML;
-  
+
   use HTML::Entities;
   use XML::Twig;
-  
+
   my $OldHTML = $HTML;
-  
+
   $HTML = HTML::Entities::decode($HTML);
   $HTML = HTML::Entities::encode($HTML,'&');
 
@@ -99,12 +92,12 @@ sub PrettyHTML ($) {
   } else {
     push @DebugStack,"HTML Parse failed with error: ".$@;
     return $OldHTML;
-  }    
+  }
 }
 
-sub DocDBHeader { 
+sub DocDBHeader {
   my ($Title,$PageTitle,%Params) = @_;
-  
+
   my $Search  = $Params{-search}; # Fix search page!
   my $NoBody  = $Params{-nobody};
   my $Refresh = $Params{-refresh} || "";
@@ -113,10 +106,10 @@ sub DocDBHeader {
   my @ScriptParts = split /\//,$ENV{SCRIPT_NAME};
   my $ScriptName  = pop @ScriptParts;
 
-  unless ($PageTitle) { 
+  unless ($PageTitle) {
     $PageTitle = $Title;
-  }  
-  
+  }
+
   # FIXME: Do Hash lookup for scripts as they are certified XHTML?
   if ($DOCTYPE) {
     print $DOCTYPE;
@@ -128,17 +121,17 @@ sub DocDBHeader {
   print "<head>\n";
   if ($Refresh) {
     print "<meta http-equiv=\"refresh\" content=\"$Refresh\" />\n";
-  }  
+  }
   print '<meta http-equiv="Content-Type" content="text/html; charset='.$HTTP_ENCODING.'" />',"\n";
   print "<title>$Title</title>\n";
 
   # Include DocDB style sheets
-  
+
   my @PublicCSS = ("");
   if ($Public) {
     @PublicCSS = ("","Public");
   }
-  
+
   foreach my $ScriptCSS ("",$ScriptName) {
     foreach my $ProjectCSS ("",$ShortProject) {
       foreach my $PublicCSS (@PublicCSS) {
@@ -149,7 +142,7 @@ sub DocDBHeader {
             if ($BrowserCSS eq "_IE") { # Use IE format for including. Hopefully we can not give these to IE7
               print "<!--[if IE]>\n";
               print "<link rel=\"stylesheet\" href=\"$CSSURL\" type=\"text/css\" />\n";
-              print "<![endif]-->\n"; 
+              print "<![endif]-->\n";
             } else {
               print "<link rel=\"stylesheet\" href=\"$CSSURL\" type=\"text/css\" />\n";
             }
@@ -167,10 +160,10 @@ sub DocDBHeader {
       EventSearchScript();
     }
     print "<script type=\"text/javascript\" src=\"$JSURLPath/$Script.js\"></script>\n";
-  }  
+  }
 
   if (defined &ProjectHeader) {
-    &ProjectHeader($Title,$PageTitle); 
+    &ProjectHeader($Title,$PageTitle);
   }
 
   print "</head>\n";
@@ -180,30 +173,30 @@ sub DocDBHeader {
   } else {
     if ($NoBody) {
       print "<body class=\"PopUp\">\n";
-    } else {  
+    } else {
       print "<body class=\"Normal\">\n";
-    }  
-  }  
-  
+    }
+  }
+
   if (defined &ProjectBodyStart && !$NoBody) {
-    &ProjectBodyStart($Title,$PageTitle); 
+    &ProjectBodyStart($Title,$PageTitle);
   }
 }
 
 sub DocDBFooter ($$;%) {
   require "ResponseElements.pm";
-  
+
   my ($WebMasterEmail,$WebMasterName,%Params) = @_;
-  
+
   my $NoBody = $Params{-nobody};
 
   &DebugPage("At DocDBFooter");
-  
-  unless ($NoBody) { 
+
+  unless ($NoBody) {
     if (defined &ProjectFooter) {
-      &ProjectFooter($WebMasterEmail,$WebMasterName); 
+      &ProjectFooter($WebMasterEmail,$WebMasterName);
     }
-  }  
+  }
   print "</body></html>\n";
 }
 
diff --git a/DocDB/cgi/ProcessDocumentAdd b/DocDB/cgi/ProcessDocumentAdd
index 939cabdf..dbf86e02 100755
--- a/DocDB/cgi/ProcessDocumentAdd
+++ b/DocDB/cgi/ProcessDocumentAdd
@@ -45,6 +45,7 @@ require "FileUtilities.pm";
 require "TopicUtilities.pm";
 require "WebUtilities.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 
 require "Security.pm";
 require "Scripts.pm";
@@ -127,6 +128,10 @@ my $Overhour = $Untaint -> extract(-as_integer => "overhour") || 0;
 
 # Stuff to fix
 
+my @TestTopicIDs = $Untaint -> extract(-as_listofint => "topics") || ();
+
+push @DebugStack, "Topics from test are ".(join ',', @TestTopicIDs)." so there."
+
 my   @JournalIDs    = split /\0/,$params{journal};
 my   @Volumes       = split /\0/,$params{volume};
 my   @Pages         = split /\0/,$params{page};
diff --git a/DocDB/cgi/UntaintInput.pm b/DocDB/cgi/UntaintInput.pm
new file mode 100644
index 00000000..0609b916
--- /dev/null
+++ b/DocDB/cgi/UntaintInput.pm
@@ -0,0 +1,30 @@
+#
+# Description: Gather together all Untaint handlers for every script that needs them
+#
+#      Author: Eric Vaandering (ewv@fnal.gov)
+#    Modified: Eric Vaandering (ewv@fnal.gov)
+
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
+
+#    This file is part of DocDB.
+
+#    DocDB is free software; you can redistribute it and/or modify
+#    it under the terms of version 2 of the GNU General Public License
+#    as published by the Free Software Foundation.
+
+#    DocDB is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+
+#    You should have received a copy of the GNU General Public License
+#    along with DocDB; if not, write to the Free Software
+#    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+
+use CGI::Untaint;
+
+require "UntaintHTML.pm";
+require "UntaintInteger.pm";
+require "UntaintListOfInts.pm";
+
+1;
\ No newline at end of file
diff --git a/DocDB/cgi/UntaintListOfInts.pm b/DocDB/cgi/UntaintListOfInts.pm
new file mode 100644
index 00000000..464ac734
--- /dev/null
+++ b/DocDB/cgi/UntaintListOfInts.pm
@@ -0,0 +1,41 @@
+#        Name: UntaintInteger.pm
+# Description: Allows a list of (null separated) positive integers
+#
+#      Author: Eric Vaandering (ewv@fnal.gov)
+#    Modified: Eric Vaandering (ewv@fnal.gov)
+
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
+
+#    This file is part of DocDB.
+
+#    DocDB is free software; you can redistribute it and/or modify
+#    it under the terms of version 2 of the GNU General Public License
+#    as published by the Free Software Foundation.
+
+#    DocDB is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+
+#    You should have received a copy of the GNU General Public License
+#    along with DocDB; if not, write to the Free Software
+#    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+
+package CGI::Untaint::listofint;
+
+$VERSION = '1.00';
+
+use strict;
+use base 'CGI::Untaint::object';
+
+sub _untaint_re { qr/^((\d+)(\000)*)+$/ }
+
+sub is_valid {
+  my $self = shift;
+  my $RawValue = $self->value;
+  my @Values = split /\0/,$RawValue;
+
+  $self->value(@Values);
+}
+
+1;

From 33fec1cc66ccc879b8800763cf8e2973d643387b Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Sun, 7 Jul 2013 11:03:26 -0500
Subject: [PATCH 034/163] Working list of integer untainter

---
 DocDB/cgi/ProcessDocumentAdd   | 8 +++++---
 DocDB/cgi/UntaintListOfInts.pm | 6 ++++--
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/DocDB/cgi/ProcessDocumentAdd b/DocDB/cgi/ProcessDocumentAdd
index dbf86e02..73d4370c 100755
--- a/DocDB/cgi/ProcessDocumentAdd
+++ b/DocDB/cgi/ProcessDocumentAdd
@@ -128,9 +128,11 @@ my $Overhour = $Untaint -> extract(-as_integer => "overhour") || 0;
 
 # Stuff to fix
 
-my @TestTopicIDs = $Untaint -> extract(-as_listofint => "topics") || ();
-
-push @DebugStack, "Topics from test are ".(join ',', @TestTopicIDs)." so there."
+my $TestTopicIDs = $Untaint -> extract(-as_listofint => "topics") || undef;
+#my @TestTopicIDs = $Untaint -> extract(-as_listofint => "topics") || ();
+print STDERR  "TTI is ".$TestTopicIDs;
+my @TestTopicIDs = @{ $TestTopicIDs};
+push @DebugStack, "Topics from test are ".(join ',', @TestTopicIDs)." so there.";
 
 my   @JournalIDs    = split /\0/,$params{journal};
 my   @Volumes       = split /\0/,$params{volume};
diff --git a/DocDB/cgi/UntaintListOfInts.pm b/DocDB/cgi/UntaintListOfInts.pm
index 464ac734..20a45654 100644
--- a/DocDB/cgi/UntaintListOfInts.pm
+++ b/DocDB/cgi/UntaintListOfInts.pm
@@ -34,8 +34,10 @@ sub is_valid {
   my $self = shift;
   my $RawValue = $self->value;
   my @Values = split /\0/,$RawValue;
-
-  $self->value(@Values);
+  print STDERR "The decoded list is ".join ',',@Values;
+  my $ArrRef = \@Values;
+  print STDERR "Array Ref is ".$ArrRef;
+  $self->value($ArrRef);
 }
 
 1;

From 4038e4d1705769b5bc39c7dbc8aa23296ade4f97 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Sun, 7 Jul 2013 18:04:32 +0200
Subject: [PATCH 035/163] To avoid conflict

---
 DocDB/cgi/ProcessDocumentAdd | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/DocDB/cgi/ProcessDocumentAdd b/DocDB/cgi/ProcessDocumentAdd
index dbf86e02..8554267c 100755
--- a/DocDB/cgi/ProcessDocumentAdd
+++ b/DocDB/cgi/ProcessDocumentAdd
@@ -130,7 +130,7 @@ my $Overhour = $Untaint -> extract(-as_integer => "overhour") || 0;
 
 my @TestTopicIDs = $Untaint -> extract(-as_listofint => "topics") || ();
 
-push @DebugStack, "Topics from test are ".(join ',', @TestTopicIDs)." so there."
+push @DebugStack, "Topics from test are ".(join ',', @TestTopicIDs)." so there.";
 
 my   @JournalIDs    = split /\0/,$params{journal};
 my   @Volumes       = split /\0/,$params{volume};

From 1f59d55398efbeb3356c9ab18542e61838eae483 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Sun, 7 Jul 2013 21:06:45 +0200
Subject: [PATCH 036/163] Remove debugging from UntaintList

---
 DocDB/cgi/UntaintListOfInts.pm | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/DocDB/cgi/UntaintListOfInts.pm b/DocDB/cgi/UntaintListOfInts.pm
index 20a45654..b3044361 100644
--- a/DocDB/cgi/UntaintListOfInts.pm
+++ b/DocDB/cgi/UntaintListOfInts.pm
@@ -34,9 +34,8 @@ sub is_valid {
   my $self = shift;
   my $RawValue = $self->value;
   my @Values = split /\0/,$RawValue;
-  print STDERR "The decoded list is ".join ',',@Values;
   my $ArrRef = \@Values;
-  print STDERR "Array Ref is ".$ArrRef;
+
   $self->value($ArrRef);
 }
 

From 55c5b3c77f590c3519ae12656ae936b30c452928 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Mon, 8 Jul 2013 12:29:20 +0200
Subject: [PATCH 037/163] Try one line version

---
 DocDB/cgi/ProcessDocumentAdd | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/DocDB/cgi/ProcessDocumentAdd b/DocDB/cgi/ProcessDocumentAdd
index f5878180..f80ff3ab 100755
--- a/DocDB/cgi/ProcessDocumentAdd
+++ b/DocDB/cgi/ProcessDocumentAdd
@@ -128,11 +128,9 @@ my $Overhour = $Untaint -> extract(-as_integer => "overhour") || 0;
 
 # Stuff to fix
 
-my $TestTopicIDs = $Untaint -> extract(-as_listofint => "topics") || undef;
-#my @TestTopicIDs = $Untaint -> extract(-as_listofint => "topics") || ();
-print STDERR  "TTI is ".$TestTopicIDs;
-my @TestTopicIDs = @{ $TestTopicIDs};
-
+#FIXME: Coalesce to one line?
+#my $TestTopicIDs = $Untaint -> extract(-as_listofint => "topics") || undef;
+my @TestTopicIDs = @{ $Untaint -> extract(-as_listofint => "topics") || undef };
 push @DebugStack, "Topics from test are ".(join ',', @TestTopicIDs)." so there.";
 
 my   @JournalIDs    = split /\0/,$params{journal};

From 718ab3d46e92f8982574671ff2620723e0fcbf29 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Mon, 8 Jul 2013 05:38:30 -0500
Subject: [PATCH 038/163] add gitignore

---
 .gitignore | 9 +++++++++
 1 file changed, 9 insertions(+)
 create mode 100644 .gitignore

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 00000000..3efef7f1
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,9 @@
+.DS_Store
+.DS_Store?
+._*
+.Spotlight-V100
+.Trashes
+Icon?
+ehthumbs.db
+Thumbs.db
+

From fcac8fbb45fe328303c7fe5406a6c8c287208e58 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Mon, 8 Jul 2013 14:01:29 +0200
Subject: [PATCH 039/163] Add List Of Ints, take care of lists & file entry

---
 DocDB/cgi/ProcessDocumentAdd    | 55 +++++++++++++++++----------------
 DocDB/cgi/UntaintInput.pm       |  1 +
 DocDB/cgi/UntaintListOfInts.pm  |  2 +-
 DocDB/cgi/UntaintListOfWords.pm | 42 +++++++++++++++++++++++++
 4 files changed, 73 insertions(+), 27 deletions(-)
 create mode 100644 DocDB/cgi/UntaintListOfWords.pm

diff --git a/DocDB/cgi/ProcessDocumentAdd b/DocDB/cgi/ProcessDocumentAdd
index f80ff3ab..b188b4d9 100755
--- a/DocDB/cgi/ProcessDocumentAdd
+++ b/DocDB/cgi/ProcessDocumentAdd
@@ -117,6 +117,7 @@ my $LessFiles = $Untaint -> extract(-as_printable => "LessFiles") || "";
 
 my $DocTypeID = $Untaint -> extract(-as_integer => "doctype") || 0;
 my $RequesterID = $Untaint -> extract(-as_integer => "requester") || 0;
+   $Requester = $RequesterID; #FIXME: Replace with RequesterID
 my $SessionTalkID = $params{sessiontalkid};
 
 my $Overdate = $Untaint -> extract(-as_integer => "overdate") || 0;
@@ -126,22 +127,15 @@ my $Overyear = $Untaint -> extract(-as_integer => "overyear") || 0;
 my $Overmin = $Untaint -> extract(-as_integer => "overmin") || 0;
 my $Overhour = $Untaint -> extract(-as_integer => "overhour") || 0;
 
-# Stuff to fix
+# Journal Info
 
-#FIXME: Coalesce to one line?
-#my $TestTopicIDs = $Untaint -> extract(-as_listofint => "topics") || undef;
-my @TestTopicIDs = @{ $Untaint -> extract(-as_listofint => "topics") || undef };
-push @DebugStack, "Topics from test are ".(join ',', @TestTopicIDs)." so there.";
+my @JournalIDs = @{ $Untaint -> extract(-as_listofint => "journal") || undef };
+my @Volumes = @{ $Untaint -> extract(-as_listofwords => "volume") || undef };
+my @Pages = @{ $Untaint -> extract(-as_listofwords => "page") || undef };
 
-my   @JournalIDs    = split /\0/,$params{journal};
-my   @Volumes       = split /\0/,$params{volume};
-my   @Pages         = split /\0/,$params{page};
-
-$Requester     = $RequesterID; #FIXME: Replace with RequesterID
-
-my @XRefs         = split /,*\s+/,$params{xrefs}; # Can be comma or space separated
-my @EventIDs          = $query -> param('events');
-my @RequestedTopicIDs = $query -> param('topics');
+my @XRefs = split /,*\s+/,($Untaint -> extract(-as_safehtml => "xrefs") || ""); # Can be comma or space separated
+my @EventIDs = @{ $Untaint -> extract(-as_listofint => "events") || undef };
+my @RequestedTopicIDs = @{ $Untaint -> extract(-as_listofint => "topics") || undef };
 
 # FIXME: All the file stuff (maybe can keep looping through like below
 # FIXME: Authors. Extract to two fields with untaint, pass through to figure out IDs
@@ -150,6 +144,8 @@ my @RequestedTopicIDs = $query -> param('topics');
 if ($Archive eq "multi") {$Archive = "single";} # No real difference
 
 # Fill in file hash
+my $HttpUser = $Untaint -> extract(-as_printable => "http_user") || "";
+my $HttpPass = $Untaint -> extract(-as_printable => "http_pass") || "";
 
 my %Files = ();
 my $NeedURLs      = 0;
@@ -157,34 +153,41 @@ my $AddNewFile    = 0;
 my $NumberOfFiles = 0;
 for (my $i = 1; $i<= $MaxFiles; ++$i) {
   my $Key = $i; # Probably something better later
-  if ($params{"upload$i"}) {
+  my $UploadI = $Untaint -> extract(-as_printable => "upload$i") || "";
+  my $UrlI = $Untaint -> extract(-as_printable => "url$i") || "";
+  my $CopyI = $Untaint -> extract(-as_printable => "copy$i") || "";
+  my $FileIDI = $Untaint -> extract(-as_integer => "fileid$i") || 0;
+  my $NewNameI = $Untaint -> extract(-as_safehtml => "newname$i") || ""; # FIXME: More restrictive?
+  my $MainI = $Untaint -> extract(-as_integer => "main$i") || "";
+  my $DescriptionI = $Untaint -> extract(-as_safehtml => "filedesc$i") || "";
+  if ($UploadI) {
     $AddNewFile = 1;
     ++$NumberOfFiles;
-    $Files{$Key}{File} = $query ->  param("upload$i");
-  } elsif ($params{"url$i"}) {
+    $Files{$Key}{File} = $UploadI;
+  } elsif ($UrlI) {
     $NeedURLs = 1;
     $AddNewFile = 1;
     ++$NumberOfFiles;
-    $Files{$Key}{URL}         = $params{"url$i"};
-    $Files{$Key}{User}        = $params{http_user};
-    $Files{$Key}{Pass}        = $params{http_pass};
-    $Files{$Key}{NewFilename} = $params{"newname$i"};
-  } elsif ($params{"copyfile$i"}) {
+    $Files{$Key}{URL}         = $UrlI;
+    $Files{$Key}{User}        = $HttpUser;
+    $Files{$Key}{Pass}        = $HttpPass;
+    $Files{$Key}{NewFilename} = $NewNameI;
+  } elsif ($CopyI) {
     ++$NumberOfFiles;
-    $Files{$Key}{CopyFileID} = $params{"fileid$i"};
+    $Files{$Key}{CopyFileID} = $FileIDI;
   } elsif ($Mode eq "updatedb") {
     ++$NumberOfFiles;
-    $Files{$Key}{FileID} = $params{"fileid$i"};
+    $Files{$Key}{FileID} = $FileIDI;
     push @DebugStack,"Duplicating in slot $i, $Files{$Key}{FileID}";
   }
 
-  if ($params{"main$i"}) {
+  if ($MainI) {
     $Files{$Key}{Main} = 1;
   } else {
     $Files{$Key}{Main} = 0;
   }
 
-  $Files{$Key}{Description} = $params{"filedesc$i"};
+  $Files{$Key}{Description} = $DescriptionI;
 }
 
 # FIXME: Several places fetch information for the about-to-be-updated document
diff --git a/DocDB/cgi/UntaintInput.pm b/DocDB/cgi/UntaintInput.pm
index 0609b916..3b73405b 100644
--- a/DocDB/cgi/UntaintInput.pm
+++ b/DocDB/cgi/UntaintInput.pm
@@ -26,5 +26,6 @@ use CGI::Untaint;
 require "UntaintHTML.pm";
 require "UntaintInteger.pm";
 require "UntaintListOfInts.pm";
+require "UntaintListOfWords.pm";
 
 1;
\ No newline at end of file
diff --git a/DocDB/cgi/UntaintListOfInts.pm b/DocDB/cgi/UntaintListOfInts.pm
index b3044361..a4eb593f 100644
--- a/DocDB/cgi/UntaintListOfInts.pm
+++ b/DocDB/cgi/UntaintListOfInts.pm
@@ -1,4 +1,4 @@
-#        Name: UntaintInteger.pm
+#        Name: UntaintListOfInts.pm
 # Description: Allows a list of (null separated) positive integers
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
diff --git a/DocDB/cgi/UntaintListOfWords.pm b/DocDB/cgi/UntaintListOfWords.pm
new file mode 100644
index 00000000..58094635
--- /dev/null
+++ b/DocDB/cgi/UntaintListOfWords.pm
@@ -0,0 +1,42 @@
+#        Name: UntaintListOfWords.pm
+# Description: Allows a list of (null separated) words
+#
+#      Author: Eric Vaandering (ewv@fnal.gov)
+#    Modified: Eric Vaandering (ewv@fnal.gov)
+
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
+
+#    This file is part of DocDB.
+
+#    DocDB is free software; you can redistribute it and/or modify
+#    it under the terms of version 2 of the GNU General Public License
+#    as published by the Free Software Foundation.
+
+#    DocDB is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+
+#    You should have received a copy of the GNU General Public License
+#    along with DocDB; if not, write to the Free Software
+#    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+
+package CGI::Untaint::listofwords;
+
+$VERSION = '1.00';
+
+use strict;
+use base 'CGI::Untaint::object';
+
+sub _untaint_re { qr/^((\w+)(\000)*)+$/ }
+
+sub is_valid {
+  my $self = shift;
+  my $RawValue = $self->value;
+  my @Values = split /\0/,$RawValue;
+  my $ArrRef = \@Values;
+
+  $self->value($ArrRef);
+}
+
+1;

From 1821b20aa503532fd95c0414b76ddc971bdcf7dd Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Mon, 8 Jul 2013 16:36:00 +0200
Subject: [PATCH 040/163] Switch authors to untaint, cleanup Mode, untaint
 archive files, minor cleanups

---
 DocDB/cgi/HTMLUtilities.pm   |  7 +++++--
 DocDB/cgi/ProcessDocumentAdd | 30 ++++++++++++++++++------------
 DocDB/cgi/RevisionHTML.pm    |  3 ---
 3 files changed, 23 insertions(+), 17 deletions(-)

diff --git a/DocDB/cgi/HTMLUtilities.pm b/DocDB/cgi/HTMLUtilities.pm
index 989e67a2..25226199 100644
--- a/DocDB/cgi/HTMLUtilities.pm
+++ b/DocDB/cgi/HTMLUtilities.pm
@@ -24,6 +24,8 @@
 
 require "ProjectRoutines.pm";
 
+# FIXME: Remove URLify, Paragraphize, AddLineBreaks, SafeHTML (possibly) from Utitlities.pm
+
 sub SmartHTML ($) {
   my ($ArgRef) = @_;
   my $Text          = exists $ArgRef->{-text}          ?  $ArgRef->{-text}          : "";
@@ -60,8 +62,9 @@ sub SmartHTML ($) {
 
   # Make two line-feeds into a paragraph break and one into a line break in HTML
   if ($AddLineBreaks) {
-    $Text =~ s/\n\n/<p\/>/g;
-    $Text =~ s/\n/<br\/>/g;
+    $Text =~ s/\s*\n\s*\n\s*/<p\/>/g; # Replace two new lines and any space with <p>
+    $Text =~ s/\s*\n\s*/<br\/>\n/g;
+    $Text =~ s/<p\/>/<p\/>\n/g;
   }
 
   return $Text;
diff --git a/DocDB/cgi/ProcessDocumentAdd b/DocDB/cgi/ProcessDocumentAdd
index b188b4d9..99456f03 100755
--- a/DocDB/cgi/ProcessDocumentAdd
+++ b/DocDB/cgi/ProcessDocumentAdd
@@ -74,15 +74,15 @@ GetSecurityGroups();
 %params = $query -> Vars; # TODO remove
 my $Untaint   = CGI::Untaint -> new($query -> Vars);
 
-$mode = $params{mode}; #FIXME: Remove
-$Mode = $params{mode};
+my $Mode = $Untaint -> extract(-as_printable => "mode") || "";
+$mode = $Mode; #FIXME: Remove when not needed
 
 print $query -> header( -charset => $HTTP_ENCODING );
 if ($Mode eq "reserve") {
   &DocDBHeader("$Project Document Reservation Results","Document Reservation Results",-scripts => ["PopUps"]);
 } elsif ($Mode eq "add") {
   &DocDBHeader("$Project Document Addition Results","Document Addition Results",-scripts => ["PopUps"]);
-} elsif ($Mode eq "update" || $mode eq "updatedb") {
+} elsif ($Mode eq "update" || $Mode eq "updatedb") {
   &DocDBHeader("$Project Document Modification Results","Document Modification Results",-scripts => ["PopUps"]);
 }
 
@@ -127,6 +127,9 @@ my $Overyear = $Untaint -> extract(-as_integer => "overyear") || 0;
 my $Overmin = $Untaint -> extract(-as_integer => "overmin") || 0;
 my $Overhour = $Untaint -> extract(-as_integer => "overhour") || 0;
 
+my @AuthorIDs = @{ $Untaint -> extract(-as_listofint => "authors") || undef };
+my $AuthorManual = $Untaint -> extract(-as_safehtml => "authormanual") || "";
+
 # Journal Info
 
 my @JournalIDs = @{ $Untaint -> extract(-as_listofint => "journal") || undef };
@@ -137,7 +140,12 @@ my @XRefs = split /,*\s+/,($Untaint -> extract(-as_safehtml => "xrefs") || "");
 my @EventIDs = @{ $Untaint -> extract(-as_listofint => "events") || undef };
 my @RequestedTopicIDs = @{ $Untaint -> extract(-as_listofint => "topics") || undef };
 
-# FIXME: All the file stuff (maybe can keep looping through like below
+# Zip/tarfile params
+
+my $SingleUpload = $Untaint -> extract(-as_printable => "single_upload") || "";
+my $MainFile = $Untaint -> extract(-as_printable => "mainfile") || "";
+my $Description = $Untaint -> extract(-as_safehtml => "filedesc") || ""
+
 # FIXME: Authors. Extract to two fields with untaint, pass through to figure out IDs
 
 
@@ -196,17 +204,15 @@ for (my $i = 1; $i<= $MaxFiles; ++$i) {
 my %Archive = ();
 if ($Archive eq "archive") { # They uploaded a tar/zip file
   $AddNewFile = 1;
-  $Archive{File} = $query ->  param("single_upload");
-  $Archive{MainFile}    = $params{"mainfile"};
-  $Archive{Description} = $params{"filedesc"};
+  $Archive{File} = $SingleUpload;
+  $Archive{MainFile} = $MainFile;
+  $Archive{Description} = $Description;
 }
 
 my $OrderAuthors = $FALSE;
 if ($AuthorMode eq "field") {
   $OrderAuthors = $TRUE;
-  @authorIDs = ProcessManualAuthors($params{authormanual});
-} else {
-  @authorIDs = split /\0/,$params{authors};
+  @AuthorIDs = ProcessManualAuthors($AuthorManual);
 }
 
 if ($Overdate && $Overyear && $Overmonth && $Overday) {
@@ -359,7 +365,7 @@ if ($EnhancedSecurity) {
 }
 
 if ($mode eq "add" || $mode eq "update" || $mode eq "updatedb") {
-  unless (@authorIDs) {
+  unless (@AuthorIDs) {
     push @ErrorStack,"You must supply at least one author for this document.";
   }
 }
@@ -495,7 +501,7 @@ if (@XRefs) {
 ### Add to authors, topics and securities
 
 my $Count;
-$Count = InsertAuthors( -docrevid  => $DocRevID, -authorids => \@authorIDs, -order => $OrderAuthors);
+$Count = InsertAuthors( -docrevid  => $DocRevID, -authorids => \@AuthorIDs, -order => $OrderAuthors);
 $Count = InsertTopics(  -docrevid  => $DocRevID, -topicids  => \@TopicIDs);
 $Count = InsertSecurity(-docrevid  => $DocRevID,
                         -viewids   => \@securities,
diff --git a/DocDB/cgi/RevisionHTML.pm b/DocDB/cgi/RevisionHTML.pm
index a6ee8b8e..1a66f678 100644
--- a/DocDB/cgi/RevisionHTML.pm
+++ b/DocDB/cgi/RevisionHTML.pm
@@ -236,9 +236,6 @@ sub PrintAbstract ($;$) {
   my $Format = exists $ArgRef->{-format} ? $ArgRef->{-format} : "div";
 
   if ($Abstract) {
-#     $Abstract = &URLify($Abstract);
-#     $Abstract =~ s/\n\n/<p\/>/g;
-#     $Abstract =~ s/\n/<br\/>/g;
     $Abstract = SmartHTML( {-text => $Abstract, -makeURLs => $TRUE, -addLineBreaks => $TRUE} );
   } else {
     $Abstract = "None";

From da9b6bd115a1a841367295086288795a27208565 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Tue, 9 Jul 2013 14:58:31 +0200
Subject: [PATCH 041/163] Get rid of remaining params uses

---
 DocDB/cgi/ProcessDocumentAdd | 38 +++++++++++++++++++-----------------
 1 file changed, 20 insertions(+), 18 deletions(-)

diff --git a/DocDB/cgi/ProcessDocumentAdd b/DocDB/cgi/ProcessDocumentAdd
index 99456f03..e07d49b9 100755
--- a/DocDB/cgi/ProcessDocumentAdd
+++ b/DocDB/cgi/ProcessDocumentAdd
@@ -71,7 +71,7 @@ GetSecurityGroups();
 
 ### Set up, give user initial information
 
-%params = $query -> Vars; # TODO remove
+#%params = $query -> Vars; # TODO remove
 my $Untaint   = CGI::Untaint -> new($query -> Vars);
 
 my $Mode = $Untaint -> extract(-as_printable => "mode") || "";
@@ -87,8 +87,6 @@ if ($Mode eq "reserve") {
 }
 
 ### Pull info out of params into local variables
-### FIXME: Get all the params here, too confusing later on to be using $param
-### FIXME: Any reason all of these can't be "my"?
 
 # "Hidden" things
 
@@ -97,6 +95,8 @@ my $AuthorMode = $Untaint -> extract(-as_printable => "authormode") || "";
 my $OldVersion = $Untaint -> extract(-as_printable => "oldversion") || "";
 my $MaxFiles = $Untaint -> extract(-as_printable => "maxfiles") || "";
 my $UniqueID = $Untaint -> extract(-as_printable => "uniqueid") || "";
+my $DocumentID = $Untaint -> extract(-as_integer => "docid") || 0;
+my $UserVersion = $Untaint -> extract(-as_integer => "version") || undef; # Special case to allow modifying version 0 (reservations)
 
 # Text fields
 
@@ -117,8 +117,7 @@ my $LessFiles = $Untaint -> extract(-as_printable => "LessFiles") || "";
 
 my $DocTypeID = $Untaint -> extract(-as_integer => "doctype") || 0;
 my $RequesterID = $Untaint -> extract(-as_integer => "requester") || 0;
-   $Requester = $RequesterID; #FIXME: Replace with RequesterID
-my $SessionTalkID = $params{sessiontalkid};
+my $SessionTalkID = $Untaint -> extract(-as_integer => "sessiontalkid") || 0;
 
 my $Overdate = $Untaint -> extract(-as_integer => "overdate") || 0;
 my $Overday = $Untaint -> extract(-as_integer => "overday") || 0;
@@ -130,6 +129,9 @@ my $Overhour = $Untaint -> extract(-as_integer => "overhour") || 0;
 my @AuthorIDs = @{ $Untaint -> extract(-as_listofint => "authors") || undef };
 my $AuthorManual = $Untaint -> extract(-as_safehtml => "authormanual") || "";
 
+my @ViewGroupIDs = @{ $Untaint -> extract(-as_listofint => "security") || undef };
+my @ModifyGroupIDs = @{ $Untaint -> extract(-as_listofint => "modify") || undef };
+
 # Journal Info
 
 my @JournalIDs = @{ $Untaint -> extract(-as_listofint => "journal") || undef };
@@ -143,6 +145,7 @@ my @RequestedTopicIDs = @{ $Untaint -> extract(-as_listofint => "topics") || und
 # Zip/tarfile params
 
 my $SingleUpload = $Untaint -> extract(-as_printable => "single_upload") || "";
+my $SingleHTTP = $Untaint -> extract(-as_printable => "single_http") || "";
 my $MainFile = $Untaint -> extract(-as_printable => "mainfile") || "";
 my $Description = $Untaint -> extract(-as_safehtml => "filedesc") || ""
 
@@ -255,10 +258,10 @@ if ($PreserveSigs && !CanPreserveSigs()) {
 if ($PreserveSigs && $mode ne "updatedb") {
   push @ErrorStack,'Signatures may only be preserved when modifying document meta-data.';
 }
-unless ($params{requester}) {
+unless ($RequesterID) {
   push @ErrorStack,"You must supply a submitter for this document.";
 }
-unless ($params{title}) {
+unless ($Title) {
   push @ErrorStack,"You must supply a title for this document.";
 }
 
@@ -288,7 +291,7 @@ unless ($DocTypeID) {
 }
 
 if ($Mode eq "add" || $Mode eq "update") {
-  unless ($params{abstract}) {
+  unless ($Abstract) {
     push @ErrorStack,"You must supply an abstract for this document.";
   }
   unless ($AddNewFile) {
@@ -296,10 +299,10 @@ if ($Mode eq "add" || $Mode eq "update") {
                       If you just want to change information about the
                       document, choose `Update DB Info' instead.";
   }
-  if     ($params{single_upload} && $params{single_http}) {
+  if     ($SingleUpload && $SingleHTTP) {
     push @ErrorStack,"You may not specify both URL and file upload.";
   }
-  if     (!$params{mainfile} && $Archive eq "archive") {
+  if     (!$MainFile && $Archive eq "archive") {
     push @ErrorStack,"You must specify a main file in the archive.";
   }
 
@@ -310,7 +313,6 @@ if ($Mode eq "add" || $Mode eq "update") {
 }
 
 if ($Mode eq "update" && !$LessFiles) {
-  my $DocumentID = $params{docid};
   FetchDocument($DocumentID);
   my $Version = $Documents{$DocumentID}{NVersions};
   my $DocRevID = FetchRevisionByDocumentAndVersion($DocumentID,$Version);
@@ -323,10 +325,10 @@ if ($Mode eq "update" && !$LessFiles) {
 }
 
 if ($Mode eq "update" || $Mode eq "updatedb") {
-  unless ($params{docid}) {
+  unless ($DocumentID) {
     push @ErrorStack,"You must supply a document number to modify a document.";
   }
-  unless (&CanModify($params{docid})) {
+  unless (&CanModify($DocumentID)) {
     push @ErrorStack,"You are not allowed to modify this document.";
   }
 }
@@ -359,9 +361,9 @@ if ($mode eq "add" || $mode eq "update") {
   }
 }
 
-@securities  = split ("\0",$params{security});
+@securities  = @ViewGroupIDs;
 if ($EnhancedSecurity) {
-  @ModifyGroups = split ("\0",$params{modify});
+  @ModifyGroups = @ModifyGroupIDs;
 }
 
 if ($mode eq "add" || $mode eq "update" || $mode eq "updatedb") {
@@ -431,7 +433,7 @@ my $documentID;
 if ($mode eq "reserve" || $mode eq "add") {
   $documentID = &InsertDocument(-requesterid => $RequesterID, -datetime => $SQL_NOW, -dochash => $UniqueID);
 } else {
-  $documentID = $params{docid};
+  $documentID = $DocumentID;
 }
 
 ### Set version number. For reservations, it is "0", for new documents "1". For
@@ -448,8 +450,8 @@ if      ($mode eq "reserve") {
   $version   = $Documents{$documentID}{NVersions} + 1;
 } elsif ($mode eq "updatedb") {
   &FetchDocument($documentID);
-  if  (defined $params{version}) {
-    $version = $params{version};
+  if  (defined $UserVersion) {
+    $version = $UserVersion;
   } else {
     $version = $Documents{$documentID}{NVersions};
   }

From 2130f3e7e4c21c77800bc3feff85274ba9589fe5 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Tue, 9 Jul 2013 08:31:31 -0500
Subject: [PATCH 042/163] Go back to Param for actual file

---
 DocDB/cgi/ProcessDocumentAdd | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/DocDB/cgi/ProcessDocumentAdd b/DocDB/cgi/ProcessDocumentAdd
index e07d49b9..c84b5565 100755
--- a/DocDB/cgi/ProcessDocumentAdd
+++ b/DocDB/cgi/ProcessDocumentAdd
@@ -147,10 +147,7 @@ my @RequestedTopicIDs = @{ $Untaint -> extract(-as_listofint => "topics") || und
 my $SingleUpload = $Untaint -> extract(-as_printable => "single_upload") || "";
 my $SingleHTTP = $Untaint -> extract(-as_printable => "single_http") || "";
 my $MainFile = $Untaint -> extract(-as_printable => "mainfile") || "";
-my $Description = $Untaint -> extract(-as_safehtml => "filedesc") || ""
-
-# FIXME: Authors. Extract to two fields with untaint, pass through to figure out IDs
-
+my $Description = $Untaint -> extract(-as_safehtml => "filedesc") || "";
 
 if ($Archive eq "multi") {$Archive = "single";} # No real difference
 
@@ -164,12 +161,12 @@ my $AddNewFile    = 0;
 my $NumberOfFiles = 0;
 for (my $i = 1; $i<= $MaxFiles; ++$i) {
   my $Key = $i; # Probably something better later
-  my $UploadI = $Untaint -> extract(-as_printable => "upload$i") || "";
+  my $UploadI = $query -> param("upload$i"); #$Untaint -> extract(-as_printable => "upload$i") || "";
   my $UrlI = $Untaint -> extract(-as_printable => "url$i") || "";
   my $CopyI = $Untaint -> extract(-as_printable => "copy$i") || "";
   my $FileIDI = $Untaint -> extract(-as_integer => "fileid$i") || 0;
   my $NewNameI = $Untaint -> extract(-as_safehtml => "newname$i") || ""; # FIXME: More restrictive?
-  my $MainI = $Untaint -> extract(-as_integer => "main$i") || "";
+  my $MainI = $Untaint -> extract(-as_printable => "main$i") || "";
   my $DescriptionI = $Untaint -> extract(-as_safehtml => "filedesc$i") || "";
   if ($UploadI) {
     $AddNewFile = 1;

From 818455434853c35bf6b640c5cf65e76ac25a5720 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Tue, 9 Jul 2013 17:08:41 +0200
Subject: [PATCH 043/163] Use SmartHTML for notes, pubinfo

---
 DocDB/cgi/ProcessDocumentAdd | 2 +-
 DocDB/cgi/RevisionHTML.pm    | 8 ++------
 2 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/DocDB/cgi/ProcessDocumentAdd b/DocDB/cgi/ProcessDocumentAdd
index c84b5565..4e5f0099 100755
--- a/DocDB/cgi/ProcessDocumentAdd
+++ b/DocDB/cgi/ProcessDocumentAdd
@@ -161,7 +161,7 @@ my $AddNewFile    = 0;
 my $NumberOfFiles = 0;
 for (my $i = 1; $i<= $MaxFiles; ++$i) {
   my $Key = $i; # Probably something better later
-  my $UploadI = $query -> param("upload$i"); #$Untaint -> extract(-as_printable => "upload$i") || "";
+  my $UploadI = $query -> param("upload$i");
   my $UrlI = $Untaint -> extract(-as_printable => "url$i") || "";
   my $CopyI = $Untaint -> extract(-as_printable => "copy$i") || "";
   my $FileIDI = $Untaint -> extract(-as_integer => "fileid$i") || 0;
diff --git a/DocDB/cgi/RevisionHTML.pm b/DocDB/cgi/RevisionHTML.pm
index 1a66f678..7618664f 100644
--- a/DocDB/cgi/RevisionHTML.pm
+++ b/DocDB/cgi/RevisionHTML.pm
@@ -283,9 +283,7 @@ sub PrintRevisionNote {
   my ($RevisionNote) = @_;
   if ($RevisionNote) {
     print "<div id=\"RevisionNote\">\n";
-    $RevisionNote = &URLify($RevisionNote);
-    $RevisionNote =~ s/\n\n/<p\/>/g;
-    $RevisionNote =~ s/\n/<br\/>/g;
+    $RevisionNote = SmartHTML( {-text => $RevisionNote, -makeURLs => $TRUE, -addLineBreaks => $TRUE} );
     print "<dl>\n";
     print "<dt class=\"InfoHeader\"><span class=\"InfoHeader\">Notes and Changes:</span></dt>\n";
     print "<dd>$RevisionNote</dd>\n";
@@ -401,9 +399,7 @@ sub PrintPubInfo ($) {
   my ($pubinfo) = @_;
   if ($pubinfo) {
     print "<div id=\"PubInfo\">\n";
-    $pubinfo = &URLify($pubinfo);
-    $pubinfo =~ s/\n\n/<p>/g;
-    $pubinfo =~ s/\n/<br>/g;
+    $pubinfo = SmartHTML( {-text => $pubinfo, -makeURLs => $TRUE, -addLineBreaks => $TRUE} );
     print "<dl>\n";
     print "<dt class=\"InfoHeader\"><span class=\"InfoHeader\">Publication Information:</span></dt>\n";
     print "<dd>$pubinfo</dd>\n";

From 01829b32524fdcbde8c639fcf6c2ec8907a9baa6 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Tue, 9 Jul 2013 17:32:46 +0200
Subject: [PATCH 044/163] Add protections to title and file descriptions

---
 DocDB/cgi/FileHTML.pm         | 10 ++++++++--
 DocDB/cgi/ResponseElements.pm |  8 ++++++--
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/DocDB/cgi/FileHTML.pm b/DocDB/cgi/FileHTML.pm
index 24296d4f..653003ca 100644
--- a/DocDB/cgi/FileHTML.pm
+++ b/DocDB/cgi/FileHTML.pm
@@ -1,10 +1,10 @@
+#        Name: FileHTML.pm
 #
 # Description: Subroutines to provide links for files, groups of
 #              files and archives.
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified:
-#
+#    Modified: Eric Vaandering (ewv@fnal.gov)
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
@@ -23,6 +23,7 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
+require "HTMLUtilities.pm";
 
 sub FileListByRevID {
   require "MiscSQL.pm";
@@ -168,6 +169,11 @@ sub FileLink ($) {
 
   my $Link = "";
 
+  # Sanitize output
+  $ShortName = SmartHTML( {-text => $ShortName, } );
+  $Description = SmartHTML( {-text => $Description, } );
+  $PrintedName = SmartHTML( {-text => $PrintedName, } );
+
   if ($Format eq "short") {
     if ($Description) {
       return "<a href=\"$URL\" title=\"$ShortName\">$Description</a>";
diff --git a/DocDB/cgi/ResponseElements.pm b/DocDB/cgi/ResponseElements.pm
index 7504b964..4d61976a 100644
--- a/DocDB/cgi/ResponseElements.pm
+++ b/DocDB/cgi/ResponseElements.pm
@@ -24,6 +24,7 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
+require "HTMLUtilities.pm";
 require "AuthorHTML.pm"; #FIXME: Remove, move references to correct place
 require "TopicHTML.pm";  #FIXME: Remove, move references to correct place
 require "FileHTML.pm";   #FIXME: Remove, move references to correct place
@@ -31,11 +32,14 @@ require "RevisionHTML.pm";   #FIXME: Remove, move references to correct place
 
 sub PrintTitle {
   my ($Title) = @_;
+  my $HTML = "<h1>";
   if ($Title) {
-    print "<h1>$Title</h1>\n";
+    $HTML .= SmartHTML( {-text => $Title, } );
   } else {
-    print "<h1><b>Title:</b> none<br></h1>\n";
+    $HTML .= "<b>Title:</b> none";
   }
+  $HTML .= "</h1>\n";
+  print $HTML;
 }
 
 sub WarnPage () { # Non-fatal errors

From f9d715c20920ea041176d9482cbbd58900601915 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 10 Jul 2013 11:06:41 +0200
Subject: [PATCH 045/163] Use SmartHTML on authors

---
 DocDB/cgi/AuthorHTML.pm | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/DocDB/cgi/AuthorHTML.pm b/DocDB/cgi/AuthorHTML.pm
index cb4293e4..76671910 100644
--- a/DocDB/cgi/AuthorHTML.pm
+++ b/DocDB/cgi/AuthorHTML.pm
@@ -1,8 +1,9 @@
+#        Name: AuthorHTML.pm
 #
 # Description: Routines to create HTML elements for authors and institutions
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified:
+#    Modified: Eric Vaandering (ewv@fnal.gov)
 #
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
@@ -22,6 +23,8 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
+require "HTMLUtilities.pm";
+
 sub FirstAuthor ($;$) {
   my ($DocRevID,$ArgRef) = @_;
   my $Institution = exists $ArgRef->{-institution} ? $ArgRef->{-institution} : $FALSE;
@@ -152,6 +155,7 @@ sub AuthorLink ($;%) {
   FetchAuthor($AuthorID);
   FetchInstitution($Authors{$AuthorID}{InstitutionID});
   my $InstitutionName = $Institutions{$Authors{$AuthorID}{InstitutionID}}{LONG};
+  $InstitutionName = SmartHTML( {-text => $InstitutionName,} );
   unless ($Authors{$AuthorID}{FULLNAME}) {
     return "Unknown";
   }
@@ -165,9 +169,9 @@ sub AuthorLink ($;%) {
   my $Link;
   $Link = "<a href=\"$Script?authorid=$AuthorID\" title=\"$InstitutionName\">";
   if ($Format eq "full") {
-    $Link .= $Authors{$AuthorID}{FULLNAME};
+    $Link .= SmartHTML( {-text => $Authors{$AuthorID}{FULLNAME}, } );
   } elsif ($Format eq "formal") {
-    $Link .= $Authors{$AuthorID}{Formal};
+    $Link .= SmartHTML( {-text => $Authors{$AuthorID}{Formal}, } );
   }
   $Link .= "</a>";
 
@@ -185,7 +189,7 @@ sub PrintAuthorInfo {
 
   print "$link\n";
   print " of ";
-  print $Institutions{$Authors{$AuthorID}{InstitutionID}}{LONG};
+  print SmartHTML( {-text => $Institutions{$Authors{$AuthorID}{InstitutionID}}{LONG}, } );
 }
 
 sub AuthorsByInstitution {

From d5435f6ed38d14be5cdf44abac571aa6698ceca1 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 10 Jul 2013 11:27:51 +0200
Subject: [PATCH 046/163] Move Topics from CGI::escapeHTML to SmartHTML

---
 DocDB/cgi/TopicHTML.pm | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/DocDB/cgi/TopicHTML.pm b/DocDB/cgi/TopicHTML.pm
index 682e95cd..43f2d8c6 100644
--- a/DocDB/cgi/TopicHTML.pm
+++ b/DocDB/cgi/TopicHTML.pm
@@ -24,6 +24,8 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
+require "HTMLUtilities.pm";
+
 sub TopicListByID {
   my ($ArgRef) = @_;
   my @TopicIDs    = exists $ArgRef->{-topicids}    ? @{$ArgRef->{-topicids}}   : ();
@@ -116,14 +118,14 @@ sub TopicLink ($) {
   $Link = "";
 
   if ($Format eq "short") {
-    $Text    = CGI::escapeHTML($Topics{$TopicID}{Short});
+    $Text    = SmartHTML( {-text => $Topics{$TopicID}{Short}, } );
     $Tooltip = TopicName({-topicid => $TopicID, -format => "withparents",} );
   } elsif ($Format eq "long") {
-    $Text    = CGI::escapeHTML($Topics{$TopicID}{Long} );
-    $Tooltip = CGI::escapeHTML($Topics{$TopicID}{Short});
+    $Text    = SmartHTML( {-text => $Topics{$TopicID}{Long} , } );
+    $Tooltip = SmartHTML( {-text => $Topics{$TopicID}{Short}, } );
   } elsif ($Format eq "withparents") {
-    $Text    = CGI::escapeHTML($Topics{$TopicID}{Short});
-    $Tooltip = CGI::escapeHTML($Topics{$TopicID}{Long} );
+    $Text    = SmartHTML( {-text => $Topics{$TopicID}{Short}, } );
+    $Tooltip = SmartHTML( {-text => $Topics{$TopicID}{Long}, } );
     my @ParentTopicIDs = FetchTopicParents( {-topicid => $TopicID});
     if (@ParentTopicIDs) {
       my ($ParentTopicID) = @ParentTopicIDs;
@@ -156,7 +158,7 @@ sub TopicName ($) {
       $Text .= $Separator;
     }
   }
-  $Text .= CGI::escapeHTML($Topics{$TopicID}{Short});
+  $Text .= SmartHTML( {-text => $Topics{$TopicID}{Short}, } );
 
   return $Text;
 }

From afd868c90112cc361a76c88037f2a441eb1bd5e6 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 10 Jul 2013 13:46:48 +0200
Subject: [PATCH 047/163] Fix institute in ListBy

---
 DocDB/cgi/ListBy | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/DocDB/cgi/ListBy b/DocDB/cgi/ListBy
index 7e68a495..2a67c14d 100755
--- a/DocDB/cgi/ListBy
+++ b/DocDB/cgi/ListBy
@@ -144,11 +144,12 @@ if ($Days) {
 
   my $Link = AuthorLink($AuthorID);
 
-  $Message = "<span class=\"Highlight\">$Link of $Institutions{$Authors{$AuthorID}{InstitutionID}}{LONG}</span>
-              is listed as an author on the following documents:";
+  $Message = "<span class=\"Highlight\">$Link of ";
+  $Message .= SmartHTML( {-text => $Institutions{$Authors{$AuthorID}{InstitutionID}}{LONG}, } );
+  $Message .= "</span> is listed as an author on the following documents:";
   my %Hash = GetEventHashByModerator($AuthorID);
   if (%Hash) {
-    $Message .= '<br/>(List <a href="'.$ListEventsBy.'?authorid='.$AuthorID.'">events</a> moderated by '.$Authors{$AuthorID}{FULLNAME}.')';
+    $Message .= '<br/>(List <a href="'.$ListEventsBy.'?authorid='.$AuthorID.'">events</a> moderated by '.$Link.')';
   }
   @DocumentIDs = GetAuthorDocuments($AuthorID);
 } elsif ($EventID) {

From df6b130ebe5f8b69afd683dd1b05b4a738ed48da Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 10 Jul 2013 14:11:48 +0200
Subject: [PATCH 048/163] Make keyword printing safe

---
 DocDB/cgi/KeywordHTML.pm | 114 ++++++++++++++++++++-------------------
 1 file changed, 58 insertions(+), 56 deletions(-)

diff --git a/DocDB/cgi/KeywordHTML.pm b/DocDB/cgi/KeywordHTML.pm
index 171bc752..6f0a0367 100644
--- a/DocDB/cgi/KeywordHTML.pm
+++ b/DocDB/cgi/KeywordHTML.pm
@@ -1,7 +1,7 @@
 #
 #        Name: KeywordHTML.pm
-# Description: Routines to produce snippets of HTML and form elements 
-#              dealing with keywords 
+# Description: Routines to produce snippets of HTML and form elements
+#              dealing with keywords
 #
 #      Author: Lynn Garren (garren@fnal.gov)
 #    Modified: Eric Vaandering (ewv@fnal.gov)
@@ -12,7 +12,7 @@
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -26,9 +26,9 @@
 
 sub KeywordGroupInfo ($;$) {
   my ($KeyID,$mode) = @_;
-  
+
   require "KeywordSQL.pm";
-  
+
   &FetchKeywordGroup($KeyID);
   my $info;
   if ($mode eq "short") {
@@ -38,13 +38,15 @@ sub KeywordGroupInfo ($;$) {
   } else {
     $info = $KeywordGroups{$KeyID}{Short};
   }
-  
+
   return $info;
 }
 
 sub KeywordsbyKeywordGroup ($;$) {
+
+  # FIXME: Make KeyLink SafeHTML
   my ($KeywordGroupID,$Mode) = @_;
-  
+
   require "Sorts.pm";
 
   my @KeywordIDs = sort byKeyword &GetKeywordsByKeywordGroupID($KeywordGroupID);
@@ -61,13 +63,13 @@ sub KeywordsbyKeywordGroup ($;$) {
       $KeyLink = &KeywordLinkByID($KeywordID,-format => "short");
     }
     print "<li>$KeyLink</li>\n";
-  }  
+  }
   print "</ul>\n";
 }
 
 sub KeywordTable {
   my ($Mode) = @_;
-  
+
   require "Sorts.pm";
 
   my $NCols = 4;
@@ -80,7 +82,7 @@ sub KeywordTable {
     unless ($Col % $NCols) {
       if ($Row) {
         print "</tr>\n";
-      }  
+      }
       print "<tr valign=top>\n";
       ++$Row;
     }
@@ -88,7 +90,7 @@ sub KeywordTable {
     &KeywordsbyKeywordGroup($KeywordGroupID,$Mode);
     print "</td>\n";
     ++$Col;
-  }  
+  }
   print "</tr>\n";
   print "</table>\n";
 }
@@ -104,7 +106,7 @@ sub KeywordDetailedList {
     my $KeywordGroup = &KeywordGroupInfo($KeywordGroupID,"short");
     my $Label = $KeywordGroup;
     $Label =~ s/\s+//;
-    
+
     print "  <td>\n";
     print "  <a href=\"#$Label\"><b>$KeywordGroup</b>\n";
     print "  </td>\n";
@@ -135,15 +137,15 @@ sub KeywordDetailedList {
       print "  <td>$Link</td>\n";
       print "  <td>$Text</td>\n";
       print "</tr>\n";
-    }  
+    }
 
-  }  
+  }
   print "</table>\n";
 }
 
 sub KeywordSelect (%) { # Scrolling selectable list for keyword groups
-  my (%Params) = @_; 
-  
+  my (%Params) = @_;
+
   my $Format   = $Params{-format}   || "short";        # short, long, full
   my $Multiple = $Params{-multiple} || "";             # Any non-null text is "true"
   my $Name     = $Params{-name}     || "keywordlist";
@@ -151,19 +153,19 @@ sub KeywordSelect (%) { # Scrolling selectable list for keyword groups
   my $Disabled = $Params{-disabled} || "0";
 
   my $Booleans = "";
-  
+
   if ($Disabled) {
     $Booleans .= "-disabled";
-  }  
-  
+  }
+
 # Scrolling selectable list for keywords
   my @KeywordIDs = sort byKeyword keys %Keywords;
   my %KeywordLabels = ();
   foreach my $ID (@KeywordIDs) {
     if ($Format eq "short") {
-      $KeywordLabels{$ID} = $Keywords{$ID}{Short}; 
+      $KeywordLabels{$ID} = $Keywords{$ID}{Short};
     } elsif ($Format eq "long") {
-      $KeywordLabels{$ID} = $Keywords{$ID}{Long}; 
+      $KeywordLabels{$ID} = $Keywords{$ID}{Long};
     } elsif ($Format eq "full") {
       $KeywordLabels{$ID} = $Keywords{$ID}{Short}." [";
       if ($MaxLabel) {
@@ -172,78 +174,78 @@ sub KeywordSelect (%) { # Scrolling selectable list for keyword groups
         } else {
           $KeywordLabels{$ID} .= $Keywords{$ID}{Long};
         }
-        $KeywordLabels{$ID} .= "]"; 
-      }  
+        $KeywordLabels{$ID} .= "]";
+      }
     }
-  }  
+  }
   print FormElementTitle(-helplink => "keywords", -helptext => "Keywords");
-  print $query -> scrolling_list(-name => "keywordlist", -values => \@KeywordIDs, 
+  print $query -> scrolling_list(-name => "keywordlist", -values => \@KeywordIDs,
                                  -labels => \%KeywordLabels,
                                  -size => 10, -multiple => $Multiple, $Booleans );
 };
 
 sub KeywordGroupSelect (%) { # Scrolling selectable list for keyword groups
-  my (%Params) = @_; 
-  
+  my (%Params) = @_;
+
   my $Format   = $Params{-format}   || "short";        # short, full
   my $Multiple = $Params{-multiple} || "";             # Any non-null text is "true"
   my $Name     = $Params{-name}     || "keywordgroup";
   my $Remove   = $Params{-remove}   || "";
   my $Disabled = $Params{-disabled} || "0";
-  
+
   my $Booleans = "";
-  
+
   if ($Disabled) {
     $Booleans .= "-disabled";
-  }  
-  
+  }
+
   print FormElementTitle(-helplink => "keywordgroups", -helptext => "Keyword Groups");
   my @KeyGroupIDs = keys %KeywordGroups;
   my %GroupLabels = ();
-  
+
   foreach my $ID (@KeyGroupIDs) {
     if ($Format eq "full") {
       $GroupLabels{$ID} = "$KeywordGroups{$ID}{Short} [$KeywordGroups{$ID}{Long}]";
-    } else {  
+    } else {
       $GroupLabels{$ID} = $KeywordGroups{$ID}{Short};
-    }  
-  }  
+    }
+  }
 
   if ($Remove) {
     unshift @KeyGroupIDs,"-1";
     $GroupLabels{"-1"} = "Remove existing groups";
   }
-    
-  print $query -> scrolling_list(-name => $Name, 
-                                 -values => \@KeyGroupIDs, 
-                                 -labels => \%GroupLabels, -size => 10, 
+
+  print $query -> scrolling_list(-name => $Name,
+                                 -values => \@KeyGroupIDs,
+                                 -labels => \%GroupLabels, -size => 10,
                                  -multiple => $Multiple, $Booleans);
 };
 
 sub KeywordLinkByID ($;%) {
   my ($KeywordID,%Params) = @_;
-  
+
   my $Format = $Params{-format} || "short"; # short, long
   my $NoLink = $Params{-nolink} || "";      # will just return information
 
   &FetchKeyword($KeywordID);
   my $Keyword = $Keywords{$KeywordID}{Short};
   my $Link;
-  
-  unless ($NoLink) {  
+
+  unless ($NoLink) {
     $Link .= "<a href=\"$Search\?keywordsearchmode=anyword&amp;keywordsearch=$Keyword\">";
   }
-  
-  if ($Format eq "short") { 
+
+  if ($Format eq "short") {
     $Link .= $Keywords{$KeywordID}{Short};
   } elsif ($Format eq "long") {
     $Link .= $Keywords{$KeywordID}{Long};
-  }  
+  }
 
-  unless ($NoLink) {  
+  unless ($NoLink) {
     $Link .=  "</a>";
   }
-  
+
   return $Link;
 }
 
@@ -251,26 +253,26 @@ sub KeywordLink ($;%) { # FIXME: Allow parameters of short, long, full a la Lynn
   my ($Keyword,%Params) = @_;
 
   my $Format = $Params{-format} || "short"; # short, full
-  
-  my $ret = "<a href=\"$Search\?keywordsearchmode=anyword&amp;keywordsearch=$Keyword\">";
-  $ret .= "$Keyword";
+  my $SafeKeyword = SafeHTML( {-text => $Keyword} );
+  my $ret = "<a href=\"$Search\?keywordsearchmode=anyword;keywordsearch=$SafeKeyword\">";
+  $ret .= "$SafeKeyword";
   $ret .=  "</a>";
   return $ret;
-}         
+}
 
 sub KeywordsBox (%) {
-  my (%Params) = @_; 
+  my (%Params) = @_;
   #FIXME: Get rid of global default
-  
+
   my $Required = $Params{-required}   || 0;
 
-  my $ElementTitle = &FormElementTitle(-helplink  => "keywords" , 
+  my $ElementTitle = &FormElementTitle(-helplink  => "keywords" ,
                                        -helptext  => "Keywords" ,
                                        -extratext => "(space separated) - <a href=\"Javascript:keywordchooserwindow(\'$ListKeywords?mode=chooser\');\"><b>Keyword
   Chooser</b></a>",
                                        -required  => $Required );
-  print $ElementTitle,"\n";                                     
-  print $query -> textfield (-name => 'keywords', -default => $KeywordsDefault, 
+  print $ElementTitle,"\n";
+  print $query -> textfield (-name => 'keywords', -default => $KeywordsDefault,
                              -size => 70, -maxlength => 240);
 };
 

From 93f069f097873f76093be0b2f53c91372c0d355d Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 10 Jul 2013 14:13:54 +0200
Subject: [PATCH 049/163] Make keyword printing safe

---
 DocDB/cgi/KeywordHTML.pm | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/DocDB/cgi/KeywordHTML.pm b/DocDB/cgi/KeywordHTML.pm
index 6f0a0367..411cbd78 100644
--- a/DocDB/cgi/KeywordHTML.pm
+++ b/DocDB/cgi/KeywordHTML.pm
@@ -24,6 +24,8 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
+require "HTMLUtilities.pm";
+
 sub KeywordGroupInfo ($;$) {
   my ($KeyID,$mode) = @_;
 

From c7b62cc5f7970438a1cdc0cc03a08e3a06396488 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 10 Jul 2013 14:15:39 +0200
Subject: [PATCH 050/163] Make keyword printing safe

---
 DocDB/cgi/KeywordHTML.pm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/DocDB/cgi/KeywordHTML.pm b/DocDB/cgi/KeywordHTML.pm
index 411cbd78..5dffcf5a 100644
--- a/DocDB/cgi/KeywordHTML.pm
+++ b/DocDB/cgi/KeywordHTML.pm
@@ -46,7 +46,7 @@ sub KeywordGroupInfo ($;$) {
 
 sub KeywordsbyKeywordGroup ($;$) {
 
-  # FIXME: Make KeyLink SafeHTML
+  # FIXME: Make KeyLink SmartHTML
   my ($KeywordGroupID,$Mode) = @_;
 
   require "Sorts.pm";
@@ -255,7 +255,7 @@ sub KeywordLink ($;%) { # FIXME: Allow parameters of short, long, full a la Lynn
   my ($Keyword,%Params) = @_;
 
   my $Format = $Params{-format} || "short"; # short, full
-  my $SafeKeyword = SafeHTML( {-text => $Keyword} );
+  my $SafeKeyword = SmartHTML( {-text => $Keyword} );
   my $ret = "<a href=\"$Search\?keywordsearchmode=anyword;keywordsearch=$SafeKeyword\">";
   $ret .= "$SafeKeyword";
   $ret .=  "</a>";

From bb706509c2ac1742bfc24933f328091b2f2dc825 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 10 Jul 2013 14:33:04 +0200
Subject: [PATCH 051/163] Update Title, abstract, notes, pubinfo entry boxes to
 use SmartHTML

---
 DocDB/cgi/FormElements.pm | 188 +++++++++++++++++++-------------------
 DocDB/cgi/RevisionHTML.pm |  10 +-
 2 files changed, 101 insertions(+), 97 deletions(-)

diff --git a/DocDB/cgi/FormElements.pm b/DocDB/cgi/FormElements.pm
index 0d84357e..ee4e959f 100644
--- a/DocDB/cgi/FormElements.pm
+++ b/DocDB/cgi/FormElements.pm
@@ -1,11 +1,11 @@
 #
 #        Name: FormElements.pm
-# Description: Various routines which supply input forms for document 
-#              addition, etc. This file is deprecated. Routines are 
+# Description: Various routines which supply input forms for document
+#              addition, etc. This file is deprecated. Routines are
 #              being moved out into the various *HTML.pm files.
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified: 
+#    Modified:
 #
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
@@ -13,7 +13,7 @@
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -29,9 +29,9 @@ require "TopicHTML.pm";
 
 sub DaysPulldown (;$) {
   my ($DefaultDays) = @_;
-  unless ($DefaultDays) { 
+  unless ($DefaultDays) {
     $DefaultDays = $LastDays;
-  }  
+  }
   my @Days = (1,2,3,5,7,10,14,20,30,45,60,90,120,180 );
   print $query -> popup_menu (-name    => 'days', -values   => \@Days,
                               -default => $DefaultDays,  -onChange => "submit()");
@@ -39,7 +39,7 @@ sub DaysPulldown (;$) {
 
 sub DateTimePulldown (%) { # Note capitalization
   my (%Params) = @_;
-  
+
   my $Name        = $Params{-name}        || "date";
   my $Disabled    = $Params{-disabled}    || 0;
   my $DateOnly    = $Params{-dateonly}    || 0;
@@ -47,7 +47,7 @@ sub DateTimePulldown (%) { # Note capitalization
   my $OneTime     = $Params{-onetime}     || 0;
   my $OneLine     = $Params{-oneline}     || 0;
   my $Granularity = $Params{-granularity} || 5;
-  
+
   my $Default     = $Params{-default};
 
   my $HelpLink  = $Params{-helplink}  || "";
@@ -55,13 +55,13 @@ sub DateTimePulldown (%) { # Note capitalization
   my $Required  = $Params{-required}  || 0;
   my $NoBreak   = $Params{-nobreak}  ;
   my $ExtraText = $Params{-extratext};
-   
+
   my $Booleans = "";
-  
+
   if ($Disabled) {
     $Booleans .= "-disabled";
-  }  
-  
+  }
+
   my ($Sec,$Min,$Hour,$Day,$Mon,$Year) = localtime(time);
   $Year += 1900;
   $Min = (int (($Min+($Granularity/2))/$Granularity))*$Granularity; # Nearest $Granularity minutes
@@ -69,13 +69,13 @@ sub DateTimePulldown (%) { # Note capitalization
   my $DefaultHHMM;
   if ($Default) {
     my ($DefaultDate,$DefaultTime);
-    if ($DateOnly) { 
+    if ($DateOnly) {
       $DefaultDate = $Default;
     } elsif ($TimeOnly) {
       $DefaultTime = $Default;
     } else {
       ($DefaultDate,$DefaultTime) = split /\s+/,$Default;
-    }  
+    }
 
     ($Year,$Mon,$Day) = split /-/,$DefaultDate;
     $Day  = int($Day);
@@ -88,41 +88,41 @@ sub DateTimePulldown (%) { # Note capitalization
     $Sec  = int($Sec);
     $DefaultHHMM = sprintf "%2.2d:%2.2d",$Hour,$Min;
   }
-  
+
   my @Years = ();
   for (my $i = $FirstYear; $i<=$Year+1; ++$i) { # $FirstYear - current year + 1
     push @Years,$i;
-  }  
+  }
 
   my @Days = ();
   for (my $i = 1; $i<=31; ++$i) { # $FirstYear - current year
     push @Days,$i;
-  }  
+  }
 
   my @Hours = ();
   for (my $i = 0; $i<24; ++$i) {
     push @Hours,$i;
-  }  
+  }
 
   my @Minutes = ();
   for (my $i = 0; $i<=55; $i=$i+5) {
     push @Minutes,(sprintf "%2.2d",$i);
-  }  
-  
+  }
+
   my @Times = ();
   for (my $Hour = 0; $Hour<=23; ++$Hour) {
     for (my $Min = 0; $Min<=59; $Min=$Min+$Granularity) {
       push @Times,sprintf "%2.2d:%2.2d",$Hour,$Min;
-    }  
-  }  
-  
-  my $ElementTitle = &FormElementTitle(-helplink  => $HelpLink , 
+    }
+  }
+
+  my $ElementTitle = &FormElementTitle(-helplink  => $HelpLink ,
                                        -helptext  => $HelpText ,
                                        -extratext => $ExtraText,
                                        -text      => $Text     ,
                                        -nobreak   => $NoBreak  ,
                                        -required  => $Required );
-  print $ElementTitle,"\n";                                     
+  print $ElementTitle,"\n";
 
   unless ($DateOnly) {
     if ($OneTime) {
@@ -135,10 +135,10 @@ sub DateTimePulldown (%) { # Note capitalization
   }
   unless ($OneLine || $DateOnly || $TimeOnly) {
     print "<br\>\n";
-  } 
+  }
   if ($OneLine) {
     print "&nbsp;\n";
-  } 
+  }
   unless ($TimeOnly) {
     print $query -> popup_menu (-name => $Name."day",-values => \@Days, -default => $Day, $Booleans);
     print $query -> popup_menu (-name => $Name."month",-values => \@AbrvMonths, -default => $AbrvMonths[$Mon], $Booleans);
@@ -150,11 +150,11 @@ sub DateTimePullDown { #FIXME: Replace with DateTimePulldown
   my ($sec,$min,$hour,$day,$mon,$year) = localtime(time);
   $year += 1900;
   $min = (int (($min+3)/5))*5; # Nearest five minutes
-  
+
   my @days = ();
   for ($i = 1; $i<=31; ++$i) {
     push @days,$i;
-  }  
+  }
 
   my @months = ("Jan","Feb","Mar","Apr","May","Jun",
              "Jul","Aug","Sep","Oct","Nov","Dec");
@@ -162,18 +162,18 @@ sub DateTimePullDown { #FIXME: Replace with DateTimePulldown
   my @years = ();
   for ($i = $FirstYear; $i<=$year; ++$i) { # $FirstYear - current year
     push @years,$i;
-  }  
+  }
 
   my @hours = ();
   for ($i = 0; $i<24; ++$i) {
     push @hours,$i;
-  }  
+  }
 
   my @minutes = ();
   for ($i = 0; $i<=55; $i=$i+5) {
     push @minutes,(sprintf "%2.2d",$i);
-  }  
-  
+  }
+
   print FormElementTitle(-helplink => "overdate", -helptext => "Date &amp; Time");
   print $query -> popup_menu (-name => 'overday',-values => \@days, -default => $day);
   print $query -> popup_menu (-name => 'overmonth',-values => \@months, -default => $months[$mon]);
@@ -185,11 +185,11 @@ sub DateTimePullDown { #FIXME: Replace with DateTimePulldown
 }
 
 sub PubInfoBox {
-  my $ElementTitle = &FormElementTitle(-helplink  => "pubinfo", 
+  my $ElementTitle = &FormElementTitle(-helplink  => "pubinfo",
                                        -helptext  => "Other publication information");
-  print $ElementTitle,"\n";                                     
-
-  print $query -> textarea (-name => 'pubinfo', -default => $PubInfoDefault,
+  print $ElementTitle,"\n";
+  my $SafeDefault = SmartHTML({-text => $PubInfoDefault},);
+  print $query -> textarea (-name => 'pubinfo', -default => $SafeDefault,
                             -columns => 60, -rows => 3);
 };
 
@@ -197,20 +197,20 @@ sub InstitutionSelect (;%) { # Scrolling selectable list for institutions
   require "Sorts.pm";
 
   my (%Params) = @_;
-  
+
   my $Mode     = $Params{-format}    || "short";
   my $Disabled = $Params{-disabled}  || "0";
   my $Required = $Params{-required}  || $FALSE;
-  
+
   my $ExtraText;
   if ($Mode eq "full") {$ExtraText = "(Long descriptions in brackets)";}
-  
-  
-  my $ElementTitle = &FormElementTitle(-helplink  => "institution", 
+
+
+  my $ElementTitle = &FormElementTitle(-helplink  => "institution",
                                        -helptext  => "Institution",
                                        -extratext => $ExtraText,
                                        -required  => $Required);
-  print $ElementTitle,"\n";                                     
+  print $ElementTitle,"\n";
 
   my @InstIDs = sort byInstitution keys %Institutions;
   my %InstLabels = ();
@@ -220,8 +220,8 @@ sub InstitutionSelect (;%) { # Scrolling selectable list for institutions
     } else {
       $InstLabels{$ID} = $Institutions{$ID}{SHORT};
     }
-  } 
-  if ($Disabled) { 
+  }
+  if ($Disabled) {
     print $query -> scrolling_list(-name => "inst", -values => \@InstIDs,
                                    -labels => \%InstLabels,  -size => 10,
                                    -disabled);
@@ -233,37 +233,37 @@ sub InstitutionSelect (;%) { # Scrolling selectable list for institutions
 
 sub NameEntryBox (;%) {
   my (%Params) = @_;
-  
+
   my $Disabled = $Params{-disabled}  || "0";
-  
+
   my $Booleans = "";
-  
+
   if ($Disabled) {
     $Booleans .= "-disabled";
-  }  
-  
+  }
+
   print "<table class=\"MedPaddedTable\"><tr>\n";
   print "<td>\n";
-  my $ElementTitle = FormElementTitle(-helplink  => "authorentry", 
+  my $ElementTitle = FormElementTitle(-helplink  => "authorentry",
                                       -helptext  => "First Name",
                                       -required  => $TRUE);
-  print $ElementTitle,"\n";                                     
-  print $query -> textfield (-name => 'first', 
+  print $ElementTitle,"\n";
+  print $query -> textfield (-name => 'first',
                              -size => 20, -maxlength => 32,$Booleans);
   print "</td></tr>\n";
   print "<tr><td>\n";
-  $ElementTitle = FormElementTitle(-helplink  => "authorentry", 
+  $ElementTitle = FormElementTitle(-helplink  => "authorentry",
                                    -helptext  => "Middle Initial(s)");
-  print $ElementTitle,"\n";                                     
-  print $query -> textfield (-name => 'middle', 
+  print $ElementTitle,"\n";
+  print $query -> textfield (-name => 'middle',
                              -size => 10, -maxlength => 16,$Booleans);
   print "</td></tr>\n";
   print "<tr><td>\n";
-  $ElementTitle = FormElementTitle(-helplink  => "authorentry", 
+  $ElementTitle = FormElementTitle(-helplink  => "authorentry",
                                    -helptext  => "Last Name",
                                    -required  => $TRUE);
-  print $ElementTitle,"\n";                                     
-  print $query -> textfield (-name => 'lastname', 
+  print $ElementTitle,"\n";
+  print $query -> textfield (-name => 'lastname',
                              -size => 20, -maxlength => 32,$Booleans);
   print "</td>\n";
   print "</tr></table>\n";
@@ -274,7 +274,7 @@ sub UpdateButton {
 
 #  unless (&CanModify) {return;}
 
-  $query -> param('mode','update'); 
+  $query -> param('mode','update');
   $query -> param('docid',$DocumentID);
 
   print $query -> startform('POST',$DocumentAddForm);
@@ -289,13 +289,13 @@ sub UpdateButton {
 
 sub UpdateDBButton {
   my ($DocumentID,$Version) = @_;
-  
+
 #  unless (&CanModify) {return;}
 
   $query -> param('mode',   'updatedb');
   $query -> param('docid',  $DocumentID);
   $query -> param('version',$Version);
-  
+
   print $query -> startform('POST',$DocumentAddForm);
   print "<div>\n";
   print $query -> hidden(-name =>    'mode', -default => 'updatedb');
@@ -314,7 +314,7 @@ sub AddFilesButton {
 
   $query -> param('docid',$DocumentID);
   $query -> param('version',$Version);
-  
+
   print $query -> startform('POST',$AddFilesForm);
   print "<div>\n";
   print $query -> hidden(-name => 'docid',   -default => $DocumentID);
@@ -325,9 +325,9 @@ sub AddFilesButton {
   print "\n";
 }
 
-sub TextField (%) {  
+sub TextField (%) {
   my (%Params) = @_;
-  
+
   my $HelpLink  = $Params{-helplink} ;
   my $HelpText  = $Params{-helptext} ;
   my $ExtraText = $Params{-extratext};
@@ -339,28 +339,28 @@ sub TextField (%) {
   my $Size      = $Params{-size}      || 40;
   my $MaxLength = $Params{-maxlength} || 240;
   my $Disabled  = $Params{-disabled}  || $FALSE;
-    
-  my %Options = ();  
+
+  my %Options = ();
   if ($Disabled) {
     $Options{-disabled} = "disabled";
-  }  
+  }
 
-  my $ElementTitle = &FormElementTitle(-helplink  => $HelpLink , 
+  my $ElementTitle = &FormElementTitle(-helplink  => $HelpLink ,
                                        -helptext  => $HelpText ,
                                        -extratext => $ExtraText,
                                        -text      => $Text     ,
                                        -nobreak   => $NoBreak  ,
                                        -required  => $Required ,
                                       );
-  print $ElementTitle,"\n";                                     
-  print $query -> textfield (-name => $Name, -default   => $Default, 
+  print $ElementTitle,"\n";
+  print $query -> textfield (-name => $Name, -default   => $Default,
                              -size => $Size, -maxlength => $MaxLength, %Options,);
-} 
+}
 
-sub TextArea (%) {  
+sub TextArea (%) {
   require "Utilities.pm";
   my (%Params) = @_;
-  
+
   my $HelpLink  = $Params{-helplink} ;
   my $HelpText  = $Params{-helptext} ;
   my $ExtraText = $Params{-extratext};
@@ -371,21 +371,21 @@ sub TextArea (%) {
   my $Default   = $Params{-default}   || "";
   my $Columns   = $Params{-columns}   || 40;
   my $Rows      = $Params{-rows}      || 6;
-  
-  my $ElementTitle = &FormElementTitle(-helplink  => $HelpLink , 
+
+  my $ElementTitle = &FormElementTitle(-helplink  => $HelpLink ,
                                        -helptext  => $HelpText ,
                                        -extratext => $ExtraText,
                                        -text      => $Text     ,
                                        -nobreak   => $NoBreak  ,
                                        -required  => $Required );
-  print $ElementTitle,"\n";                                     
-  print $query -> textarea (-name    => $Name,    -default   => &SafeHTML($Default), 
+  print $ElementTitle,"\n";
+  print $query -> textarea (-name    => $Name,    -default   => &SafeHTML($Default),
                             -columns => $Columns, -rows      => $Rows);
-} 
+}
 
-sub FormElementTitle (%) {  
+sub FormElementTitle (%) {
   my (%Params) = @_;
-  
+
   my $HelpLink  = $Params{-helplink}  || "";
   my $HelpText  = $Params{-helptext}  || "";
   my $ExtraText = $Params{-extratext} || "";
@@ -397,14 +397,14 @@ sub FormElementTitle (%) {
 
   my $TitleText = "";
   my $Colon     = "";
-  
+
   unless ($HelpLink || $Text) {
     return $TitleText;
-  }  
-  
+  }
+
   unless ($NoColon) {
     $Colon = ":";
-  }  
+  }
   unless ($NoBold) {
     $TitleText .= "<strong>";
   }
@@ -412,26 +412,26 @@ sub FormElementTitle (%) {
     $TitleText .= "<a class=\"Help\" href=\"Javascript:helppopupwindow(\'$DocDBHelp?term=$HelpLink\');\">";
     $TitleText .= "$HelpText$Colon</a>";
   } elsif ($Text) {
-    $TitleText .= "$Text$Colon"; 
+    $TitleText .= "$Text$Colon";
   }
   unless ($NoBold) {
     $TitleText .= "</strong>";
   }
-  
+
   if ($Required) {
     $TitleText .= $RequiredMark;
-  } 
-   
+  }
+
   if ($ExtraText) {
     $TitleText .= "&nbsp;$ExtraText";
-  } 
-  
-  if ($NoBreak) { 
+  }
+
+  if ($NoBreak) {
 #    $TitleText .= "\n";
   } else {
     $TitleText .= "<br/>\n";
-  }  
-  
+  }
+
   return $TitleText;
 }
 
diff --git a/DocDB/cgi/RevisionHTML.pm b/DocDB/cgi/RevisionHTML.pm
index 7618664f..0d448e04 100644
--- a/DocDB/cgi/RevisionHTML.pm
+++ b/DocDB/cgi/RevisionHTML.pm
@@ -35,7 +35,8 @@ sub TitleBox (%) {
                                        -helptext  => "Title" ,
                                        -required  => $Required );
   print $ElementTitle,"\n";
-  print $query -> textfield (-name => 'title', -default => $TitleDefault,
+  my $SafeDefault = SmartHTML({-text => $TitleDefault},);
+  print $query -> textfield (-name => 'title', -default => $SafeDefault,
                              -size => 70, -maxlength => 240);
 };
 
@@ -54,11 +55,13 @@ sub AbstractBox (%) {
                                        -helptext  => $HelpText ,
                                        -required  => $Required );
   print $ElementTitle,"\n";
-  print $query -> textarea (-name    => $Name, -default => $AbstractDefault,
+  my $SafeDefault = SmartHTML({-text => $AbstractDefault},);
+  print $query -> textarea (-name    => $Name, -default => $SafeDefault,
                             -rows    => $Rows, -columns => $Columns);
 };
 
 sub RevisionNoteBox {
+  # FIXME: Make Javascript OK with SmartHTML
   my (%Params) = @_;
   my $Default  = $Params{-default}  || "";
   my $JSInsert = $Params{-jsinsert} || "";
@@ -83,7 +86,8 @@ sub RevisionNoteBox {
                                        -extratext => $ExtraText,
                                        -required  => $Required );
   print $ElementTitle,"\n";
-  print $query -> textarea (-name => 'revisionnote', -default => $Default,
+  my $SafeDefault = SmartHTML({-text => $Default},);
+  print $query -> textarea (-name => 'revisionnote', -default => $SafeDefault,
                             -columns => 60, -rows => 6);
 };
 

From 42c6c700be324b3b94063d838df57784ecd32f57 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 10 Jul 2013 16:03:09 +0200
Subject: [PATCH 052/163] SmartHTML for Author Entry

---
 DocDB/cgi/AuthorHTML.pm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/DocDB/cgi/AuthorHTML.pm b/DocDB/cgi/AuthorHTML.pm
index 76671910..26e463fc 100644
--- a/DocDB/cgi/AuthorHTML.pm
+++ b/DocDB/cgi/AuthorHTML.pm
@@ -310,7 +310,7 @@ sub AuthorScroll (%) {
   my @ActiveIDs = ();
   foreach my $ID (@AuthorIDs) {
     if ($Authors{$ID}{ACTIVE} || $All) {
-      $AuthorLabels{$ID} = $Authors{$ID}{Formal};
+      $AuthorLabels{$ID} = SmartHTML({-text=>$Authors{$ID}{Formal}});
       push @ActiveIDs,$ID;
     }
   }
@@ -347,7 +347,7 @@ sub AuthorTextEntry ($;@) {
 
   foreach $AuthorID (@Defaults) {
     FetchAuthor($AuthorID);
-    $AuthorManDefault .= "$Authors{$AuthorID}{FULLNAME}\n" ;
+    $AuthorManDefault .= SmartHTML({-text=>$Authors{$AuthorID}{FULLNAME}})."\n" ;
   }
 
   print FormElementTitle(-helplink => $HelpLink, -helptext  => $HelpText,

From ed4fba5247806ee4e692ed0ca7c8cfc692969444 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 10 Jul 2013 16:14:00 +0200
Subject: [PATCH 053/163] SmartHTML for KeywordsBox

---
 DocDB/cgi/KeywordHTML.pm | 1 +
 1 file changed, 1 insertion(+)

diff --git a/DocDB/cgi/KeywordHTML.pm b/DocDB/cgi/KeywordHTML.pm
index 5dffcf5a..197db2b0 100644
--- a/DocDB/cgi/KeywordHTML.pm
+++ b/DocDB/cgi/KeywordHTML.pm
@@ -274,6 +274,7 @@ sub KeywordsBox (%) {
   Chooser</b></a>",
                                        -required  => $Required );
   print $ElementTitle,"\n";
+  my $SafeDefault = SmartHTML({-text => $KeywordsDefault},);
   print $query -> textfield (-name => 'keywords', -default => $KeywordsDefault,
                              -size => 70, -maxlength => 240);
 };

From 0a890ef6a9acc7edb1b32fda1914600388de1058 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 10 Jul 2013 16:20:14 +0200
Subject: [PATCH 054/163] Do topics with SmartHTML

---
 DocDB/cgi/TopicHTML.pm | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/DocDB/cgi/TopicHTML.pm b/DocDB/cgi/TopicHTML.pm
index 43f2d8c6..a9e8edf3 100644
--- a/DocDB/cgi/TopicHTML.pm
+++ b/DocDB/cgi/TopicHTML.pm
@@ -378,15 +378,17 @@ sub TopicScroll ($) {
   my %TopicLabels = ();
 #  my @ActiveIDs = @TopicIDs; # Later can select single root topics, etc.
 
+  my $SafeShort = SmartHTML({-text=>$Topics{$ID}{Short}});
+  my $SafeLong = SmartHTML({-text=>$Topics{$ID}{Long}});
+
   foreach my $ID (@TopicIDs) {
     my $Spaces = '-'x(1*(scalar(@{$TopicProvenance{$ID}})-1));
     if ($ItemFormat eq "short") {
-      $TopicLabels{$ID} = $Spaces.CGI::escapeHTML($Topics{$ID}{Short});
+      $TopicLabels{$ID} = $Spaces.$SafeShort;
     } elsif ($ItemFormat eq "long") {
-      $TopicLabels{$ID} = $Spaces.CGI::escapeHTML($Topics{$ID}{Long});
+      $TopicLabels{$ID} = $Spaces.$SafeLong;
     } elsif ($ItemFormat eq "full") {
-      $TopicLabels{$ID} = $Spaces.CGI::escapeHTML($Topics{$ID}{Short}.
-                                             " [".$Topics{$ID}{Long}."]");
+      $TopicLabels{$ID} = $Spaces.$SafeShort." [".$SafeLong."]");
     }
 
     if (($ItemFormat eq "short" or $ItemFormat eq "long") &&
@@ -399,13 +401,10 @@ sub TopicScroll ($) {
                          -text      => $Text    , -extratext => $ExtraText,
                          -required  => $Required);
 
-  $query ->  autoEscape(0);  # Turn off and on since sometimes scrolling_list double escape this.
-
   print $query -> scrolling_list(-name     => $Name, -values => \@TopicIDs,
                                  -size     => $Size, -labels => \%TopicLabels,
                                  -multiple => $Multiple,
                                  -default  => \@Defaults, %Options);
-  $query ->  autoEscape(1);
 }
 
 1;

From 54f3ed81c675715ac21b1c5142a3805cfbcab25b Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 10 Jul 2013 09:27:01 -0500
Subject: [PATCH 055/163] Fix mistakes in TopicHTML

---
 DocDB/cgi/DocDBGlobals.pm | 2 +-
 DocDB/cgi/TopicHTML.pm    | 7 +++----
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/DocDB/cgi/DocDBGlobals.pm b/DocDB/cgi/DocDBGlobals.pm
index 12ab8805..6cfc53dd 100644
--- a/DocDB/cgi/DocDBGlobals.pm
+++ b/DocDB/cgi/DocDBGlobals.pm
@@ -30,7 +30,7 @@ use DateTime;
 $LocalTimezone = DateTime::TimeZone->new(name => 'local');
 $TRUE  = 1;
 $FALSE = 0;
-
+$DebugOutput=1;
 # Advertising link for DocDB
 
 $DocDBHome = "http://docdb-v.sourceforge.net/";
diff --git a/DocDB/cgi/TopicHTML.pm b/DocDB/cgi/TopicHTML.pm
index a9e8edf3..bdd2e481 100644
--- a/DocDB/cgi/TopicHTML.pm
+++ b/DocDB/cgi/TopicHTML.pm
@@ -378,17 +378,16 @@ sub TopicScroll ($) {
   my %TopicLabels = ();
 #  my @ActiveIDs = @TopicIDs; # Later can select single root topics, etc.
 
-  my $SafeShort = SmartHTML({-text=>$Topics{$ID}{Short}});
-  my $SafeLong = SmartHTML({-text=>$Topics{$ID}{Long}});
-
   foreach my $ID (@TopicIDs) {
+    my $SafeShort = SmartHTML({-text=>$Topics{$ID}{Short}});
+    my $SafeLong = SmartHTML({-text=>$Topics{$ID}{Long}});
     my $Spaces = '-'x(1*(scalar(@{$TopicProvenance{$ID}})-1));
     if ($ItemFormat eq "short") {
       $TopicLabels{$ID} = $Spaces.$SafeShort;
     } elsif ($ItemFormat eq "long") {
       $TopicLabels{$ID} = $Spaces.$SafeLong;
     } elsif ($ItemFormat eq "full") {
-      $TopicLabels{$ID} = $Spaces.$SafeShort." [".$SafeLong."]");
+      $TopicLabels{$ID} = $Spaces.$SafeShort." [".$SafeLong."]";
     }
 
     if (($ItemFormat eq "short" or $ItemFormat eq "long") &&

From b4cdf1c6914ae9d6cd951610eed2f16f5658998d Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Thu, 11 Jul 2013 16:33:06 +0200
Subject: [PATCH 056/163] Fix up keyword chooser

---
 DocDB/cgi/DocDBGlobals.pm |  2 +-
 DocDB/cgi/KeywordHTML.pm  | 11 +++++++----
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/DocDB/cgi/DocDBGlobals.pm b/DocDB/cgi/DocDBGlobals.pm
index 6cfc53dd..12ab8805 100644
--- a/DocDB/cgi/DocDBGlobals.pm
+++ b/DocDB/cgi/DocDBGlobals.pm
@@ -30,7 +30,7 @@ use DateTime;
 $LocalTimezone = DateTime::TimeZone->new(name => 'local');
 $TRUE  = 1;
 $FALSE = 0;
-$DebugOutput=1;
+
 # Advertising link for DocDB
 
 $DocDBHome = "http://docdb-v.sourceforge.net/";
diff --git a/DocDB/cgi/KeywordHTML.pm b/DocDB/cgi/KeywordHTML.pm
index 197db2b0..506506ea 100644
--- a/DocDB/cgi/KeywordHTML.pm
+++ b/DocDB/cgi/KeywordHTML.pm
@@ -231,17 +231,20 @@ sub KeywordLinkByID ($;%) {
   my $NoLink = $Params{-nolink} || "";      # will just return information
 
   &FetchKeyword($KeywordID);
-  my $Keyword = $Keywords{$KeywordID}{Short};
+  my $SafeShortKeyword = SmartHTML( {-text => $Keywords{$KeywordID}{Short}} );
+  my $SafeLongKeyword = SmartHTML( {-text => $Keywords{$KeywordID}{long}} );
   my $Link;
 
+  # FIXME_XSS: Check to make sure this kind of search still works.
+  # May need to remove special characters or adapt search atoms
   unless ($NoLink) {
-    $Link .= "<a href=\"$Search\?keywordsearchmode=anyword&amp;keywordsearch=$Keyword\">";
+    $Link .= "<a href=\"$Search\?keywordsearchmode=anyword&amp;keywordsearch=$SafeShortKeyword\">";
   }
 
   if ($Format eq "short") {
-    $Link .= $Keywords{$KeywordID}{Short};
+    $Link .= $SafeShortKeyword;
   } elsif ($Format eq "long") {
-    $Link .= $Keywords{$KeywordID}{Long};
+    $Link .= $SafeLongKeyword;
   }
 
   unless ($NoLink) {

From 8dd2727802b5fca11cbcc2e52deda160f0188575 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Thu, 11 Jul 2013 16:42:47 +0200
Subject: [PATCH 057/163] Fix Keyword Chooser

---
 DocDB/cgi/KeywordHTML.pm | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/DocDB/cgi/KeywordHTML.pm b/DocDB/cgi/KeywordHTML.pm
index 506506ea..8c73d0e8 100644
--- a/DocDB/cgi/KeywordHTML.pm
+++ b/DocDB/cgi/KeywordHTML.pm
@@ -34,11 +34,11 @@ sub KeywordGroupInfo ($;$) {
   &FetchKeywordGroup($KeyID);
   my $info;
   if ($mode eq "short") {
-    $info = $KeywordGroups{$KeyID}{Short};
+    $info = SmartHTML({-text=>$KeywordGroups{$KeyID}{Short}});
   } elsif ($mode eq "long") {
-    $info = $KeywordGroups{$KeyID}{Long};
+    $info = SmartHTML({-text=>$KeywordGroups{$KeyID}{Long}});
   } else {
-    $info = $KeywordGroups{$KeyID}{Short};
+    $info = SmartHTML({-text=>$KeywordGroups{$KeyID}{Short}});
   }
 
   return $info;
@@ -46,7 +46,8 @@ sub KeywordGroupInfo ($;$) {
 
 sub KeywordsbyKeywordGroup ($;$) {
 
-  # FIXME: Make KeyLink SmartHTML
+  # FIXME_XSS: Check to make sure this kind of search still works.
+  # May need to remove special characters or adapt search atoms
   my ($KeywordGroupID,$Mode) = @_;
 
   require "Sorts.pm";
@@ -59,8 +60,9 @@ sub KeywordsbyKeywordGroup ($;$) {
   foreach my $KeywordID (@KeywordIDs) {
     my $KeyLink;
     if ($Mode eq "chooser") {
+      my $SafeKeyword = SmartHTML({-text=>$KeywordGroups{$KeyID}{Short}});
       $KeyLink = "<a href=\"$ListKeywords?mode=chooser\" ".
-                 "onclick=\"InsertKeyword('$Keywords{$KeywordID}{Short}');\">$Keywords{$KeywordID}{Short}</a>";
+                 "onclick=\"InsertKeyword('$SafeKeyword');\">$SafeKeyword</a>";
     } else {
       $KeyLink = &KeywordLinkByID($KeywordID,-format => "short");
     }

From bf42e07c39f601402899ef15a10e6d0f7f6d9a69 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Thu, 11 Jul 2013 17:12:54 +0200
Subject: [PATCH 058/163] Can't untaint single_upload either

---
 DocDB/cgi/ProcessDocumentAdd | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/DocDB/cgi/ProcessDocumentAdd b/DocDB/cgi/ProcessDocumentAdd
index 4e5f0099..ea502a39 100755
--- a/DocDB/cgi/ProcessDocumentAdd
+++ b/DocDB/cgi/ProcessDocumentAdd
@@ -144,7 +144,7 @@ my @RequestedTopicIDs = @{ $Untaint -> extract(-as_listofint => "topics") || und
 
 # Zip/tarfile params
 
-my $SingleUpload = $Untaint -> extract(-as_printable => "single_upload") || "";
+my $SingleUpload = $query -> param("single_upload"); # Filehandle
 my $SingleHTTP = $Untaint -> extract(-as_printable => "single_http") || "";
 my $MainFile = $Untaint -> extract(-as_printable => "mainfile") || "";
 my $Description = $Untaint -> extract(-as_safehtml => "filedesc") || "";

From 01c97b3e0db4f8c004e3bf5b10826421bad1b3be Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Thu, 11 Jul 2013 17:18:07 +0200
Subject: [PATCH 059/163] Use correct types for override variables

---
 DocDB/cgi/ProcessDocumentAdd | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/DocDB/cgi/ProcessDocumentAdd b/DocDB/cgi/ProcessDocumentAdd
index ea502a39..551b4a8e 100755
--- a/DocDB/cgi/ProcessDocumentAdd
+++ b/DocDB/cgi/ProcessDocumentAdd
@@ -119,9 +119,9 @@ my $DocTypeID = $Untaint -> extract(-as_integer => "doctype") || 0;
 my $RequesterID = $Untaint -> extract(-as_integer => "requester") || 0;
 my $SessionTalkID = $Untaint -> extract(-as_integer => "sessiontalkid") || 0;
 
-my $Overdate = $Untaint -> extract(-as_integer => "overdate") || 0;
+my $Overdate = $Untaint -> extract(-as_safehtml => "overdate") || 0;
 my $Overday = $Untaint -> extract(-as_integer => "overday") || 0;
-my $Overmonth = $Untaint -> extract(-as_integer => "overmonth") || 0;
+my $Overmonth = $Untaint -> extract(-as_safehtml => "overmonth") || 0;
 my $Overyear = $Untaint -> extract(-as_integer => "overyear") || 0;
 my $Overmin = $Untaint -> extract(-as_integer => "overmin") || 0;
 my $Overhour = $Untaint -> extract(-as_integer => "overhour") || 0;

From 24c3f23df41d626c51839db9e601f189d343b1cc Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Thu, 11 Jul 2013 10:22:06 -0500
Subject: [PATCH 060/163] Fix keyword hash

---
 DocDB/cgi/KeywordHTML.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/DocDB/cgi/KeywordHTML.pm b/DocDB/cgi/KeywordHTML.pm
index 8c73d0e8..47cd8085 100644
--- a/DocDB/cgi/KeywordHTML.pm
+++ b/DocDB/cgi/KeywordHTML.pm
@@ -60,7 +60,7 @@ sub KeywordsbyKeywordGroup ($;$) {
   foreach my $KeywordID (@KeywordIDs) {
     my $KeyLink;
     if ($Mode eq "chooser") {
-      my $SafeKeyword = SmartHTML({-text=>$KeywordGroups{$KeyID}{Short}});
+      my $SafeKeyword = SmartHTML({-text=>$Keywords{$KeywordID}{Short}});
       $KeyLink = "<a href=\"$ListKeywords?mode=chooser\" ".
                  "onclick=\"InsertKeyword('$SafeKeyword');\">$SafeKeyword</a>";
     } else {

From 4649945f8ec82598f4e9ed180e93c28af4b7912f Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Mon, 22 Jul 2013 15:33:36 -0500
Subject: [PATCH 061/163] Clean up params a bit

---
 DocDB/cgi/ProcessDocumentAdd | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/DocDB/cgi/ProcessDocumentAdd b/DocDB/cgi/ProcessDocumentAdd
index 551b4a8e..a3295735 100755
--- a/DocDB/cgi/ProcessDocumentAdd
+++ b/DocDB/cgi/ProcessDocumentAdd
@@ -71,8 +71,7 @@ GetSecurityGroups();
 
 ### Set up, give user initial information
 
-#%params = $query -> Vars; # TODO remove
-my $Untaint   = CGI::Untaint -> new($query -> Vars);
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 
 my $Mode = $Untaint -> extract(-as_printable => "mode") || "";
 $mode = $Mode; #FIXME: Remove when not needed
@@ -86,7 +85,7 @@ if ($Mode eq "reserve") {
   &DocDBHeader("$Project Document Modification Results","Document Modification Results",-scripts => ["PopUps"]);
 }
 
-### Pull info out of params into local variables
+### Pull info out of parameters into local variables
 
 # "Hidden" things
 

From 8e589679d1cac4317cb445aa370415545e19bd6c Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Mon, 22 Jul 2013 16:47:55 -0500
Subject: [PATCH 062/163] Fix author add script, administer forms, and file
 addition

---
 DocDB/cgi/AddFiles       | 43 +++++++++++++++++++++-------------------
 DocDB/cgi/AddFilesForm   |  1 +
 DocDB/cgi/AdministerForm |  1 +
 DocDB/cgi/AdministerHome |  1 +
 DocDB/cgi/AuthorAdd      | 13 ++++++------
 DocDB/cgi/AuthorAddForm  |  6 ++++--
 6 files changed, 37 insertions(+), 28 deletions(-)

diff --git a/DocDB/cgi/AddFiles b/DocDB/cgi/AddFiles
index aaa9dbb8..259451f6 100755
--- a/DocDB/cgi/AddFiles
+++ b/DocDB/cgi/AddFiles
@@ -61,7 +61,7 @@ $dbh   = DBI -> connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rwuser,$db_rwpass
 
 ### Set up, give user initial information
 
-%params = $query -> Vars;
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 
 print $query -> header( -charset => $HTTP_ENCODING );
 &DocDBHeader("$Project File Addition Results","File Addition Results");
@@ -73,12 +73,12 @@ print $query -> header( -charset => $HTTP_ENCODING );
 
 ### Get document and revision ID
 
-my $DocumentID   = $params{docid};
-my $Version      = $params{version};
-my $Replace      = $params{replace};
-my $MaxFiles     = $params{maxfiles};
-my $SubmitAgree  = $params{submitagree};
-my $PreserveSigs = $params{preservesigs};
+my $DocumentID = $Untaint -> extract(-as_integer => "docid") || 0;
+my $Version = $Untaint -> extract(-as_integer => "version") || 0; 
+my $Replace = $Untaint -> extract(-as_printable => "replace") || "";
+my $MaxFiles = $Untaint -> extract(-as_integer => "maxfiles") || 0;
+my $Replace = $Untaint -> extract(-as_printable => "submitagree") || "";
+my $Replace = $Untaint -> extract(-as_printable => "preservesigs") || "";
 
 my $DocRevID;
 
@@ -86,11 +86,8 @@ my $DocRevID;
 
 if ($DocumentID && $Version) {
   $DocRevID = &FetchRevisionByDocumentAndVersion($DocumentID,$Version);
-  unless ($DocRevID) {
-    push @ErrorStack,"No such document exists.";
-  }
-  unless (&CanModify($DocumentID,$Version)) {
-    push @ErrorStack,"You are not authorized to modify this document.";
+  unless ($DocRevID && CanModify($DocumentID,$Version)) {
+    push @ErrorStack,"You are not authorized to modify this document or it does not exist.";
   }
 } else {
   push @ErrorStack,"You must supply document and version numbers to add files.";
@@ -110,6 +107,8 @@ if ($PreserveSigs && !CanPreserveSigs()) {
 my $UpdateLink = $DocumentAddForm."?mode=update&docid=$DocumentID";
 
 # Fill in file hash
+my $HttpUser = $Untaint -> extract(-as_printable => "http_user") || "";
+my $HttpPass = $Untaint -> extract(-as_printable => "http_pass") || "";
 
 my %Files = ();
 my $NeedURLs   = 0;
@@ -117,9 +116,13 @@ my $AddNewFile = 0;
 
 for (my $i = 1; $i<= $MaxFiles; ++$i) {
   my $Key = $i; # Probably something better later
-  if ($params{"upload$i"}) {
+  my $UploadI = $query -> param("upload$i");
+  my $UrlI = $Untaint -> extract(-as_printable => "url$i") || "";
+  my $MainI = $Untaint -> extract(-as_printable => "main$i") || "";
+  my $DescriptionI = $Untaint -> extract(-as_safehtml => "filedesc$i") || "";
+  if ($UploadI) {
     $AddNewFile = 1;
-    $Files{$Key}{File} = $query ->  param("upload$i");
+    $Files{$Key}{File} = $UploadI;
     if (&ExistsUpload($DocRevID,$Files{$Key}{File})) {
       if ($Replace) {
         push @WarnStack,"The file $short_file already existed and has been
@@ -131,12 +134,12 @@ for (my $i = 1; $i<= $MaxFiles; ++$i) {
              document,  not add files.";
       }
     }
-  } elsif ($params{"url$i"}) {
+  } elsif ($UrlI) {
     $NeedURLs = 1;
     $AddNewFile = 1;
-    $Files{$Key}{URL}  = $params{"url$i"};
-    $Files{$Key}{User} = $params{http_user};
-    $Files{$Key}{Pass} = $params{http_pass};
+    $Files{$Key}{URL}  = $UrlI;
+    $Files{$Key}{User} = $HttpUser;
+    $Files{$Key}{Pass} = $HttpPass;
     if (&ExistsURL($DocRevID,$Files{$Key}{URL})) {
       if ($Replace) {
         push @WarnStack,"The file $short_file already existed and has been
@@ -150,13 +153,13 @@ for (my $i = 1; $i<= $MaxFiles; ++$i) {
     }
   }
 
-  if ($params{"main$i"}) {
+  if ($MainI) {
     $Files{$Key}{Main} = 1;
   } else {
     $Files{$Key}{Main} = 0;
   }
 
-  $Files{$Key}{Description} = $params{"filedesc$i"};
+  $Files{$Key}{Description} = $DescriptionI;
 }
 
 unless ($AddNewFile) {
diff --git a/DocDB/cgi/AddFilesForm b/DocDB/cgi/AddFilesForm
index 8af0c11d..e92be391 100755
--- a/DocDB/cgi/AddFilesForm
+++ b/DocDB/cgi/AddFilesForm
@@ -48,6 +48,7 @@ require "HTMLUtilities.pm";
 require "Scripts.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 
 &GetSecurityGroups;
diff --git a/DocDB/cgi/AdministerForm b/DocDB/cgi/AdministerForm
index 1e98992e..b0efae94 100755
--- a/DocDB/cgi/AdministerForm
+++ b/DocDB/cgi/AdministerForm
@@ -52,6 +52,7 @@ require "HTMLUtilities.pm";
 require "Sorts.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
 $dbh   = DBI -> connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 
 &GetSecurityGroups;
diff --git a/DocDB/cgi/AdministerHome b/DocDB/cgi/AdministerHome
index 9f8fb540..fabaab58 100755
--- a/DocDB/cgi/AdministerHome
+++ b/DocDB/cgi/AdministerHome
@@ -37,6 +37,7 @@ require "SecurityHTML.pm";
 #require "MeetingSecurityUtilities.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 
 GetSecurityGroups();
diff --git a/DocDB/cgi/AuthorAdd b/DocDB/cgi/AuthorAdd
index 7d1d74a1..24faf37f 100755
--- a/DocDB/cgi/AuthorAdd
+++ b/DocDB/cgi/AuthorAdd
@@ -1,10 +1,11 @@
 #! /usr/bin/env perl
 #
+#        Name: AuthorAdd
 # Description: Adds an author into the DB list of authors.  
 #              Called by submission from AddAuthorForm 
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified: 
+#    Modified: Eric Vaandering (ewv@fnal.gov)
 #
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
@@ -38,12 +39,12 @@ $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rwuser,$db_rwpass);
 
 GetSecurityGroups();
 
-%params = $query -> Vars;
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 
-$InstitutionID   = $params{inst};
-$FirstName       = $params{first};
-$MiddleInitials  = $params{middle};
-$LastName        = $params{lastname};
+my $InstitutionID = $Untaint -> extract(-as_integer => "inst") || 0;
+my $FirstName = $Untaint -> extract(-as_safehtml => "first") || 0;
+my $MiddleInitials = $Untaint -> extract(-as_safehtml => "middle") || 0;
+my $LastName = $Untaint -> extract(-as_safehtml => "lastname") || 0;
 
 print $query -> header( -charset => $HTTP_ENCODING );
 DocDBHeader("Author Addition Results");
diff --git a/DocDB/cgi/AuthorAddForm b/DocDB/cgi/AuthorAddForm
index 39eafe51..0eca817d 100755
--- a/DocDB/cgi/AuthorAddForm
+++ b/DocDB/cgi/AuthorAddForm
@@ -1,9 +1,10 @@
 #! /usr/bin/env perl
 #
-# Description: A simple for to allow new author addition (no changes possible)
+# Description: A simple script to allow new author addition (no changes possible)
 #
+#        Name: AuthorAddForm
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified:
+#    Modified: Eric Vaandering (ewv@fnal.gov)
 #
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
@@ -36,6 +37,7 @@ require "HTMLUtilities.pm";
 require "Sorts.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
 $dbh   = DBI -> connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 
 GetInstitutions();

From 9a5dc7866e8476dfe6c4b22df357dc9b6237e5c8 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Mon, 29 Jul 2013 14:25:33 -0500
Subject: [PATCH 063/163] Update more scripts with untaint

---
 DocDB/cgi/AdministerHome        |  5 +++--
 DocDB/cgi/AuthorAdminister      | 22 ++++++++++++----------
 DocDB/cgi/BulkCertificateInsert |  8 ++++----
 DocDB/cgi/ConfirmTalkHint       | 14 +++++---------
 DocDB/cgi/CustomListForm        | 27 ++++++++++++++-------------
 5 files changed, 38 insertions(+), 38 deletions(-)

diff --git a/DocDB/cgi/AdministerHome b/DocDB/cgi/AdministerHome
index fabaab58..96400731 100755
--- a/DocDB/cgi/AdministerHome
+++ b/DocDB/cgi/AdministerHome
@@ -1,5 +1,8 @@
 #! /usr/bin/env perl
 #
+#        Name: AdministerHome
+# Description: A "home page" for the various administration pages 
+#
 #      Author: Lynn Garren (garren@fnal.gov)
 #    Modified: Eric Vaandering (ewv@fnal.gov)
 
@@ -30,11 +33,9 @@ require "Scripts.pm";
 require "ResponseElements.pm";
 require "FormElements.pm";
 require "Messages.pm";
-#require "Cookies.pm";
 require "Security.pm";
 require "SecuritySQL.pm";
 require "SecurityHTML.pm";
-#require "MeetingSecurityUtilities.pm";
 
 $query = new CGI;  # Global for subroutines
 $query -> autoEscape(0);
diff --git a/DocDB/cgi/AuthorAdminister b/DocDB/cgi/AuthorAdminister
index f44acd79..f88e0192 100755
--- a/DocDB/cgi/AuthorAdminister
+++ b/DocDB/cgi/AuthorAdminister
@@ -38,24 +38,26 @@ require "AuthorSQL.pm";
 require "Messages.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
 
-%params = $query -> Vars;
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 
 @ErrorStack = ();
 @WarnStack  = ();
 
 # Parameters to script
 
-$Password    = $params{password};
-my $Username = $params{admuser};
-$Action      = $params{admaction};
+my $Password = $Untaint -> extract(-as_printable => "password") || "";
+my $Username = $Untaint -> extract(-as_printable => "admuser") || "";
+my $Action = $Untaint -> extract(-as_printable => "admaction") || "";
 
-my $AuthorID      = $params{authors};
-my $ConsolidateID = $params{targetauthor};
-$FirstName        = $params{first};
-$Middle           = $params{middle};
-$LastName         = $params{lastname};
-$InstitutionID    = $params{inst};
+my $AuthorID = $Untaint -> extract(-as_integer => "authors") || 0;
+my $ConsolidateID = $Untaint -> extract(-as_integer => "targetauthor") || 0;
+my $InstitutionID = $Untaint -> extract(-as_integer => "inst") || 0;
+
+my $FirstName = $Untaint -> extract(-as_safehtml => "first") || 0;
+my $Middle = $Untaint -> extract(-as_safehtml => "middle") || 0;
+my $LastName = $Untaint -> extract(-as_safehtml => "lastname") || 0;
 
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$Username,$Password);
 
diff --git a/DocDB/cgi/BulkCertificateInsert b/DocDB/cgi/BulkCertificateInsert
index 271acc8f..85f2c8f7 100755
--- a/DocDB/cgi/BulkCertificateInsert
+++ b/DocDB/cgi/BulkCertificateInsert
@@ -3,7 +3,7 @@
 # Description: Allows an administrator to create entries for certificate users in EmailUser
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified:
+#    Modified: Eric Vaandering (ewv@fnal.gov)
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
@@ -41,18 +41,18 @@ require "SecuritySQL.pm";
 require "SecurityHTML.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
 
 # Parameters to script
 
 my $Untaint   = CGI::Untaint -> new($query -> Vars);
-my %CGIParams = $query -> Vars;
 
 my $Password = $Untaint -> extract (-as_printable => "password")  || "";
 my $Username = $Untaint -> extract (-as_printable => "admuser")   || "";
 my $Action   = $Untaint -> extract (-as_printable => "admaction") || "";
 my $Force    = $Untaint -> extract (-as_printable => "admforce")  || "";
 my $CanSign  = $Untaint -> extract (-as_printable => "CanSign")   || "";
-my @GroupIDs = split /\0/,$CGIParams{group};
+my @GroupIDs = @{ $Untaint -> extract(-as_listofint => "group") || undef };
 
 if ($CanSign) {$CanSign = $TRUE;}
 
@@ -96,7 +96,7 @@ if ($Action eq "Insert") {
 
   foreach my $Row (1..$MaxUsers) {
     my $Username = $Untaint -> extract (-as_printable => "name$Row")  || "";
-    my $Name     = $Untaint -> extract (-as_printable => "commonname$Row")  || "";
+    my $Name     = $Untaint -> extract (-as_safehtml => "commonname$Row")  || "";
     my $Email    = $Untaint -> extract (-as_printable => "email$Row") || "";
 
     if ($Username) {
diff --git a/DocDB/cgi/ConfirmTalkHint b/DocDB/cgi/ConfirmTalkHint
index 0288fc32..b7ed53ce 100755
--- a/DocDB/cgi/ConfirmTalkHint
+++ b/DocDB/cgi/ConfirmTalkHint
@@ -4,7 +4,7 @@
 #              and a document
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified: 
+#    Modified: Eric Vaandering (ewv@fnal.gov)
 #
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
@@ -45,19 +45,15 @@ require "Security.pm";
 require "SQLChecks.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
 
-%params = $query -> Vars;
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 
 @ErrorStack = ();
 @WarnStack  = ();
 
-$DocumentID    = $params{documentid};
-$SessionTalkID = $params{sessiontalkid};
-
-$DocumentID    =~ s/^\s+//; # Remove leading and trailing spaces
-$DocumentID    =~ s/\s+$//;
-$SessionTalkID =~ s/^\s+//;
-$SessionTalkID =~ s/\s+$//;
+my $DocumentID = $Untaint -> extract(-as_integer => "documentid") || 0;
+my $SessionTalkID = $Untaint -> extract(-as_integer => "sessiontalkid") || 0;
 
 unless ($DocumentID) {
   push @ErrorStack,"You are must supply a document number!";
diff --git a/DocDB/cgi/CustomListForm b/DocDB/cgi/CustomListForm
index 8053ad56..5afedac6 100755
--- a/DocDB/cgi/CustomListForm
+++ b/DocDB/cgi/CustomListForm
@@ -55,16 +55,17 @@ require "MeetingHTML.pm";
 require "TopicHTML.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
 
-%params = $query -> Vars;
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 
-my $Scope             = $params{scope};
-my @EventGroupIDs     = split /\0/,$params{eventgroups};
-my @EventIDs          = split /\0/,$params{events};
-my @Defaults          = split /\0/,$params{defaultlists};
-my @TopicIDs          = split /\0/,$params{topics};
-my @DocTypeIDs        = split /\0/,$params{doctype};
-my $DefaultEventID    = $params{eventid};
+my $Scope = $Untaint -> extract(-as_printable => "scope") || "";
+my @EventGroupIDs = @{ $Untaint -> extract(-as_listofint => "eventgroups") || undef };
+my @EventIDs = @{ $Untaint -> extract(-as_listofint => "events") || undef };
+my @Defaults = @{ $Untaint -> extract(-as_listofwords => "defaultlists") || undef };
+my @TopicIDs = @{ $Untaint -> extract(-as_listofint => "topics") || undef };
+my @DocTypeIDs = @{ $Untaint -> extract(-as_listofint => "doctype") || undef };
+my $DefaultEventID = $Untaint -> extract(-as_integer => "eventid") || 0;
 
 my $MaxFields = 15;
 my @Cookies = ();
@@ -98,13 +99,13 @@ if (CanAdminister()) {
 
 my %FieldList = ();
 foreach my $FieldCount (1..$MaxFields) {
-  my $Field = $params{"field$FieldCount"};
+  my $Field = $Untaint -> extract(-as_printable => "field$FieldCount") || "";
   if ($Field && $Field ne "xxxx") {
     push @ActionStack,"Field \"$Field\" added to the display";
-    $FieldList{$Field}{Row}     = $params{"row$FieldCount"};
-    $FieldList{$Field}{Column}  = $params{"col$FieldCount"};
-    $FieldList{$Field}{RowSpan} = $params{"rowspan$FieldCount"};
-    $FieldList{$Field}{ColSpan} = $params{"colspan$FieldCount"};
+    $FieldList{$Field}{Row}     = $Untaint -> extract(-as_integer => "row$FieldCount") || 0;
+    $FieldList{$Field}{Column}  = $Untaint -> extract(-as_integer => "col$FieldCount") || 0;
+    $FieldList{$Field}{RowSpan} = $Untaint -> extract(-as_integer => "rowspan$FieldCount") || 0;
+    $FieldList{$Field}{ColSpan} = $Untaint -> extract(-as_integer => "colspan$FieldCount") || 0;
   }
 }
 

From 20fae3f86f2ea3b1617378961dffffdb9c91977b Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Mon, 29 Jul 2013 14:37:54 -0500
Subject: [PATCH 064/163] Untaint scripts starting with D

---
 DocDB/cgi/DeleteConfirm     |  7 +++----
 DocDB/cgi/DeleteDocument    | 13 +++++--------
 DocDB/cgi/DisplayMeeting    | 10 +++++-----
 DocDB/cgi/DocDBInstructions |  6 ++++--
 DocDB/cgi/DocTypeAdminister | 16 ++++++++--------
 DocDB/cgi/DocumentDatabase  |  3 +--
 6 files changed, 26 insertions(+), 29 deletions(-)

diff --git a/DocDB/cgi/DeleteConfirm b/DocDB/cgi/DeleteConfirm
index b460031a..2bc0577d 100755
--- a/DocDB/cgi/DeleteConfirm
+++ b/DocDB/cgi/DeleteConfirm
@@ -42,15 +42,14 @@ require "Security.pm";
 require "RevisionHTML.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 
 &GetSecurityGroups;
 
-%params = $query -> Vars;
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 
-$DocumentID = $params{docid};
-$DocumentID =~ s/^\s+//; # Remove leading and trailing spaces
-$DocumentID =~ s/\s+$//;
+my $DocumentID = $Untaint -> extract(-as_integer => "documentid") || 0;
 
 @ErrorStack = ();
 
diff --git a/DocDB/cgi/DeleteDocument b/DocDB/cgi/DeleteDocument
index 3dfef2c4..12e48535 100755
--- a/DocDB/cgi/DeleteDocument
+++ b/DocDB/cgi/DeleteDocument
@@ -34,15 +34,12 @@ require "FSUtilities.pm";
 require "HTMLUtilities.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 
-%params = $query -> Vars;
-
-$DocumentID = $params{docid};
-$DocumentID =~ s/^\s+//; # Remove leading and trailing spaces
-$DocumentID =~ s/\s+$//;
-
-my $Password      = $params{password};
-my $Username      = $params{admuser};
+my $DocumentID = $Untaint -> extract(-as_integer => "documentid") || 0;
+my $Password = $Untaint -> extract(-as_printable => "password") || "";
+my $Username = $Untaint -> extract(-as_printable => "admuser") || "";
 
 @ErrorStack = ();
 
diff --git a/DocDB/cgi/DisplayMeeting b/DocDB/cgi/DisplayMeeting
index 550f1782..3b3c4c25 100755
--- a/DocDB/cgi/DisplayMeeting
+++ b/DocDB/cgi/DisplayMeeting
@@ -53,12 +53,12 @@ require "EventUtilities.pm";
 require "Utilities.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 
-%params = $query -> Vars;
-
-my $SessionID          = $params{sessionid};
-my $SessionSeparatorID = $params{sessionseparatorid};
-my $EventID            = $params{conferenceid};
+my $SessionID = $Untaint -> extract(-as_integer => "sessionid") || 0;
+my $SessionSeparatorID = $Untaint -> extract(-as_integer => "sessionseparatorid") || 0;
+my $EventID = $Untaint -> extract(-as_integer => "conferenceid") || 0;
 
 @ErrorStack = ();
 @WarnStack  = ();
diff --git a/DocDB/cgi/DocDBInstructions b/DocDB/cgi/DocDBInstructions
index 2bcd8b58..3dbce48f 100755
--- a/DocDB/cgi/DocDBInstructions
+++ b/DocDB/cgi/DocDBInstructions
@@ -35,12 +35,14 @@ require "SecuritySQL.pm";
 require "Security.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 
 &GetSecurityGroups;
 
-%params = $query -> Vars;
-$InstructionSet = $params{set} || "general";
+my $Untaint = CGI::Untaint -> new($query -> Vars);
+
+my $InstructionSet = $Untaint -> extract(-as_printable => "general") || "";
 
 # Title
 
diff --git a/DocDB/cgi/DocTypeAdminister b/DocDB/cgi/DocTypeAdminister
index a834e61b..f325f433 100755
--- a/DocDB/cgi/DocTypeAdminister
+++ b/DocDB/cgi/DocTypeAdminister
@@ -37,18 +37,18 @@ require "DocTypeHTML.pm";
 require "Messages.pm";
 
 $query = new CGI;  # Global for subroutines
-
-%params = $query -> Vars;
+$query -> autoEscape(0);
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 
 # Parameters to script 
 
-$Password  = $params{password};
-my $Username      = $params{admuser};
-$Action    = $params{admaction};
+my $Password = $Untaint -> extract(-as_printable => "password") || "";
+my $Username = $Untaint -> extract(-as_printable => "admuser") || "";
+my $Action = $Untaint -> extract(-as_printable => "admaction") || "";
 
-my $DocTypeID = $params{doctype};
-my $ShortName = $params{name};
-my $LongName  = $params{longdesc};
+my $DocTypeID = $Untaint -> extract(-as_integer => "doctype") || 0;
+my $ShortName = $Untaint -> extract(-as_safehtml => "name") || 0;
+my $LongName = $Untaint -> extract(-as_safehtml => "longdesc") || 0;
 
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$Username,$Password);
 
diff --git a/DocDB/cgi/DocumentDatabase b/DocDB/cgi/DocumentDatabase
index 92c54bdd..2c1439a9 100755
--- a/DocDB/cgi/DocumentDatabase
+++ b/DocDB/cgi/DocumentDatabase
@@ -47,6 +47,7 @@ require "XRefSQL.pm";
 require "Messages.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 GetSecurityGroups();
 
@@ -56,8 +57,6 @@ if ($UserValidation eq "certificate") {
   $CertificateStatus = CertificateStatus();
 }
 
-# %params = $query -> Vars;  # No parameters (yet?) 
-
 print $query->header( -charset => $HTTP_ENCODING );
 if ($UserValidation eq "certificate" && $CertificateStatus ne "verified") {
   DocDBHeader("$Project Document Database","Document Database", -scripts => ["PopUps"], -refresh => "5;url=$CertificateApplyForm");

From 8c3115c9b1e3706b7b04dfd9e4c56f067bd14811 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Mon, 29 Jul 2013 15:34:25 -0500
Subject: [PATCH 065/163] Untaint scripts starting with E

---
 DocDB/cgi/EditTalkInfo                | 31 ++++++++++-----------------
 DocDB/cgi/EmailAdminister             | 28 +++++++++++++-----------
 DocDB/cgi/EmailAdministerForm         |  5 +++--
 DocDB/cgi/EmailCreate                 |  9 ++++----
 DocDB/cgi/EmailLogin                  |  1 +
 DocDB/cgi/EventAdministerForm         | 26 +++++++++++-----------
 DocDB/cgi/ExternalDocDBAdministerForm | 24 ++++++++++-----------
 7 files changed, 60 insertions(+), 64 deletions(-)

diff --git a/DocDB/cgi/EditTalkInfo b/DocDB/cgi/EditTalkInfo
index 69c193dc..ee36365d 100755
--- a/DocDB/cgi/EditTalkInfo
+++ b/DocDB/cgi/EditTalkInfo
@@ -38,31 +38,22 @@ require "MeetingSecurityUtilities.pm";
 require "HTMLUtilities.pm";
 require "DBUtilities.pm";
 
-#require "DocumentSQL.pm";
-#require "RevisionSQL.pm";
 require "TalkSQL.pm";
 require "MeetingSQL.pm";
 require "TalkHintSQL.pm";
-#require "TalkHintUtilities.pm";
-#require "DocumentUtilities.pm";
-#require "FormElements.pm";
-
-#require "DocumentHTML.pm";
-#require "TalkHTML.pm";
-#require "AuthorHTML.pm";
-#require "TopicHTML.pm";
 
 $query = new CGI;  
-my %Params = $query -> Vars;
-
-my $SessionOrderID = $Params{sessionorderid};
-my $Title          = $Params{talktitle};
-my $DocumentID     = $Params{docid};
-my $Confirmed      = $Params{talkconfirm};
-my $Length         = $Params{talktime};
-my $Note           = $Params{talknote};
-my @AuthorHints    = split /\0/,$Params{authors};
-my @TopicHints     = split /\0/,$Params{topics};
+$query -> autoEscape(0);
+my $Untaint = CGI::Untaint -> new($query -> Vars);
+
+my $SessionOrderID = $Untaint -> extract(-as_integer => "sessionorderid") || 0;
+my $Title = $Untaint -> extract(-as_safehtml => "talktitle") || "";
+my $DocumentID = $Untaint -> extract(-as_integer => "docid") || 0;
+my $Confirmed = $Untaint -> extract(-as_safehtml => "talkconfirm") || "";
+my $Length = $Untaint -> extract(-as_safehtml => "talktime") || "";
+my $Note = $Untaint -> extract(-as_safehtml => "talknote") || "";
+my @AuthorHints = @{ $Untaint -> extract(-as_listofint => "authors") || undef };
+my @TopicHints = @{ $Untaint -> extract(-as_listofint => "topics") || undef };
 if ($Confirmed) {
   $Confirmed = $TRUE;
 }
diff --git a/DocDB/cgi/EmailAdminister b/DocDB/cgi/EmailAdminister
index 1a406ab4..27d95930 100755
--- a/DocDB/cgi/EmailAdminister
+++ b/DocDB/cgi/EmailAdminister
@@ -42,22 +42,24 @@ require "Messages.pm";
 require "EmailUserHTML.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 
 # Parameters to script
 
-%params = $query -> Vars;
-my $Password      = $params{password};
-my $Username      = $params{admuser};
-my $Action        = $params{admaction};
-
-my $EmailUserID   = $params{emailuserid};
-my $SingleUser    = $params{singleuser};
-my $NewPassword   = $params{resetpw};
-my $ClearGroups   = ($params{cleargroups} eq "on");
-my $ClearUser     = ($params{clearuser}   eq "on");
-my $UserSign      = ($params{usersign}    eq "on");
-my $VerifyUser    = ($params{verifyuser}  eq "on");
-my @UsersGroupIDs = split /\0/,$params{usergroups};
+my $Password = $Untaint -> extract(-as_printable => "password") || "";
+my $Username = $Untaint -> extract(-as_printable => "admuser") || "";
+my $Action = $Untaint -> extract(-as_printable => "admaction") || "";
+
+my $EmailUserID = $Untaint -> extract(-as_integer => "emailuserid") || 0;
+my $SingleUser = $Untaint -> extract(-as_safehtml => "singleuser") || "";
+my $NewPassword = $Untaint -> extract(-as_printable => "resetpw") || "";
+
+my $ClearGroups   = ($Untaint -> extract(-as_printable => "cleargroups") eq "on");
+my $ClearUser     = ($Untaint -> extract(-as_printable => "clearuser")   eq "on");
+my $UserSign      = ($Untaint -> extract(-as_printable => "usersign")    eq "on");
+my $VerifyUser    = ($Untaint -> extract(-as_printable => "verifyuser")  eq "on");
+my @UsersGroupIDs = @{ $Untaint -> extract(-as_listofint => "usergroups") || undef };
 
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$Username,$Password);
 
diff --git a/DocDB/cgi/EmailAdministerForm b/DocDB/cgi/EmailAdministerForm
index 7fce2bf0..0e49d632 100755
--- a/DocDB/cgi/EmailAdministerForm
+++ b/DocDB/cgi/EmailAdministerForm
@@ -45,11 +45,12 @@ require "SecuritySQL.pm";
 require "NotificationSQL.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
 $dbh   = DBI -> connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 
-%params = $query -> Vars;
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 
-my $EmailUserID  = $params{emailuserid} || 0;
+my $EmailUserID = $Untaint -> extract(-as_integer => "emailuserid") || 0;
 
 GetSecurityGroups();
 
diff --git a/DocDB/cgi/EmailCreate b/DocDB/cgi/EmailCreate
index be00e04b..92c7cfed 100755
--- a/DocDB/cgi/EmailCreate
+++ b/DocDB/cgi/EmailCreate
@@ -31,16 +31,17 @@ require "HTMLUtilities.pm";
 require "ResponseElements.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rwuser,$db_rwpass);
 @ErrorStack = ();
 
-%params = $query -> Vars;
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 
 # Collect parameters
 
-my $UserName = $params{username};
-my $Password = $params{password};
-my $PassConf = $params{passconf};
+my $UserName = $Untaint -> extract(-as_safehtml => "username") || "";
+my $Password = $Untaint -> extract(-as_printable => "password") || "";
+my $PassConf = $Untaint -> extract(-as_printable => "passconf") || "";
 $UserName =~ s/\s+//g;
 $Password =~ s/\s+//g;
 $PassConf =~ s/\s+//g;
diff --git a/DocDB/cgi/EmailLogin b/DocDB/cgi/EmailLogin
index 33aa12b7..49c5cd7b 100755
--- a/DocDB/cgi/EmailLogin
+++ b/DocDB/cgi/EmailLogin
@@ -32,6 +32,7 @@ require "ResponseElements.pm";
 require "EmailSecurity.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
 
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 
diff --git a/DocDB/cgi/EventAdministerForm b/DocDB/cgi/EventAdministerForm
index 9e874cc6..76d02c62 100755
--- a/DocDB/cgi/EventAdministerForm
+++ b/DocDB/cgi/EventAdministerForm
@@ -48,19 +48,19 @@ require "MeetingHTML.pm";
 require "TopicHTML.pm"; # For description boxes
 
 $query = new CGI;  # Global for subroutines
-
-%params = $query -> Vars;
-
-my $Password         = $params{password};
-my $Username         = $params{admuser};
-my $Action           = $params{admaction};
-my $Force            = $params{admforce};
-
-my $SubForm          = $params{subform};
-my $EventGroupID     = int($params{eventgroups});
-my $EventID          = int($params{events});
-my $ShortDescription = $params{shortdesc};
-my $LongDescription  = $params{longdesc};
+$query -> autoEscape(0);
+my $Untaint = CGI::Untaint -> new($query -> Vars);
+
+my $Password = $Untaint -> extract(-as_printable => "password") || "";
+my $Username = $Untaint -> extract(-as_printable => "admuser") || "";
+my $Action = $Untaint -> extract(-as_printable => "admaction") || "";
+my $Force = $Untaint -> extract(-as_printable => "admforce") || "";
+
+my $SubForm = $Untaint -> extract(-as_printable => "subform") || "";
+my $EventGroupID = $Untaint -> extract(-as_integer => "eventgroups") || 0;
+my $EventID = $Untaint -> extract(-as_integer => "events") || 0;
+my $ShortDescription = $Untaint -> extract(-as_safehtml => "shortdesc") || "";
+my $LongDescription = $Untaint -> extract(-as_safehtml => "longdesc") || "";
 
 $query -> delete_all();
 
diff --git a/DocDB/cgi/ExternalDocDBAdministerForm b/DocDB/cgi/ExternalDocDBAdministerForm
index 27f79e26..9ebd525d 100755
--- a/DocDB/cgi/ExternalDocDBAdministerForm
+++ b/DocDB/cgi/ExternalDocDBAdministerForm
@@ -44,21 +44,21 @@ require "XRefHTML.pm";
 require "XRefSQL.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 
-%params = $query -> Vars;
+my $Password = $Untaint -> extract(-as_printable => "password") || "";
+my $Username = $Untaint -> extract(-as_printable => "admuser") || "";
+my $Action = $Untaint -> extract(-as_printable => "admaction") || "";
+my $Force = $Untaint -> extract(-as_printable => "admforce") || "";
 
-my $Password         = $params{password};
-my $Username         = $params{admuser};
-my $Action           = $params{admaction};
-my $Force            = $params{admforce};
+my $SubForm = $Untaint -> extract(-as_printable => "subform") || "";
 
-my $SubForm          = $params{subform};
-
-my $ExternalDocDBID  = $params{externaldocdbs};
-my $ProjectName      = $params{project};
-my $Description      = $params{desc};
-my $PublicURL        = $params{puburl};
-my $PrivateURL       = $params{privurl};
+my $ExternalDocDBID = $Untaint -> extract(-as_integer => "externaldocdbs") || 0;
+my $ProjectName = $Untaint -> extract(-as_safehtml => "project") || "";
+my $Description = $Untaint -> extract(-as_safehtml => "desc") || "";
+my $PublicURL = $Untaint -> extract(-as_safehtml => "puburl") || "";
+my $PrivateURL = $Untaint -> extract(-as_safehtml => "privurl") || "";
 
 $query -> delete_all();
 

From c4e2e22d48258eeb453c7ccbd94e88511682d990 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Mon, 29 Jul 2013 16:54:40 -0500
Subject: [PATCH 066/163] Untaint more admin scripts

---
 DocDB/cgi/GroupAdminister       | 32 ++++++++++++++++----------------
 DocDB/cgi/GroupAdministerForm   |  1 +
 DocDB/cgi/InstitutionAdminister | 16 ++++++++--------
 DocDB/cgi/JournalAdminister     | 22 +++++++++++-----------
 4 files changed, 36 insertions(+), 35 deletions(-)

diff --git a/DocDB/cgi/GroupAdminister b/DocDB/cgi/GroupAdminister
index 2d4d5a15..585a16b2 100755
--- a/DocDB/cgi/GroupAdminister
+++ b/DocDB/cgi/GroupAdminister
@@ -38,28 +38,28 @@ require "GroupHTML.pm";
 require "Messages.pm";
 
 $query = new CGI;  # Global for subroutines
-
-%CGIParams = $query -> Vars;
+$query -> autoEscape(0);
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 
 @ErrorStack = ();
 @WarnStack  = ();
 
 # Parameters to script 
 
-my $Password       = $CGIParams{password};
-my $Username       = $CGIParams{admuser};
-my $Action         = $CGIParams{admaction};
-
-my $Description    = $CGIParams{description};
-my $Name           = $CGIParams{name};
-my $ParentID       = $CGIParams{parent};
-my @ChildIDs       = split /\0/,$CGIParams{child};
-my $View           = $CGIParams{view};
-my $Create         = $CGIParams{create};
-my $Admin          = $CGIParams{admin};
-my $NoPerm         = $CGIParams{remove};
-my $RemoveChildren = $CGIParams{removesubs};
-my $Force          = $CGIParams{admforce};
+my $Password = $Untaint -> extract(-as_printable => "password") || "";
+my $Username = $Untaint -> extract(-as_printable => "admuser") || "";
+my $Action = $Untaint -> extract(-as_printable => "admaction") || "";
+my $Force = $Untaint -> extract(-as_printable => "admforce") || "";
+
+my $Description = $Untaint -> extract(-as_safehtml => "description") || "";
+my $Name = $Untaint -> extract(-as_safehtml => "name") || "";
+my $ParentID = $Untaint -> extract(-as_integer => "ParentID") || 0;
+my @ChildIDs = @{ $Untaint -> extract(-as_listofint => "child") || undef };
+my $View = $Untaint -> extract(-as_printable => "view") || "";
+my $Create = $Untaint -> extract(-as_printable => "create") || "";
+my $Admin = $Untaint -> extract(-as_printable => "admin") || "";
+my $NoPerm = $Untaint -> extract(-as_printable => "remove") || "";
+my $RemoveChildren = $Untaint -> extract(-as_printable => "removesubs") || "";
 
 if ($View)           {$View   = 1;} # Make sure they are in format MySQL is expecting
 if ($Create)         {$Create = 1;}
diff --git a/DocDB/cgi/GroupAdministerForm b/DocDB/cgi/GroupAdministerForm
index e295cfca..bf216923 100755
--- a/DocDB/cgi/GroupAdministerForm
+++ b/DocDB/cgi/GroupAdministerForm
@@ -40,6 +40,7 @@ require "HTMLUtilities.pm";
 require "Sorts.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
 $dbh   = DBI -> connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 
 GetSecurityGroups();
diff --git a/DocDB/cgi/InstitutionAdminister b/DocDB/cgi/InstitutionAdminister
index 79652e2c..d8268ea3 100755
--- a/DocDB/cgi/InstitutionAdminister
+++ b/DocDB/cgi/InstitutionAdminister
@@ -37,21 +37,21 @@ require "AuthorHTML.pm";
 require "Messages.pm";
 
 $query = new CGI;  # Global for subroutines
-
-%params = $query -> Vars;
+$query -> autoEscape(0);
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 
 @ErrorStack = ();
 @WarnStack  = ();
 
 # Parameters to script 
 
-$Password      = $params{password};
-my $Username      = $params{admuser};
-$Action        = $params{admaction};
+my $Password = $Untaint -> extract(-as_printable => "password") || "";
+my $Username = $Untaint -> extract(-as_printable => "admuser") || "";
+my $Action = $Untaint -> extract(-as_printable => "admaction") || "";
 
-$InstitutionID = $params{inst};
-$LongName      = $params{longdesc};
-$ShortName     = $params{shortdesc};
+my $InstitutionID = $Untaint -> extract(-as_integer => "inst") || 0;
+my $LongName = $Untaint -> extract(-as_safehtml => "longdesc") || "";
+my $ShortName = $Untaint -> extract(-as_safehtml => "shortdesc") || "";
 
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$Username,$Password);
 
diff --git a/DocDB/cgi/JournalAdminister b/DocDB/cgi/JournalAdminister
index e059b30c..13a271b1 100755
--- a/DocDB/cgi/JournalAdminister
+++ b/DocDB/cgi/JournalAdminister
@@ -36,24 +36,24 @@ require "JournalHTML.pm";
 require "Messages.pm";
 
 $query = new CGI;  # Global for subroutines
-
-%params = $query -> Vars;
+$query -> autoEscape(0);
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 
 @ErrorStack = ();
 @WarnStack  = ();
 
 # Parameters to script 
 
-$Password     = $params{password};
-my $Username      = $params{admuser};
-$Action       = $params{admaction};
+my $Password = $Untaint -> extract(-as_printable => "password") || "";
+my $Username = $Untaint -> extract(-as_printable => "admuser") || "";
+my $Action = $Untaint -> extract(-as_printable => "admaction") || "";
 
-$JournalID    = $params{journal};
-$FullName     = $params{name};
-$Abbreviation = $params{abbr};
-$Acronym      = $params{acronym};
-$Publisher    = $params{pub};
-$URL          = $params{url};
+my $JournalID = $Untaint -> extract(-as_integer => "journal") || 0;
+my $FullName = $Untaint -> extract(-as_safehtml => "name") || "";
+my $Abbreviation = $Untaint -> extract(-as_safehtml => "abbr") || "";
+my $Acronym = $Untaint -> extract(-as_safehtml => "acronym") || "";
+my $Publisher = $Untaint -> extract(-as_safehtml => "pub") || "";
+my $URL = $Untaint -> extract(-as_safehtml => "url") || "";
 
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$Username,$Password);
 

From f1502fc11997aded75f6bf0d8e69cb74ae01302c Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Mon, 29 Jul 2013 17:01:35 -0500
Subject: [PATCH 067/163] Untaint keyword admin scripts

---
 DocDB/cgi/KeywordAdministerForm  |  1 +
 DocDB/cgi/KeywordGroupAdminister | 16 ++++++++--------
 DocDB/cgi/KeywordListAdminister  | 20 ++++++++++----------
 3 files changed, 19 insertions(+), 18 deletions(-)

diff --git a/DocDB/cgi/KeywordAdministerForm b/DocDB/cgi/KeywordAdministerForm
index 4657b629..89aeebfb 100755
--- a/DocDB/cgi/KeywordAdministerForm
+++ b/DocDB/cgi/KeywordAdministerForm
@@ -41,6 +41,7 @@ require "HTMLUtilities.pm";
 require "Sorts.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
 $dbh   = DBI -> connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 
 &GetKeywords;
diff --git a/DocDB/cgi/KeywordGroupAdminister b/DocDB/cgi/KeywordGroupAdminister
index 37fc9225..3587dddf 100755
--- a/DocDB/cgi/KeywordGroupAdminister
+++ b/DocDB/cgi/KeywordGroupAdminister
@@ -37,21 +37,21 @@ require "KeywordHTML.pm";
 require "Messages.pm";
 
 $query = new CGI;  # Global for subroutines
-
-%params = $query -> Vars;
+$query -> autoEscape(0);
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 
 @ErrorStack = ();
 @WarnStack  = ();
 
 # Parameters to script 
 
-$Password      = $params{password};
-my $Username      = $params{admuser};
-$Action        = $params{admaction};
+my $Password = $Untaint -> extract(-as_printable => "password") || "";
+my $Username = $Untaint -> extract(-as_printable => "admuser") || "";
+my $Action = $Untaint -> extract(-as_printable => "admaction") || "";
 
-$KeywordGroupID  = $params{keywordgroup};
-$LongName      = $params{longdesc};
-$ShortName     = $params{shortdesc};
+my $KeywordGroupID = $Untaint -> extract(-as_integer => "keywordgroup") || 0;
+my $LongName = $Untaint -> extract(-as_safehtml => "longdesc") || "";
+my $ShortName = $Untaint -> extract(-as_safehtml => "shortdesc") || "";
 
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$Username,$Password);
 
diff --git a/DocDB/cgi/KeywordListAdminister b/DocDB/cgi/KeywordListAdminister
index fbf292c9..d3b7b722 100755
--- a/DocDB/cgi/KeywordListAdminister
+++ b/DocDB/cgi/KeywordListAdminister
@@ -39,22 +39,22 @@ require "KeywordSQL.pm";
 require "Messages.pm";
 
 $query = new CGI;  # Global for subroutines
-
-%params = $query -> Vars;
+$query -> autoEscape(0);
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 
 @ErrorStack = ();
 @WarnStack  = ();
 
 # Parameters to script 
  
-my $Password        = $params{password};
-my $Username        = $params{admuser};
-my $Action          = $params{admaction};
-
-my $KeywordID       = $params{keywordlist};
-my @KeywordGroupIDs = split /\0/,$params{keywordgroup};
-my $LongName        = $params{longdesc};
-my $ShortName       = $params{shortdesc};
+my $Password = $Untaint -> extract(-as_printable => "password") || "";
+my $Username = $Untaint -> extract(-as_printable => "admuser") || "";
+my $Action = $Untaint -> extract(-as_printable => "admaction") || "";
+
+my $KeywordID = $Untaint -> extract(-as_integer => "keywordlist") || 0;
+my @KeywordGroupIDs = @{ $Untaint -> extract(-as_listofint => "keywordgroup") || undef };
+my $LongName = $Untaint -> extract(-as_safehtml => "longdesc") || "";
+my $ShortName = $Untaint -> extract(-as_safehtml => "shortdesc") || "";
 
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$Username,$Password);
 

From 8fe717615984b9418ca801d86b66ce5628beff23 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Tue, 30 Jul 2013 11:09:04 -0500
Subject: [PATCH 068/163] Start of routine to do rlike searches

---
 DocDB/cgi/SearchAtoms.pm | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/DocDB/cgi/SearchAtoms.pm b/DocDB/cgi/SearchAtoms.pm
index 27eceaa6..3413c2f1 100644
--- a/DocDB/cgi/SearchAtoms.pm
+++ b/DocDB/cgi/SearchAtoms.pm
@@ -23,6 +23,8 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
+use HTML::Entities qw(encode_entities_numeric);
+
 %SearchWeights = ( # These weights are used to order documents from the simple search
                   "Author"          => 4,
                   "Topic"           => 3,
@@ -52,6 +54,7 @@ sub TextSearch {
     my @Words = split /\s+/,$Words;
     foreach my $Word (@Words) {
       if ($Mode eq "anysub" || $Mode eq "allsub") {
+        my $RegExp = RegExpSearchAtom($Word);
         $Word =~ tr/[A-Z]/[a-z]/;
         push @Atoms,"LOWER($Field) like \"%$Word%\"";
       } elsif ($Mode eq "anyword" || $Mode eq "allword") {
@@ -74,6 +77,34 @@ sub TextSearch {
   return $Phrase;
 }
 
+sub RegExpSearchAtom {
+  my ($Word, $RequireWord) = @_;
+
+  my @RegExpParts = ();
+  my $RegExpAtom  = '';
+
+  my $SimpleWord = $Word;
+  $SimpleWord = s/^\w+//g;
+  if ($SimpleWord eq $Word) { # No special characters found
+    push @RegExpParts, $Word;
+  } else {
+    print STDERR "Special characters found, gotta figure this out\n";
+  }
+
+  if ($RequireWord) {
+    $RegExpAtom .= '[[:<:]]';
+  }
+  $RegExpAtom .= '(';
+  $RegExpAtom .= join '|', @RegExpParts;
+  $RegExpAtom .= ')';
+  if ($RequireWord) {
+    $RegExpAtom .= '[[:>:]]';
+  }
+  my $SafeAtom = $dbh->quote($RegExpAtom);
+  print STDERR "Searching for $SafeAtom\n";
+  return $SafeAtom;
+}
+
 sub IDSearch {
   my ($Table,$Field,$Mode,@IDs) = @_;
 

From f7a314c7653f6fd8c621690293275a0596a7ec38 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Tue, 30 Jul 2013 11:26:48 -0500
Subject: [PATCH 069/163] Start adding special character handling to search

---
 DocDB/cgi/SearchAtoms.pm | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/DocDB/cgi/SearchAtoms.pm b/DocDB/cgi/SearchAtoms.pm
index 3413c2f1..7f98665e 100644
--- a/DocDB/cgi/SearchAtoms.pm
+++ b/DocDB/cgi/SearchAtoms.pm
@@ -58,6 +58,7 @@ sub TextSearch {
         $Word =~ tr/[A-Z]/[a-z]/;
         push @Atoms,"LOWER($Field) like \"%$Word%\"";
       } elsif ($Mode eq "anyword" || $Mode eq "allword") {
+        my $RegExp = RegExpSearchAtom($Word, $TRUE);
         $Word =~ tr/[A-Z]/[a-z]/;
         push @Atoms,"LOWER($Field) REGEXP \"\[\[:<:\]\]$Word\[\[:>:\]\]\"";
       }
@@ -84,11 +85,15 @@ sub RegExpSearchAtom {
   my $RegExpAtom  = '';
 
   my $SimpleWord = $Word;
-  $SimpleWord = s/^\w+//g;
+  $SimpleWord =~ s/^\w+//g;
   if ($SimpleWord eq $Word) { # No special characters found
     push @RegExpParts, $Word;
   } else {
-    print STDERR "Special characters found, gotta figure this out\n";
+    print STDERR "Special characters found in $Word becomes $SimpleWord, gotta figure this out\n";
+    # First take care of regexp special characters
+    my $RESafeWord = $Word;
+    $RESafeWord =~ s/(\[\\\^\$\.\|\?\*\+\(\))/\\\1/;
+    push @RegExpParts, $RESafeWord;
   }
 
   if ($RequireWord) {

From c81ddaae33bd92d507a9268d7249047d570a07d1 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Tue, 30 Jul 2013 13:23:51 -0500
Subject: [PATCH 070/163] All five formats

---
 DocDB/cgi/SearchAtoms.pm | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/DocDB/cgi/SearchAtoms.pm b/DocDB/cgi/SearchAtoms.pm
index 7f98665e..1bc6196c 100644
--- a/DocDB/cgi/SearchAtoms.pm
+++ b/DocDB/cgi/SearchAtoms.pm
@@ -85,15 +85,23 @@ sub RegExpSearchAtom {
   my $RegExpAtom  = '';
 
   my $SimpleWord = $Word;
-  $SimpleWord =~ s/^\w+//g;
+  $SimpleWord =~ s/\W//g;
   if ($SimpleWord eq $Word) { # No special characters found
     push @RegExpParts, $Word;
   } else {
     print STDERR "Special characters found in $Word becomes $SimpleWord, gotta figure this out\n";
     # First take care of regexp special characters
-    my $RESafeWord = $Word;
-    $RESafeWord =~ s/(\[\\\^\$\.\|\?\*\+\(\))/\\\1/;
-    push @RegExpParts, $RESafeWord;
+    my $Escaped = $Word;
+    $Escaped =~ s/([\[\\\^\$\.\|\?\*\+\(\)])/\\\1/g;                     # Prepend \ to regexp safe characters [\^$.|?*+()
+    push @RegExpParts, $Escaped;
+    push @RegExpParts, HTML::Entities::encode($Word);                    # &amp;
+    push @RegExpParts, HTML::Entities::encode_entities_numeric($Word);   # &#xab;
+    $Escaped = $Word;
+    $Escaped =~ s{(\W)}{"%".sprintf("%x", unpack(U,$1))}ge;              # %20
+    push @RegExpParts, $Escaped
+    $Escaped = $Word;
+    $Escaped =~ s{(\W)}{"&#".unpack(U,$1).";"}ge;                        # &#1234;
+    push @RegExpParts, $Escaped
   }
 
   if ($RequireWord) {

From 2e36ee8a4e9f0e753f0dd8fcb3cddd1a3f44941e Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Tue, 30 Jul 2013 13:39:09 -0500
Subject: [PATCH 071/163] Filter duplicates

---
 DocDB/cgi/SearchAtoms.pm | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/DocDB/cgi/SearchAtoms.pm b/DocDB/cgi/SearchAtoms.pm
index 1bc6196c..c15a60a8 100644
--- a/DocDB/cgi/SearchAtoms.pm
+++ b/DocDB/cgi/SearchAtoms.pm
@@ -93,15 +93,23 @@ sub RegExpSearchAtom {
     # First take care of regexp special characters
     my $Escaped = $Word;
     $Escaped =~ s/([\[\\\^\$\.\|\?\*\+\(\)])/\\\1/g;                     # Prepend \ to regexp safe characters [\^$.|?*+()
+    print STDERR " adding $Escaped\n";
     push @RegExpParts, $Escaped;
-    push @RegExpParts, HTML::Entities::encode($Word);                    # &amp;
-    push @RegExpParts, HTML::Entities::encode_entities_numeric($Word);   # &#xab;
+
+    $Escaped = HTML::Entities::encode($Word);                    # &amp;
+    if ($Escaped ne $Word) {
+      push @RegExpParts, $Escaped;
+    }
+    $Escaped = HTML::Entities::encode_entities_numeric($Word);   # &#xab;
+    if ($Escaped ne $Word) {
+      push @RegExpParts, $Escaped;
+    }
     $Escaped = $Word;
-    $Escaped =~ s{(\W)}{"%".sprintf("%x", unpack(U,$1))}ge;              # %20
-    push @RegExpParts, $Escaped
+    $Escaped =~ s{(\W)}{"%".sprintf("%x", unpack(U,$1))}ge;      # %20
+    push @RegExpParts, $Escaped;
     $Escaped = $Word;
-    $Escaped =~ s{(\W)}{"&#".unpack(U,$1).";"}ge;                        # &#1234;
-    push @RegExpParts, $Escaped
+    $Escaped =~ s{(\W)}{"&#".unpack(U,$1).";"}ge;                # &#1234;
+    push @RegExpParts, $Escaped;
   }
 
   if ($RequireWord) {

From dd4f47889c748d4ca8764eb4e42eca2af29e3ca4 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Tue, 30 Jul 2013 13:58:59 -0500
Subject: [PATCH 072/163] Switch to regexp

---
 DocDB/cgi/SearchAtoms.pm | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/DocDB/cgi/SearchAtoms.pm b/DocDB/cgi/SearchAtoms.pm
index c15a60a8..46d17928 100644
--- a/DocDB/cgi/SearchAtoms.pm
+++ b/DocDB/cgi/SearchAtoms.pm
@@ -55,12 +55,14 @@ sub TextSearch {
     foreach my $Word (@Words) {
       if ($Mode eq "anysub" || $Mode eq "allsub") {
         my $RegExp = RegExpSearchAtom($Word);
-        $Word =~ tr/[A-Z]/[a-z]/;
-        push @Atoms,"LOWER($Field) like \"%$Word%\"";
+#        $Word =~ tr/[A-Z]/[a-z]/;
+#        push @Atoms,"LOWER($Field) like \"%$Word%\"";
+        push @Atoms, "$Field rlike $RegExp";
       } elsif ($Mode eq "anyword" || $Mode eq "allword") {
         my $RegExp = RegExpSearchAtom($Word, $TRUE);
-        $Word =~ tr/[A-Z]/[a-z]/;
-        push @Atoms,"LOWER($Field) REGEXP \"\[\[:<:\]\]$Word\[\[:>:\]\]\"";
+#        $Word =~ tr/[A-Z]/[a-z]/;
+#        push @Atoms,"LOWER($Field) REGEXP \"\[\[:<:\]\]$Word\[\[:>:\]\]\"";
+        push @Atoms, "$Field rlike $RegExp";
       }
     }
   }

From 1b097011526eed19b0eb5535f14bb3aae1fdbadf Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Tue, 30 Jul 2013 14:41:24 -0500
Subject: [PATCH 073/163] allow special characters for text fields in search

---
 DocDB/cgi/Search.pm      | 24 +++++++++++++-----------
 DocDB/cgi/SearchAtoms.pm | 16 ++++++----------
 2 files changed, 19 insertions(+), 21 deletions(-)

diff --git a/DocDB/cgi/Search.pm b/DocDB/cgi/Search.pm
index 57a2fa21..8b56b6eb 100644
--- a/DocDB/cgi/Search.pm
+++ b/DocDB/cgi/Search.pm
@@ -100,15 +100,15 @@ sub LocalSearch ($) {
 
   ### Purify input (remove punctuation)
 
-  $SimpleText         =~ s/[^\s\w+-\.]//go;
-  $TitleSearch        =~ s/[^\s\w+-\.]//go;
-  $AbstractSearch     =~ s/[^\s\w+-\.]//go;
-  $KeywordSearch      =~ s/[^\s\w+-\.]//go;
-  $RevisionNoteSearch =~ s/[^\s\w+-\.]//go;
-  $PubInfoSearch      =~ s/[^\s\w+-\.]//go;
-  $FileSearch         =~ s/[^\s\w+-\.]//go;
-  $FileDescSearch     =~ s/[^\s\w+-\.]//go;
-  $FileContSearch     =~ s/[^\s\w+-\.]//go;
+#  $SimpleText         =~ s/[^\s\w+-\.]//go;
+#  $TitleSearch        =~ s/[^\s\w+-\.]//go;
+#  $AbstractSearch     =~ s/[^\s\w+-\.]//go;
+#  $KeywordSearch      =~ s/[^\s\w+-\.]//go;
+#  $RevisionNoteSearch =~ s/[^\s\w+-\.]//go;
+#  $PubInfoSearch      =~ s/[^\s\w+-\.]//go;
+#  $FileSearch         =~ s/[^\s\w+-\.]//go;
+#  $FileDescSearch     =~ s/[^\s\w+-\.]//go;
+  $FileContSearch     =~ s/[^\s\w+-\.]//go;  # No idea what they'd do with special characters, best to remove
 
   GetTopics();
   GetSecurityGroups();
@@ -125,6 +125,8 @@ sub LocalSearch ($) {
   }
 
   if ($SimpleText) { # Break up words and set parameters for rest of search
+    my $SimpleAlphaNumeric = $SimpleText;
+    $SimpleAlphaNumeric =~ s/[^\s\w+-\.]//go;    # FIXME: Upgrade Match* routines to handle special characters
     @RequesterSearchIDs  = ();
     @AuthorSearchIDs     = ();
     @TypeSearchIDs       = ();
@@ -132,7 +134,7 @@ sub LocalSearch ($) {
     @EventSearchIDs      = ();
     @EventGroupSearchIDs = ();
 
-    my @Words = split /\s+/,$SimpleText;
+    my @Words = split /\s+/,$SimpleAlphaNumeric;
     foreach my $Word (@Words) {
       push @AuthorSearchIDs    ,MatchAuthor(     {-either => $Word} );
       push @TypeSearchIDs      ,MatchDocType(    {-short  => $Word} );
@@ -153,7 +155,7 @@ sub LocalSearch ($) {
     $PubInfoSearch          = $SimpleText;
     $FileSearch             = $SimpleText;
     $FileDescSearch         = $SimpleText;
-    $FileContSearch         = $SimpleText;
+    $FileContSearch         = $SimpleAlphaNumeric  # No idea what they'd do with special characters, best to remove
     $TitleSearchMode        = "anyword";
     $AbstractSearchMode     = "anyword";
     $KeywordSearchMode      = "anyword";
diff --git a/DocDB/cgi/SearchAtoms.pm b/DocDB/cgi/SearchAtoms.pm
index 46d17928..f968d7cb 100644
--- a/DocDB/cgi/SearchAtoms.pm
+++ b/DocDB/cgi/SearchAtoms.pm
@@ -55,13 +55,9 @@ sub TextSearch {
     foreach my $Word (@Words) {
       if ($Mode eq "anysub" || $Mode eq "allsub") {
         my $RegExp = RegExpSearchAtom($Word);
-#        $Word =~ tr/[A-Z]/[a-z]/;
-#        push @Atoms,"LOWER($Field) like \"%$Word%\"";
         push @Atoms, "$Field rlike $RegExp";
       } elsif ($Mode eq "anyword" || $Mode eq "allword") {
         my $RegExp = RegExpSearchAtom($Word, $TRUE);
-#        $Word =~ tr/[A-Z]/[a-z]/;
-#        push @Atoms,"LOWER($Field) REGEXP \"\[\[:<:\]\]$Word\[\[:>:\]\]\"";
         push @Atoms, "$Field rlike $RegExp";
       }
     }
@@ -91,24 +87,24 @@ sub RegExpSearchAtom {
   if ($SimpleWord eq $Word) { # No special characters found
     push @RegExpParts, $Word;
   } else {
-    print STDERR "Special characters found in $Word becomes $SimpleWord, gotta figure this out\n";
-    # First take care of regexp special characters
-    my $Escaped = $Word;
-    $Escaped =~ s/([\[\\\^\$\.\|\?\*\+\(\)])/\\\1/g;                     # Prepend \ to regexp safe characters [\^$.|?*+()
-    print STDERR " adding $Escaped\n";
+    my $Escaped = $Word;                                         # First take care of regexp special characters
+    $Escaped =~ s/([\[\\\^\$\.\|\?\*\+\(\)])/\\\1/g;             # Prepend \ to regexp safe characters [\^$.|?*+()
     push @RegExpParts, $Escaped;
 
     $Escaped = HTML::Entities::encode($Word);                    # &amp;
     if ($Escaped ne $Word) {
       push @RegExpParts, $Escaped;
     }
+
     $Escaped = HTML::Entities::encode_entities_numeric($Word);   # &#xab;
     if ($Escaped ne $Word) {
       push @RegExpParts, $Escaped;
     }
+
     $Escaped = $Word;
     $Escaped =~ s{(\W)}{"%".sprintf("%x", unpack(U,$1))}ge;      # %20
     push @RegExpParts, $Escaped;
+
     $Escaped = $Word;
     $Escaped =~ s{(\W)}{"&#".unpack(U,$1).";"}ge;                # &#1234;
     push @RegExpParts, $Escaped;
@@ -123,8 +119,8 @@ sub RegExpSearchAtom {
   if ($RequireWord) {
     $RegExpAtom .= '[[:>:]]';
   }
+
   my $SafeAtom = $dbh->quote($RegExpAtom);
-  print STDERR "Searching for $SafeAtom\n";
   return $SafeAtom;
 }
 

From 791c95b558ea08710a9677b03f72776a8f2c62d2 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Tue, 30 Jul 2013 14:42:54 -0500
Subject: [PATCH 074/163] allow special characters for text fields in search

---
 DocDB/cgi/Search.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/DocDB/cgi/Search.pm b/DocDB/cgi/Search.pm
index 8b56b6eb..56294139 100644
--- a/DocDB/cgi/Search.pm
+++ b/DocDB/cgi/Search.pm
@@ -155,7 +155,7 @@ sub LocalSearch ($) {
     $PubInfoSearch          = $SimpleText;
     $FileSearch             = $SimpleText;
     $FileDescSearch         = $SimpleText;
-    $FileContSearch         = $SimpleAlphaNumeric  # No idea what they'd do with special characters, best to remove
+    $FileContSearch         = $SimpleAlphaNumeric;  # No idea what they'd do with special characters, best to remove
     $TitleSearchMode        = "anyword";
     $AbstractSearchMode     = "anyword";
     $KeywordSearchMode      = "anyword";

From 8263139acf1e2ceded76145f16303bebb9680d94 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Tue, 30 Jul 2013 15:31:26 -0500
Subject: [PATCH 075/163] allow special characters for text fields in search

---
 DocDB/cgi/Search | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/DocDB/cgi/Search b/DocDB/cgi/Search
index 0a6a13ed..8ce310de 100755
--- a/DocDB/cgi/Search
+++ b/DocDB/cgi/Search
@@ -36,9 +36,11 @@ require "HTMLUtilities.pm";
 require "Search.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 ### Set up, give user initial information
 
+# Need these unsanitized to perform searches. Never printed anyhow.
 my %CGIParams = $query -> Vars;
 
 ### Pull info out of params into local variables

From 2e7be2169781d4f5031ea2071875baefcf66dcc7 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Tue, 30 Jul 2013 15:33:16 -0500
Subject: [PATCH 076/163] Update SearchForm

---
 DocDB/cgi/SearchForm | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/DocDB/cgi/SearchForm b/DocDB/cgi/SearchForm
index 5f6fc4ef..dd338580 100755
--- a/DocDB/cgi/SearchForm
+++ b/DocDB/cgi/SearchForm
@@ -43,6 +43,7 @@ require "HTMLUtilities.pm";
 require "MeetingHTML.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 
 GetAuthors();
@@ -51,7 +52,7 @@ GetSecurityGroups();
 GetJournals();
 GetDocTypes();
 
-%params = $query -> Vars;
+#%params = $query -> Vars;
 
 print $query -> header( -charset => $HTTP_ENCODING );
 

From fc27369cadc9e4d6234be674cc60d7df1297bac1 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 31 Jul 2013 15:16:08 -0500
Subject: [PATCH 077/163] Fix document link, add CGI::Untaint to scripts
 modified so far

---
 DocDB/cgi/AddFiles                    |  4 +-
 DocDB/cgi/AuthorAdd                   | 22 ++++-----
 DocDB/cgi/AuthorAdminister            |  2 +-
 DocDB/cgi/ConfirmTalkHint             | 16 +++----
 DocDB/cgi/CustomListForm              |  1 +
 DocDB/cgi/DeleteConfirm               |  2 +-
 DocDB/cgi/DeleteDocument              |  2 +-
 DocDB/cgi/DisplayMeeting              |  2 +-
 DocDB/cgi/DocDBInstructions           |  2 +-
 DocDB/cgi/DocTypeAdminister           | 24 +++++-----
 DocDB/cgi/DocumentHTML.pm             |  4 +-
 DocDB/cgi/EditTalkInfo                | 17 +++----
 DocDB/cgi/EmailAdminister             |  2 +-
 DocDB/cgi/EmailAdministerForm         |  1 +
 DocDB/cgi/EmailCreate                 | 18 ++++----
 DocDB/cgi/EventAdministerForm         |  1 +
 DocDB/cgi/ExternalDocDBAdministerForm | 45 +++++++++---------
 DocDB/cgi/GroupAdminister             | 66 +++++++++++++--------------
 DocDB/cgi/InstitutionAdminister       | 28 ++++++------
 DocDB/cgi/JournalAdminister           | 32 ++++++-------
 DocDB/cgi/KeywordGroupAdminister      | 28 ++++++------
 DocDB/cgi/KeywordListAdminister       | 42 ++++++++---------
 22 files changed, 184 insertions(+), 177 deletions(-)

diff --git a/DocDB/cgi/AddFiles b/DocDB/cgi/AddFiles
index 259451f6..ddba2bf4 100755
--- a/DocDB/cgi/AddFiles
+++ b/DocDB/cgi/AddFiles
@@ -26,7 +26,7 @@
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
 use Benchmark;
-use CGI;
+use CGI::Untaint;
 use DBI;
 
 $StartTime = new Benchmark;
@@ -74,7 +74,7 @@ print $query -> header( -charset => $HTTP_ENCODING );
 ### Get document and revision ID
 
 my $DocumentID = $Untaint -> extract(-as_integer => "docid") || 0;
-my $Version = $Untaint -> extract(-as_integer => "version") || 0; 
+my $Version = $Untaint -> extract(-as_integer => "version") || 0;
 my $Replace = $Untaint -> extract(-as_printable => "replace") || "";
 my $MaxFiles = $Untaint -> extract(-as_integer => "maxfiles") || 0;
 my $Replace = $Untaint -> extract(-as_printable => "submitagree") || "";
diff --git a/DocDB/cgi/AuthorAdd b/DocDB/cgi/AuthorAdd
index 24faf37f..5ea8a8d2 100755
--- a/DocDB/cgi/AuthorAdd
+++ b/DocDB/cgi/AuthorAdd
@@ -1,8 +1,8 @@
 #! /usr/bin/env perl
 #
 #        Name: AuthorAdd
-# Description: Adds an author into the DB list of authors.  
-#              Called by submission from AddAuthorForm 
+# Description: Adds an author into the DB list of authors.
+#              Called by submission from AddAuthorForm
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified: Eric Vaandering (ewv@fnal.gov)
@@ -13,7 +13,7 @@
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -25,7 +25,7 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-use CGI;
+use CGI::Untaint;
 use DBI;
 
 require "DocDBGlobals.pm";
@@ -58,24 +58,24 @@ unless (CanCreate()) {
 }
 unless ($InstitutionID && $FirstName && $LastName) {
   push @ErrorStack,"You must supply a first and last name and an institution.";
-}  
-  
+}
+
 EndPage(@ErrorStack);
 
 my $AuthorInsert = $dbh->prepare(
    "insert into Author ".
-          "(AuthorID, FirstName, MiddleInitials, LastName, InstitutionID,Active) ". 
+          "(AuthorID, FirstName, MiddleInitials, LastName, InstitutionID,Active) ".
    "values (0,        ?,         ?,              ?,        ?,            1)");
-            
+
 $AuthorInsert -> execute($FirstName,$MiddleInitials,$LastName,$InstitutionID);
 my $AuthorID = $AuthorInsert -> {mysql_insertid}; # Works with MySQL only
-                           
+
 if ($AuthorID) {
-  push @ActionStack,"$FirstName $MiddleInitials $LastName has been added as an author. You can <a href=\"$AuthorAddForm\">add another</a> author."; 
+  push @ActionStack,"$FirstName $MiddleInitials $LastName has been added as an author. You can <a href=\"$AuthorAddForm\">add another</a> author.";
 } else {
   unless (@ErrorStack) {
     push @ErrorStack,"Something unknown went wrong. Contact an administrator.";
-  }   
+  }
 }
 
 ActionReport();
diff --git a/DocDB/cgi/AuthorAdminister b/DocDB/cgi/AuthorAdminister
index f88e0192..55a04f87 100755
--- a/DocDB/cgi/AuthorAdminister
+++ b/DocDB/cgi/AuthorAdminister
@@ -27,7 +27,7 @@
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
 
-use CGI;
+use CGI::Untaint;
 use DBI;
 
 require "DocDBGlobals.pm";
diff --git a/DocDB/cgi/ConfirmTalkHint b/DocDB/cgi/ConfirmTalkHint
index b7ed53ce..a9b1e65d 100755
--- a/DocDB/cgi/ConfirmTalkHint
+++ b/DocDB/cgi/ConfirmTalkHint
@@ -1,6 +1,6 @@
 #! /usr/bin/env perl
 #
-# Description: Script to confirm a match between a talk entered in the agenda 
+# Description: Script to confirm a match between a talk entered in the agenda
 #              and a document
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
@@ -12,7 +12,7 @@
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -25,7 +25,7 @@
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
 
-use CGI;
+use CGI::Untaint;
 use DBI;
 
 require "DocDBGlobals.pm";
@@ -57,11 +57,11 @@ my $SessionTalkID = $Untaint -> extract(-as_integer => "sessiontalkid") || 0;
 
 unless ($DocumentID) {
   push @ErrorStack,"You are must supply a document number!";
-}  
+}
 
 unless ($SessionTalkID) {
   push @ErrorStack,"You are must supply a Session Number!";
-}  
+}
 
 print $query -> header( -charset => $HTTP_ENCODING );
 &DocDBHeader("Confirming document match","",-nobody => $TRUE);
@@ -69,7 +69,7 @@ print $query -> header( -charset => $HTTP_ENCODING );
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rwuser,$db_rwpass);
 unless ($dbh) {
   push @ErrorStack,$Msg_NoConnect;
-}      
+}
 &EndPage(@ErrorStack);
 
 &FetchDocument($DocumentID);
@@ -101,9 +101,9 @@ my $RevisionEventCheck = $dbh -> prepare("select RevEventID from RevisionEvent w
 $RevisionEventCheck -> execute($DocRevID,$ConferenceID);
 my ($RevisionEventID) = $RevisionEventCheck -> fetchrow_array;
 unless ($RevisionEventID) {
-  my $Insert = $dbh -> prepare("insert into RevisionEvent (RevEventID,DocRevID,ConferenceID) values (0,?,?)"); 
+  my $Insert = $dbh -> prepare("insert into RevisionEvent (RevEventID,DocRevID,ConferenceID) values (0,?,?)");
   $Insert -> execute($DocRevID,$ConferenceID);
-}  
+}
 print "<p><b>The match has been confirmed.<br/>
              Press the button below to reload the original page.</b></p>\n";
 
diff --git a/DocDB/cgi/CustomListForm b/DocDB/cgi/CustomListForm
index 5afedac6..349b58cd 100755
--- a/DocDB/cgi/CustomListForm
+++ b/DocDB/cgi/CustomListForm
@@ -28,6 +28,7 @@
 
 
 use CGI qw(-nosticky);
+use CGI::Untaint;
 use DBI;
 
 require "DocDBGlobals.pm";
diff --git a/DocDB/cgi/DeleteConfirm b/DocDB/cgi/DeleteConfirm
index 2bc0577d..82f15b44 100755
--- a/DocDB/cgi/DeleteConfirm
+++ b/DocDB/cgi/DeleteConfirm
@@ -25,7 +25,7 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-use CGI;
+use CGI::Untaint;
 use DBI;
 
 require "DocDBGlobals.pm";
diff --git a/DocDB/cgi/DeleteDocument b/DocDB/cgi/DeleteDocument
index 12e48535..01ea1b31 100755
--- a/DocDB/cgi/DeleteDocument
+++ b/DocDB/cgi/DeleteDocument
@@ -24,7 +24,7 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-use CGI;
+use CGI::Untaint;
 use DBI;
 
 require "DocDBGlobals.pm";
diff --git a/DocDB/cgi/DisplayMeeting b/DocDB/cgi/DisplayMeeting
index 3b3c4c25..d239f6a4 100755
--- a/DocDB/cgi/DisplayMeeting
+++ b/DocDB/cgi/DisplayMeeting
@@ -26,7 +26,7 @@
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
 use Benchmark;
-use CGI;
+use CGI::Untaint;
 use DBI;
 
 $StartTime = new Benchmark;
diff --git a/DocDB/cgi/DocDBInstructions b/DocDB/cgi/DocDBInstructions
index 3dbce48f..cbc44330 100755
--- a/DocDB/cgi/DocDBInstructions
+++ b/DocDB/cgi/DocDBInstructions
@@ -25,7 +25,7 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-use CGI;
+use CGI::Untaint;
 use DBI;
 
 require "DocDBGlobals.pm";
diff --git a/DocDB/cgi/DocTypeAdminister b/DocDB/cgi/DocTypeAdminister
index f325f433..b1e44679 100755
--- a/DocDB/cgi/DocTypeAdminister
+++ b/DocDB/cgi/DocTypeAdminister
@@ -1,19 +1,19 @@
 #! /usr/bin/env perl
 #
 #        Name: DocTypeAdminister.pm
-# Description: This script is called by AdministerForm and does administration 
+# Description: This script is called by AdministerForm and does administration
 #              on document types in the DB. This script adds, modifies and
 #              deletes document types.
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified: 
+#    Modified:
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -25,7 +25,7 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-use CGI;
+use CGI::Untaint;
 use DBI;
 
 require "DocDBGlobals.pm";
@@ -40,7 +40,7 @@ $query = new CGI;  # Global for subroutines
 $query -> autoEscape(0);
 my $Untaint = CGI::Untaint -> new($query -> Vars);
 
-# Parameters to script 
+# Parameters to script
 
 my $Password = $Untaint -> extract(-as_printable => "password") || "";
 my $Username = $Untaint -> extract(-as_printable => "admuser") || "";
@@ -54,7 +54,7 @@ $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$Username,$Password);
 
 unless ($dbh) {
   push @ErrorStack,$Msg_AdminNoConnect;
-}         
+}
 EndPage();
 
 print $query -> header( -charset => $HTTP_ENCODING );
@@ -62,7 +62,7 @@ DocDBHeader("Modified List of Document Types");
 
 unless (CanAdminister()) {
   push @ErrorStack,$Msg_AdminNoLogin;
-}  
+}
 EndPage();
 
 GetDocTypes();
@@ -81,14 +81,14 @@ if      ($Action eq "Delete") { # Delete institutions
   }
   EndPage();
 
-# Deal with name changes     
+# Deal with name changes
 
-  if ($ShortName) { 
+  if ($ShortName) {
     push @ActionStack,"Changed document type's short name to $ShortName";
     my $DocTypeUpdate = $dbh->prepare("update DocumentType set ShortType=? where DocTypeID=?");
     $DocTypeUpdate -> execute($ShortName,$DocTypeID);
   }
-  if ($LongName) { 
+  if ($LongName) {
     push @ActionStack,"Changed document type's long name to $LongName";
     my $DocTypeUpdate = $dbh -> prepare("update DocumentType set LongType=? where DocTypeID=?");
     $DocTypeUpdate -> execute($LongName,$DocTypeID);
@@ -100,7 +100,7 @@ if      ($Action eq "Delete") { # Delete institutions
   $DocTypeID = $DocTypeInsert -> {mysql_insertid}; # Works with MySQL only
 } else {
   push @ErrorStack,"No valid action was specified.";
-}  
+}
 
 # For modify or new fetch institution information and display.
 
@@ -109,5 +109,5 @@ EndPage();
 
 DocDBNavBar();
 DocDBFooter($DBWebMasterEmail,$DBWebMasterName);
- 
+
 exit;
diff --git a/DocDB/cgi/DocumentHTML.pm b/DocDB/cgi/DocumentHTML.pm
index 85dcd1d1..a0505635 100644
--- a/DocDB/cgi/DocumentHTML.pm
+++ b/DocDB/cgi/DocumentHTML.pm
@@ -23,6 +23,8 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
+require "HTMLUtilities.pm";
+
 sub DocumentTable (%) {
   require "DocumentSQL.pm";
   require "RevisionSQL.pm";
@@ -383,7 +385,7 @@ sub DocumentLink (%) {
     $Link .= $DocumentID."-v".$Version;
     $Link .= $EndElement;
   } elsif ($TitleLink) {      # Use the document Title
-    $Link .= $DocRevisions{$DocRevID}{Title};
+    $Link .= SmartHTML({-text => $DocRevisions{$DocRevID}{Title} });
     $Link .= $EndElement;
     if ($UseSignoffs && !$NoApprovalStatus) { # Put document status on next line
       require "SignoffUtilities.pm";
diff --git a/DocDB/cgi/EditTalkInfo b/DocDB/cgi/EditTalkInfo
index ee36365d..a80b955e 100755
--- a/DocDB/cgi/EditTalkInfo
+++ b/DocDB/cgi/EditTalkInfo
@@ -5,14 +5,14 @@
 #              and display it since it could get crowded in the normal table.
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified: 
+#    Modified:
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -26,7 +26,8 @@
 
 # FIXME: XHTML
 
-use CGI qw(-nosticky);                                                                                      
+use CGI qw(-nosticky);
+use CGI::Untaint;
 use DBI;
 
 require "DocDBGlobals.pm";
@@ -42,7 +43,7 @@ require "TalkSQL.pm";
 require "MeetingSQL.pm";
 require "TalkHintSQL.pm";
 
-$query = new CGI;  
+$query = new CGI;
 $query -> autoEscape(0);
 my $Untaint = CGI::Untaint -> new($query -> Vars);
 
@@ -57,7 +58,7 @@ my @TopicHints = @{ $Untaint -> extract(-as_listofint => "topics") || undef };
 if ($Confirmed) {
   $Confirmed = $TRUE;
 }
-  
+
 CreateConnection(-type => "rw");
 EndPage(-startpage => $TRUE);
 
@@ -90,14 +91,14 @@ EndPage(-startpage => $TRUE);
 if ($TalkSeparatorID) { # Modify a talk separator
   my $TalkSeparatorUpdate = $dbh -> prepare(
    "update TalkSeparator set ".
-   "Time=?, Title=?, Note=? ". 
+   "Time=?, Title=?, Note=? ".
    "where TalkSeparatorID=?");
   $TalkSeparatorUpdate -> execute($Length,$Title,$Note,$TalkSeparatorID);
   push @ActionStack,"Modified break: $Title";
 } elsif ($SessionTalkID) { # Modify a talk
   my $SessionTalkUpdate = $dbh -> prepare(
    "update SessionTalk set ".
-   "DocumentID=?, Confirmed=?, Time=?, HintTitle=?, Note=? ". 
+   "DocumentID=?, Confirmed=?, Time=?, HintTitle=?, Note=? ".
    "where SessionTalkID=?");
   $SessionTalkUpdate -> execute($DocumentID,$Confirmed,$Length,$Title,$Note,$SessionTalkID);
   if ($Confirmed) {
@@ -107,7 +108,7 @@ if ($TalkSeparatorID) { # Modify a talk separator
   InsertAuthorHints($SessionTalkID,@AuthorHints);
   push @ActionStack,"Modified talk: $Title";
 }
-  
+
 # Start page
 
 print $query -> header( -charset => $HTTP_ENCODING );
diff --git a/DocDB/cgi/EmailAdminister b/DocDB/cgi/EmailAdminister
index 27d95930..4abad034 100755
--- a/DocDB/cgi/EmailAdminister
+++ b/DocDB/cgi/EmailAdminister
@@ -29,7 +29,7 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-use CGI;
+use CGI::Untaint;
 use DBI;
 
 require "DocDBGlobals.pm";
diff --git a/DocDB/cgi/EmailAdministerForm b/DocDB/cgi/EmailAdministerForm
index 0e49d632..40e20641 100755
--- a/DocDB/cgi/EmailAdministerForm
+++ b/DocDB/cgi/EmailAdministerForm
@@ -28,6 +28,7 @@
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
 use CGI qw(-nosticky);
+use CGI::Untaint;
 use DBI;
 
 require "DocDBGlobals.pm";
diff --git a/DocDB/cgi/EmailCreate b/DocDB/cgi/EmailCreate
index 92c7cfed..2afe657e 100755
--- a/DocDB/cgi/EmailCreate
+++ b/DocDB/cgi/EmailCreate
@@ -3,7 +3,7 @@
 # Description: Creates a new e-mail notification account
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified: 
+#    Modified:
 #
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
@@ -11,7 +11,7 @@
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -23,9 +23,9 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-use CGI;    
+use CGI::Untaint;
 use DBI;
-                                                  
+
 require "DocDBGlobals.pm";
 require "HTMLUtilities.pm";
 require "ResponseElements.pm";
@@ -66,7 +66,7 @@ if ($UserExists) {
 }
 
 # Start the page
-   
+
 print $query -> header( -charset => $HTTP_ENCODING );
 &DocDBHeader("Notification Account Creation");
 
@@ -74,7 +74,7 @@ print $query -> header( -charset => $HTTP_ENCODING );
 
 unless (@ErrorStack) {
   srand (time ^ $$ ^ unpack "%32L*", `ps -eaf`);
-  
+
   my $Salt = ((0..9,'a'..'z','A'..'Z','.','/')[(int rand (64))]).
              ((0..9,'a'..'z','A'..'Z','.','/')[(int rand (64))]);
 
@@ -82,10 +82,10 @@ unless (@ErrorStack) {
   my $UserInsert        = $dbh -> prepare(
      "insert into EmailUser (EmailUserID,Username,Password) ".
      "values                (0,          ?,       ?)");
-     $UserInsert -> execute($UserName,$EncryptedPassword); 
-     
+     $UserInsert -> execute($UserName,$EncryptedPassword);
+
   print "User <b>$UserName</b> created. Do not forget your password, there is no way to
-  retrieve it.<p>\n";   
+  retrieve it.<p>\n";
 }
 
 EndPage(@ErrorStack);
diff --git a/DocDB/cgi/EventAdministerForm b/DocDB/cgi/EventAdministerForm
index 76d02c62..4d75f404 100755
--- a/DocDB/cgi/EventAdministerForm
+++ b/DocDB/cgi/EventAdministerForm
@@ -28,6 +28,7 @@
 
 
 use CGI qw(-nosticky);
+use CGI::Untaint;
 use DBI;
 
 require "DocDBGlobals.pm";
diff --git a/DocDB/cgi/ExternalDocDBAdministerForm b/DocDB/cgi/ExternalDocDBAdministerForm
index 9ebd525d..5921f581 100755
--- a/DocDB/cgi/ExternalDocDBAdministerForm
+++ b/DocDB/cgi/ExternalDocDBAdministerForm
@@ -1,10 +1,10 @@
 #! /usr/bin/env perl
 #
 #        Name: ExternalDocDBAdministerForm
-# Description: Allows the administrator to add knowledge of other DocDBs. 
+# Description: Allows the administrator to add knowledge of other DocDBs.
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified: 
+#    Modified:
 #
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
@@ -12,7 +12,7 @@
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -26,6 +26,7 @@
 
 
 use CGI qw(-nosticky);
+use CGI::Untaint;
 use DBI;
 
 require "DocDBGlobals.pm";
@@ -75,7 +76,7 @@ GetSecurityGroups();
 
 print $query -> header( -charset => $HTTP_ENCODING );
 DocDBHeader("Administer External DocDBs","",
-             -scripts => ["PopUps","ExternalDocDBAdminDisable"]); 
+             -scripts => ["PopUps","ExternalDocDBAdminDisable"]);
 
 unless (CanAdminister()) {
   push @ErrorStack,"You are not allowed to access administrative functions.";
@@ -95,40 +96,40 @@ if ($SubForm eq "externaldocdb") {
     $Delete  -> execute($ExternalDocDBID);
     push @ActionStack,"Deleted reference to external DocDB";
   } elsif ($Action eq "Modify") {
-    if ($ProjectName) { 
+    if ($ProjectName) {
       push @ActionStack,"Updated project name of $ExternalDocDBs{$ExternalDocDBID}{Project}";
       my $Update = $dbh->prepare("update ExternalDocDB set Project=? where ExternalDocDBID=?");
       $Update -> execute($ProjectName,$ExternalDocDBID);
     }
-    if ($Description) { 
+    if ($Description) {
       push @ActionStack,"Updated description of $ExternalDocDBs{$ExternalDocDBID}{Project}";
       my $Update = $dbh->prepare("update ExternalDocDB set Description=? where ExternalDocDBID=?");
       $Update -> execute($Description,$ExternalDocDBID);
     }
-    if ($PrivateURL) { 
+    if ($PrivateURL) {
       push @ActionStack,"Updated private URL of $ExternalDocDBs{$ExternalDocDBID}{Project}";
       my $Update = $dbh->prepare("update ExternalDocDB set PrivateURL=? where ExternalDocDBID=?");
       $Update -> execute($PrivateURL,$ExternalDocDBID);
     }
-    if ($PublicURL) { 
+    if ($PublicURL) {
       push @ActionStack,"Updated public URL of $ExternalDocDBs{$ExternalDocDBID}{Project}";
       my $Update = $dbh->prepare("update ExternalDocDB set PublicURL=? where ExternalDocDBID=?");
       $Update -> execute($PublicURL,$ExternalDocDBID);
     }
-  } elsif ($Action eq "New") { 
+  } elsif ($Action eq "New") {
     push @ActionStack,"New external DocDB for <strong>$ProjectName</strong> added";
-    my $Insert = $dbh -> prepare("insert into ExternalDocDB (Project,Description,PrivateURL,PublicURL) values (?,?,?,?)"); 
+    my $Insert = $dbh -> prepare("insert into ExternalDocDB (Project,Description,PrivateURL,PublicURL) values (?,?,?,?)");
     $Insert -> execute($ProjectName,$Description,$PrivateURL,$PublicURL);
   } else {
     push @WarnStack,"No valid action was specified.";
-  }  
+  }
 }
-   
-if (@ActionStack) { 
+
+if (@ActionStack) {
   ClearExternalDocDBs();
   GetAllExternalDocDBs();
   ActionReport();
-}  
+}
 
 EndPage();
 
@@ -157,7 +158,7 @@ print $query -> start_multipart_form('POST',"$ExternalDocDBAdministerForm",
                                      "name=\"externaldocdb\" id=\"externaldocdb\"");
 print "<table class=\"LowPaddedTable CenteredTable\">\n";
 print "<tr>\n";
-print "<td colspan=\"3\">\n"; 
+print "<td colspan=\"3\">\n";
  AdministerActions(-form => "externaldocdb");
  print $query -> hidden(-name => "subform",   -default => "externaldocdb");
 print "</td>\n";
@@ -165,33 +166,33 @@ print "</tr>\n";
 
 print "<tr>\n";
 print "<td rowspan=\"5\">\n";
- ExternalDocDBSelect(-disabled => true, -format => "full"); 
-print "</td>\n";  
-print "<td>\n"; 
+ ExternalDocDBSelect(-disabled => true, -format => "full");
+print "</td>\n";
+print "<td>\n";
  TextField(-name => "project", -disabled => "true", -helptext => "Project", -helplink => "extdocdb");
 print "</td>\n";
 print "</tr>\n";
 
 print "<tr>\n";
-print "<td>\n"; 
+print "<td>\n";
  TextField(-name => "desc", -disabled => "true", -helptext => "Description", -helplink => "extdocdb");
 print "</td>\n";
 print "</tr>\n";
 
 print "<tr>\n";
-print "<td>\n"; 
+print "<td>\n";
  TextField(-name => "puburl", -disabled => "true", -helptext => "Public URL", -helplink => "extdocdb");
 print "</td>\n";
 print "</tr>\n";
 
 print "<tr>\n";
-print "<td>\n"; 
+print "<td>\n";
  TextField(-name => "privurl", -disabled => "true", -helptext => "Private URL", -helplink => "extdocdb");
 print "</td>\n";
 print "</tr>\n";
 
 print "<tr>\n";
-print "<td>\n"; 
+print "<td>\n";
  AdminRegardless();
 print "</td>\n";
 print "</tr>\n";
diff --git a/DocDB/cgi/GroupAdminister b/DocDB/cgi/GroupAdminister
index 585a16b2..dde15cbd 100755
--- a/DocDB/cgi/GroupAdminister
+++ b/DocDB/cgi/GroupAdminister
@@ -1,20 +1,20 @@
 #! /usr/bin/env perl
 #
-#        Name: GroupAdminister 
-# Description: This script is called by GroupAdministerForm and does 
-#              administration on Groups in the DB. This script adds, modifies 
+#        Name: GroupAdminister
+# Description: This script is called by GroupAdministerForm and does
+#              administration on Groups in the DB. This script adds, modifies
 #              and deletes groups. It also displays all the groups and their
-#              relationships since this can be difficult to understand. 
+#              relationships since this can be difficult to understand.
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified: 
+#    Modified:
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -26,7 +26,7 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-use CGI;
+use CGI::Untaint;
 use DBI;
 
 require "DocDBGlobals.pm";
@@ -44,7 +44,7 @@ my $Untaint = CGI::Untaint -> new($query -> Vars);
 @ErrorStack = ();
 @WarnStack  = ();
 
-# Parameters to script 
+# Parameters to script
 
 my $Password = $Untaint -> extract(-as_printable => "password") || "";
 my $Username = $Untaint -> extract(-as_printable => "admuser") || "";
@@ -71,7 +71,7 @@ $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$Username,$Password);
 
 unless ($dbh) {
   push @ErrorStack,$Msg_AdminNoConnect;
-}         
+}
 
 print $query -> header( -charset => $HTTP_ENCODING );
 DocDBHeader("Modified Groups");
@@ -80,7 +80,7 @@ EndPage(@ErrorStack);
 
 unless (CanAdminister()) {
   push @ErrorStack,$Msg_AdminNoLogin;
-}  
+}
 EndPage(@ErrorStack);
 
 GetSecurityGroups();
@@ -109,29 +109,29 @@ if      ($Action eq "Delete") { # Delete group
       ($Count) = $RSC -> fetchrow_array;
       if ($Count) {
         push @WarnStack,"Action would change view list on $Count document(s).";
-      }  
+      }
       $TotalCount += $Count;
       ($Count) = $RMC -> fetchrow_array;
       if ($Count) {
         push @WarnStack,"Action would change modify list on $Count document(s).";
-      }  
+      }
       $TotalCount += $Count;
       ($Count) = $MSC -> fetchrow_array;
       if ($Count) {
         push @WarnStack,"Action would change view list on $Count event(s).";
-      }  
+      }
       $TotalCount += $Count;
       ($Count) = $MMC -> fetchrow_array;
       if ($Count) {
         push @WarnStack,"Action would change modify list on $Count event(s).";
-      }  
+      }
       $TotalCount += $Count;
       ($Count) = $EUC -> fetchrow_array;
       if ($Count) {
         push @WarnStack,"Action would change groups for $Count user(s).";
-      }  
+      }
       $TotalCount += $Count;
-    }  
+    }
 
     if ($Force || !$TotalCount) {
       my $RSD = $dbh -> prepare("delete from RevisionSecurity where GroupID=?");
@@ -144,7 +144,7 @@ if      ($Action eq "Delete") { # Delete group
       $Count = $RSD -> execute($ParentID);
       if (int($Count)) {
         push @ActionStack,"Group removed from view list on $Count document(s).";
-      }  
+      }
       $Count = $RMD -> execute($ParentID);
       if (int($Count)) {
         push @ActionStack,"Group removed from modify list on $Count document(s).";
@@ -169,7 +169,7 @@ if      ($Action eq "Delete") { # Delete group
       push @ActionStack,"$SecurityGroups{$ParentID}{NAME} has been deleted.";
       push @ActionStack,"Remove group from .htpasswd file and run scripts/Resecure if applicable.";
     } else {
-      push @ErrorStack,"Action could lead to unintended consequences. 
+      push @ErrorStack,"Action could lead to unintended consequences.
                         Use the <strong>force</strong> option if you want to proceed.";
     }
   }
@@ -179,15 +179,15 @@ if      ($Action eq "Delete") { # Delete group
   }
   EndPage(@ErrorStack);
 
-# Deal with name changes     
+# Deal with name changes
 
-  if ($Name) { 
+  if ($Name) {
     push @ActionStack,"Updating group name.";
     my $GroupUpdate = $dbh->prepare(
        "update SecurityGroup set Name=? where GroupID=?");
     $GroupUpdate -> execute($Name,$ParentID);
   }
-  if ($Description) { 
+  if ($Description) {
     push @ActionStack,"Updating group description.";
     my $GroupUpdate = $dbh->prepare(
        "update SecurityGroup set Description=? where GroupID=?");
@@ -210,32 +210,32 @@ if      ($Action eq "Delete") { # Delete group
         push @ActionStack,"Adding subordinate.";
         $HierarchyInsert -> execute($ChildID,$ParentID);
       }
-    }     
+    }
   }
 
-# Update permissions 
-  
+# Update permissions
+
   if ($NoPerm) {
     my $GroupUpdate = $dbh->prepare(
        "update SecurityGroup set CanCreate=0,CanAdminister=0,CanView=0,CanConfig=0 where GroupID=?");
     $GroupUpdate -> execute($ParentID);
-  }  
+  }
   if ($View) {
     my $GroupUpdate = $dbh->prepare(
        "update SecurityGroup set CanView=1 where GroupID=?");
     $GroupUpdate -> execute($ParentID);
-  }  
+  }
   if ($Create) {
     my $GroupUpdate = $dbh->prepare(
        "update SecurityGroup set CanCreate=1 where GroupID=?");
     $GroupUpdate -> execute($ParentID);
-  }  
+  }
   if ($Admin) {
     my $GroupUpdate = $dbh->prepare(
        "update SecurityGroup set CanAdminister=1 where GroupID=?");
     $GroupUpdate -> execute($ParentID);
-  }  
-     
+  }
+
 } elsif ($Action eq "New") { # Create new groups
   push @ActionStack,"Adding a new group.";
   my $GroupInsert = $dbh->prepare(
@@ -252,10 +252,10 @@ if      ($Action eq "Delete") { # Delete group
     if ($ChildID && $ChildID != $ParentID) {
       $HierarchyInsert -> execute($ChildID,$ParentID);
     }
-  }     
+  }
 } else {
   push @ErrorStack,"No valid action was specified.";
-}  
+}
 
 # For modify or new fetch institution information and display.
 
@@ -285,9 +285,9 @@ if ($Action eq "Modify" || $Action eq "New") {
   print "</td>\n";
   print "</tr>\n";
   print "</table>\n";
-}  
+}
 
 DocDBNavBar();
 DocDBFooter($DBWebMasterEmail,$DBWebMasterName);
- 
+
 exit;
diff --git a/DocDB/cgi/InstitutionAdminister b/DocDB/cgi/InstitutionAdminister
index d8268ea3..02f05011 100755
--- a/DocDB/cgi/InstitutionAdminister
+++ b/DocDB/cgi/InstitutionAdminister
@@ -3,17 +3,17 @@
 # Description: This script is called by AdministerForm and does administration
 #              on Institutions in the DB. This script adds, modifies and deletes
 #              institutions. It will not delete institutions if there are authors
-#              associated with that institution. 
+#              associated with that institution.
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified: 
+#    Modified:
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -25,7 +25,7 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-use CGI;
+use CGI::Untaint;
 use DBI;
 
 require "DocDBGlobals.pm";
@@ -43,7 +43,7 @@ my $Untaint = CGI::Untaint -> new($query -> Vars);
 @ErrorStack = ();
 @WarnStack  = ();
 
-# Parameters to script 
+# Parameters to script
 
 my $Password = $Untaint -> extract(-as_printable => "password") || "";
 my $Username = $Untaint -> extract(-as_printable => "admuser") || "";
@@ -57,7 +57,7 @@ $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$Username,$Password);
 
 unless ($dbh) {
   push @ErrorStack,$Msg_AdminNoConnect;
-}         
+}
 print $query -> header( -charset => $HTTP_ENCODING );
 &DocDBHeader("Modified List of Institutions");
 
@@ -65,13 +65,13 @@ print $query -> header( -charset => $HTTP_ENCODING );
 
 unless (&CanAdminister) {
   push @ErrorStack,$Msg_AdminNoLogin;
-}  
+}
 &EndPage(@ErrorStack);
 
 &GetInstitutions;
 
 if      ($Action eq "Delete") { # Delete institutions
-  @AuthorIDs = &GetInstitutionAuthors($InstitutionID); 
+  @AuthorIDs = &GetInstitutionAuthors($InstitutionID);
   if (!$InstitutionID) {
     push @ErrorStack,$Msg_ModInstEmpty;
   } elsif (@AuthorIDs) {
@@ -89,15 +89,15 @@ if      ($Action eq "Delete") { # Delete institutions
   }
   &EndPage(@ErrorStack);
 
-# Deal with name changes     
+# Deal with name changes
 
-  if ($ShortName) { 
+  if ($ShortName) {
     print "<b>Updating short institution name.</b><br>\n";
     my $InstitutionUpdate = $dbh->prepare(
        "update Institution set ShortName=? where InstitutionID=?");
     $InstitutionUpdate -> execute($ShortName,$InstitutionID);
   }
-  if ($LongName) { 
+  if ($LongName) {
     print "<b>Updating long institution name.</b><br>\n";
     my $InstitutionUpdate = $dbh->prepare(
        "update Institution set LongName=? where InstitutionID=?");
@@ -113,7 +113,7 @@ if      ($Action eq "Delete") { # Delete institutions
   $InstitutionID = $InstitutionInsert -> {mysql_insertid}; # Works with MySQL only
 } else {
   push @ErrorStack,"No valid action was specified.";
-}  
+}
 
 # For modify or new fetch institution information and display.
 
@@ -124,7 +124,7 @@ if ($Action eq "Modify" || $Action eq "New") {
   print "Short institution name: $Institutions{$InstitutionID}{SHORT}<br>\n";
   print "Long institution name:  $Institutions{$InstitutionID}{LONG}<br>\n";
   print "</b><p>\n";
-}  
+}
 
 print "<p>\n";
 
@@ -133,5 +133,5 @@ print "<p>\n";
 
 &DocDBNavBar;
 &DocDBFooter($DBWebMasterEmail,$DBWebMasterName);
- 
+
 exit;
diff --git a/DocDB/cgi/JournalAdminister b/DocDB/cgi/JournalAdminister
index 13a271b1..b19936c5 100755
--- a/DocDB/cgi/JournalAdminister
+++ b/DocDB/cgi/JournalAdminister
@@ -2,17 +2,17 @@
 #
 # Description: This script is called by AdministerForm and does administration
 #              on journals in the DB. This script adds, modifies and deletes
-#              journals. 
+#              journals.
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified: 
+#    Modified:
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -24,7 +24,7 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-use CGI;
+use CGI::Untaint;
 use DBI;
 
 require "DocDBGlobals.pm";
@@ -42,7 +42,7 @@ my $Untaint = CGI::Untaint -> new($query -> Vars);
 @ErrorStack = ();
 @WarnStack  = ();
 
-# Parameters to script 
+# Parameters to script
 
 my $Password = $Untaint -> extract(-as_printable => "password") || "";
 my $Username = $Untaint -> extract(-as_printable => "admuser") || "";
@@ -59,7 +59,7 @@ $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$Username,$Password);
 
 unless ($dbh) {
   push @ErrorStack,$Msg_AdminNoConnect;
-}         
+}
 print $query -> header( -charset => $HTTP_ENCODING );
 &DocDBHeader("Modified List of Institutions");
 
@@ -67,7 +67,7 @@ print $query -> header( -charset => $HTTP_ENCODING );
 
 unless (&CanAdminister) {
   push @ErrorStack,$Msg_AdminNoLogin;
-}  
+}
 &EndPage(@ErrorStack);
 
 &GetJournals;
@@ -86,33 +86,33 @@ if      ($Action eq "Delete") { # Delete institutions
   }
   &EndPage(@ErrorStack);
 
-# Deal with name changes     
+# Deal with name changes
 
-  if ($FullName) { 
+  if ($FullName) {
     print "<b>Updating journal name.</b><br>\n";
     my $JournalUpdate = $dbh->prepare(
        "update Journal set Name=? where JournalID=?");
     $JournalUpdate -> execute($FullName,$JournalID);
   }
-  if ($Abbreviation) { 
+  if ($Abbreviation) {
     print "<b>Updating journal abbreviation.</b><br>\n";
     my $JournalUpdate = $dbh->prepare(
        "update Journal set Abbreviation=? where JournalID=?");
     $JournalUpdate -> execute($Abbreviation,$JournalID);
   }
-  if ($Acronym) { 
+  if ($Acronym) {
     print "<b>Updating journal acronym.</b><br>\n";
     my $JournalUpdate = $dbh->prepare(
        "update Journal set Acronym=? where JournalID=?");
     $JournalUpdate -> execute($Acronym,$JournalID);
   }
-  if ($Publisher) { 
+  if ($Publisher) {
     print "<b>Updating journal publisher.</b><br>\n";
     my $JournalUpdate = $dbh->prepare(
        "update Journal set Publisher=? where JournalID=?");
     $JournalUpdate -> execute($Publisher,$JournalID);
   }
-  if ($URL) { 
+  if ($URL) {
     print "<b>Updating journal URL.</b><br>\n";
     my $JournalUpdate = $dbh->prepare(
        "update Journal set URL=? where JournalID=?");
@@ -129,7 +129,7 @@ if      ($Action eq "Delete") { # Delete institutions
   $JournalID = $JournalInsert -> {mysql_insertid}; # Works with MySQL only
 } else {
   push @ErrorStack,"No valid action was specified.";
-}  
+}
 
 # For modify or new fetch institution information and display.
 
@@ -142,7 +142,7 @@ if ($Action eq "Modify" || $Action eq "New") {
   print "Publisher:    $Journals{$JournalID}{Publisher}    <br>\n";
   print "URL:          $Journals{$JournalID}{URL}          <br>\n";
   print "</b><p>\n";
-}  
+}
 
 print "<p>\n";
 
@@ -151,5 +151,5 @@ print "<p>\n";
 
 &DocDBNavBar;
 &DocDBFooter($DBWebMasterEmail,$DBWebMasterName);
- 
+
 exit;
diff --git a/DocDB/cgi/KeywordGroupAdminister b/DocDB/cgi/KeywordGroupAdminister
index 3587dddf..321f9d32 100755
--- a/DocDB/cgi/KeywordGroupAdminister
+++ b/DocDB/cgi/KeywordGroupAdminister
@@ -3,17 +3,17 @@
 # Description: This script is called by KeywordAdministerForm and does administration
 #              on Keyword Groups in the DB. This script adds, modifies and deletes
 #              these groups. It will not delete groups if there are associated
-#              keywords. 
+#              keywords.
 #
 #      Author: Lynn Garren (garren@fnal.gov)
-#    Modified: 
+#    Modified:
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -25,7 +25,7 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-use CGI;
+use CGI::Untaint;
 use DBI;
 
 require "DocDBGlobals.pm";
@@ -43,7 +43,7 @@ my $Untaint = CGI::Untaint -> new($query -> Vars);
 @ErrorStack = ();
 @WarnStack  = ();
 
-# Parameters to script 
+# Parameters to script
 
 my $Password = $Untaint -> extract(-as_printable => "password") || "";
 my $Username = $Untaint -> extract(-as_printable => "admuser") || "";
@@ -57,7 +57,7 @@ $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$Username,$Password);
 
 unless ($dbh) {
   push @ErrorStack,$Msg_AdminNoConnect;
-}         
+}
 
 print $query -> header( -charset => $HTTP_ENCODING );
 &DocDBHeader("Modified List of Keyword Groups");
@@ -66,13 +66,13 @@ print $query -> header( -charset => $HTTP_ENCODING );
 
 unless (&CanAdminister) {
   push @ErrorStack,$Msg_AdminNoLogin;
-}  
+}
 &EndPage(@ErrorStack);
 
 &GetKeywords;
 
 if      ($Action eq "Delete") { # Delete keyword groups
-  @KeywordListIDs = &GetKeywordsByKeywordGroupID($KeywordGroupID); 
+  @KeywordListIDs = &GetKeywordsByKeywordGroupID($KeywordGroupID);
   if (!$KeywordGroupID) {
     push @ErrorStack,$Msg_ModKeyGrEmpty;
   } elsif (@KeywordListIDs) { # Not sure we want this anymore
@@ -90,15 +90,15 @@ if      ($Action eq "Delete") { # Delete keyword groups
   }
   &EndPage(@ErrorStack);
 
-# Deal with name changes     
+# Deal with name changes
 
-  if ($ShortName) { 
+  if ($ShortName) {
     print "<b>Updating short description.</b><br>\n";
     my $KeywordGroupUpdate = $dbh->prepare(
        "update KeywordGroup set ShortDescription=? where KeywordGroupID=?");
     $KeywordGroupUpdate -> execute($ShortName,$KeywordGroupID);
   }
-  if ($LongName) { 
+  if ($LongName) {
     print "<b>Updating long description.</b><br>\n";
     my $KeywordGroupUpdate = $dbh->prepare(
        "update KeywordGroup set LongDescription=? where KeywordGroupID=?");
@@ -114,7 +114,7 @@ if      ($Action eq "Delete") { # Delete keyword groups
   $KeywordGroupID = $KeywordGroupInsert -> {mysql_insertid}; # Works with MySQL only
 } else {
   push @ErrorStack,"No valid action was specified.";
-}  
+}
 
 # For modify or new fetch information and display.
 
@@ -124,7 +124,7 @@ if ($Action eq "Modify" || $Action eq "New") {
   print "Short description: $KeywordGroups{$KeywordGroupID}{Short}<br>\n";
   print "Long description:  $KeywordGroups{$KeywordGroupID}{Long}<br>\n";
   print "</b><p>\n";
-}  
+}
 
 print "<p>\n";
 $keyadminform = "<a href=\"$KeywordAdministerForm\">Administer Keywords</a>";
@@ -139,5 +139,5 @@ print "<p>\n";
 
 &DocDBNavBar;
 &DocDBFooter($DBWebMasterEmail,$DBWebMasterName);
- 
+
 exit;
diff --git a/DocDB/cgi/KeywordListAdminister b/DocDB/cgi/KeywordListAdminister
index d3b7b722..0ef831a5 100755
--- a/DocDB/cgi/KeywordListAdminister
+++ b/DocDB/cgi/KeywordListAdminister
@@ -1,7 +1,7 @@
 #! /usr/bin/env perl
 #
 # Description: This script is called by KeywordAdministerForm and does administration
-#              on the Keyword table in the DB. 
+#              on the Keyword table in the DB.
 #
 #      Author: Lynn Garren (garren@fnal.gov)
 #    Modified: Eric Vaandering (ewv@fnal.gov)
@@ -11,7 +11,7 @@
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -26,7 +26,7 @@
 # FIXME: Check for no groups, warn
 # FIXME: Check for duplicate keyword, warn
 
-use CGI;
+use CGI::Untaint;
 use DBI;
 
 require "DocDBGlobals.pm";
@@ -45,8 +45,8 @@ my $Untaint = CGI::Untaint -> new($query -> Vars);
 @ErrorStack = ();
 @WarnStack  = ();
 
-# Parameters to script 
- 
+# Parameters to script
+
 my $Password = $Untaint -> extract(-as_printable => "password") || "";
 my $Username = $Untaint -> extract(-as_printable => "admuser") || "";
 my $Action = $Untaint -> extract(-as_printable => "admaction") || "";
@@ -60,7 +60,7 @@ $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$Username,$Password);
 
 unless ($dbh) {
   push @ErrorStack,$Msg_AdminNoConnect;
-}         
+}
 print $query -> header( -charset => $HTTP_ENCODING );
 &DocDBHeader("Modified List of Keywords");
 
@@ -68,10 +68,10 @@ print $query -> header( -charset => $HTTP_ENCODING );
 
 unless (&CanAdminister) {
   push @ErrorStack,$Msg_AdminNoLogin;
-}  
+}
 &EndPage(@ErrorStack);
 
-if ($Action eq "Delete") { 
+if ($Action eq "Delete") {
 
   unless ($KeywordID) {
     push @ErrorStack,$Msg_ModKeywdEmpty;
@@ -79,9 +79,9 @@ if ($Action eq "Delete") {
   &EndPage(@ErrorStack);
   &FetchKeyword($KeywordID);
   my $KeywordLink   = &KeywordLinkByID($KeywordID);
-  
+
   &DeleteKeyword($KeywordID); # Delete KeywordID from Keyword table
-  
+
   print "$KeywordLink has been removed from the database.<br>\n";
 } elsif ($Action eq "Modify") {
   unless ($KeywordID) {
@@ -89,29 +89,29 @@ if ($Action eq "Delete") {
   }
   &EndPage(@ErrorStack);
 
-# Deal with name changes     
+# Deal with name changes
 
-  if ($ShortName) { 
+  if ($ShortName) {
     print "<b>Updating short keyword name.</b><br>\n";
     my $KeywordUpdate = $dbh->prepare(
        "update Keyword set ShortDescription=? where KeywordID=?");
     $KeywordUpdate -> execute($ShortName,$KeywordID);
   }
-  if ($LongName) { 
+  if ($LongName) {
     print "<b>Updating long keyword name.</b><br>\n";
     my $KeywordUpdate = $dbh->prepare(
        "update Keyword set LongDescription=? where KeywordID=?");
     $KeywordUpdate -> execute($LongName,$KeywordID);
   }
 
-# Deal with KeywordGroup changes   
+# Deal with KeywordGroup changes
 
   @KeywordGroupIDs = sort numerically @KeywordGroupIDs; # Want to get -1: remove first
   foreach my $KeywordGroupID (@KeywordGroupIDs) {
     if ($KeywordGroupID == -1) { # Remove existing KeywordGrouping entries
       my $GroupingDelete = $dbh -> prepare("delete from KeywordGrouping where KeywordID=?");
       $GroupingDelete -> execute($KeywordID);
-    } elsif ($KeywordGroupID) { 
+    } elsif ($KeywordGroupID) {
       my $GroupingSelect = $dbh -> prepare(
        "select KeywordGroupingID from KeywordGrouping where KeywordID=? and KeywordGroupID=?");
       $GroupingSelect -> execute($KeywordID,$KeywordGroupID);
@@ -130,11 +130,11 @@ if ($Action eq "Delete") {
 
   print "<b>Adding a new keyword.</b><br>\n";
   my $KeywordInsert = $dbh->prepare(
-   "insert into Keyword (KeywordID, ShortDescription, LongDescription) ". 
+   "insert into Keyword (KeywordID, ShortDescription, LongDescription) ".
    "values (0,?,?)");
 
   my $KeywordGroupingInsert = $dbh->prepare(
-   "insert into KeywordGrouping (KeywordGroupingID, KeywordGroupID, KeywordID) ". 
+   "insert into KeywordGrouping (KeywordGroupingID, KeywordGroupID, KeywordID) ".
    "values (0,?,?)");
 
   $KeywordInsert -> execute($ShortName,$LongName);
@@ -142,10 +142,10 @@ if ($Action eq "Delete") {
 
   foreach my $KeywordGroupID (@KeywordGroupIDs) {
     $KeywordGroupingInsert -> execute($KeywordGroupID,$KeywordID);
-  }  
+  }
 } else {
   push @ErrorStack,"No valid action was specified.";
-}  
+}
 
 # For modify or new fetch information and display.
 
@@ -158,7 +158,7 @@ if ($Action eq "Modify" || $Action eq "New") {
   print "Short description: $ShortLink<br>\n";
   print "Long description: $LongLink<br>\n";
   print "</b><p>\n";
-}  
+}
 
 print "<p>\n";
 $keyadminform = "<a href=\"$KeywordAdministerForm\">Administer Keywords</a>";
@@ -173,5 +173,5 @@ print "<p>\n";
 
 &DocDBNavBar;
 &DocDBFooter($DBWebMasterEmail,$DBWebMasterName);
- 
+
 exit;

From c24fdadaaaf83f164279f3ca2c6d641c8e7d16d9 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 31 Jul 2013 15:19:31 -0500
Subject: [PATCH 078/163] Need both CGI and CGI::Untaint

---
 DocDB/cgi/AddFiles               | 1 +
 DocDB/cgi/AuthorAdd              | 1 +
 DocDB/cgi/AuthorAdminister       | 1 +
 DocDB/cgi/ConfirmTalkHint        | 1 +
 DocDB/cgi/DeleteConfirm          | 1 +
 DocDB/cgi/DeleteDocument         | 1 +
 DocDB/cgi/DisplayMeeting         | 1 +
 DocDB/cgi/DocTypeAdminister      | 1 +
 DocDB/cgi/EmailAdminister        | 1 +
 DocDB/cgi/EmailCreate            | 1 +
 DocDB/cgi/GroupAdminister        | 1 +
 DocDB/cgi/InstitutionAdminister  | 1 +
 DocDB/cgi/JournalAdminister      | 1 +
 DocDB/cgi/KeywordGroupAdminister | 1 +
 DocDB/cgi/KeywordListAdminister  | 1 +
 15 files changed, 15 insertions(+)

diff --git a/DocDB/cgi/AddFiles b/DocDB/cgi/AddFiles
index ddba2bf4..dbb84006 100755
--- a/DocDB/cgi/AddFiles
+++ b/DocDB/cgi/AddFiles
@@ -26,6 +26,7 @@
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
 use Benchmark;
+use CGI;
 use CGI::Untaint;
 use DBI;
 
diff --git a/DocDB/cgi/AuthorAdd b/DocDB/cgi/AuthorAdd
index 5ea8a8d2..ffc06a80 100755
--- a/DocDB/cgi/AuthorAdd
+++ b/DocDB/cgi/AuthorAdd
@@ -25,6 +25,7 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
+use CGI;
 use CGI::Untaint;
 use DBI;
 
diff --git a/DocDB/cgi/AuthorAdminister b/DocDB/cgi/AuthorAdminister
index 55a04f87..404ef4ac 100755
--- a/DocDB/cgi/AuthorAdminister
+++ b/DocDB/cgi/AuthorAdminister
@@ -27,6 +27,7 @@
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
 
+use CGI;
 use CGI::Untaint;
 use DBI;
 
diff --git a/DocDB/cgi/ConfirmTalkHint b/DocDB/cgi/ConfirmTalkHint
index a9b1e65d..78a6174a 100755
--- a/DocDB/cgi/ConfirmTalkHint
+++ b/DocDB/cgi/ConfirmTalkHint
@@ -25,6 +25,7 @@
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
 
+use CGI;
 use CGI::Untaint;
 use DBI;
 
diff --git a/DocDB/cgi/DeleteConfirm b/DocDB/cgi/DeleteConfirm
index 82f15b44..24cabe89 100755
--- a/DocDB/cgi/DeleteConfirm
+++ b/DocDB/cgi/DeleteConfirm
@@ -25,6 +25,7 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
+use CGI;
 use CGI::Untaint;
 use DBI;
 
diff --git a/DocDB/cgi/DeleteDocument b/DocDB/cgi/DeleteDocument
index 01ea1b31..392adcbf 100755
--- a/DocDB/cgi/DeleteDocument
+++ b/DocDB/cgi/DeleteDocument
@@ -24,6 +24,7 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
+use CGI;
 use CGI::Untaint;
 use DBI;
 
diff --git a/DocDB/cgi/DisplayMeeting b/DocDB/cgi/DisplayMeeting
index d239f6a4..cbaafc15 100755
--- a/DocDB/cgi/DisplayMeeting
+++ b/DocDB/cgi/DisplayMeeting
@@ -26,6 +26,7 @@
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
 use Benchmark;
+use CGI;
 use CGI::Untaint;
 use DBI;
 
diff --git a/DocDB/cgi/DocTypeAdminister b/DocDB/cgi/DocTypeAdminister
index b1e44679..e5a0896b 100755
--- a/DocDB/cgi/DocTypeAdminister
+++ b/DocDB/cgi/DocTypeAdminister
@@ -25,6 +25,7 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
+use CGI;
 use CGI::Untaint;
 use DBI;
 
diff --git a/DocDB/cgi/EmailAdminister b/DocDB/cgi/EmailAdminister
index 4abad034..abedec20 100755
--- a/DocDB/cgi/EmailAdminister
+++ b/DocDB/cgi/EmailAdminister
@@ -29,6 +29,7 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
+use CGI;
 use CGI::Untaint;
 use DBI;
 
diff --git a/DocDB/cgi/EmailCreate b/DocDB/cgi/EmailCreate
index 2afe657e..4b734e19 100755
--- a/DocDB/cgi/EmailCreate
+++ b/DocDB/cgi/EmailCreate
@@ -23,6 +23,7 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
+use CGI;
 use CGI::Untaint;
 use DBI;
 
diff --git a/DocDB/cgi/GroupAdminister b/DocDB/cgi/GroupAdminister
index dde15cbd..da3335fb 100755
--- a/DocDB/cgi/GroupAdminister
+++ b/DocDB/cgi/GroupAdminister
@@ -26,6 +26,7 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
+use CGI;
 use CGI::Untaint;
 use DBI;
 
diff --git a/DocDB/cgi/InstitutionAdminister b/DocDB/cgi/InstitutionAdminister
index 02f05011..b78d56bb 100755
--- a/DocDB/cgi/InstitutionAdminister
+++ b/DocDB/cgi/InstitutionAdminister
@@ -25,6 +25,7 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
+use CGI;
 use CGI::Untaint;
 use DBI;
 
diff --git a/DocDB/cgi/JournalAdminister b/DocDB/cgi/JournalAdminister
index b19936c5..8fa56d59 100755
--- a/DocDB/cgi/JournalAdminister
+++ b/DocDB/cgi/JournalAdminister
@@ -24,6 +24,7 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
+use CGI;
 use CGI::Untaint;
 use DBI;
 
diff --git a/DocDB/cgi/KeywordGroupAdminister b/DocDB/cgi/KeywordGroupAdminister
index 321f9d32..38ddfecd 100755
--- a/DocDB/cgi/KeywordGroupAdminister
+++ b/DocDB/cgi/KeywordGroupAdminister
@@ -25,6 +25,7 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
+use CGI;
 use CGI::Untaint;
 use DBI;
 
diff --git a/DocDB/cgi/KeywordListAdminister b/DocDB/cgi/KeywordListAdminister
index 0ef831a5..fee0b9ac 100755
--- a/DocDB/cgi/KeywordListAdminister
+++ b/DocDB/cgi/KeywordListAdminister
@@ -26,6 +26,7 @@
 # FIXME: Check for no groups, warn
 # FIXME: Check for duplicate keyword, warn
 
+use CGI;
 use CGI::Untaint;
 use DBI;
 

From 3861cde7b6e0b6a4d818a86c9a0e56900d78f055 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 31 Jul 2013 15:20:22 -0500
Subject: [PATCH 079/163] Need both CGI and CGI::Untaint

---
 DocDB/cgi/DocDBInstructions | 1 +
 1 file changed, 1 insertion(+)

diff --git a/DocDB/cgi/DocDBInstructions b/DocDB/cgi/DocDBInstructions
index cbc44330..7bca007e 100755
--- a/DocDB/cgi/DocDBInstructions
+++ b/DocDB/cgi/DocDBInstructions
@@ -25,6 +25,7 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
+use CGI;
 use CGI::Untaint;
 use DBI;
 

From 5b175d00fc2655d7734e846434f1701c815d8422 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 31 Jul 2013 16:24:37 -0500
Subject: [PATCH 080/163] Fix instructions

---
 DocDB/cgi/DocDBInstructions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/DocDB/cgi/DocDBInstructions b/DocDB/cgi/DocDBInstructions
index 7bca007e..c298303c 100755
--- a/DocDB/cgi/DocDBInstructions
+++ b/DocDB/cgi/DocDBInstructions
@@ -43,7 +43,7 @@ $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 
 my $Untaint = CGI::Untaint -> new($query -> Vars);
 
-my $InstructionSet = $Untaint -> extract(-as_printable => "general") || "";
+my $InstructionSet = $Untaint -> extract(-as_printable => "set") || "general";
 
 # Title
 

From fab40b02bb07449d919be9007613fca092d175e7 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 31 Jul 2013 16:39:47 -0500
Subject: [PATCH 081/163] Fix selects for Institution and doctype, ListBy for
 DocType

---
 DocDB/cgi/DocTypeHTML.pm  | 42 ++++++++++++++++++++-------------------
 DocDB/cgi/FormElements.pm |  6 ++++--
 DocDB/cgi/ListBy          |  6 ++++--
 3 files changed, 30 insertions(+), 24 deletions(-)

diff --git a/DocDB/cgi/DocTypeHTML.pm b/DocDB/cgi/DocTypeHTML.pm
index 312e7355..8f2c3ec3 100644
--- a/DocDB/cgi/DocTypeHTML.pm
+++ b/DocDB/cgi/DocTypeHTML.pm
@@ -1,17 +1,17 @@
-#     
+#
 #        Name: DocTypeHTML.pm
-# Description: Routines with form elements and other HTML generating 
+# Description: Routines with form elements and other HTML generating
 #              code pertaining to DocumentTypes.
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified: 
+#    Modified: Eric Vaandering (ewv@fnal.gov)
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -30,48 +30,50 @@ sub DocTypeSelect (;%) { # Scrolling selectable list for doc type search
   my $Format   = exists $ArgRef->{-format}   ?   $ArgRef->{-format}   : "full";
 #  my $HelpLink = exists $ArgRef->{-helplink} ?   $ArgRef->{-helplink} : "";
 #  my $HelpText = exists $ArgRef->{-helptext} ?   $ArgRef->{-helptext} : "  my (%Params) = @_;
-  
+
   my $Booleans = "";
-  
+
   if ($Disabled) {
     $Booleans .= "-disabled";
-  }  
-  
+  }
+
   my %DocTypeLabels = ();
   foreach my $DocTypeID (keys %DocumentTypes) {
+    my $LongName = SmartHTML({-text => $DocumentTypes{$DocTypeID}{LONG}},);
+    my $ShortName = SmartHTML({-text => $DocumentTypes{$DocTypeID}{SHORT}},);
     if ($Format eq "short") {
-      $DocTypeLabels{$DocTypeID} = "$DocumentTypes{$DocTypeID}{SHORT}";    
+      $DocTypeLabels{$DocTypeID} = $ShortName;
     } elsif ($Format eq "full") {
-      $DocTypeLabels{$DocTypeID} = "$DocumentTypes{$DocTypeID}{SHORT} [$DocumentTypes{$DocTypeID}{LONG}]";
+      $DocTypeLabels{$DocTypeID} = "$ShortName [$LongName]";
     }
-  }  
-  print FormElementTitle(-helplink => "doctype", -helptext => "Document type");   
-  print $query -> scrolling_list(-size => 10, -name => "doctype", -multiple => $Multiple, 
+  }
+  print FormElementTitle(-helplink => "doctype", -helptext => "Document type");
+  print $query -> scrolling_list(-size => 10, -name => "doctype", -multiple => $Multiple,
                               -values => \%DocTypeLabels, $Booleans);
 };
 
 
 sub DocTypeEntryBox (;%) {
   my (%Params) = @_;
-  
+
   my $Disabled = $Params{-disabled}  || "0";
-  
+
   my $Booleans = "";
-  
+
   if ($Disabled) {
     $Booleans .= "-disabled";
-  }  
-  
+  }
+
   print "<table cellpadding=5><tr valign=top>\n";
   print "<td>\n";
   print FormElementTitle(-helplink => "doctypeentry", -helptext => "Short Description");
-  print $query -> textfield (-name => 'name', 
+  print $query -> textfield (-name => 'name',
                              -size => 20, -maxlength => 32, $Booleans);
   print "</td>\n";
   print "</tr><tr>\n";
   print "<td>\n";
   print FormElementTitle(-helplink => "doctypeentry", -helptext => "Long Description");
-  print $query -> textfield (-name => 'longdesc', 
+  print $query -> textfield (-name => 'longdesc',
                              -size => 40, -maxlength => 255, $Booleans);
   print "</td></tr>\n";
 
diff --git a/DocDB/cgi/FormElements.pm b/DocDB/cgi/FormElements.pm
index ee4e959f..78f13fea 100644
--- a/DocDB/cgi/FormElements.pm
+++ b/DocDB/cgi/FormElements.pm
@@ -215,10 +215,12 @@ sub InstitutionSelect (;%) { # Scrolling selectable list for institutions
   my @InstIDs = sort byInstitution keys %Institutions;
   my %InstLabels = ();
   foreach my $ID (@InstIDs) {
+    my $LongName = SmartHTML({-text => $Institutions{$ID}{LONG}},);
+    my $ShortName = SmartHTML({-text => $Institutions{$ID}{SHORT}},);
     if ($Mode eq "full") {
-      $InstLabels{$ID} = $Institutions{$ID}{SHORT}." [".$Institutions{$ID}{LONG}."]";
+      $InstLabels{$ID} = $ShortName." [".$LongName."]";
     } else {
-      $InstLabels{$ID} = $Institutions{$ID}{SHORT};
+      $InstLabels{$ID} = $ShortName;
     }
   }
   if ($Disabled) {
diff --git a/DocDB/cgi/ListBy b/DocDB/cgi/ListBy
index 2a67c14d..52a68ec4 100755
--- a/DocDB/cgi/ListBy
+++ b/DocDB/cgi/ListBy
@@ -196,8 +196,10 @@ if ($Days) {
   FetchDocType ($TypeID);
   $FieldListOptions{-doctypeid} = $TypeID;
   $Title   = "Document List by Type";
-  $Message = "These documents of type <span class=\"Highlight\">
-             $DocumentTypes{$TypeID}{SHORT}</span> are available:";
+
+  $Message = "These documents of type <span class=\"Highlight\">";
+  $Message .= SmartHTML({-text => $DocumentTypes{$TypeID}{SHORT},});
+  $Message .= "</span> are available:";
 
   $List = $dbh -> prepare("select DISTINCT(DocumentRevision.DocumentID) from ".
            "DocumentRevision where DocumentRevision.DocTypeID=?");

From 288f1a1ff076017dfe158847ffe4926ebe9cc52d Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 31 Jul 2013 16:50:18 -0500
Subject: [PATCH 082/163] Try to fix institution

---
 DocDB/cgi/InstitutionAdminister | 1 +
 1 file changed, 1 insertion(+)

diff --git a/DocDB/cgi/InstitutionAdminister b/DocDB/cgi/InstitutionAdminister
index b78d56bb..d2c5ea3c 100755
--- a/DocDB/cgi/InstitutionAdminister
+++ b/DocDB/cgi/InstitutionAdminister
@@ -33,6 +33,7 @@ require "DocDBGlobals.pm";
 require "ResponseElements.pm";
 require "Security.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 require "AuthorSQL.pm";
 require "AuthorHTML.pm";
 require "Messages.pm";

From daa6a2e978abfa71ed5478c7603e018003662e68 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 31 Jul 2013 16:56:44 -0500
Subject: [PATCH 083/163] Add UntaintInput to each script

---
 DocDB/cgi/AddFiles                    | 1 +
 DocDB/cgi/AdministerForm              | 1 +
 DocDB/cgi/AuthorAdd                   | 1 +
 DocDB/cgi/AuthorAdminister            | 1 +
 DocDB/cgi/BulkCertificateInsert       | 1 +
 DocDB/cgi/ConfirmTalkHint             | 1 +
 DocDB/cgi/CustomListForm              | 1 +
 DocDB/cgi/DeleteConfirm               | 1 +
 DocDB/cgi/DeleteDocument              | 1 +
 DocDB/cgi/DisplayMeeting              | 1 +
 DocDB/cgi/DocDBInstructions           | 1 +
 DocDB/cgi/DocTypeAdminister           | 1 +
 DocDB/cgi/EditTalkInfo                | 1 +
 DocDB/cgi/EmailAdminister             | 1 +
 DocDB/cgi/EmailAdministerForm         | 1 +
 DocDB/cgi/EmailCreate                 | 1 +
 DocDB/cgi/EventAdministerForm         | 1 +
 DocDB/cgi/ExternalDocDBAdministerForm | 1 +
 DocDB/cgi/GroupAdminister             | 1 +
 DocDB/cgi/JournalAdminister           | 1 +
 DocDB/cgi/KeywordGroupAdminister      | 1 +
 DocDB/cgi/KeywordListAdminister       | 1 +
 DocDB/cgi/ListBy                      | 1 +
 23 files changed, 23 insertions(+)

diff --git a/DocDB/cgi/AddFiles b/DocDB/cgi/AddFiles
index dbb84006..437235f3 100755
--- a/DocDB/cgi/AddFiles
+++ b/DocDB/cgi/AddFiles
@@ -41,6 +41,7 @@ require "MiscSQL.pm";
 require "FSUtilities.pm";
 require "WebUtilities.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 require "FileUtilities.pm";
 require "Security.pm";
 
diff --git a/DocDB/cgi/AdministerForm b/DocDB/cgi/AdministerForm
index b0efae94..f9f53a83 100755
--- a/DocDB/cgi/AdministerForm
+++ b/DocDB/cgi/AdministerForm
@@ -49,6 +49,7 @@ require "MiscSQL.pm";
 require "ResponseElements.pm";
 
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 require "Sorts.pm";
 
 $query = new CGI;  # Global for subroutines
diff --git a/DocDB/cgi/AuthorAdd b/DocDB/cgi/AuthorAdd
index ffc06a80..35888586 100755
--- a/DocDB/cgi/AuthorAdd
+++ b/DocDB/cgi/AuthorAdd
@@ -34,6 +34,7 @@ require "ResponseElements.pm";
 require "SecuritySQL.pm";
 require "Security.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 
 $query = new CGI;  # Global for subroutines
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rwuser,$db_rwpass);
diff --git a/DocDB/cgi/AuthorAdminister b/DocDB/cgi/AuthorAdminister
index 404ef4ac..b61036a0 100755
--- a/DocDB/cgi/AuthorAdminister
+++ b/DocDB/cgi/AuthorAdminister
@@ -35,6 +35,7 @@ require "DocDBGlobals.pm";
 require "ResponseElements.pm";
 require "Security.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 require "AuthorSQL.pm";
 require "Messages.pm";
 
diff --git a/DocDB/cgi/BulkCertificateInsert b/DocDB/cgi/BulkCertificateInsert
index 85f2c8f7..69958624 100755
--- a/DocDB/cgi/BulkCertificateInsert
+++ b/DocDB/cgi/BulkCertificateInsert
@@ -36,6 +36,7 @@ require "Messages.pm";
 require "DBUtilities.pm";
 require "DBColumnSizes.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 
 require "SecuritySQL.pm";
 require "SecurityHTML.pm";
diff --git a/DocDB/cgi/ConfirmTalkHint b/DocDB/cgi/ConfirmTalkHint
index 78a6174a..5040d4cc 100755
--- a/DocDB/cgi/ConfirmTalkHint
+++ b/DocDB/cgi/ConfirmTalkHint
@@ -42,6 +42,7 @@ require "MeetingSecurityUtilities.pm";
 
 require "FSUtilities.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 require "Security.pm";
 require "SQLChecks.pm";
 
diff --git a/DocDB/cgi/CustomListForm b/DocDB/cgi/CustomListForm
index 349b58cd..e37afa3f 100755
--- a/DocDB/cgi/CustomListForm
+++ b/DocDB/cgi/CustomListForm
@@ -43,6 +43,7 @@ require "DocDBFields.pm";
 
 require "DBUtilities.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 require "MeetingSecurityUtilities.pm";
 
 require "ConfigSQL.pm";
diff --git a/DocDB/cgi/DeleteConfirm b/DocDB/cgi/DeleteConfirm
index 24cabe89..377e570c 100755
--- a/DocDB/cgi/DeleteConfirm
+++ b/DocDB/cgi/DeleteConfirm
@@ -37,6 +37,7 @@ require "DocumentSQL.pm";
 require "RevisionSQL.pm";
 
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 require "AdministerElements.pm";
 require "Security.pm";
 
diff --git a/DocDB/cgi/DeleteDocument b/DocDB/cgi/DeleteDocument
index 392adcbf..ccaa6556 100755
--- a/DocDB/cgi/DeleteDocument
+++ b/DocDB/cgi/DeleteDocument
@@ -33,6 +33,7 @@ require "ResponseElements.pm";
 require "Security.pm";
 require "FSUtilities.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 
 $query = new CGI;  # Global for subroutines
 $query -> autoEscape(0);
diff --git a/DocDB/cgi/DisplayMeeting b/DocDB/cgi/DisplayMeeting
index cbaafc15..91b75411 100755
--- a/DocDB/cgi/DisplayMeeting
+++ b/DocDB/cgi/DisplayMeeting
@@ -36,6 +36,7 @@ require "DocDBGlobals.pm";
 require "Messages.pm";
 
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 require "ResponseElements.pm";
 require "Sorts.pm";
 require "Scripts.pm";
diff --git a/DocDB/cgi/DocDBInstructions b/DocDB/cgi/DocDBInstructions
index c298303c..780d1667 100755
--- a/DocDB/cgi/DocDBInstructions
+++ b/DocDB/cgi/DocDBInstructions
@@ -31,6 +31,7 @@ use DBI;
 
 require "DocDBGlobals.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 require "Messages.pm";
 require "SecuritySQL.pm";
 require "Security.pm";
diff --git a/DocDB/cgi/DocTypeAdminister b/DocDB/cgi/DocTypeAdminister
index e5a0896b..ee27234d 100755
--- a/DocDB/cgi/DocTypeAdminister
+++ b/DocDB/cgi/DocTypeAdminister
@@ -33,6 +33,7 @@ require "DocDBGlobals.pm";
 require "ResponseElements.pm";
 require "Security.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 require "MiscSQL.pm";
 require "DocTypeHTML.pm";
 require "Messages.pm";
diff --git a/DocDB/cgi/EditTalkInfo b/DocDB/cgi/EditTalkInfo
index a80b955e..04f01b5b 100755
--- a/DocDB/cgi/EditTalkInfo
+++ b/DocDB/cgi/EditTalkInfo
@@ -37,6 +37,7 @@ require "ResponseElements.pm";
 require "Security.pm";
 require "MeetingSecurityUtilities.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 require "DBUtilities.pm";
 
 require "TalkSQL.pm";
diff --git a/DocDB/cgi/EmailAdminister b/DocDB/cgi/EmailAdminister
index abedec20..e89a3fc4 100755
--- a/DocDB/cgi/EmailAdminister
+++ b/DocDB/cgi/EmailAdminister
@@ -37,6 +37,7 @@ require "DocDBGlobals.pm";
 require "ResponseElements.pm";
 require "Security.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 require "SecuritySQL.pm";
 require "NotificationSQL.pm";
 require "Messages.pm";
diff --git a/DocDB/cgi/EmailAdministerForm b/DocDB/cgi/EmailAdministerForm
index 40e20641..f7a250df 100755
--- a/DocDB/cgi/EmailAdministerForm
+++ b/DocDB/cgi/EmailAdministerForm
@@ -36,6 +36,7 @@ require "Scripts.pm";
 require "ResponseElements.pm";
 require "Security.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 require "AdministerElements.pm";
 require "EmailUserHTML.pm";
 require "SecurityHTML.pm";
diff --git a/DocDB/cgi/EmailCreate b/DocDB/cgi/EmailCreate
index 4b734e19..455bf4de 100755
--- a/DocDB/cgi/EmailCreate
+++ b/DocDB/cgi/EmailCreate
@@ -29,6 +29,7 @@ use DBI;
 
 require "DocDBGlobals.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 require "ResponseElements.pm";
 
 $query = new CGI;  # Global for subroutines
diff --git a/DocDB/cgi/EventAdministerForm b/DocDB/cgi/EventAdministerForm
index 4d75f404..71dd3300 100755
--- a/DocDB/cgi/EventAdministerForm
+++ b/DocDB/cgi/EventAdministerForm
@@ -41,6 +41,7 @@ require "Sorts.pm";
 
 require "DBUtilities.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 
 require "MeetingSQL.pm";
 require "SecuritySQL.pm";
diff --git a/DocDB/cgi/ExternalDocDBAdministerForm b/DocDB/cgi/ExternalDocDBAdministerForm
index 5921f581..18570955 100755
--- a/DocDB/cgi/ExternalDocDBAdministerForm
+++ b/DocDB/cgi/ExternalDocDBAdministerForm
@@ -39,6 +39,7 @@ require "Sorts.pm";
 
 require "DBUtilities.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 
 require "SecuritySQL.pm";
 require "XRefHTML.pm";
diff --git a/DocDB/cgi/GroupAdminister b/DocDB/cgi/GroupAdminister
index da3335fb..11fd4e42 100755
--- a/DocDB/cgi/GroupAdminister
+++ b/DocDB/cgi/GroupAdminister
@@ -34,6 +34,7 @@ require "DocDBGlobals.pm";
 require "ResponseElements.pm";
 require "Security.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 require "SecuritySQL.pm";
 require "GroupHTML.pm";
 require "Messages.pm";
diff --git a/DocDB/cgi/JournalAdminister b/DocDB/cgi/JournalAdminister
index 8fa56d59..937ff6b6 100755
--- a/DocDB/cgi/JournalAdminister
+++ b/DocDB/cgi/JournalAdminister
@@ -32,6 +32,7 @@ require "DocDBGlobals.pm";
 require "ResponseElements.pm";
 require "Security.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 require "MiscSQL.pm";
 require "JournalHTML.pm";
 require "Messages.pm";
diff --git a/DocDB/cgi/KeywordGroupAdminister b/DocDB/cgi/KeywordGroupAdminister
index 38ddfecd..bfb38b2c 100755
--- a/DocDB/cgi/KeywordGroupAdminister
+++ b/DocDB/cgi/KeywordGroupAdminister
@@ -33,6 +33,7 @@ require "DocDBGlobals.pm";
 require "ResponseElements.pm";
 require "Security.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 require "KeywordSQL.pm";
 require "KeywordHTML.pm";
 require "Messages.pm";
diff --git a/DocDB/cgi/KeywordListAdminister b/DocDB/cgi/KeywordListAdminister
index fee0b9ac..dae6381d 100755
--- a/DocDB/cgi/KeywordListAdminister
+++ b/DocDB/cgi/KeywordListAdminister
@@ -35,6 +35,7 @@ require "Sorts.pm";
 require "ResponseElements.pm";
 require "Security.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 require "KeywordHTML.pm";
 require "KeywordSQL.pm";
 require "Messages.pm";
diff --git a/DocDB/cgi/ListBy b/DocDB/cgi/ListBy
index 52a68ec4..3c27e62f 100755
--- a/DocDB/cgi/ListBy
+++ b/DocDB/cgi/ListBy
@@ -35,6 +35,7 @@ require "DocDBGlobals.pm";
 require "DocumentHTML.pm";
 require "SecuritySQL.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 require "DocumentUtilities.pm";
 
 $query = new CGI;  # Global for subroutines

From 11fbf82b91fa89cb0bc73fe5d8701eb3da291440 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Thu, 1 Aug 2013 11:35:44 -0500
Subject: [PATCH 084/163] Fix checkboxes on AddFiles, use SafeHTML in journals

---
 DocDB/cgi/AddFiles       |  4 +--
 DocDB/cgi/JournalHTML.pm | 74 +++++++++++++++++++++-------------------
 2 files changed, 40 insertions(+), 38 deletions(-)

diff --git a/DocDB/cgi/AddFiles b/DocDB/cgi/AddFiles
index 437235f3..b2355f43 100755
--- a/DocDB/cgi/AddFiles
+++ b/DocDB/cgi/AddFiles
@@ -79,8 +79,8 @@ my $DocumentID = $Untaint -> extract(-as_integer => "docid") || 0;
 my $Version = $Untaint -> extract(-as_integer => "version") || 0;
 my $Replace = $Untaint -> extract(-as_printable => "replace") || "";
 my $MaxFiles = $Untaint -> extract(-as_integer => "maxfiles") || 0;
-my $Replace = $Untaint -> extract(-as_printable => "submitagree") || "";
-my $Replace = $Untaint -> extract(-as_printable => "preservesigs") || "";
+my $SubmitAgree = $Untaint -> extract(-as_printable => "submitagree") || "";
+my $PreserveSigs = $Untaint -> extract(-as_printable => "preservesigs") || "";
 
 my $DocRevID;
 
diff --git a/DocDB/cgi/JournalHTML.pm b/DocDB/cgi/JournalHTML.pm
index 9f4513e6..673abf64 100644
--- a/DocDB/cgi/JournalHTML.pm
+++ b/DocDB/cgi/JournalHTML.pm
@@ -1,16 +1,16 @@
 #
-# Description: Routines with form elements and other HTML generating 
+# Description: Routines with form elements and other HTML generating
 #              code pertaining to Journals and References.
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified: 
+#    Modified:
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -22,69 +22,71 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
+require "HTMLUtilities.pm";
+
 sub JournalSelect (;%) {
   my (%Params) = @_;
-  
+
   my $Disabled = $Params{-disabled} || "0";
   my $Mode     = $Params{-format}   || "0";
- 
+
   my $Booleans = "";
-  
+
   if ($Disabled) {
     $Booleans .= "-disabled";
-  }  
-  
+  }
+
   my @JournalIDs = keys %Journals;
   my %JournalLabels = ();
   foreach my $ID (@JournalIDs) {
-    $JournalLabels{$ID} = $Journals{$ID}{Abbreviation};
+    $JournalLabels{$ID} = SmartHTML({-text => $Journals{$ID}{Abbreviation}},);
   }
   @JournalIDs = sort @JournalIDs;  #FIXME Sort by abbreviation
 
   print FormElementTitle(-helplink => "journal", -helptext => "Journal");
-  print $query -> scrolling_list(-name => "journal", -values => \@JournalIDs, 
-                                 -labels => \%JournalLabels, -size => 10, 
+  print $query -> scrolling_list(-name => "journal", -values => \@JournalIDs,
+                                 -labels => \%JournalLabels, -size => 10,
                                  -default => $JournalDefault, $Booleans);
 
 }
 
 sub JournalEntryBox (;%) {
   my (%Params) = @_;
-  
+
   my $Disabled = $Params{-disabled} || "0";
   my $Mode     = $Params{-format}   || "0";
- 
+
   my $Booleans = "";
-  
+
   if ($Disabled) {
     $Booleans .= "-disabled";
-  }  
+  }
 
   print "<table cellpadding=5><tr valign=top>\n";
   print "<td>\n";
   print FormElementTitle(-helplink => "journalentry", -helptext => "Full Name");
-  print $query -> textfield (-name => 'name', 
+  print $query -> textfield (-name => 'name',
                              -size => 40, -maxlength => 128, $Booleans);
   print "</td>\n";
   print "<td>\n";
   print FormElementTitle(-helplink => "journalentry", -helptext => "Publisher");
-  print $query -> textfield (-name => 'pub', 
+  print $query -> textfield (-name => 'pub',
                              -size => 40, -maxlength => 64, $Booleans);
   print "</td></tr>\n";
 
   print "<tr><td>\n";
   print FormElementTitle(-helplink => "journalentry", -helptext => "Abbreviation");
-  print $query -> textfield (-name => 'abbr', 
+  print $query -> textfield (-name => 'abbr',
                              -size => 40, -maxlength => 64, $Booleans);
   print "</td>\n";
   print "<td>\n";
   print FormElementTitle(-helplink => "journalentry", -helptext => "URL");
-  print $query -> textfield (-name => 'url', 
+  print $query -> textfield (-name => 'url',
                              -size => 40, -maxlength => 240, $Booleans);
   print "</td></tr>\n";
   print "<tr><td>\n";
   print FormElementTitle(-helplink => "journalentry", -helptext => "Acronym");
-  print $query -> textfield (-name => 'acronym', 
+  print $query -> textfield (-name => 'acronym',
                              -size => 8, -maxlength => 8, $Booleans);
   print "</td></tr>\n";
   print "</table>\n";
@@ -107,11 +109,11 @@ sub JournalTable (;$) {
   my @JournalIDs = sort keys %Journals; #FIXME Sort by abbreviation
   foreach my $ID (@JournalIDs) {
     print "<tr>\n";
-    print "<td>$Journals{$ID}{Name}</td>\n";
-    print "<td>$Journals{$ID}{Abbreviation}</td>\n";
-    print "<td>$Journals{$ID}{Acronym}</td>\n";
-    print "<td>$Journals{$ID}{Publisher}</td>\n";
-    print "<td>$Journals{$ID}{URL}</td>\n";
+    print "<td>".SmartHTML({-text => $Journals{$ID}{Name}},)."</td>\n";
+    print "<td>".SmartHTML({-text => $Journals{$ID}{Abbreviation}},)."</td>\n";
+    print "<td>".SmartHTML({-text => $Journals{$ID}{Acronym}},)."</td>\n";
+    print "<td>".SmartHTML({-text => $Journals{$ID}{Publisher}},)."</td>\n";
+    print "<td>".SmartHTML({-text => $Journals{$ID}{URL}, -makeURLs => $TRUE},)."</td>\n";
     print "</tr>\n";
   }
   print "</table>\n";
@@ -119,7 +121,7 @@ sub JournalTable (;$) {
 
 sub ReferenceForm {
   require "MiscSQL.pm";
-  
+
   GetJournals();
 
   my @JournalIDs = keys %Journals;
@@ -129,33 +131,33 @@ sub ReferenceForm {
   }
   @JournalIDs = sort @JournalIDs;  #FIXME Sort by acronym
   unshift @JournalIDs,0; $JournalLabels{0} = "----"; # Null Journal
-  my $ElementTitle = FormElementTitle(-helplink  => "reference", 
+  my $ElementTitle = FormElementTitle(-helplink  => "reference",
                                       -helptext  => "Journal References");
-  print $ElementTitle,"\n";                                     
+  print $ElementTitle,"\n";
 
   my @ReferenceIDs = (@ReferenceDefaults,0);
-  
+
   print "<table class=\"LowPaddedTable\">\n";
-  foreach my $ReferenceID (@ReferenceIDs) { 
+  foreach my $ReferenceID (@ReferenceIDs) {
     print "<tr>\n";
     my $JournalDefault = $RevisionReferences{$ReferenceID}{JournalID};
     my $VolumeDefault  = $RevisionReferences{$ReferenceID}{Volume}   ;
     my $PageDefault    = $RevisionReferences{$ReferenceID}{Page}     ;
     print "<td><b>Journal: </b>\n";
-    print $query -> popup_menu(-name => "journal", -values => \@JournalIDs, 
+    print $query -> popup_menu(-name => "journal", -values => \@JournalIDs,
                                    -labels => \%JournalLabels,
                                    -default => $JournalDefault);
     print "</td>";
     print "<td><b>Volume:</b> \n";
-    print $query -> textfield (-name => 'volume', 
-                               -size => 8, -maxlength => 8, 
+    print $query -> textfield (-name => 'volume',
+                               -size => 8, -maxlength => 8,
                                -default => $VolumeDefault);
     print "</td>";
     print "<td><b>Page:</b> \n";
-    print $query -> textfield (-name => 'page', 
-                               -size => 8, -maxlength => 16, 
+    print $query -> textfield (-name => 'page',
+                               -size => 8, -maxlength => 16,
                                -default => $PageDefault);
-    print "</td></tr>\n";                           
+    print "</td></tr>\n";
   }
   print "</table>\n";
 }

From 956ae7d61a8c8f69901ee6b93dcc2696e4d0fceb Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Thu, 1 Aug 2013 15:14:28 -0500
Subject: [PATCH 085/163] SmartHTML for security group table, selector, and
 links

---
 DocDB/cgi/GroupAdministerForm | 25 ++++++++-----
 DocDB/cgi/SecurityHTML.pm     | 69 ++++++++++++++++++-----------------
 2 files changed, 51 insertions(+), 43 deletions(-)

diff --git a/DocDB/cgi/GroupAdministerForm b/DocDB/cgi/GroupAdministerForm
index bf216923..e04983ef 100755
--- a/DocDB/cgi/GroupAdministerForm
+++ b/DocDB/cgi/GroupAdministerForm
@@ -1,17 +1,17 @@
 #! /usr/bin/env perl
 #
-# Description: This script provides a form to administer groups in 
+# Description: This script provides a form to administer groups in
 #              the DocDB and shows the relationships between groups.
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified: 
+#    Modified:
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -23,7 +23,7 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-use CGI qw(-nosticky);                                                                                      
+use CGI qw(-nosticky);
 use DBI;
 
 require "DocDBGlobals.pm";
@@ -46,7 +46,7 @@ $dbh   = DBI -> connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass
 GetSecurityGroups();
 
 print $query -> header( -charset => $HTTP_ENCODING );
-DocDBHeader("Group Administration","",-scripts => ["PopUps","GroupAdminDisable"]); 
+DocDBHeader("Group Administration","",-scripts => ["PopUps","GroupAdminDisable"]);
 
 @ErrorStack = ();
 @WarnStack  = ();
@@ -92,14 +92,14 @@ print "</tr>\n";
 
 print "<tr>\n";
 print '<td rowspan="4">';
-SecurityScroll(-name      => 'parent', -disabled => $TRUE, 
+SecurityScroll(-name      => 'parent', -disabled => $TRUE,
                -helplink  => 'parent', -helptext => 'Group');
-print "</td>\n";  
+print "</td>\n";
 print '<td rowspan="4">';
 SecurityScroll(-name      => 'child', -disabled => $TRUE, -multiple => $TRUE,
                -helplink  => 'child', -helptext => 'Subordinates');
 print "<br/>\n";
-print $query -> checkbox(-name  => "removesubs", -value    => 'removesubs', 
+print $query -> checkbox(-name  => "removesubs", -value    => 'removesubs',
                          -label => '',           -disabled => 'disabled');
 print "Remove all";
 print "</td>\n";
@@ -132,7 +132,12 @@ my @GroupIDs = sort numerically keys %SecurityGroups;
 print '<table class="HighPaddedTable">';
 foreach my $GroupID (@GroupIDs) {
   print "<tr>\n";
-  print "<td><strong>$SecurityGroups{$GroupID}{NAME}</strong><br/>($SecurityGroups{$GroupID}{Description})</td>\n";
+  print "<td><strong>";
+  print SmartHTML({-text => $SecurityGroups{$GroupID}{NAME}},);
+  $SecurityGroups{$GroupID}{NAME}
+  print "</strong><br/>(";
+  print SmartHTML({-text => $SecurityGroups{$GroupID}{Description}},);
+  print ")</td>\n";
   print "<td>\n";
   print "<strong>Dominant groups:</strong>\n";
   PrintGroupParents($GroupID);
@@ -146,7 +151,7 @@ foreach my $GroupID (@GroupIDs) {
   PrintGroupPermissions($GroupID);
   print "</td>\n";
   print "</tr>\n";
-} 
+}
 print "</table>\n";
 
 print "<hr/>\n";
diff --git a/DocDB/cgi/SecurityHTML.pm b/DocDB/cgi/SecurityHTML.pm
index 9b540913..68843a2e 100644
--- a/DocDB/cgi/SecurityHTML.pm
+++ b/DocDB/cgi/SecurityHTML.pm
@@ -3,14 +3,14 @@
 # Description: Routines which supply HTML and form elements related to security
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified: 
+#    Modified:
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -27,13 +27,14 @@ sub SecurityScroll (%) {
   require "Sorts.pm";
   require "Scripts.pm";
   require "FormElements.pm";
-  
+  require "HTMLUtilities.pm";
+
   my (%Params) = @_;
-  
+
   my $AddPublic =   $Params{-addpublic} || $FALSE;
   my $HelpLink  =   $Params{-helplink}  || "";
   my $HelpText  =   $Params{-helptext}  || "Groups";
-  my $Multiple  =   $Params{-multiple}; 
+  my $Multiple  =   $Params{-multiple};
   my $Name      =   $Params{-name}      || "groups";
   my $Format    =   $Params{-format}    || "short";
   my $Size      =   $Params{-size}      || 10;
@@ -42,55 +43,56 @@ sub SecurityScroll (%) {
   my @Default   = @{$Params{-default}};
 
   my %Options = ();
- 
+
   if ($Disabled) {
     $Options{-disabled} = "disabled";
-  }  
+  }
 
   &GetSecurityGroups;
-  
+
   unless (@GroupIDs) {
     @GroupIDs = keys %SecurityGroups;
   }
-    
+
   my %GroupLabels = ();
 
   foreach my $GroupID (@GroupIDs) {
-    $GroupLabels{$GroupID} = $SecurityGroups{$GroupID}{NAME};
+    SmartHTML({-text => $SecurityGroups{$GroupID}{NAME}},);
+    $GroupLabels{$GroupID} = SmartHTML({-text => $SecurityGroups{$GroupID}{NAME}},);
     if ($Format eq "full") {
-      $GroupLabels{$GroupID} .= " [".$SecurityGroups{$GroupID}{Description}."]";
+      $GroupLabels{$GroupID} .= " [".SmartHTML({-text => $SecurityGroups{$GroupID}{Description}},)."]";
     }
-  }  
-  
+  }
+
   if ($AddPublic) { # Add dummy security code for "Public"
-    my $ID = 0; 
-    push @GroupIDs,$ID; 
+    my $ID = 0;
+    push @GroupIDs,$ID;
     $GroupLabels{$ID} = "Public";
   }
-      
+
   @GroupIDs = sort numerically @GroupIDs;
 
-  if ($HelpLink) {  
+  if ($HelpLink) {
     my $BoxTitle = &FormElementTitle(-helplink => $HelpLink, -helptext => $HelpText);
     print $BoxTitle;
   }
-  
-  print $query -> scrolling_list(-name => $Name, -values => \@GroupIDs, 
-                                 -labels => \%GroupLabels, 
+
+  print $query -> scrolling_list(-name => $Name, -values => \@GroupIDs,
+                                 -labels => \%GroupLabels,
                                  -size => $Size, -multiple => $Multiple,
                                  -default => \@Default, %Options);
 };
 
 sub SecurityListByID {
   my (@GroupIDs) = @_;
-  
+
   print "<div id=\"Viewable\">\n";
   if ($EnhancedSecurity) {
     print "<b>Viewable by:</b><br/>\n";
-  } else {  
+  } else {
     print "<b>Accessible by:</b><br/>\n";
-  }  
-  
+  }
+
   print "<ul>\n";
   if (@GroupIDs) {
     foreach $GroupID (@GroupIDs) {
@@ -105,11 +107,11 @@ sub SecurityListByID {
 
 sub ModifyListByID {
   my (@GroupIDs) = @_;
-  
+
   unless ($EnhancedSecurity) {
     return;
   }
-    
+
   print "<div id=\"Modifiable\">\n";
   print "<b>Modifiable by:</b><br/>\n";
   print "<ul>\n";
@@ -147,22 +149,23 @@ sub SecurityLink ($) {
   my $Check   = exists $ArgRef->{-check}   ? $ArgRef->{-check}   : "";
 
   require "Security.pm";
-  
+
   my %Message = ("view" => "Can't view now", "create" => "Can't modify now");
 
   unless ($GroupID) {
     return;
   }
-  
+
   my $Link = "<a href=\"$ListBy?groupid=$GroupID\"";
-  $Link .= " title=\"$SecurityGroups{$GroupID}{Description}\"";
-  $Link .= ">";
-  $Link .= $SecurityGroups{$GroupID}{NAME};
+  $Link .= ' title="';
+  $Link .= SmartHTML({-text => $SecurityGroups{$GroupID}{Description}},);
+  $Link .= '">';
+  $Link .= SmartHTML({-text => $SecurityGroups{$GroupID}{NAME}},);
   $Link .= "</a>";
   if ($Check && !GroupCan({ -groupid => $GroupID, -action => $Check }) ) {
     $Link .= "<br/>(".$Message{$Check}.")";
-  }  
-     
+  }
+
   return $Link;
 }
 

From 4a947a70708a8bd0aea91f68cdb0045eafc254e1 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Thu, 1 Aug 2013 15:15:21 -0500
Subject: [PATCH 086/163] SmartHTML for security group table, selector, and
 links

---
 DocDB/cgi/GroupAdministerForm | 1 -
 1 file changed, 1 deletion(-)

diff --git a/DocDB/cgi/GroupAdministerForm b/DocDB/cgi/GroupAdministerForm
index e04983ef..07f45fbe 100755
--- a/DocDB/cgi/GroupAdministerForm
+++ b/DocDB/cgi/GroupAdministerForm
@@ -134,7 +134,6 @@ foreach my $GroupID (@GroupIDs) {
   print "<tr>\n";
   print "<td><strong>";
   print SmartHTML({-text => $SecurityGroups{$GroupID}{NAME}},);
-  $SecurityGroups{$GroupID}{NAME}
   print "</strong><br/>(";
   print SmartHTML({-text => $SecurityGroups{$GroupID}{Description}},);
   print ")</td>\n";

From 4923e00552936a2c25b01315ca9526d9f28497ac Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Thu, 1 Aug 2013 15:26:46 -0500
Subject: [PATCH 087/163] Make ListBy safe for Groups and events

---
 DocDB/cgi/ListBy | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/DocDB/cgi/ListBy b/DocDB/cgi/ListBy
index 3c27e62f..936edb91 100755
--- a/DocDB/cgi/ListBy
+++ b/DocDB/cgi/ListBy
@@ -163,9 +163,11 @@ if ($Days) {
   $FieldListOptions{-eventid}      = $EventID;
   $FieldListOptions{-eventgroupid} = $Conferences{$EventID}{EventGroupID};
   $Title   = "Document List by Event";
-  $Message = "These documents from <span class=\"Highlight\">$Conferences{$EventID}{LongDescription}</span> ";
+  $Message = "These documents from <span class=\"Highlight\">";
+  $Message .= SmartHTML({-text => $Conferences{$EventID}{LongDescription}});
+  $Message .= "</span> ";
   if ($Conferences{$EventID}{URL}) {
-    $Message .= "(<a href=\"$Conferences{$EventID}{URL}\">$Conferences{$EventID}{URL}</a>) ";
+    $Message .= "(".SmartHTML({-text => $Conferences{$EventID}{URL}, -makeURLs=$TRUE})."</a>) ";
   }
   $Message .= "are available:";
   $List = $dbh -> prepare("select DISTINCT(DocumentRevision.DocumentID) from ".
@@ -187,7 +189,9 @@ if ($Days) {
   $FieldListOptions{-eventgroupid} = $EventGroupID;
   $FieldListOptions{-default}      = "Event Group Default";
   $Title   = "Document List by Event Group";
-  $Message = "These documents from <span class=\"Highlight\">$EventGroups{$EventGroupID}{LongDescription}</span> are available:";
+  $Message = "These documents from <span class=\"Highlight\">";
+  $Message .= SmartHTML({-text => $EventGroups{$EventGroupID}{LongDescription},});
+  $Message .="</span> are available:";
   $List = $dbh -> prepare("select DISTINCT(DocumentRevision.DocumentID) from ".
            "DocumentRevision,RevisionEvent,Conference where DocumentRevision.DocRevID=RevisionEvent.DocRevID ".
            "and DocumentRevision.Obsolete=0 and RevisionEvent.ConferenceID=Conference.ConferenceID and Conference.EventGroupID=?");
@@ -210,8 +214,9 @@ if ($Days) {
     $GroupID = FetchSecurityGroupByName($Group);
   }
   $Title   = "Document List by Group";
-  $Message = "These documents for <span class=\"Highlight\">
-             $SecurityGroups{$GroupID}{NAME}</span> are available:";
+  $Message = "These documents for <span class=\"Highlight\">";
+  $Message .= SmartHTML({-text => $SecurityGroups{$GroupID}{NAME},});
+  $Message .= "</span> are available:";
 
   $List = $dbh -> prepare("select DISTINCT(DocumentRevision.DocumentID) from ".
            "DocumentRevision,RevisionSecurity where DocumentRevision.DocRevID=RevisionSecurity.DocRevID ".

From 11d2c646b305c0a93834c82a9772b6e9450718b8 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Thu, 1 Aug 2013 15:27:29 -0500
Subject: [PATCH 088/163] Make ListBy safe for Groups and events

---
 DocDB/cgi/ListBy | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/DocDB/cgi/ListBy b/DocDB/cgi/ListBy
index 936edb91..3d7990e7 100755
--- a/DocDB/cgi/ListBy
+++ b/DocDB/cgi/ListBy
@@ -167,7 +167,7 @@ if ($Days) {
   $Message .= SmartHTML({-text => $Conferences{$EventID}{LongDescription}});
   $Message .= "</span> ";
   if ($Conferences{$EventID}{URL}) {
-    $Message .= "(".SmartHTML({-text => $Conferences{$EventID}{URL}, -makeURLs=$TRUE})."</a>) ";
+    $Message .= "(".SmartHTML({-text => $Conferences{$EventID}{URL}, -makeURLs=>$TRUE})."</a>) ";
   }
   $Message .= "are available:";
   $List = $dbh -> prepare("select DISTINCT(DocumentRevision.DocumentID) from ".

From d78ab3e5efaad1f69f5723bc58e05917664d42b4 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Thu, 1 Aug 2013 16:07:16 -0500
Subject: [PATCH 089/163] Make keyword selectable lists safe

---
 DocDB/cgi/KeywordHTML.pm | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/DocDB/cgi/KeywordHTML.pm b/DocDB/cgi/KeywordHTML.pm
index 47cd8085..57ac6b95 100644
--- a/DocDB/cgi/KeywordHTML.pm
+++ b/DocDB/cgi/KeywordHTML.pm
@@ -167,16 +167,16 @@ sub KeywordSelect (%) { # Scrolling selectable list for keyword groups
   my %KeywordLabels = ();
   foreach my $ID (@KeywordIDs) {
     if ($Format eq "short") {
-      $KeywordLabels{$ID} = $Keywords{$ID}{Short};
+      $KeywordLabels{$ID} = SmartHTML({-text=>$Keywords{$KeywordID}{Short}});
     } elsif ($Format eq "long") {
-      $KeywordLabels{$ID} = $Keywords{$ID}{Long};
+      $KeywordLabels{$ID} = SmartHTML({-text=>$Keywords{$KeywordID}{Long}});
     } elsif ($Format eq "full") {
-      $KeywordLabels{$ID} = $Keywords{$ID}{Short}." [";
+      $KeywordLabels{$ID} = SmartHTML({-text=>$Keywords{$KeywordID}{Short}})." [";
       if ($MaxLabel) {
         if ( (length $Keywords{$ID}{Long}) > $MaxLabel) {
-          $KeywordLabels{$ID} .= substr($Keywords{$ID}{Long},0,$MaxLabel)." ...";
+          $KeywordLabels{$ID} .= substr(SmartHTML({-text=>$Keywords{$KeywordID}{Long}}),0,$MaxLabel)." ...";
         } else {
-          $KeywordLabels{$ID} .= $Keywords{$ID}{Long};
+          $KeywordLabels{$ID} .= SmartHTML({-text=>$Keywords{$KeywordID}{Long}});
         }
         $KeywordLabels{$ID} .= "]";
       }
@@ -209,9 +209,9 @@ sub KeywordGroupSelect (%) { # Scrolling selectable list for keyword groups
 
   foreach my $ID (@KeyGroupIDs) {
     if ($Format eq "full") {
-      $GroupLabels{$ID} = "$KeywordGroups{$ID}{Short} [$KeywordGroups{$ID}{Long}]";
+      $GroupLabels{$ID} = SmartHTML({-text=>$KeywordGroups{$ID}{Short}})." ".SmartHTML({-text=>$KeywordGroups{$ID}{Long}});
     } else {
-      $GroupLabels{$ID} = $KeywordGroups{$ID}{Short};
+      $GroupLabels{$ID} = SmartHTML({-text=>$KeywordGroups{$ID}{Short}});
     }
   }
 

From 3c38363ca432e7c6d597bdcf09821b208487523d Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Thu, 1 Aug 2013 16:09:00 -0500
Subject: [PATCH 090/163] Make keyword selectable lists safe

---
 DocDB/cgi/KeywordHTML.pm | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/DocDB/cgi/KeywordHTML.pm b/DocDB/cgi/KeywordHTML.pm
index 57ac6b95..82ec7ee8 100644
--- a/DocDB/cgi/KeywordHTML.pm
+++ b/DocDB/cgi/KeywordHTML.pm
@@ -167,16 +167,16 @@ sub KeywordSelect (%) { # Scrolling selectable list for keyword groups
   my %KeywordLabels = ();
   foreach my $ID (@KeywordIDs) {
     if ($Format eq "short") {
-      $KeywordLabels{$ID} = SmartHTML({-text=>$Keywords{$KeywordID}{Short}});
+      $KeywordLabels{$ID} = SmartHTML({-text=>$Keywords{$ID}{Short}});
     } elsif ($Format eq "long") {
-      $KeywordLabels{$ID} = SmartHTML({-text=>$Keywords{$KeywordID}{Long}});
+      $KeywordLabels{$ID} = SmartHTML({-text=>$Keywords{$ID}{Long}});
     } elsif ($Format eq "full") {
-      $KeywordLabels{$ID} = SmartHTML({-text=>$Keywords{$KeywordID}{Short}})." [";
+      $KeywordLabels{$ID} = SmartHTML({-text=>$Keywords{$ID}{Short}})." [";
       if ($MaxLabel) {
         if ( (length $Keywords{$ID}{Long}) > $MaxLabel) {
-          $KeywordLabels{$ID} .= substr(SmartHTML({-text=>$Keywords{$KeywordID}{Long}}),0,$MaxLabel)." ...";
+          $KeywordLabels{$ID} .= substr(SmartHTML({-text=>$Keywords{$ID}{Long}}),0,$MaxLabel)." ...";
         } else {
-          $KeywordLabels{$ID} .= SmartHTML({-text=>$Keywords{$KeywordID}{Long}});
+          $KeywordLabels{$ID} .= SmartHTML({-text=>$Keywords{$ID}{Long}});
         }
         $KeywordLabels{$ID} .= "]";
       }

From 22be333f7ea8a3a5d6c542cdb1b8aa365d21dd21 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Fri, 2 Aug 2013 15:45:04 -0500
Subject: [PATCH 091/163] Try URI escaping on keywords

---
 DocDB/cgi/KeywordHTML.pm | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/DocDB/cgi/KeywordHTML.pm b/DocDB/cgi/KeywordHTML.pm
index 82ec7ee8..5bd14f75 100644
--- a/DocDB/cgi/KeywordHTML.pm
+++ b/DocDB/cgi/KeywordHTML.pm
@@ -24,6 +24,9 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
+use HTML::Entities;
+use URI::Escape;
+
 require "HTMLUtilities.pm";
 
 sub KeywordGroupInfo ($;$) {
@@ -235,12 +238,14 @@ sub KeywordLinkByID ($;%) {
   &FetchKeyword($KeywordID);
   my $SafeShortKeyword = SmartHTML( {-text => $Keywords{$KeywordID}{Short}} );
   my $SafeLongKeyword = SmartHTML( {-text => $Keywords{$KeywordID}{long}} );
+  my $UnsafeURI = HTML::decode_entities($Keywords{$KeywordID}{Short});
+  my $SafeURI = uri_escape($UnsafeURI);
   my $Link;
 
   # FIXME_XSS: Check to make sure this kind of search still works.
   # May need to remove special characters or adapt search atoms
   unless ($NoLink) {
-    $Link .= "<a href=\"$Search\?keywordsearchmode=anyword&amp;keywordsearch=$SafeShortKeyword\">";
+    $Link .= "<a href=\"$Search\?keywordsearchmode=anyword&amp;keywordsearch=$SafeURI\">";
   }
 
   if ($Format eq "short") {
@@ -261,7 +266,9 @@ sub KeywordLink ($;%) { # FIXME: Allow parameters of short, long, full a la Lynn
 
   my $Format = $Params{-format} || "short"; # short, full
   my $SafeKeyword = SmartHTML( {-text => $Keyword} );
-  my $ret = "<a href=\"$Search\?keywordsearchmode=anyword;keywordsearch=$SafeKeyword\">";
+  my $UnsafeURI = HTML::decode_entities($Keyword);
+  my $SafeURI = uri_escape($UnsafeURI);
+  my $ret = "<a href=\"$Search\?keywordsearchmode=anyword;keywordsearch=$SafeURI\">";
   $ret .= "$SafeKeyword";
   $ret .=  "</a>";
   return $ret;

From caafc9c5844447bd87456bbead59fb0877d7692e Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Fri, 2 Aug 2013 15:48:02 -0500
Subject: [PATCH 092/163] Use right scope

---
 DocDB/cgi/KeywordHTML.pm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/DocDB/cgi/KeywordHTML.pm b/DocDB/cgi/KeywordHTML.pm
index 5bd14f75..4e905f31 100644
--- a/DocDB/cgi/KeywordHTML.pm
+++ b/DocDB/cgi/KeywordHTML.pm
@@ -238,7 +238,7 @@ sub KeywordLinkByID ($;%) {
   &FetchKeyword($KeywordID);
   my $SafeShortKeyword = SmartHTML( {-text => $Keywords{$KeywordID}{Short}} );
   my $SafeLongKeyword = SmartHTML( {-text => $Keywords{$KeywordID}{long}} );
-  my $UnsafeURI = HTML::decode_entities($Keywords{$KeywordID}{Short});
+  my $UnsafeURI = decode_entities($Keywords{$KeywordID}{Short});
   my $SafeURI = uri_escape($UnsafeURI);
   my $Link;
 
@@ -266,7 +266,7 @@ sub KeywordLink ($;%) { # FIXME: Allow parameters of short, long, full a la Lynn
 
   my $Format = $Params{-format} || "short"; # short, full
   my $SafeKeyword = SmartHTML( {-text => $Keyword} );
-  my $UnsafeURI = HTML::decode_entities($Keyword);
+  my $UnsafeURI = decode_entities($Keyword);
   my $SafeURI = uri_escape($UnsafeURI);
   my $ret = "<a href=\"$Search\?keywordsearchmode=anyword;keywordsearch=$SafeURI\">";
   $ret .= "$SafeKeyword";

From cd7c3834181004b614d36339ba50dede7a6504ca Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Mon, 5 Aug 2013 14:17:18 -0500
Subject: [PATCH 093/163] Untaint and no autoescaping for List* scripts

---
 DocDB/cgi/ListAllMeetings      | 12 +++++++-----
 DocDB/cgi/ListAuthors          |  5 +++--
 DocDB/cgi/ListBy               | 31 ++++++++++++++++---------------
 DocDB/cgi/ListEventsBy         |  1 +
 DocDB/cgi/ListGroupUsers       | 19 ++++++++++---------
 DocDB/cgi/ListGroups           |  9 +++++----
 DocDB/cgi/ListKeywords         | 10 ++++++----
 DocDB/cgi/ListManagedDocuments |  5 ++---
 DocDB/cgi/ListTopics           |  3 ++-
 DocDB/cgi/ListTypes            |  5 +++--
 10 files changed, 55 insertions(+), 45 deletions(-)

diff --git a/DocDB/cgi/ListAllMeetings b/DocDB/cgi/ListAllMeetings
index 71a1fb8d..d2ecc19b 100755
--- a/DocDB/cgi/ListAllMeetings
+++ b/DocDB/cgi/ListAllMeetings
@@ -26,22 +26,24 @@
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
 use CGI;
+use CGI::Untaint;
 use DBI;
 
 require "DocDBGlobals.pm";
 require "MeetingSQL.pm";
 require "MeetingHTML.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 require "SecuritySQL.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 
-%params = $query -> Vars;
-
-my $Mode         = $params{mode} || "display";
-my $EventGroupID = $params{eventgroupid};
-my $EventGroup   = $params{eventgroup};
+my $Mode = $Untaint -> extract(-as_printable => "mode") || "display";
+my $EventGroupID = $Untaint -> extract(-as_integer => "eventgroupid") || 0;
+my $EventGroup = $Untaint -> extract(-as_integer => "eventgroup") || 0;
 
 GetSecurityGroups();
 
diff --git a/DocDB/cgi/ListAuthors b/DocDB/cgi/ListAuthors
index cd0eaa55..99df7d66 100755
--- a/DocDB/cgi/ListAuthors
+++ b/DocDB/cgi/ListAuthors
@@ -7,7 +7,7 @@
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -19,7 +19,7 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-use CGI;                                                                                      
+use CGI;
 use DBI;
 
 require "DocDBGlobals.pm";
@@ -28,6 +28,7 @@ require "ResponseElements.pm";
 require "HTMLUtilities.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 
 GetInstitutions();
diff --git a/DocDB/cgi/ListBy b/DocDB/cgi/ListBy
index 3d7990e7..51571761 100755
--- a/DocDB/cgi/ListBy
+++ b/DocDB/cgi/ListBy
@@ -27,6 +27,7 @@
 
 use Benchmark;
 use CGI;
+use CGI::Untaint;
 use DBI;
 
 $StartTime = new Benchmark;
@@ -39,27 +40,27 @@ require "UntaintInput.pm";
 require "DocumentUtilities.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 
-%params = $query -> Vars;
+my $Days = $Untaint -> extract(-as_integer => "days") || 0;
+my $TypeID = $Untaint -> extract(-as_integer => "typeid") || 0;
+my $AuthorID = $Untaint -> extract(-as_integer => "authorid") || 0;
 
-my $Days         = $params{days}         || 0;
-my $TypeID       = $params{typeid}       || 0;
-my $AuthorID     = $params{authorid}     || 0;
+my $TopicID = $Untaint -> extract(-as_integer => "topicid") || 0;
+my $Topic = $Untaint -> extract(-as_safehtml => "topic") || "";
 
-my $TopicID      = $params{topicid}      || 0;
-my $Topic        = $params{topic}        || 0;
+my $EventID = $Untaint -> extract(-as_integer => "eventid") || 0;
+my $EventGroupID = $Untaint -> extract(-as_integer => "eventgroupid") || 0;
+my $EventGroup = $Untaint -> extract(-as_safehtml => "eventgroup") || "";
 
-my $EventID      = $params{eventid}      || 0;
-my $EventGroupID = $params{eventgroupid} || 0;
-my $EventGroup   = $params{eventgroup}   || "";
+my $GroupID = $Untaint -> extract(-as_integer => "groupid") || 0;
+my $Group = $Untaint -> extract(-as_safehtml => "group") || "";
 
-my $GroupID      = $params{groupid}      || 0;
-my $Group        = $params{group}        || "";
+my $AllPubs = $Untaint -> extract(-as_safehtml => "allpubs") || "";
+my $AllDocs = $Untaint -> extract(-as_safehtml => "alldocs") || "";
 
-my $AllPubs      = $params{allpubs}      || "";
-my $AllDocs      = $params{alldocs}      || "";
-
-my $Mode         = $params{mode}         || "";
+my $Mode = $Untaint -> extract(-as_safehtml => "mode") || "";
 
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 
diff --git a/DocDB/cgi/ListEventsBy b/DocDB/cgi/ListEventsBy
index a9d493ec..6be818d0 100755
--- a/DocDB/cgi/ListEventsBy
+++ b/DocDB/cgi/ListEventsBy
@@ -44,6 +44,7 @@ require "TopicHTML.pm";
 require "CalendarHTML.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
 
 # Parameters to script
 
diff --git a/DocDB/cgi/ListGroupUsers b/DocDB/cgi/ListGroupUsers
index 56e69fb7..6b262111 100755
--- a/DocDB/cgi/ListGroupUsers
+++ b/DocDB/cgi/ListGroupUsers
@@ -6,7 +6,7 @@
 #              receiving what.
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified: 
+#    Modified:
 #
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
@@ -14,7 +14,7 @@
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -26,7 +26,7 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-use CGI qw(-nosticky);                                                                                      
+use CGI qw(-nosticky);
 use DBI;
 
 require "DocDBGlobals.pm";
@@ -39,12 +39,13 @@ require "SecuritySQL.pm";
 require "NotificationSQL.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
 $dbh   = DBI -> connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 
 GetSecurityGroups();
 
 print $query -> header( -charset => $HTTP_ENCODING );
-DocDBHeader("List of Groups and Users",""); 
+DocDBHeader("List of Groups and Users","");
 
 @ErrorStack = ();
 @WarnStack  = ();
@@ -62,12 +63,12 @@ EndPage();
 
 print "<h2>DocDB Security Groups</h2>\n";
 
-print "<p>These are the security groups withing DocDB and a summary of their 
+print "<p>These are the security groups withing DocDB and a summary of their
        permissions. To see  the individual members of these groups, see the
        lists below or click on the group name which will take you to the list.
        </p>\n";
 
-print '<table class="CenteredTable LowPaddedTable">'."\n"; 
+print '<table class="CenteredTable LowPaddedTable">'."\n";
 print '<tr><th>Group</th><th>Description</th><th>Admin?</th><th>Create?</th><th>View?</th></tr>'."\n";
 foreach my $SecurityGroupID (@SecurityGroupIDs) {
   print '<tr>';
@@ -92,14 +93,14 @@ foreach my $SecurityGroupID (@SecurityGroupIDs) {
   if (@EmailUserIDs) {
     print "<p><a name=\"$GroupName\" /><strong>$GroupName has these members:</strong></p>\n<ul>\n";
     foreach my $EmailUserID (@EmailUserIDs) {
-      if ($EmailUser{$EmailUserID}{Name}) { 
+      if ($EmailUser{$EmailUserID}{Name}) {
         print "<li>$EmailUser{$EmailUserID}{Name} ($EmailUser{$EmailUserID}{Username}, $EmailUser{$EmailUserID}{EmailAddress})</li>\n";
-      }  
+      }
     }
     print "</ul>\n";
   } else {
     print "<p><a name=\"$GroupName\" /><strong>$GroupName has no members.</strong></p>\n";
-  }    
+  }
 }
 
 DocDBNavBar();
diff --git a/DocDB/cgi/ListGroups b/DocDB/cgi/ListGroups
index c94e877f..0b5a37c4 100755
--- a/DocDB/cgi/ListGroups
+++ b/DocDB/cgi/ListGroups
@@ -7,7 +7,7 @@
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -19,7 +19,7 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-use CGI;                                                                                      
+use CGI;
 use DBI;
 
 require "DocDBGlobals.pm";
@@ -29,6 +29,7 @@ require "HTMLUtilities.pm";
 require "DBUtilities.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
 CreateConnection(-type => "ro");
 
 GetSecurityGroups();
@@ -44,8 +45,8 @@ foreach my $GroupID (keys %SecurityGroups) {
   print "<td>",SecurityLink( {-groupid => $GroupID} ),"</td>\n";
   print "<td>",$SecurityGroups{$GroupID}{Description},"</td>\n";
   print "</tr>\n";
-} 
- 
+}
+
 print "</table>\n";
 
 
diff --git a/DocDB/cgi/ListKeywords b/DocDB/cgi/ListKeywords
index 6137acbf..a0a8f8de 100755
--- a/DocDB/cgi/ListKeywords
+++ b/DocDB/cgi/ListKeywords
@@ -27,6 +27,7 @@
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
 use CGI;
+use CGI::Untaint;
 use DBI;
 
 require "DocDBGlobals.pm";
@@ -34,18 +35,19 @@ require "KeywordSQL.pm";
 require "ResponseElements.pm";
 require "KeywordHTML.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 
 require "Messages.pm";
 
 $query = new CGI;  # Global for subroutines
-%params = $query -> Vars;
+$query -> autoEscape(0);
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 
-my $Mode   = $params{mode}   || "display";
-my $Format = $params{format} || "short"  ;
+my $Mode = $Untaint -> extract(-as_printable => "mode") || "display";
+my $Format = $Untaint -> extract(-as_printable => "format") || "short";
 
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 
-
 print $query -> header( -charset => $HTTP_ENCODING );
 &DocDBHeader("List of Keywords","", -scripts => ["PopUps","InsertKeyword"]);
 
diff --git a/DocDB/cgi/ListManagedDocuments b/DocDB/cgi/ListManagedDocuments
index df83a010..ca8c3b87 100755
--- a/DocDB/cgi/ListManagedDocuments
+++ b/DocDB/cgi/ListManagedDocuments
@@ -7,7 +7,7 @@
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -36,8 +36,7 @@ require "HTMLUtilities.pm";
 require "DocumentUtilities.pm";
 
 $query = new CGI; # Global for subroutines
-
-%params = $query -> Vars;
+$query -> autoEscape(0);
 
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 
diff --git a/DocDB/cgi/ListTopics b/DocDB/cgi/ListTopics
index 1ed68742..12581b93 100755
--- a/DocDB/cgi/ListTopics
+++ b/DocDB/cgi/ListTopics
@@ -7,7 +7,7 @@
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -28,6 +28,7 @@ require "TopicHTML.pm";
 require "HTMLUtilities.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 
 GetTopics();
diff --git a/DocDB/cgi/ListTypes b/DocDB/cgi/ListTypes
index 132c1d56..293aea4f 100755
--- a/DocDB/cgi/ListTypes
+++ b/DocDB/cgi/ListTypes
@@ -7,7 +7,7 @@
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -19,7 +19,7 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-use CGI;                                                                                      
+use CGI;
 use DBI;
 
 require "DocDBGlobals.pm";
@@ -28,6 +28,7 @@ require "ResponseElements.pm";
 require "HTMLUtilities.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 
 &GetDocTypes;

From ce302e2650c770cab999a79b3d00685921003a48 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Mon, 5 Aug 2013 15:14:08 -0500
Subject: [PATCH 094/163] Untaint MeetingModify (including untaint handler for
 list of safe HTML) and Retrieve scripts

---
 DocDB/cgi/MeetingModify         | 102 ++++++++++++++++++--------------
 DocDB/cgi/ModifyHome            |  85 +++++++++++++-------------
 DocDB/cgi/RetrieveArchive       |  10 ++--
 DocDB/cgi/RetrieveFile          |  44 +++++++-------
 DocDB/cgi/UntaintInput.pm       |   3 +-
 DocDB/cgi/UntaintListOfHTML.pm  |  48 +++++++++++++++
 DocDB/cgi/UntaintListOfWords.pm |   2 -
 7 files changed, 178 insertions(+), 116 deletions(-)
 create mode 100644 DocDB/cgi/UntaintListOfHTML.pm

diff --git a/DocDB/cgi/MeetingModify b/DocDB/cgi/MeetingModify
index b0ce0122..af6cef6f 100755
--- a/DocDB/cgi/MeetingModify
+++ b/DocDB/cgi/MeetingModify
@@ -25,6 +25,7 @@
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
 use CGI qw(-nosticky);
+use CGI::Untaint;
 use DBI;
 use Time::Local;
 
@@ -32,6 +33,7 @@ require "DocDBGlobals.pm";
 require "Messages.pm";
 
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 require "ResponseElements.pm";
 require "FormElements.pm";
 require "Sorts.pm";
@@ -47,51 +49,61 @@ require "TopicSQL.pm";
 require "WebUtilities.pm";
 
 $query = new CGI;  # Global for subroutines
-
-%params = $query -> Vars;
+$query -> autoEscape(0);
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 $query -> delete_all(); # Stop program from caching variable from script to script
 
-my $Mode               = $params{mode};
-my $NoSessions         = $params{nosessions};
-
-my $EventGroupID       = $params{eventgroups};
-my $Short              = $params{shortdesc};
-my $Long               = $params{long};
-
-my $ConferenceID       = $params{conferenceid};
-my $OffsetDays         = $params{offsetdays};
-
-my $StartYear          = $params{startyear};
-my $StartMonth         = $params{startmonth};
-my $StartDay           = $params{startday};
-my $EndYear            = $params{endyear};
-my $EndMonth           = $params{endmonth};
-my $EndDay             = $params{endday};
-my $MeetPreamble       = $params{meetpreamble};
-my $MeetEpilogue       = $params{meetepilogue};
-my $Location           = $params{location};
-my $AltLocation        = $params{altlocation};
-my $URL                = $params{url};
-my $ShowAllTalks       = $params{meetshowall};
-
-my @MeetingViewGroupIDs   = split /\0/,$params{meetingviewgroups};
-my @MeetingModifyGroupIDs = split /\0/,$params{meetingmodifygroups};
-my @MeetingTopicIDs       = split /\0/,$params{topics};
-my @MeetingModeratorIDs   = split /\0/,$params{moderators};
-
-my @SessionYears         = split /\0/,$params{sessionyear};
-my @SessionMonths        = split /\0/,$params{sessionmonth};
-my @SessionDays          = split /\0/,$params{sessionday};
-my @SessionHours         = split /\0/,$params{sessiontime};
-my @SessionOrders        = split /\0/,$params{sessionorder};
-my @RawSessionSeparators = split /\0/,$params{sessionseparator};
-my @SessionLocations     = split /\0/,$params{sessionlocation};
-my @SessionAltLocations  = split /\0/,$params{sessionaltlocation};
-my @SessionTitles        = split /\0/,$params{sessiontitle};
-my @SessionDescriptions  = split /\0/,$params{sessiondescription};
-my @MeetingOrderIDs      = split /\0/,$params{meetingorderid};
-my @SessionDeletes       = split /\0/,$params{sessiondelete};
-my @SessionShowAlls      = split /\0/,$params{sessionshowall};
+my $print = $Untaint -> extract(-as_printable => "subform") || "";
+my $int = $Untaint -> extract(-as_integer => "eventgroups") || 0;
+my $html = $Untaint -> extract(-as_safehtml => "longdesc") || "";
+
+my @htmls = @{ $Untaint -> extract(-as_listofhtml => "defaultlists") || undef };
+my @words = @{ $Untaint -> extract(-as_listofwords => "defaultlists") || undef };
+my @ints = @{ $Untaint -> extract(-as_listofint => "topics") || undef };
+
+my $Mode = $Untaint -> extract(-as_safehtml => "mode") || "";
+my $NoSessions = $Untaint -> extract(-as_safehtml => "nosessions") || "";
+
+my $EventGroupID = $Untaint -> extract(-as_integer => "eventgroups") || 0;
+my $Short = $Untaint -> extract(-as_safehtml => "shortdesc") || "";
+my $Long = $Untaint -> extract(-as_safehtml => "long") || "";
+
+my $ConferenceID = $Untaint -> extract(-as_integer => "conferenceid") || 0;
+my $OffsetDays = $Untaint -> extract(-as_integer => "offsetdays") || 0;
+
+my $StartYear = $Untaint -> extract(-as_integer => "startyear") || 0;
+my $StartMonth = $Untaint -> extract(-as_safehtml => "startmonth") || "";
+my $StartDay = $Untaint -> extract(-as_integer => "startday") || 0;
+my $EndYear = $Untaint -> extract(-as_integer => "endyear") || 0;
+my $EndMonth = $Untaint -> extract(-as_safehtml => "endmonth") || "";
+my $EndDay = $Untaint -> extract(-as_integer => "endday") || 0;
+
+my $MeetPreamble = $Untaint -> extract(-as_safehtml => "meetpreamble") || "";
+my $MeetEpilogue = $Untaint -> extract(-as_safehtml => "meetepilogue") || "";
+my $Location = $Untaint -> extract(-as_safehtml => "location") || "";
+my $AltLocation = $Untaint -> extract(-as_safehtml => "altlocation") || "";
+my $URL = $Untaint -> extract(-as_safehtml => "url") || "";
+my $ShowAllTalks = $Untaint -> extract(-as_safehtml => "meetshowall") || "";
+
+my @MeetingViewGroupIDs = @{ $Untaint -> extract(-as_listofint => "meetingviewgroups") || undef };
+my @MeetingModifyGroupIDs = @{ $Untaint -> extract(-as_listofint => "meetingmodifygroups") || undef };
+my @MeetingTopicIDs = @{ $Untaint -> extract(-as_listofint => "topics") || undef };
+my @MeetingModeratorIDs = @{ $Untaint -> extract(-as_listofint => "moderators") || undef };
+
+my @SessionYears = @{ $Untaint -> extract(-as_listofint => "sessionyear") || undef };
+my @SessionMonths = @{ $Untaint -> extract(-as_listofhtml => "sessionmonth") || undef };
+my @SessionDays = @{ $Untaint -> extract(-as_listofint => "sessionday") || undef };
+my @SessionHours = @{ $Untaint -> extract(-as_listofint => "sessiontime") || undef };
+my @SessionOrders = @{ $Untaint -> extract(-as_listofhtml => "sessionorder") || undef };
+my @RawSessionSeparators = @{ $Untaint -> extract(-as_listofwords => "sessionseparator") || undef };
+
+my @SessionLocations = @{ $Untaint -> extract(-as_listofhtml => "sessionlocation") || undef };
+my @SessionAltLocations = @{ $Untaint -> extract(-as_listofhtml => "sessionaltlocation") || undef };
+my @SessionTitles = @{ $Untaint -> extract(-as_listofhtml => "sessiontitle") || undef };
+my @SessionDescriptions = @{ $Untaint -> extract(-as_listofhtml => "sessiondescription") || undef };
+my @MeetingOrderIDs = @{ $Untaint -> extract(-as_listofint => "meetingorderid") || undef };
+my @SessionDeletes = @{ $Untaint -> extract(-as_listofwords => "sessiondelete") || undef };
+my @SessionShowAlls = @{ $Untaint -> extract(-as_listofwords => "sessionshowall") || undef };
 
 my $StartDate = "$StartYear-$ReverseAbrvMonth{$StartMonth}-$StartDay";
 my $EndDate   = "$EndYear-$ReverseAbrvMonth{$EndMonth}-$EndDay";
@@ -293,8 +305,8 @@ if ($Mode eq "create" || $Mode eq "modify") {
     my $SessionSeparatorID = 0;
     my $SessionID          = 0;
 
-    my @TopicIDs     = split /\0/,$params{"sessiontopics-$MeetingOrderID"};
-    my @ModeratorIDs = split /\0/,$params{"moderators-$MeetingOrderID"};
+    my @TopicIDs = @{ $Untaint -> extract(-as_listofint => "sessiontopics-$MeetingOrderID") || undef };
+    my @ModeratorIDs = @{ $Untaint -> extract(-as_listofint => "moderators-$MeetingOrderID") || undef };
 
     # Key on MeetingOrderID to see if we are going to insert or update.
     if (grep /n/,$MeetingOrderID) {
diff --git a/DocDB/cgi/ModifyHome b/DocDB/cgi/ModifyHome
index 8296db7f..b412deba 100755
--- a/DocDB/cgi/ModifyHome
+++ b/DocDB/cgi/ModifyHome
@@ -1,14 +1,14 @@
 #! /usr/bin/env perl
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified: 
+#    Modified:
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -20,7 +20,7 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-use CGI qw(-nosticky);                                                                                      
+use CGI qw(-nosticky);
 use DBI;
 
 require "DocDBGlobals.pm";
@@ -37,6 +37,7 @@ require "SecurityHTML.pm";
 require "MeetingSecurityUtilities.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 
 GetSecurityGroups();
@@ -66,7 +67,7 @@ print "<p><strong><a href=\"$MainPage\">Main Menu</a></strong></p>\n";
 print "<p><strong><a href=\"$DocDBInstructions\">Instructions</a></strong></p>\n";
 if ($PersonalAccountLink) {
   print "<p><strong>$PersonalAccountLink</strong></p>\n";
-}  
+}
 print "<p><strong><a href=\"#customcreate\">Customized<br/>Create/Modify</a></strong></p>\n";
 print "<p><strong><a href=\"#addform\">Customized<br/>Add Files</a></strong></p>\n";
 foreach my $Text (@{ $ProjectMessages{Homepage}{LeftColumn} }) {
@@ -83,88 +84,88 @@ print "(".FormElementTitle(-helplink => "modifytypes", -helptext => "Which optio
 ### New upload short form
 
 print "<ul>\n";
-print "<li>"; 
+print "<li>";
 print "\n",$query -> startform('POST',$DocumentAddForm),"<div>\n";
 print $query -> submit (-value => "Create a new");
-print " document from "; 
+print " document from ";
 print $query -> textfield(-name => "numfile", -size => 2, -maxlength => 2);
-print " file(s) on your "; 
+print " file(s) on your ";
 print FormElementTitle(-helplink => "uploadmethod", -helptext => "local computer",
                        -nocolon  => $TRUE,          -nobreak  => $TRUE);
 print $query -> hidden(-name => 'mode',    -default => 'add');
 print $query -> hidden(-name => 'upload',    -default => 'file');
 print "\n</div>\n",$query -> endform,"\n\n";
-print "</li>"; 
+print "</li>";
 
 ### New http short form
 
-print "<li>"; 
+print "<li>";
 print "\n",$query -> startform('POST',$DocumentAddForm),"<div>\n";
 print $query -> submit (-value => "Create a new");
-print " document from "; 
+print " document from ";
 print $query -> textfield(-name => "numfile", -size => 2, -maxlength => 2);
-print " file(s) on the "; 
+print " file(s) on the ";
 print FormElementTitle(-helplink => "uploadmethod", -helptext => "web",
                        -nocolon  => $TRUE,          -nobreak  => $TRUE);
 print $query -> hidden(-name => 'mode',    -default => 'add');
 print $query -> hidden(-name => 'upload',    -default => 'http');
 print "\n</div>\n",$query -> endform,"\n\n";
-print "</li>"; 
+print "</li>";
 
 ### Reserve form (button)
 
-print "<li>"; 
+print "<li>";
 print "\n",$query -> startform('POST',$DocumentAddForm),"<div>\n";
 print $query -> submit (-value => "Reserve");
-print " a document number\n"; 
+print " a document number\n";
 print "(if you don't yet have a draft of your document).\n";
 print $query -> hidden(-name => 'mode',    -default => 'reserve');
 print "\n</div>\n",$query -> endform,"\n\n";
-print "</li>"; 
+print "</li>";
 
 ### Update short form
 
-print "<li>"; 
+print "<li>";
 print "\n",$query -> startform('POST',$DocumentAddForm),"<div>\n";
 print $query -> submit (-value => "Update");
-print " document # "; 
+print " document # ";
 print $query -> textfield(-name => "docid", -size => 6, -maxlength => 6);
 print $query -> hidden(-name => 'mode',    -default => 'update');
 print "\n</div>\n",$query -> endform,"\n\n";
-print "</li>"; 
+print "</li>";
 
 ### Update DB short form
 
-print "<li>"; 
+print "<li>";
 print "\n",$query -> startform('POST',$DocumentAddForm),"<div>\n";
 print $query -> submit (-value => "Update DB Info");
-print " for document # "; 
+print " for document # ";
 print $query -> textfield(-name => "docid", -size => 6, -maxlength => 6);
 print $query -> hidden(-name => 'mode',    -default => 'updatedb');
 print "\n</div>\n",$query -> endform,"\n\n";
-print "</li>"; 
+print "</li>";
 
 ### File Add short form
 
-print "<li>"; 
+print "<li>";
 print "\n",$query -> startform('POST',$AddFilesForm),"<div>\n";
 print $query -> submit (-value => "Add");
-print " "; 
+print " ";
 print $query -> textfield(-name => "numfile", -size => 3, -maxlength => 2);
-print " file(s) to document # "; 
+print " file(s) to document # ";
 print $query -> textfield(-name => "docid", -size => 6, -maxlength => 6);
 #print $query -> hidden(-name => 'mode',    -default => 'updatedb');
 print "\n</div>\n",$query -> endform,"\n\n";
-print "</li>"; 
+print "</li>";
 
 if (CanAdminister()) { # Delete Form
-  print "<li>"; 
+  print "<li>";
   print "\n",$query -> startform('POST',$DeleteConfirm),"<div>\n";
   print $query -> submit (-value => "Delete");
-  print " document # "; 
+  print " document # ";
   print $query -> textfield(-name => "docid", -size => 6, -maxlength => 6);
   print "\n</div>\n",$query -> endform,"\n\n";
-  print "</li>"; 
+  print "</li>";
 }
 print "</ul>\n";
 
@@ -174,34 +175,34 @@ if (CanCreateMeeting()) {
 
   ### Full meeting form
 
-  print "<li>\n"; 
+  print "<li>\n";
   print $query -> startform('POST',$MeetingModify),"<div>\n";
   print $query -> submit (-value => "Create");
-  print " a new event with multiple sessions"; 
+  print " a new event with multiple sessions";
   print "\n</div>\n",$query -> endform,"\n\n";
-  print "</li>\n"; 
+  print "</li>\n";
 
   ### Reduced meeting form
 
-  print "<li>\n"; 
+  print "<li>\n";
   print $query -> startform('POST',$SessionModify),"<div>\n";
   print $query -> hidden(-name => 'singlesession', -default => 1);
   print $query -> hidden(-name => 'mode', -default => "new");
   print $query -> submit (-value => "Create");
-  print " a new event with only one session"; 
+  print " a new event with only one session";
   print "\n</div>\n",$query -> endform,"\n\n";
-  print "</li>\n"; 
+  print "</li>\n";
 
   ### No sessions form
 
-  print "<li>\n"; 
+  print "<li>\n";
   print $query -> startform('POST',$MeetingModify),"<div>\n";
   print $query -> hidden(-name => 'nosessions',    -default => 1);
   print $query -> submit (-value => "Create");
-  print " an externally managed event (e. g. a conference)"; 
+  print " an externally managed event (e. g. a conference)";
   print "\n</div>\n",$query -> endform,"\n\n";
-  print "</li>\n"; 
-  
+  print "</li>\n";
+
   print "<li>Modify an  <a href=\"$ListAllMeetings?mode=modify\">existing
              event</a> (choose event on next page)</li>\n";
 
@@ -215,14 +216,14 @@ if (CanAdminister()) {
   print "<li>Perform other <a href=\"$AdministerHome\">administration tasks</a></li>\n";
 }
 print "</ul>\n";
-           
+
 
 print "<hr/>\n";
-  
-### Customized Add/Update form creation form   
+
+### Customized Add/Update form creation form
 
 print "<a name=\"customcreate\" />\n";
-  
+
 print $query -> startform('POST',$DocumentAddForm);
 #print "<div>\n";
 $modes{reserve}  = "Reserve document #";
diff --git a/DocDB/cgi/RetrieveArchive b/DocDB/cgi/RetrieveArchive
index 6ac7eb55..d4d48d03 100755
--- a/DocDB/cgi/RetrieveArchive
+++ b/DocDB/cgi/RetrieveArchive
@@ -27,6 +27,7 @@
 # FIXME: No links ask for .tar (might change)
 
 use CGI;
+use CGI::Untaint;
 use DBI;
 
 require "DocDBGlobals.pm";
@@ -35,15 +36,16 @@ require "SecuritySQL.pm";
 require "DocumentSQL.pm";
 require "FSUtilities.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 require "FileUtilities.pm";
 require "Security.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 
-%params = $query -> Vars;
-
-my $Type       = $params{type} ;
-my $DocumentID = $params{docid};
+my $Type = $Untaint -> extract(-as_printable => "type") || "";
+my $DocumentID = $Untaint -> extract(-as_integer => "docid") || 0;
 
 unless ($DocumentID) {
   push @ErrorStack,"You are must supply a document number!";
diff --git a/DocDB/cgi/RetrieveFile b/DocDB/cgi/RetrieveFile
index 10822ddf..66fac7c0 100755
--- a/DocDB/cgi/RetrieveFile
+++ b/DocDB/cgi/RetrieveFile
@@ -8,7 +8,7 @@
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -21,6 +21,7 @@
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
 use CGI;
+use CGI::Untaint;
 use DBI;
 
 require "DocDBGlobals.pm";
@@ -31,26 +32,25 @@ require "RevisionSQL.pm";
 require "MiscSQL.pm";
 require "FSUtilities.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 require "Security.pm";
 require "SQLChecks.pm";
 
 require "RevisionHTML.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 
-%params = $query -> Vars;
-
-my $DocumentID = $params{docid};
-   $DocumentID =~ s/^\s+//; # Remove leading and trailing spaces
-   $DocumentID =~ s/\s+$//;
-my $Version    = $params{version};
-my $AsOf       = $params{asof};
-my $FileName   = $params{filename};
-my $Extension  = $params{extension};
+my $DocumentID = $Untaint -> extract(-as_integer => "docid") || 0;
+my $Version = $Untaint -> extract(-as_integer => "version") || 0;
+my $AsOf = $Untaint -> extract(-as_safehtml => "asof") || "";
+my $FileName = $Untaint -> extract(-as_safehtml => "filename") || "";
+my $Extension = $Untaint -> extract(-as_safehtml => "extension") || "";
 
 unless ($DocumentID) {
   push @ErrorStack,"You are must supply a document number!";
-}  
+}
 
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 
@@ -63,11 +63,11 @@ if (defined $Version && defined $AsOf) {
 }
 if (grep /\//,$FileName) {
   push @ErrorStack,"File names with / are not allowed for security reasons.";
-}  
+}
 
 if (@ErrorStack) {  # The user made one or more mistakes, warn and exit
   print $query -> header( -charset => $HTTP_ENCODING );
-  DocDBHeader("File Retrieve Results"); 
+  DocDBHeader("File Retrieve Results");
   EndPage();
 }
 
@@ -94,8 +94,8 @@ unless (&CanAccess($DocumentID,$Version)) {
     push @ErrorStack,"The $remote_user group is not authorized to view this document (or it does not exist).";
   } else {
     push @ErrorStack,"This document is not publicly accessible.";
-  }  
-}  
+  }
+}
 
 unless ($DocRevID) {
   push @ErrorStack,"This document does not exist.";
@@ -103,7 +103,7 @@ unless ($DocRevID) {
 
 if (@ErrorStack) {  # The user made one or more mistakes, warn and exit
   print $query -> header( -charset => $HTTP_ENCODING );
-  &DocDBHeader("File Retrieve Results"); 
+  &DocDBHeader("File Retrieve Results");
   EndPage();
 }
 
@@ -119,14 +119,14 @@ if ($FileName) {
         grep /$Extension$/i,$DocFiles{$DocFileID}{NAME}) {
       ++$NFiles;
       $LastFile = $DocFiles{$DocFileID}{NAME};
-    } 
+    }
   }
   if ($NFiles == 1) {
     $FullFile = &FullFile($DocumentID,$Version,$LastFile);
     $FullURL  = &GetURLDir($DocumentID,$Version).CGI::escape($LastFile);
   } elsif ($NFiles > 1) {
     push @WarnStack,"More than one file was found. Please select one below.";
-  }  
+  }
 } else {
   &FetchDocFiles($DocRevID);
   my $NFiles = 0;
@@ -136,7 +136,7 @@ if ($FileName) {
         $DocFiles{$DocFileID}{ROOT}) {
       ++$NFiles;
       $LastFile = $DocFiles{$DocFileID}{NAME};
-    } 
+    }
   }
   if ($NFiles == 1) {
     $FullFile = &FullFile($DocumentID,$Version,$LastFile);
@@ -145,8 +145,8 @@ if ($FileName) {
     push @WarnStack,"More than one file was found. Please select one below.";
   } else {
     push @WarnStack,"No files were found. Document info is below.";
-  }  
-}    
+  }
+}
 
 unless (-e $FullFile) {
   push @WarnStack,"No appropriate file was found.";
@@ -159,7 +159,7 @@ if ($FullFile && ($UserValidation eq "certificate" || $Preferences{Options}{Alwa
   print $query -> redirect(-location => $FullURL, -method => 'GET');
 } else {
   print $query -> header( -charset => $HTTP_ENCODING );
-  DocDBHeader("File Retrieve Results"); 
+  DocDBHeader("File Retrieve Results");
   EndPage(@ErrorStack);
 
   PrintRevisionInfo($DocRevID);
diff --git a/DocDB/cgi/UntaintInput.pm b/DocDB/cgi/UntaintInput.pm
index 3b73405b..cacc8416 100644
--- a/DocDB/cgi/UntaintInput.pm
+++ b/DocDB/cgi/UntaintInput.pm
@@ -27,5 +27,6 @@ require "UntaintHTML.pm";
 require "UntaintInteger.pm";
 require "UntaintListOfInts.pm";
 require "UntaintListOfWords.pm";
+require "UntaintListOfHTML.pm";
 
-1;
\ No newline at end of file
+1;
diff --git a/DocDB/cgi/UntaintListOfHTML.pm b/DocDB/cgi/UntaintListOfHTML.pm
new file mode 100644
index 00000000..e0f21936
--- /dev/null
+++ b/DocDB/cgi/UntaintListOfHTML.pm
@@ -0,0 +1,48 @@
+#        Name: UntaintListOfHTML.pm
+# Description: Allows a list of (null separated) possible HTML fragments
+#
+#      Author: Eric Vaandering (ewv@fnal.gov)
+#    Modified: Eric Vaandering (ewv@fnal.gov)
+
+# Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
+
+#    This file is part of DocDB.
+
+#    DocDB is free software; you can redistribute it and/or modify
+#    it under the terms of version 2 of the GNU General Public License
+#    as published by the Free Software Foundation.
+
+#    DocDB is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+
+#    You should have received a copy of the GNU General Public License
+#    along with DocDB; if not, write to the Free Software
+#    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+
+package CGI::Untaint::listofwords;
+
+$VERSION = '1.00';
+
+use strict;
+use base 'CGI::Untaint::object';
+use HTML::Entities qw(encode_entities_numeric);
+
+sub _untaint_re { qr/^((\w+)(\000)*)+$/ }
+
+sub is_valid {
+  my $self = shift;
+  my $RawValue = $self->value;
+  my @Values = split /\0/,$RawValue;
+  my @SafeValues = ();
+  foreach $Value (@Values) {
+    my $SafeValue = encode_entities_numeric($Value);
+    push @SafeValues, $SafeValue;
+  }
+  my $ArrRef = \@SafeValues;
+
+  $self->value($ArrRef);
+}
+
+1;
diff --git a/DocDB/cgi/UntaintListOfWords.pm b/DocDB/cgi/UntaintListOfWords.pm
index 58094635..46509c05 100644
--- a/DocDB/cgi/UntaintListOfWords.pm
+++ b/DocDB/cgi/UntaintListOfWords.pm
@@ -28,8 +28,6 @@ $VERSION = '1.00';
 use strict;
 use base 'CGI::Untaint::object';
 
-sub _untaint_re { qr/^((\w+)(\000)*)+$/ }
-
 sub is_valid {
   my $self = shift;
   my $RawValue = $self->value;

From f62e83cf339c44dfee25f6dcb470e789fe2b56c5 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Mon, 5 Aug 2013 15:41:00 -0500
Subject: [PATCH 095/163] Santize SelectEmailPrefs and other Select* scripts

---
 DocDB/cgi/SelectEmailPrefs      | 239 ++++++++++++++++----------------
 DocDB/cgi/SelectGroups          |  14 +-
 DocDB/cgi/SelectPrefs           |   1 +
 DocDB/cgi/UntaintListOfHTML.pm  |   5 +-
 DocDB/cgi/UntaintListOfWords.pm |   2 +
 5 files changed, 133 insertions(+), 128 deletions(-)

diff --git a/DocDB/cgi/SelectEmailPrefs b/DocDB/cgi/SelectEmailPrefs
index 52e8df06..67d79e89 100755
--- a/DocDB/cgi/SelectEmailPrefs
+++ b/DocDB/cgi/SelectEmailPrefs
@@ -4,7 +4,7 @@
 #              changes in e-mail.
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified: 
+#    Modified:
 #
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
@@ -12,7 +12,7 @@
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -24,9 +24,10 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-use CGI qw(-nosticky);    
+use CGI qw(-nosticky);
+use CGI::Untaint;
 use DBI;
-                                                  
+
 require "DocDBGlobals.pm";
 require "ResponseElements.pm";
 require "EmailSecurity.pm";
@@ -36,6 +37,7 @@ require "Sorts.pm";
 require "SearchFormElements.pm";
 
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 require "DocumentUtilities.pm";
 
 require "AuthorSQL.pm";
@@ -48,51 +50,56 @@ require "MeetingHTML.pm";
 require "TopicHTML.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rwuser,$db_rwpass);
 
 GetTopics();
 GetAuthors();
 
-%params = $query -> Vars;
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 
 # Collect parameters
 
-my $Mode         = $params{mode};
-my $UserName     = $params{username};
-my $Password     = $params{password};
-my $NewPass      = $params{newpass};
-my $ConfNewPass  = $params{confnewpass};
-   $Digest       = $params{digest};
+my $Mode = $Untaint -> extract(-as_safehtml => "mode") || "";
+my $UserName = $Untaint -> extract(-as_safehtml => "username") || "";
+my $Password = $Untaint -> extract(-as_printable => "password") || "";
+my $NewPass = $Untaint -> extract(-as_printable => "newpass") || "";
+my $ConfNewPass = $Untaint -> extract(-as_printable => "confnewpass") || "";
+my $Digest = $Untaint -> extract(-as_safehtml => "digest") || "";
+
+my $Name = $Untaint -> extract(-as_safehtml => "name") || "";
+my $Email = $Untaint -> extract(-as_safehtml => "email") || "";
+my $HTML = $Untaint -> extract(-as_safehtml => "html") || "";
 
-my @ImmediateEventGroupIDs = split /\0/,$params{immediate_eventgroups};
-my @DailyEventGroupIDs     = split /\0/,$params{daily_eventgroups};
-my @WeeklyEventGroupIDs    = split /\0/,$params{weekly_eventgroups};
+my @ImmediateEventGroupIDs = @{ $Untaint -> extract(-as_listofint => "immediate_eventgroups") || undef };
+my @DailyEventGroupIDs = @{ $Untaint -> extract(-as_listofint => "daily_eventgroups") || undef };
+my @WeeklyEventGroupIDs = @{ $Untaint -> extract(-as_listofint => "weekly_eventgroups") || undef };
 
-my @ImmediateEventIDs      = split /\0/,$params{immediate_events};
-my @DailyEventIDs          = split /\0/,$params{daily_events};
-my @WeeklyEventIDs         = split /\0/,$params{weekly_events};
+my @ImmediateEventIDs = @{ $Untaint -> extract(-as_listofint => "immediate_events") || undef };
+my @DailyEventIDs = @{ $Untaint -> extract(-as_listofint => "daily_events") || undef };
+my @WeeklyEventIDs = @{ $Untaint -> extract(-as_listofint => "weekly_events") || undef };
 
-my @ImmediateTopicIDs      = split /\0/,$params{immediate_topics};
-my @DailyTopicIDs          = split /\0/,$params{daily_topics};
-my @WeeklyTopicIDs         = split /\0/,$params{weekly_topics};
+my @ImmediateTopicIDs = @{ $Untaint -> extract(-as_listofint => "immediate_topics") || undef };
+my @DailyTopicIDs = @{ $Untaint -> extract(-as_listofint => "daily_topics") || undef };
+my @WeeklyTopicIDs = @{ $Untaint -> extract(-as_listofint => "weekly_topics") || undef };
 
-my @ImmediateAuthorIDs     = split /\0/,$params{immediate_authors};
-my @DailyAuthorIDs         = split /\0/,$params{daily_authors};
-my @WeeklyAuthorIDs        = split /\0/,$params{weekly_authors};
+my @ImmediateAuthorIDs = @{ $Untaint -> extract(-as_listofint => "immediate_authors") || undef };
+my @DailyAuthorIDs = @{ $Untaint -> extract(-as_listofint => "daily_authors") || undef };
+my @WeeklyAuthorIDs = @{ $Untaint -> extract(-as_listofint => "weekly_authors") || undef };
 
-my $ImmediateAll           = $params{immediate_all};
-my $DailyAll               = $params{daily_all};
-my $WeeklyAll              = $params{weekly_all};
+my $ImmediateAll = $Untaint -> extract(-as_safehtml => "immediate_all") || "";
+my $DailyAll = $Untaint -> extract(-as_safehtml => "daily_all") || "";
+my $WeeklyAll = $Untaint -> extract(-as_safehtml => "weekly_all") || "";
 
-my $ImmediateKeywords      = $params{immediate_keywords};
-my $DailyKeywords          = $params{daily_keywords};
-my $WeeklyKeywords         = $params{weekly_keywords};
+my $ImmediateKeywords = $Untaint -> extract(-as_safehtml => "immediate_keywords") || "";
+my $DailyKeywords = $Untaint -> extract(-as_safehtml => "daily_keywords") || "";
+my $WeeklyKeywords = $Untaint -> extract(-as_safehtml => "weekly_keywords") || "";
 
 $ImmediateKeywords =~ s/,/ /g; my @ImmediateKeywords = split /\s+/,$ImmediateKeywords;
 $DailyKeywords     =~ s/,/ /g; my @DailyKeywords     = split /\s+/,$DailyKeywords    ;
 $WeeklyKeywords    =~ s/,/ /g; my @WeeklyKeywords    = split /\s+/,$WeeklyKeywords   ;
 
-my $ImmediateDocuments      = $params{immediate_documents};
+my $ImmediateDocuments = $Untaint -> extract(-as_safehtml => "immediate_documents") || "";
 $ImmediateDocuments =~ s/,/ /g; my @ImmediateDocuments = split /\s+/,$ImmediateDocuments;
 
 $UserName =~ s/\s+//g;
@@ -104,7 +111,7 @@ if (($NewPass || $ConfNewPass) && ($NewPass ne $ConfNewPass)) {
 }
 
 if ($Mode eq "newuser") {
-  my $PassConf = $params{passconf};
+  my $PassConf = $Untaint -> extract(-as_printable => "passconf") || "";
   $PassConf =~ s/\s+//g;
 
 # Do the passwords match, is there a password
@@ -128,7 +135,7 @@ if ($Mode eq "newuser") {
 }
 
 # Start the page
-   
+
 print $query -> header( -charset => $HTTP_ENCODING );
 DocDBHeader("Update Notification Preferences","",-scripts => ["PopUps"]); # Prob need specialized header
 
@@ -159,13 +166,13 @@ if ($Mode eq "newuser") {
 # Make the user part of the group who's httpd password they've used.
 
     my $EmailUserID =  $UserInsert -> {mysql_insertid}; # Works with MySQL only
-    my $GroupID = FetchSecurityGroupByName($remote_user); 
-    my $EmailUserInsert = $dbh -> prepare("insert into UsersGroup (UsersGroupID,EmailUserID,GroupID) values (0,?,?)"); 
+    my $GroupID = FetchSecurityGroupByName($remote_user);
+    my $EmailUserInsert = $dbh -> prepare("insert into UsersGroup (UsersGroupID,EmailUserID,GroupID) values (0,?,?)");
        $EmailUserInsert -> execute($EmailUserID,$GroupID);
 
-    print "User <b>$UserName</b> created as a member of <b>$remote_user</b> group. 
-           Do not forget your password, there is no way to retrieve it.<p\>\n"; 
-    $Mode = "update"; # Now display the form to update  
+    print "User <b>$UserName</b> created as a member of <b>$remote_user</b> group.
+           Do not forget your password, there is no way to retrieve it.<p\>\n";
+    $Mode = "update"; # Now display the form to update
   }
 }
 
@@ -175,14 +182,14 @@ EndPage();
 
 # Check for valid user
 
-if ($Password) { 
+if ($Password) {
   $EmailUserID = ValidateEmailUser($UserName,$Password);
 } elsif ($Digest) {
   $EmailUserID = ValidateEmailUserDigest($UserName,$Digest);
 } elsif ($UserValidation eq "certificate") {
   require "CertificateUtilities.pm";
   $EmailUserID = FetchEmailUserIDByCert();
-}    
+}
 
 if ($EmailUserID) {
   FetchEmailUser($EmailUserID);
@@ -203,10 +210,6 @@ EndPage();
 
 if ($Mode eq "update") {
 
-# Collect relevant parameters for user preferences
-  my $Name     = $params{name};
-  my $Email    = $params{email};
-  my $HTML     = $params{html};
 
 # Update DB
 
@@ -216,9 +219,9 @@ if ($Mode eq "update") {
   } else {
     my $UpdateUserInfo = $dbh -> prepare("update EmailUser set Name=?,EmailAddress=?,PreferHTML=? where EmailUserID=?");
     $UpdateUserInfo -> execute($Name,$Email,$HTML,$EmailUserID);
-  } 
+  }
 
-  if ($NewPass && $ConfNewPass && ($NewPass eq $ConfNewPass) 
+  if ($NewPass && $ConfNewPass && ($NewPass eq $ConfNewPass)
                && ($UserValidation ne "certificate")) {
     srand (time ^ $$ ^ unpack "%32L*", `ps axww`);
 
@@ -229,13 +232,13 @@ if ($Mode eq "update") {
     my $UpdatePassword = $dbh -> prepare("update EmailUser set Password=? where EmailUserID=?");
        $UpdatePassword -> execute($EncryptedPassword,$EmailUserID);
     push @WarnStack,"Your password has been changed.";
-  }  
+  }
 
   WarnPage();
 
 # Clear and refetch user
 
-  $EmailUser{$EmailUserID}{EmailUserID} = 0; 
+  $EmailUser{$EmailUserID}{EmailUserID} = 0;
   FetchEmailUser($EmailUserID);
 
 # Out with the old, in with the new
@@ -244,61 +247,61 @@ if ($Mode eq "update") {
 
 # All Documents
   if ($ImmediateAll) {
-    InsertNotifications( {-emailuserid => $EmailUserID, -type   => "AllDocuments", 
+    InsertNotifications( {-emailuserid => $EmailUserID, -type   => "AllDocuments",
                                   -ids => [1],          -period => "Immediate",} );
-  }  
+  }
   if ($DailyAll) {
-    InsertNotifications( {-emailuserid => $EmailUserID, -type   => "AllDocuments", 
+    InsertNotifications( {-emailuserid => $EmailUserID, -type   => "AllDocuments",
                                   -ids => [1],          -period => "Daily",} );
-  }  
+  }
   if ($WeeklyAll) {
-    InsertNotifications( {-emailuserid => $EmailUserID, -type   => "AllDocuments", 
+    InsertNotifications( {-emailuserid => $EmailUserID, -type   => "AllDocuments",
                                   -ids => [1],          -period => "Weekly",} );
-  }  
+  }
 
 # Topics
-  InsertNotifications( {-emailuserid => $EmailUserID,        -type   => "Topic", 
+  InsertNotifications( {-emailuserid => $EmailUserID,        -type   => "Topic",
                                 -ids => \@ImmediateTopicIDs, -period => "Immediate",} );
-  InsertNotifications( {-emailuserid => $EmailUserID,        -type   => "Topic", 
+  InsertNotifications( {-emailuserid => $EmailUserID,        -type   => "Topic",
                                 -ids => \@DailyTopicIDs,     -period => "Daily",} );
-  InsertNotifications( {-emailuserid => $EmailUserID,        -type   => "Topic", 
+  InsertNotifications( {-emailuserid => $EmailUserID,        -type   => "Topic",
                                 -ids => \@WeeklyTopicIDs,    -period => "Weekly",} );
-        
+
 # Authors
-  InsertNotifications( {-emailuserid => $EmailUserID,         -type   => "Author", 
+  InsertNotifications( {-emailuserid => $EmailUserID,         -type   => "Author",
                                 -ids => \@ImmediateAuthorIDs, -period => "Immediate",} );
-  InsertNotifications( {-emailuserid => $EmailUserID,         -type   => "Author", 
+  InsertNotifications( {-emailuserid => $EmailUserID,         -type   => "Author",
                                 -ids => \@DailyAuthorIDs,     -period => "Daily",} );
-  InsertNotifications( {-emailuserid => $EmailUserID,         -type   => "Author", 
+  InsertNotifications( {-emailuserid => $EmailUserID,         -type   => "Author",
                                 -ids => \@WeeklyAuthorIDs,    -period => "Weekly",} );
-        
+
 # Events
-  InsertNotifications( {-emailuserid => $EmailUserID,        -type   => "Event", 
+  InsertNotifications( {-emailuserid => $EmailUserID,        -type   => "Event",
                                 -ids => \@ImmediateEventIDs, -period => "Immediate",} );
-  InsertNotifications( {-emailuserid => $EmailUserID,        -type   => "Event", 
+  InsertNotifications( {-emailuserid => $EmailUserID,        -type   => "Event",
                                 -ids => \@DailyEventIDs,     -period => "Daily",} );
-  InsertNotifications( {-emailuserid => $EmailUserID,        -type   => "Event", 
+  InsertNotifications( {-emailuserid => $EmailUserID,        -type   => "Event",
                                 -ids => \@WeeklyEventIDs,    -period => "Weekly",} );
-        
-# EventGroups        
-  InsertNotifications( {-emailuserid => $EmailUserID,             -type   => "EventGroup", 
+
+# EventGroups
+  InsertNotifications( {-emailuserid => $EmailUserID,             -type   => "EventGroup",
                                 -ids => \@ImmediateEventGroupIDs, -period => "Immediate",} );
-  InsertNotifications( {-emailuserid => $EmailUserID,             -type   => "EventGroup", 
+  InsertNotifications( {-emailuserid => $EmailUserID,             -type   => "EventGroup",
                                 -ids => \@DailyEventGroupIDs,     -period => "Daily",} );
-  InsertNotifications( {-emailuserid => $EmailUserID,             -type   => "EventGroup", 
+  InsertNotifications( {-emailuserid => $EmailUserID,             -type   => "EventGroup",
                                 -ids => \@WeeklyEventGroupIDs,    -period => "Weekly",} );
-# Keywords        
-  InsertNotifications( {-emailuserid => $EmailUserID,        -type   => "Keyword", 
+# Keywords
+  InsertNotifications( {-emailuserid => $EmailUserID,        -type   => "Keyword",
                            -textkeys => \@ImmediateKeywords, -period => "Immediate",} );
-  InsertNotifications( {-emailuserid => $EmailUserID,        -type   => "Keyword", 
+  InsertNotifications( {-emailuserid => $EmailUserID,        -type   => "Keyword",
                            -textkeys => \@DailyKeywords,     -period => "Daily",} );
-  InsertNotifications( {-emailuserid => $EmailUserID,        -type   => "Keyword", 
+  InsertNotifications( {-emailuserid => $EmailUserID,        -type   => "Keyword",
                            -textkeys => \@WeeklyKeywords,    -period => "Weekly",} );
 # Individual documents
-  InsertNotifications( {-emailuserid => $EmailUserID,         -type   => "Document", 
+  InsertNotifications( {-emailuserid => $EmailUserID,         -type   => "Document",
                                 -ids => \@ImmediateDocuments, -period => "Immediate",} );
-  
-}  
+
+}
 
 # Clear (are refetched in DisplayNotification)
 
@@ -310,19 +313,19 @@ print $query -> hidden(-name => 'mode', -default => "update", -override => 1);
 
 print "<table class=\"HighPaddedTable CenteredTable\"><tr><td>\n";
 
-print "<p><b>Use this page to change your personal account settings.</b></p> 
+print "<p><b>Use this page to change your personal account settings.</b></p>
        <p> At the top part of the page, you can change
        your e-mail address, name, and whether you prefer text or HTML e-mail.
        (At the present time, all e-mail is text only, but your choice will be
        remembered for future enhancements.)
        Also shown are which group(s) you are a member of. If this list is incorrect,
-       <a href=\"mailto:$DBWebMasterEmail\">contact the administrators</a> and ask them 
+       <a href=\"mailto:$DBWebMasterEmail\">contact the administrators</a> and ask them
        to change your group membership.</p>\n";
 unless ($UserValidation eq "certificate") {
-  print "<p>If you want to change your password, type the new password in both boxes.</p>\n"; 
+  print "<p>If you want to change your password, type the new password in both boxes.</p>\n";
 }
-print "<p>At the bottom part of the page, select the <a href=\"#topic\">topics 
-       or  subtopics</a>,  <a href=\"#author\">authors</a>, 
+print "<p>At the bottom part of the page, select the <a href=\"#topic\">topics
+       or  subtopics</a>,  <a href=\"#author\">authors</a>,
        <a href=\"#event\">events</a>, or  <a href=\"#keyword\">keywords</a> you
        want to be notified of changes to, either immediately or in digests sent
        every day or week.</p>\n";
@@ -351,7 +354,7 @@ if (@WatchDocumentIDs) {
   print "<h4>You are watching these individual documents:</h4>\n";
 }
 my %FieldList = PrepareFieldList(-default => "Default");
-my $NDocs = DocumentTable(-fieldlist => \%FieldList, -docids => \@WatchDocumentIDs, -sortby => 'docid');  
+my $NDocs = DocumentTable(-fieldlist => \%FieldList, -docids => \@WatchDocumentIDs, -sortby => 'docid');
 
 print "<hr/><table class=\"CenteredTable\">\n";
 print "<tr><td>";
@@ -363,53 +366,53 @@ print "</td></tr></table>\n";
 print "<a name=\"topic\"/><h3>Notification by Topics</h3>\n";
 
 print "<table class=\"HighPaddedTable\"><tr><td>\n";
-TopicScroll({ -helptext   => "Immediate", -helplink => "notifytopic", 
-              -itemformat => "short", -multiple => $TRUE, 
+TopicScroll({ -helptext   => "Immediate", -helplink => "notifytopic",
+              -itemformat => "short", -multiple => $TRUE,
               -name       => "immediate_topics",
               -default    => $Notifications{$EmailUserID}{Topic_Immediate},
-            }); 
-print "</td><td>\n";  
-TopicScroll({ -helptext   => "Daily", -helplink => "notifytopic", 
-              -itemformat => "short", -multiple => $TRUE, 
+            });
+print "</td><td>\n";
+TopicScroll({ -helptext   => "Daily", -helplink => "notifytopic",
+              -itemformat => "short", -multiple => $TRUE,
               -name       => "daily_topics",
               -default    => $Notifications{$EmailUserID}{Topic_Daily},
-            }); 
-print "</td><td>\n";  
-TopicScroll({ -helptext   => "Weekly", -helplink => "notifytopic", 
-              -itemformat => "short", -multiple => $TRUE, 
+            });
+print "</td><td>\n";
+TopicScroll({ -helptext   => "Weekly", -helplink => "notifytopic",
+              -itemformat => "short", -multiple => $TRUE,
               -name       => "weekly_topics",
               -default    => $Notifications{$EmailUserID}{Topic_Weekly},
-            }); 
-print "</td></tr><tr><td>\n";  
+            });
+print "</td></tr><tr><td>\n";
 EmailAllForm({ -name => "immediate_all", -default => $Notifications{$EmailUserID}{AllDocuments_Immediate} });
-print "</td><td>";  
+print "</td><td>";
 EmailAllForm({ -name => "daily_all", -default => $Notifications{$EmailUserID}{AllDocuments_Daily} });
-print "</td><td>";  
+print "</td><td>";
 EmailAllForm({ -name => "weekly_all", -default => $Notifications{$EmailUserID}{AllDocuments_Weekly} });
 print "</td></tr></table>\n";
 
 print "<hr/><a name=\"author\"/><h3>Notification by Authors</h3>\n";
 print "<table class=\"HighPaddedTable\"><tr>\n";
-print "<td>";  
-AuthorScroll(-helptext   => "Immediate", -helplink => "notifyauthor", 
-             -multiple => $TRUE, 
+print "<td>";
+AuthorScroll(-helptext   => "Immediate", -helplink => "notifyauthor",
+             -multiple => $TRUE,
              -name       => "immediate_authors",
              -default    => $Notifications{$EmailUserID}{Author_Immediate},
-            ); 
+            );
 print "</td>\n";
-print "<td>";  
-AuthorScroll(-helptext   => "Daily", -helplink => "notifyauthor", 
-             -multiple => $TRUE, 
+print "<td>";
+AuthorScroll(-helptext   => "Daily", -helplink => "notifyauthor",
+             -multiple => $TRUE,
              -name       => "daily_authors",
              -default    => $Notifications{$EmailUserID}{Author_Daily},
-            ); 
+            );
 print "</td>\n";
-print "<td>";  
-AuthorScroll(-helptext   => "Weekly", -helplink => "notifyauthor", 
-             -multiple => $TRUE, 
+print "<td>";
+AuthorScroll(-helptext   => "Weekly", -helplink => "notifyauthor",
+             -multiple => $TRUE,
              -name       => "weekly_authors",
              -default    => $Notifications{$EmailUserID}{Author_Weekly},
-            ); 
+            );
 print "</td>\n";
 print "</tr></table>\n";
 
@@ -417,28 +420,28 @@ print "<hr/><a name=\"event\"/><h3>Notification by Events</h3>\n";
 print "<table class=\"HighPaddedTable\"><tr>\n";\
 print "<td>",FormElementTitle(-helptext => "Immediate", -helplink => "notifyevent"),"</td>";
 print "<td>";
-EventGroupSelect( {-multiple => $TRUE, -name    => "immediate_eventgroups", 
+EventGroupSelect( {-multiple => $TRUE, -name    => "immediate_eventgroups",
                    -helplink => "",    -default => $Notifications{$EmailUserID}{EventGroup_Immediate}}  );
 print "</td><td>";
-EventSelect(      {-multiple => $TRUE, -name    => "immediate_events",      
+EventSelect(      {-multiple => $TRUE, -name    => "immediate_events",
                    -helplink => "",    -default => $Notifications{$EmailUserID}{Event_Immediate}} );
 print "</td>";
 print "</tr><tr>";
 print "<td>",FormElementTitle(-helptext => "Daily", -helplink => "notifyevent"),"</td>";
 print "<td>";
-EventGroupSelect( {-multiple => $TRUE, -name => "daily_eventgroups", 
+EventGroupSelect( {-multiple => $TRUE, -name => "daily_eventgroups",
                    -helplink => "",    -default => $Notifications{$EmailUserID}{EventGroup_Daily}} );
 print "</td><td>";
-EventSelect(      {-multiple => $TRUE, -name => "daily_events",      
+EventSelect(      {-multiple => $TRUE, -name => "daily_events",
                    -helplink => "",    -default => $Notifications{$EmailUserID}{Event_Daily}} );
 print "</td>";
 print "</tr><tr>";
 print "<td>",FormElementTitle(-helptext => "Weekly", -helplink => "notifyevent"),"</td>";
 print "<td>";
-EventGroupSelect( {-multiple => $TRUE, -name => "weekly_eventgroups", 
+EventGroupSelect( {-multiple => $TRUE, -name => "weekly_eventgroups",
                    -helplink => "",    -default => $Notifications{$EmailUserID}{EventGroup_Weekly}} );
 print "</td><td>";
-EventSelect(      {-multiple => $TRUE, -name => "weekly_events",      
+EventSelect(      {-multiple => $TRUE, -name => "weekly_events",
                    -helplink => "",    -default => $Notifications{$EmailUserID}{Event_Weekly}} );
 print "</td>";
 print "</tr></table>\n";
@@ -447,13 +450,13 @@ print "</tr></table>\n";
 print "<hr/><a name=\"keyword\"/><h3>Notification by Keywords</h3>\n";
 print "<table class=\"HighPaddedTable\">\n";
 print "<tr><td>\n";
-EmailKeywordForm({ -name    => "immediate_keywords", -period => "Immediate", 
+EmailKeywordForm({ -name    => "immediate_keywords", -period => "Immediate",
                    -default => $Notifications{$EmailUserID}{Keyword_Immediate}, });
 print "</td></tr><tr><td>\n";
-EmailKeywordForm({ -name    => "daily_keywords", -period => "Daily", 
+EmailKeywordForm({ -name    => "daily_keywords", -period => "Daily",
                    -default => $Notifications{$EmailUserID}{Keyword_Daily}, });
 print "</td></tr><tr><td>\n";
-EmailKeywordForm({ -name    => "weekly_keywords", -period => "Weekly", 
+EmailKeywordForm({ -name    => "weekly_keywords", -period => "Weekly",
                    -default => $Notifications{$EmailUserID}{Keyword_Weekly}, });
 print "</td></tr></table>\n";
 
@@ -461,7 +464,7 @@ print "<hr/><a name=\"documents\"/><h3>Notification for Individual Documents</h3
 
 print "<table class=\"HighPaddedTable\">\n";
 print "<tr><td>\n";
-TextArea(-name => "immediate_documents", -helptext => "Immediate", -helplink => "notifydocument", 
+TextArea(-name => "immediate_documents", -helptext => "Immediate", -helplink => "notifydocument",
          -columns => 80, -default => join ' ',sort numerically @{$Notifications{$EmailUserID}{Document_Immediate}});
 print "</td></tr></table>\n";
 
diff --git a/DocDB/cgi/SelectGroups b/DocDB/cgi/SelectGroups
index 58a7ffd3..4701c876 100755
--- a/DocDB/cgi/SelectGroups
+++ b/DocDB/cgi/SelectGroups
@@ -3,7 +3,7 @@
 #        Author:  Eric Vaandering
 #          Date:  22 May 2005
 #
-# Allow a user to choose to limit their membership to certain groups 
+# Allow a user to choose to limit their membership to certain groups
 # for a period of time
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
@@ -11,7 +11,7 @@
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -36,7 +36,7 @@ require "Scripts.pm";
 
 # Start page
 $query  = new CGI;
-%params = $query -> Vars; 
+$query -> autoEscape(0);
 $dbh    = DBI -> connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 
 print $query -> header( -charset => $HTTP_ENCODING );
@@ -45,7 +45,7 @@ print $query -> header( -charset => $HTTP_ENCODING );
 &EndPage(@ErrorStack);
 
 print "<h3>Using this page, you can remove groups whose permissions you don't want to use</h3>\n";
- 
+
 print $query -> startform('POST',$SetGroups);
 print "<div>\n";
 print "<table id=\"SelectGroups\" class=\"CenteredTable MedPaddedTable\">\n";
@@ -57,15 +57,15 @@ my @RawGroupIDs = &FindUsersGroups(-ignorecookie => $TRUE);
 print "</td><td>\n";
 
 my @Times = ("session",1,7,30,365);
-my %Labels = ("session" => "This session", 
+my %Labels = ("session" => "This session",
                       1 => "One day",
                       7 => "One week",
                      30 => "One month",
                     365 => "One year");
 
 print "<strong>Limit for:</strong><br/>\n";
-                    
-print $query -> popup_menu (-name   => 'duration', 
+
+print $query -> popup_menu (-name   => 'duration',
                             -values => \@Times,
                             -labels => \%Labels);
 print "</td></tr><tr><td colspan=\"2\" id=\"SubmitCell\">\n";
diff --git a/DocDB/cgi/SelectPrefs b/DocDB/cgi/SelectPrefs
index 0ba81b7b..55e49bad 100755
--- a/DocDB/cgi/SelectPrefs
+++ b/DocDB/cgi/SelectPrefs
@@ -38,6 +38,7 @@ require "AuthorHTML.pm";
 # Start page
 
 $query = new CGI;
+$query -> autoEscape(0);
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 GetAuthors();
 print $query -> header( -charset => $HTTP_ENCODING );
diff --git a/DocDB/cgi/UntaintListOfHTML.pm b/DocDB/cgi/UntaintListOfHTML.pm
index e0f21936..5d187f0c 100644
--- a/DocDB/cgi/UntaintListOfHTML.pm
+++ b/DocDB/cgi/UntaintListOfHTML.pm
@@ -1,5 +1,6 @@
 #        Name: UntaintListOfHTML.pm
 # Description: Allows a list of (null separated) possible HTML fragments
+#              and return sanitized HTML
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
 #    Modified: Eric Vaandering (ewv@fnal.gov)
@@ -21,7 +22,7 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-package CGI::Untaint::listofwords;
+package CGI::Untaint::listofhtmls;
 
 $VERSION = '1.00';
 
@@ -29,8 +30,6 @@ use strict;
 use base 'CGI::Untaint::object';
 use HTML::Entities qw(encode_entities_numeric);
 
-sub _untaint_re { qr/^((\w+)(\000)*)+$/ }
-
 sub is_valid {
   my $self = shift;
   my $RawValue = $self->value;
diff --git a/DocDB/cgi/UntaintListOfWords.pm b/DocDB/cgi/UntaintListOfWords.pm
index 46509c05..58094635 100644
--- a/DocDB/cgi/UntaintListOfWords.pm
+++ b/DocDB/cgi/UntaintListOfWords.pm
@@ -28,6 +28,8 @@ $VERSION = '1.00';
 use strict;
 use base 'CGI::Untaint::object';
 
+sub _untaint_re { qr/^((\w+)(\000)*)+$/ }
+
 sub is_valid {
   my $self = shift;
   my $RawValue = $self->value;

From 907bad98f22c4e27d57691f6f473a4d64184a2b0 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Mon, 5 Aug 2013 16:02:45 -0500
Subject: [PATCH 096/163] Sanitize SessionModify

---
 DocDB/cgi/SessionModify | 89 +++++++++++++++++++++--------------------
 1 file changed, 45 insertions(+), 44 deletions(-)

diff --git a/DocDB/cgi/SessionModify b/DocDB/cgi/SessionModify
index d2ca72a3..2c9942b9 100755
--- a/DocDB/cgi/SessionModify
+++ b/DocDB/cgi/SessionModify
@@ -26,6 +26,7 @@
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
 use CGI qw(-nosticky);
+use CGI::Untaint;
 use DBI;
 
 require "DocDBGlobals.pm";
@@ -40,6 +41,7 @@ require "Utilities.pm";
 
 require "EventUtilities.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 require "MeetingSecurityUtilities.pm";
 require "TalkHintUtilities.pm";
 require "WebUtilities.pm";
@@ -55,57 +57,58 @@ require "TalkHintSQL.pm";
 require "TalkSQL.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
 
 &GetPrefsCookie;
 &SetAuthorMode;
 
 ### Gather parameters
 
-%params = $query -> Vars;
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 $query -> delete_all(); # Stop program from caching variable from script to script
 
-my $SessionID          = $params{sessionid};
-my $Mode               = $params{mode};
-my $SingleSession      = $params{singlesession};
+my $SessionID = $Untaint -> extract(-as_integer => "sessionid") || 0;
+my $Mode = $Untaint -> extract(-as_safehtml => "mode") || "";
+my $SingleSession = $Untaint -> extract(-as_safehtml => "singlesession") || "";
 
-my $SessionTitle       = $params{sessiontitle};
-my $SessionDescription = $params{sessiondescription};
-my $SessionLocation    = $params{sessionlocation};
-my $SessionAltLocation = $params{sessionaltlocation};
-my $ShowAllTalks       = $params{meetshowall};
+my $SessionTitle = $Untaint -> extract(-as_safehtml => "sessiontitle") || "";
+my $SessionDescription = $Untaint -> extract(-as_safehtml => "sessiondescription") || "";
+my $SessionLocation = $Untaint -> extract(-as_safehtml => "sessionlocation") || "";
+my $SessionAltLocation = $Untaint -> extract(-as_safehtml => "sessionaltlocation") || "";
+my $ShowAllTalks = $Untaint -> extract(-as_safehtml => "meetshowall") || "";
 if ($ShowAllTalks) {
   $ShowAllTalks = $TRUE;
 }
 
-my $SessionDay   = $params{sessionday};
-my $SessionMonth = $params{sessionmonth};
-my $SessionYear  = $params{sessionyear};
-my $SessionHour  = $params{sessiontime};
-
-my @SessionOrderIDs = split /\0/,$params{sessionorderid};
-my @TalkOrders      = split /\0/,$params{talkorder};
-my @TalkTitles      = split /\0/,$params{talktitle};
-my @TalkNotes       = split /\0/,$params{talknote};
-my @TalkTimes       = split /\0/,$params{talktime};
-my @TalkSeparators  = split /\0/,$params{talkseparator};
-my @TalkDeletes     = split /\0/,$params{talkdelete};
-my @TalkConfirms    = split /\0/,$params{talkconfirm};
-my @TalkReserves    = split /\0/,$params{talkreserve};
-my @TimeStamps      = split /\0/,$params{timestamp};
+my $SessionDay = $Untaint -> extract(-as_integer => "sessionday") || 0;
+my $SessionMonth = $Untaint -> extract(-as_safehtml => "sessionmonth") || "";
+my $SessionYear = $Untaint -> extract(-as_integer => "sessionyear") || 0;
+my $SessionHour = $Untaint -> extract(-as_integer => "sessiontime") || 0;
+
+my @SessionOrderIDs = @{ $Untaint -> extract(-as_listofint => "sessionorderid") || undef };
+my @TalkOrders = @{ $Untaint -> extract(-as_listofhtml => "talkorder") || undef };
+my @TalkTitles = @{ $Untaint -> extract(-as_listofhtml => "talktitle") || undef };
+my @TalkNotes = @{ $Untaint -> extract(-as_listofhtml => "talknote") || undef };
+my @TalkTimes = @{ $Untaint -> extract(-as_listofhtml => "talktime") || undef };
+my @TalkSeparators = @{ $Untaint -> extract(-as_listofhtml => "talkseparator") || undef };
+my @TalkDeletes = @{ $Untaint -> extract(-as_listofhtml => "talkdelete") || undef };
+my @TalkConfirms = @{ $Untaint -> extract(-as_listofhtml => "talkconfirm") || undef };
+my @TalkReserves = @{ $Untaint -> extract(-as_listofhtml => "talkreserve") || undef };
+my @TimeStamps = @{ $Untaint -> extract(-as_listofhtml => "timestamp") || undef };
 
 # For single session mode
 
-my $EventID               = $params{eventid};
-my $Location              = $params{location};
-my $AltLocation           = $params{altlocation};
-my $URL                   = $params{url};
-my $EventGroupID          = $params{eventgroups};
-my $Short                 = $params{shortdesc};
-my $Long                  = $params{long};
-my @MeetingViewGroupIDs   = split /\0/,$params{meetingviewgroups};
-my @MeetingModifyGroupIDs = split /\0/,$params{meetingmodifygroups};
-my @TopicIDs              = split /\0/,$params{topics};
-my @ModeratorIDs          = split /\0/,$params{moderators};
+my $EventID = $Untaint -> extract(-as_integer => "eventid") || 0;
+my $Location = $Untaint -> extract(-as_safehtml => "location") || "";
+my $AltLocation = $Untaint -> extract(-as_safehtml => "altlocation") || "";
+my $URL = $Untaint -> extract(-as_safehtml => "url") || "";
+my $EventGroupID = $Untaint -> extract(-as_integer => "eventgroups") || 0;
+my $Short = $Untaint -> extract(-as_safehtml => "shortdesc") || "";
+my $Long = $Untaint -> extract(-as_safehtml => "long") || "";
+my @MeetingViewGroupIDs = @{ $Untaint -> extract(-as_listofint => "meetingviewgroups") || undef };
+my @MeetingModifyGroupIDs = @{ $Untaint -> extract(-as_listofint => "meetingmodifygroups") || undef };
+my @TopicIDs = @{ $Untaint -> extract(-as_listofint => "topics") || undef };
+my @ModeratorIDs = @{ $Untaint -> extract(-as_listofint => "moderators") || undef };
 
 unless ($Long) {$Long = $Short;}
 
@@ -290,16 +293,14 @@ if ($Mode eq "modify" || $Mode eq "create") {
 
     my $TalkConfirmed   = $TalkConfirmFlags{$SessionOrderID};
     my $TalkReserve     = $TalkReserveFlags{$SessionOrderID};
-    my $TalkDocID       = $params{"talkdocid-$SessionOrderID"};
-    my $NewSessionID    = $params{"newsessionid-$SessionOrderID"};
-
-    my @TopicHints  = split /\0/,$params{"topics-$SessionOrderID"};
-    my @AuthorHints = ();
-    if ($params{"authors-$SessionOrderID"}) {
-      @AuthorHints = split /\0/,$params{"authors-$SessionOrderID"};
-    } elsif ($params{"authortext-$SessionOrderID"}) {
+    my $TalkDocID = $Untaint -> extract(-as_integer => "talkdocid-$SessionOrderID") || 0;
+    my $NewSessionID = $Untaint -> extract(-as_integer => "newsessionid-$SessionOrderID") || 0;
+
+    my @TopicHints = @{ $Untaint -> extract(-as_listofint => "topics-$SessionOrderID") || undef };
+    my @AuthorHints = @{ $Untaint -> extract(-as_listofint => "authors-$SessionOrderID") || undef };
+    my $AuthorText = $Untaint -> extract(-as_safehtml => "authortext-$SessionOrderID") || "";
+    if (!@AuthorHints && $AuthorText) {
       require "AuthorSQL.pm";
-      my $AuthorText = $params{"authortext-$SessionOrderID"};
       @AuthorHints = ProcessManualAuthors($AuthorText);
     }
 

From a951acf23670192ed71f0e93991fda54e046a047 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Mon, 5 Aug 2013 16:23:04 -0500
Subject: [PATCH 097/163] Sanitize the S* scripts

---
 DocDB/cgi/SetGroups       | 11 +++++---
 DocDB/cgi/ShowCalendar    | 14 +++++-----
 DocDB/cgi/ShowTalkNote    | 57 ++++++++++++++++++++-------------------
 DocDB/cgi/SignRevision    | 41 +++++++++++++++-------------
 DocDB/cgi/SignatureReport | 30 +++++++++++----------
 DocDB/cgi/SignoffChooser  |  3 +--
 6 files changed, 84 insertions(+), 72 deletions(-)

diff --git a/DocDB/cgi/SetGroups b/DocDB/cgi/SetGroups
index d7c467b3..9989ef7b 100755
--- a/DocDB/cgi/SetGroups
+++ b/DocDB/cgi/SetGroups
@@ -25,22 +25,25 @@
 
 
 use CGI qw(-nosticky);
+use CGI::Untaint;
 use DBI;
 
 require "DocDBGlobals.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 require "ResponseElements.pm";
 require "Cookies.pm";
 
 # Start page
 
-$query = new CGI;
-%params = $query -> Vars;
+$query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 
 my @cookies = ();
 
-my $Duration = $params{duration};
-my @GroupIDs = split /\0/,$params{groups};
+my $Duration = $Untaint -> extract(-as_safehtml => "duration") || "";
+my @GroupIDs = @{ $Untaint -> extract(-as_listofint => "groups") || undef };
 unless (@GroupIDs) {
   @GroupIDs = (-1);
 }
diff --git a/DocDB/cgi/ShowCalendar b/DocDB/cgi/ShowCalendar
index 63949cb5..b6a3a31d 100755
--- a/DocDB/cgi/ShowCalendar
+++ b/DocDB/cgi/ShowCalendar
@@ -32,12 +32,14 @@
 
 use Benchmark; $StartTime = new Benchmark;
 use CGI;
+use CGI::Untaint;
 use DBI;
 use DateTime;
 
 require "DocDBGlobals.pm";
 require "DBUtilities.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 require "ResponseElements.pm";
 
 require "MeetingSecurityUtilities.pm";
@@ -48,13 +50,13 @@ require "MeetingHTML.pm";
 require "MeetingSQL.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 
-my %Params = $query -> Vars;
-
-my $Day       = $Params{day}       || 0;
-my $Month     = $Params{month}     || 0;
-my $Year      = $Params{year}      || 0;
-my $TodayOnly = $Params{todayonly} || 0;
+my $Day = $Untaint -> extract(-as_integer => "day") || 0;
+my $Month = $Untaint -> extract(-as_integer => "month") || 0;
+my $Year = $Untaint -> extract(-as_integer => "year") || 0;
+my $TodayOnly = $Untaint -> extract(-as_safehtml => "todayonly") || "";
 
 CreateConnection();
 
diff --git a/DocDB/cgi/ShowTalkNote b/DocDB/cgi/ShowTalkNote
index c93bc1cb..ac11b989 100755
--- a/DocDB/cgi/ShowTalkNote
+++ b/DocDB/cgi/ShowTalkNote
@@ -12,7 +12,7 @@
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -26,7 +26,8 @@
 
 # FIXME: XHTML
 
-use CGI qw(-nosticky);                                                                                      
+use CGI qw(-nosticky);
+use CGI::Untaint;
 use DBI;
 
 require "DocDBGlobals.pm";
@@ -36,6 +37,7 @@ require "ResponseElements.pm";
 require "Security.pm";
 require "MeetingSecurityUtilities.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 
 require "DocumentSQL.pm";
 require "RevisionSQL.pm";
@@ -51,16 +53,17 @@ require "TalkHTML.pm";
 require "AuthorHTML.pm";
 require "TopicHTML.pm";
 
-$query = new CGI;  
-%params = $query -> Vars;
+$query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 
-my $SessionOrderID = $params{sessionorderid};
+my $SessionOrderID = $Untaint -> extract(-as_integer => "sessionorderid") || 0;
 
 $dbh   = DBI -> connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 
 unless ($dbh) {
   push @ErrorStack,$Msg_NoConnect;
-}         
+}
 EndPage();
 
 # FIXME: XHTML
@@ -85,7 +88,7 @@ if ($SessionOrders{$SessionOrderID}{SessionTalkID}) {
   $Confirmed            = $SessionTalks{$SessionTalkID}{Confirmed} ;
   $SessionID            = $SessionTalks{$SessionTalkID}{SessionID};
   # Get hints and convert to format accepted by scrolling lists
-  
+
   my @TopicHintIDs = &FetchTopicHintsBySessionTalkID($SessionTalkID);
   foreach my $TopicHintID (@TopicHintIDs) {
     push @TalkDefaultTopicHints,$TopicHints{$TopicHintID}{TopicID};
@@ -97,7 +100,7 @@ if ($SessionOrders{$SessionOrderID}{SessionTalkID}) {
 } elsif ($SessionOrders{$SessionOrderID}{TalkSeparatorID}) {
   $TalkSeparatorID   = $SessionOrders{$SessionOrderID}{TalkSeparatorID};
   FetchTalkSeparatorByID($TalkSeparatorID);
-  
+
   $TalkDefaultConfirmed = "";
   $TalkDefaultTime      = $TalkSeparators{$TalkSeparatorID}{Time}  || "00:30";
   $TalkDefaultTitle     = $TalkSeparators{$TalkSeparatorID}{Title} || "";
@@ -126,31 +129,31 @@ if ($Confirmed && $DocumentID) {
   $BestTitle  = $DocRevisions{$DocRevID}{Title};
   $UpdateLink = $DocumentAddForm."?mode=update&docid=$DocumentID";
 } else {
-  $BestTitle = $SessionTalks{$SessionTalkID}{HintTitle};    
+  $BestTitle = $SessionTalks{$SessionTalkID}{HintTitle};
 }
- 
+
 # Start page
 
 print $query -> header( -charset => $HTTP_ENCODING );
 DocDBHeader("Notes for $BestTitle","",-nobody => $TRUE, -scripts => ["PopUps"]);
 EndPage();
 
-print "<h5>Use this form to edit the agenda information for a single talk or break. 
+print "<h5>Use this form to edit the agenda information for a single talk or break.
           This does not change the information for the associated document, if any. ";
 if ($UpdateLink) {
-  print "You may <a href=\"$UpdateLink\">change that info</a> also.";         
-}          
+  print "You may <a href=\"$UpdateLink\">change that info</a> also.";
+}
 print "</h5>\n";
 
-### Form to change Agenda Info 
- 
+### Form to change Agenda Info
+
 print $query -> start_multipart_form('POST',$EditTalkInfo);
 print '<table class="MedPaddedTable LeftHeader">';
 
 print "<tr>\n";
 print "<th>",FormElementTitle(-helplink => "talkinfo", -helptext => "Title"),"</th>\n";
-print '<td colspan="2">'; 
-$query -> param('sessionorderid',$SessionOrderID);
+print '<td colspan="2">';
+my $SessionOrderID = $Untaint -> extract(-as_integer => "sessionorderid") || $SessionOrderID;
 print $query -> hidden(-name => 'sessionorderid', -default => $SessionOrderID),"\n";
 TalkTitle($TalkDefaultTitle);
 print "</td>\n";
@@ -159,23 +162,23 @@ print "</tr><tr>\n";
 if ($SessionTalkID) {
   print "<th>",FormElementTitle(-helplink => "talkdocid", -helptext => "Document #"),"</th>\n";
   print '<td colspan="2">';
-  TextField(-name => "docid", -size => 6, -maxlength => 6, -default => $DocumentID); 
-  TalkConfirm($SessionOrderID);  
-  print "</td></tr><tr>\n";  
+  TextField(-name => "docid", -size => 6, -maxlength => 6, -default => $DocumentID);
+  TalkConfirm($SessionOrderID);
+  print "</td></tr><tr>\n";
 }
 
 print "<th>",FormElementTitle(-helplink => "talktime", -helptext => "Time"),"</th>\n";
-print '<td colspan="2">'; 
-TalkTimePullDown();  
+print '<td colspan="2">';
+TalkTimePullDown();
 print "</td>\n";
-print "</tr><tr>\n"; 
+print "</tr><tr>\n";
 
 print "<th>",FormElementTitle(-helplink => "talkinfo"     , -helptext => "Notes"),"</th>\n";
 print '<td colspan="2">';
-TextArea(-name => 'talknote', -columns => 50, -rows => 8, -default => $TalkDefaultNote); 
+TextArea(-name => 'talknote', -columns => 50, -rows => 8, -default => $TalkDefaultNote);
 print "</td>\n";
 print "</tr>\n";
-  
+
 if ($SessionTalkID) {
   print "<tr><th>",FormElementTitle(-helplink => "authorhint", -helptext => "Author Hints", -nocolon => $TRUE);
   print  " &amp; ",FormElementTitle(-helplink => "topichint"    , -helptext => "Topic Hints"),"</th>\n";
@@ -198,7 +201,7 @@ if ($SessionTalkID) { # Don't do this for seperators
       print "<p><b>This talk is a confirmed match with this document:</b></p>\n";
     } else {
       print "<p><b>This talk has been matched (but not confirmed) with this document:</b></p>\n";
-    } 
+    }
     my @DocumentIDs = ($DocumentID);
     my %FieldList = PrepareFieldList(-fields => ["Title","Author","Topics","Files"]);
     DocumentTable(-fieldlist => \%FieldList, -docids  => \@DocumentIDs);
@@ -216,7 +219,7 @@ if ($SessionTalkID) { # Don't do this for seperators
       first):</b></p>\n";
       my %FieldList = PrepareFieldList(-fields => ["Title","Author","Topics","Confirm"]);
       DocumentTable(-fieldlist => \%FieldList, -docids  => \@MatchedDocIDs, -talkid => $SessionTalkID);
-    }  
+    }
   }
 }
 
diff --git a/DocDB/cgi/SignRevision b/DocDB/cgi/SignRevision
index 370bf4ee..d6aac64c 100755
--- a/DocDB/cgi/SignRevision
+++ b/DocDB/cgi/SignRevision
@@ -4,7 +4,7 @@
 #              changes in e-mail.
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified: 
+#    Modified:
 #
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
@@ -12,7 +12,7 @@
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -24,11 +24,13 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-use CGI;    
+use CGI;
+use CGI::Untaint;
 use DBI;
-                                                  
+
 require "DocDBGlobals.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 require "Scripts.pm";
 
 require "ResponseElements.pm";
@@ -42,21 +44,22 @@ require "EmailSecurity.pm";
 require "CertificateUtilities.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rwuser,$db_rwpass);
 
-%params = $query -> Vars;
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 
 # Collect parameters
 
-my $Action      = $params{action};
-my $EmailUserID = $params{emailuserid};
-my $SignatureID = $params{signatureid};
-my $Password    = $params{"password-$EmailUserID"};
+my $Action = $Untaint -> extract(-as_printable => "action") || "";
+my $EmailUserID = $Untaint -> extract(-as_integer => "emailuserid") || 0;
+my $SignatureID = $Untaint -> extract(-as_integer => "signatureid") || 0;
+my $Password = $Untaint -> extract(-as_printable => "password-$EmailUserID") || "";
 
 $Password =~ s/\s+//g;
 
 # Start the page
-   
+
 print $query -> header( -charset => $HTTP_ENCODING );
 &DocDBHeader("Document Signature","",-scripts => ["PopUps"]);
 
@@ -71,9 +74,9 @@ print $query -> header( -charset => $HTTP_ENCODING );
 my $UserName = $EmailUser{$EmailUserID}{Username};
 $EmailUserID = 0;
 
-if ($Password) { 
+if ($Password) {
   $EmailUserID = &ValidateEmailUser($UserName,$Password);
-} 
+}
 
 if ($UserValidation eq "certificate") {
   $EmailUserID = FetchEmailUserIDByCert();
@@ -89,17 +92,17 @@ unless ($EmailUserID) {
 
 unless ($Signatures{$SignatureID}{EmailUserID} == $EmailUserID) {
   push @ErrorStack,"You are not authorized to sign in this slot.";
-}  
+}
 if ($Action eq "sign" && $Signatures{$SignatureID}{Signed}) {
   push @ErrorStack,"This signature slot is already signed. You can't sign again.";
-}  
+}
 if ($Action eq "unsign" && !$Signatures{$SignatureID}{Signed}) {
   push @ErrorStack,"This signature slot is not signed. You can't remove the signature.";
-}  
+}
 if ($Action ne "unsign" && $Action ne "sign") {
   push @ErrorStack,"The action is not recognized. Must be either sign or unsign.";
-}  
-  
+}
+
 # Standard warnings/errors on exit
 
 EndPage();
@@ -118,8 +121,8 @@ if ($Action eq "sign") {
 }
 
 print "<b>You have $SignMessage the document. The new document information is
-          shown below:</b><p/>\n"; 
-print "<hr/>\n"; 
+          shown below:</b><p/>\n";
+print "<hr/>\n";
 
 # Get revision number and print updated info
 
diff --git a/DocDB/cgi/SignatureReport b/DocDB/cgi/SignatureReport
index 31af77d4..c3c7dd9a 100755
--- a/DocDB/cgi/SignatureReport
+++ b/DocDB/cgi/SignatureReport
@@ -7,7 +7,7 @@
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -33,6 +33,7 @@
 
 use Benchmark;
 use CGI;
+use CGI::Untaint;
 use DBI;
 
 $StartTime = new Benchmark;
@@ -46,16 +47,17 @@ require "ResponseElements.pm";
 require "DocumentHTML.pm";
 
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 require "RevisionUtilities.pm";
 require "SignoffUtilities.pm";
 require "Utilities.pm";
 require "DocumentUtilities.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 
-%params = $query -> Vars;
-
-my $EmailUserID = $params{emailuserid};
+my $EmailUserID = $Untaint -> extract(-as_integer => "emailuserid") || 0;
 
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 
@@ -87,20 +89,20 @@ foreach my $SignoffID (@SignoffIDs) {
       my $Status = &SignoffStatus ($SignoffID);
       if ($Status eq "Ready") {
         push @ReadyDocumentIDs,$DocumentID;
-      } elsif ($Status eq "NotReady") { 
+      } elsif ($Status eq "NotReady") {
         push @NotReadyDocumentIDs,$DocumentID;
-      } elsif ($Status eq "Signed") { 
+      } elsif ($Status eq "Signed") {
         my ($RevisionStatus) = &RevisionStatus($DocRevID);
         if ($RevisionStatus eq "Approved") {
           push @ApprovedDocumentIDs,$DocumentID;
         } elsif ($RevisionStatus eq "Unapproved") {
           push @SignedDocumentIDs,$DocumentID;
-        }      
+        }
       }
     }
-  }    
+  }
 }
-    
+
 my @CurrentDocumentIDs = (@ReadyDocumentIDs ,@NotReadyDocumentIDs,@ApprovedDocumentIDs,@SignedDocumentIDs);
 @OldSignatureDocumentIDs = RemoveArray(\@DocumentIDs,@CurrentDocumentIDs);
 
@@ -109,7 +111,7 @@ if (@ReadyDocumentIDs) {
 
   my %FieldList = PrepareFieldList(-fields => ["Docid","Title","Author","Updated"]);
   DocumentTable(-fieldlist => \%FieldList,
-                -docids    => \@ReadyDocumentIDs, 
+                -docids    => \@ReadyDocumentIDs,
                 -sortby    => "date", -reverse => 1);
 }
 
@@ -118,7 +120,7 @@ if (@NotReadyDocumentIDs) {
 
   my %FieldList = PrepareFieldList(-fields => ["Docid","Title","CanSign","Updated"]);
   DocumentTable(-fieldlist => \%FieldList,
-                -docids    => \@NotReadyDocumentIDs, 
+                -docids    => \@NotReadyDocumentIDs,
                 -sortby    => "date", -reverse => 1);
 }
 
@@ -127,7 +129,7 @@ if (@SignedDocumentIDs) {
 
   my %FieldList = PrepareFieldList(-fields => ["Docid","Title","CanSign","Updated"]);
   DocumentTable(-fieldlist => \%FieldList,
-                -docids    => \@SignedDocumentIDs, 
+                -docids    => \@SignedDocumentIDs,
                 -sortby    => "date", -reverse => 1);
 }
 
@@ -136,7 +138,7 @@ if (@ApprovedDocumentIDs) {
 
   my %FieldList = PrepareFieldList(-fields => ["Docid","Title","Author","Updated"]);
   DocumentTable(-fieldlist => \%FieldList,
-                -docids    => \@ApprovedDocumentIDs, 
+                -docids    => \@ApprovedDocumentIDs,
                 -sortby    => "date", -reverse => 1);
 }
 
@@ -145,7 +147,7 @@ if (@OldSignatureDocumentIDs) {
 
   my %FieldList = PrepareFieldList(-fields => ["Docid","Title","Author","Updated"]);
   DocumentTable(-fieldlist => \%FieldList,
-                -docids    => \@OldSignatureDocumentIDs, 
+                -docids    => \@OldSignatureDocumentIDs,
                 -sortby    => "date", -reverse => 1);
 }
 
diff --git a/DocDB/cgi/SignoffChooser b/DocDB/cgi/SignoffChooser
index ce4229c8..35ef75c3 100755
--- a/DocDB/cgi/SignoffChooser
+++ b/DocDB/cgi/SignoffChooser
@@ -41,8 +41,7 @@ require "EmailSecurity.pm";
 require "Scripts.pm";
 
 $query = new CGI;  # Global for subroutines
-%params = $query -> Vars;
-
+$query -> autoEscape(0);
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 
 print $query -> header( -charset => $HTTP_ENCODING );

From 0a16eb22710cd7bcd00d2bc02e43bcf44778f432 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Mon, 5 Aug 2013 16:54:05 -0500
Subject: [PATCH 098/163] Modify last of scripts for untainting

---
 DocDB/cgi/Statistics      | 79 +++++++++++++++++++-------------------
 DocDB/cgi/TopicAdminister | 80 ++++++++++++++++++++-------------------
 DocDB/cgi/UserAccessApply | 12 +++---
 DocDB/cgi/WatchDocument   | 12 +++---
 DocDB/cgi/XMLUpload       |  1 +
 DocDB/cgi/XSearch         | 38 +++++++++----------
 6 files changed, 115 insertions(+), 107 deletions(-)

diff --git a/DocDB/cgi/Statistics b/DocDB/cgi/Statistics
index 8ba354ee..6b9870cc 100755
--- a/DocDB/cgi/Statistics
+++ b/DocDB/cgi/Statistics
@@ -3,14 +3,14 @@
 # Description: Gather and display aggregate statistics on DocDB
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified: 
+#    Modified:
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -31,6 +31,7 @@ require "HTMLUtilities.pm";
 require "ResponseElements.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
 
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 print $query -> header( -charset => $HTTP_ENCODING );
@@ -38,28 +39,28 @@ print $query -> header( -charset => $HTTP_ENCODING );
 &DocDBHeader("$Project DocDB Statistics");
 
 my $NDoc_query = $dbh -> prepare("select COUNT(DocumentID) from Document");
-   $NDoc_query -> execute(); 
+   $NDoc_query -> execute();
 my ($NDocuments) = $NDoc_query -> fetchrow_array;
 
 my $NRev_query = $dbh -> prepare("select COUNT(DocRevID) from DocumentRevision");
-   $NRev_query -> execute(); 
+   $NRev_query -> execute();
 my ($NRevisions) = $NRev_query -> fetchrow_array;
 
 my $NOKRev_query = $dbh -> prepare("select COUNT(DocRevID) from DocumentRevision where Obsolete=0");
-   $NOKRev_query -> execute(); 
+   $NOKRev_query -> execute();
 my ($NOKRevisions) = $NOKRev_query -> fetchrow_array;
 
 my $RevPerDoc = sprintf "%5.2f",$NOKRevisions/$NDocuments;
 
 my $NFile_query = $dbh -> prepare("select COUNT(DocFileID) from DocumentFile");
-   $NFile_query -> execute(); 
+   $NFile_query -> execute();
 my ($NFiles) = $NFile_query -> fetchrow_array;
 
 my $NOKFile_query = $dbh -> prepare(
    "select COUNT(DocFileID) from DocumentFile,DocumentRevision".
    " where DocumentFile.DocRevID=DocumentRevision.DocRevID".
    " and DocumentRevision.Obsolete=0");
-   $NOKFile_query -> execute(); 
+   $NOKFile_query -> execute();
 my ($NOKFiles) = $NOKFile_query -> fetchrow_array;
 
 my $FilePerRev = sprintf "%5.2f",$NOKFiles/$NOKRevisions;
@@ -73,76 +74,76 @@ print "<table id=\"StatisticsTable\" class=\"CenteredTable MedPaddedTable\">\n";
 
 print "<tbody>\n";
 
-print "<tr><th>Total number of Documents:          </th><td>$NDocuments</td></tr>\n";  
-print "<tr><th>Total number of Revisions:          </th><td>$NRevisions</td>\n";  
-print "    <th>Number of File Entries:             </th><td>$NFiles</td></tr>\n";  
-print "<tr><th>Total Active Revisions:             </th><td>$NOKRevisions</td>\n";  
-print " <th>Actual number of Files:                </th><td>$NOKFiles</td></tr>\n";  
-print "<tr><th>Average Versions per Document:      </th><td>$RevPerDoc</td>\n";  
-print " <th>Average Files per Revision:            </th><td>$FilePerRev</td></tr>\n";  
+print "<tr><th>Total number of Documents:          </th><td>$NDocuments</td></tr>\n";
+print "<tr><th>Total number of Revisions:          </th><td>$NRevisions</td>\n";
+print "    <th>Number of File Entries:             </th><td>$NFiles</td></tr>\n";
+print "<tr><th>Total Active Revisions:             </th><td>$NOKRevisions</td>\n";
+print " <th>Actual number of Files:                </th><td>$NOKFiles</td></tr>\n";
+print "<tr><th>Average Versions per Document:      </th><td>$RevPerDoc</td>\n";
+print " <th>Average Files per Revision:            </th><td>$FilePerRev</td></tr>\n";
 print "<tr><td></td><td></td>\n";
-print " <th>Average Files per Document: </th><td>$FilePerDoc</td></tr>\n";  
+print " <th>Average Files per Document: </th><td>$FilePerDoc</td></tr>\n";
 
 print "</tbody>\n";
 
 my $NAuth_query = $dbh -> prepare("select COUNT(AuthorID) from Author");
-   $NAuth_query -> execute(); 
+   $NAuth_query -> execute();
 my ($NAuthors) = $NAuth_query -> fetchrow_array;
 
 my $NUniqAuth_query = $dbh -> prepare("select COUNT(DISTINCT(AuthorID)) from RevisionAuthor");
-   $NUniqAuth_query -> execute(); 
+   $NUniqAuth_query -> execute();
 my ($NUniqAuth) = $NUniqAuth_query -> fetchrow_array;
 
 my $NRevAuth_query = $dbh -> prepare("select COUNT(AuthorID) from RevisionAuthor");
-   $NRevAuth_query -> execute(); 
+   $NRevAuth_query -> execute();
 my ($NRevisionAuthors) = $NRevAuth_query -> fetchrow_array;
 
 my $AuthPerRev = sprintf "%5.2f",$NRevisionAuthors/$NRevisions;
 my $DocPerAuth = sprintf "%5.2f",$NDocuments/$NUniqAuth*$AuthPerRev;
 
 my $NTopic_query = $dbh -> prepare("select COUNT(TopicID) from Topic");
-   $NTopic_query -> execute(); 
+   $NTopic_query -> execute();
 my ($NTopics) = $NTopic_query -> fetchrow_array;
 
 my $NUniqTopic_query = $dbh -> prepare("select COUNT(DISTINCT(TopicID)) from RevisionTopic");
-   $NUniqTopic_query -> execute(); 
+   $NUniqTopic_query -> execute();
 my ($NUniqTopics) = $NUniqTopic_query -> fetchrow_array;
 
 my $NRevTopic_query = $dbh -> prepare("select COUNT(TopicID) from RevisionTopic");
-   $NRevTopic_query -> execute(); 
+   $NRevTopic_query -> execute();
 my ($NRevisionTopics) = $NRevTopic_query -> fetchrow_array;
 
 my $TopicPerRev = sprintf "%5.2f",$NRevisionTopics/$NRevisions;
 my $DocPerTopic = sprintf "%5.2f",$NDocuments/$NUniqTopics*$TopicPerRev;
 
 print "<tbody>\n";
-print "<tr><th>Number of registered Authors:       </th><td>$NAuthors</td>\n";  
-print " <th>Number of possible Topics:             </th><td>$NTopics</td></tr>\n";  
+print "<tr><th>Number of registered Authors:       </th><td>$NAuthors</td>\n";
+print " <th>Number of possible Topics:             </th><td>$NTopics</td></tr>\n";
 
-print "<tr><th>Authors of one or more Documents:   </th><td>$NUniqAuth</td>\n";  
-print "    <th>Number of Topics used:              </th><td>$NUniqTopics</td></tr>\n";  
+print "<tr><th>Authors of one or more Documents:   </th><td>$NUniqAuth</td>\n";
+print "    <th>Number of Topics used:              </th><td>$NUniqTopics</td></tr>\n";
 
-print "<tr><th>Number of Authors on all Revisions: </th><td>$NRevisionAuthors</td>\n";  
-print "    <th>Number of Topics on all Revisions:  </th><td>$NRevisionTopics</td></tr>\n";  
+print "<tr><th>Number of Authors on all Revisions: </th><td>$NRevisionAuthors</td>\n";
+print "    <th>Number of Topics on all Revisions:  </th><td>$NRevisionTopics</td></tr>\n";
 
-print "<tr><th>Average Authors per Revision:       </th><td>$AuthPerRev</td>\n";  
-print "    <th>Average Topics per Revision:        </th><td>$TopicPerRev</td></tr>\n";  
+print "<tr><th>Average Authors per Revision:       </th><td>$AuthPerRev</td>\n";
+print "    <th>Average Topics per Revision:        </th><td>$TopicPerRev</td></tr>\n";
 
-print "<tr><th>Average Documents per Author:       </th><td>$DocPerAuth</td>\n";  
-print "    <th>Average Documents per Topic:        </th><td>$DocPerTopic</td></tr>\n";  
+print "<tr><th>Average Documents per Author:       </th><td>$DocPerAuth</td>\n";
+print "    <th>Average Documents per Topic:        </th><td>$DocPerTopic</td></tr>\n";
 
 print "</tbody>\n";
 
 my $NEvent_query = $dbh -> prepare("select COUNT(ConferenceID) from Conference");
-   $NEvent_query -> execute(); 
+   $NEvent_query -> execute();
 my ($NEvents) = $NEvent_query -> fetchrow_array;
 
 my $NUniqEvent_query = $dbh -> prepare("select COUNT(DISTINCT(ConferenceID)) from RevisionEvent");
-   $NUniqEvent_query -> execute(); 
+   $NUniqEvent_query -> execute();
 my ($NUniqEvents) = $NUniqEvent_query -> fetchrow_array;
 
 my $NRevEvent_query = $dbh -> prepare("select COUNT(ConferenceID) from RevisionEvent");
-   $NRevEvent_query -> execute(); 
+   $NRevEvent_query -> execute();
 my ($NRevisionEvents) = $NRevEvent_query -> fetchrow_array;
 
 my $EventsPerRev = sprintf "%5.2f",$NRevisionEvents/$NRevisions;
@@ -150,11 +151,11 @@ my $DocPerEvent  = sprintf "%5.2f",$NDocuments/$NEvents*$EventsPerRev;
 
 
 print "<tbody>\n";
-print "<tr><th>Number of Events:                   </th><td>$NEvents</td></tr>\n";  
-print "<tr><th>Events with Documents:              </th><td>$NUniqEvents</td></tr>\n";  
-print "<tr><th>Number of Events for all Revisions: </th><td>$NRevisionEvents</td></tr>\n";  
-print "<tr><th>Average Events per Revision:        </th><td>$EventsPerRev</td></tr>\n";  
-print "<tr><th>Estimated Documents per Event:      </th><td>$DocPerEvent</td></tr>\n";  
+print "<tr><th>Number of Events:                   </th><td>$NEvents</td></tr>\n";
+print "<tr><th>Events with Documents:              </th><td>$NUniqEvents</td></tr>\n";
+print "<tr><th>Number of Events for all Revisions: </th><td>$NRevisionEvents</td></tr>\n";
+print "<tr><th>Average Events per Revision:        </th><td>$EventsPerRev</td></tr>\n";
+print "<tr><th>Estimated Documents per Event:      </th><td>$DocPerEvent</td></tr>\n";
 print "</tbody>\n";
 
 print "</table>\n";
diff --git a/DocDB/cgi/TopicAdminister b/DocDB/cgi/TopicAdminister
index 9ba14288..495cf5ab 100755
--- a/DocDB/cgi/TopicAdminister
+++ b/DocDB/cgi/TopicAdminister
@@ -2,18 +2,18 @@
 #
 # Description: This script is called by AdministerForm and does administration
 #              on Topics in the DB. TopicAdd is simpler and can only add
-#              topics. TopicAdd is most useful in setting up a new DB, while 
-#              TopicAdminister will be more useful in maintaining an existing DB. 
+#              topics. TopicAdd is most useful in setting up a new DB, while
+#              TopicAdminister will be more useful in maintaining an existing DB.
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified: 
+#    Modified:
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -40,13 +40,15 @@ require "Sorts.pm";
 
 require "DBUtilities.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 
 require "TopicHTML.pm";
-require "TopicSQL.pm"; 
+require "TopicSQL.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
 
-# Parameters to script 
+# Parameters to script
 
 my $Untaint = CGI::Untaint -> new($query -> Vars);
 
@@ -57,8 +59,8 @@ my $Force         = $Untaint -> extract (-as_printable => "admforce")    || "";
 
 my $TopicID       = $Untaint -> extract (-as_integer   => "topics")      || 0;
 my $ParentTopicID = $Untaint -> extract (-as_integer   => "parenttopic") || 0;
-my $LongName      = $Untaint -> extract (-as_printable => "longdesc")    || "";
-my $ShortName     = $Untaint -> extract (-as_printable => "shortdesc")   || "";
+my $LongName      = $Untaint -> extract (-as_safehtml => "longdesc")    || "";
+my $ShortName     = $Untaint -> extract (-as_safehtml => "shortdesc")   || "";
 
 
 $query -> delete_all();
@@ -82,12 +84,12 @@ DocDBHeader("Topic Administration","",-scripts => ["PopUps","TopicAdminDisable"]
 
 unless (CanAdminister()) {
   push @ErrorStack,$Msg_AdminNoLogin;
-}  
+}
 EndPage();
 GetTopics();
 
 if ($Action eq "Delete") {
-  # FIXME?: Force option is not going to be compatible with children with 
+  # FIXME?: Force option is not going to be compatible with children with
   # multiple parents In that case we would need to determine if any topics
   # would be orphaned and  then delete those, but not ones with another
   # parent
@@ -98,41 +100,41 @@ if ($Action eq "Delete") {
     push @WarnStack,$Msg_ModTopicEmpty;
   }
 
-# Deal with name changes     
+# Deal with name changes
 
-  if ($TopicID && $ShortName) { 
+  if ($TopicID && $ShortName) {
     push @ActionStack,"Updated short description of topic.";
     my $Update = $dbh -> prepare("update Topic set ShortDescription=? where TopicID=?");
     $Update -> execute($ShortName,$TopicID);
   }
-  if ($TopicID && $LongName) { 
+  if ($TopicID && $LongName) {
     push @ActionStack,"Updated long description of topic.";
     my $Update = $dbh -> prepare("update Topic set LongDescription=? where TopicID=?");
     $Update -> execute($LongName,$TopicID);
   }
 
-# Deal with parent changes   
+# Deal with parent changes
 
   if ($TopicID && $ParentTopicID && $ParentTopicID == $TopicID) {
     push @WarnStack,"You cannot set a topic to be its own parent. No action taken.";
-  }  
+  }
 
-  if ($TopicID && $ParentTopicID && $ParentTopicID != $TopicID) { 
+  if ($TopicID && $ParentTopicID && $ParentTopicID != $TopicID) {
     push @ActionStack,"Updated parent topic of (sub)topic.";
-   
+
     my $Delete = $dbh -> prepare("delete from TopicHierarchy where TopicID=?");
     my $Insert = $dbh -> prepare("insert into TopicHierarchy (TopicHierarchyID,TopicID,ParentTopicID) values (0,?,?)");
-   
+
     $Delete -> execute($TopicID);
     $Insert -> execute($TopicID,$ParentTopicID);
   }
 } elsif ($Action eq "New") {
 
   if ($ShortName || $LongName) {
-    if (!$LongName) { 
+    if (!$LongName) {
       $LongName = $ShortName;
       push @WarnStack,"No long description supplied. Short description substituted.";
-    } elsif (!$ShortName) { 
+    } elsif (!$ShortName) {
       $ShortName = $LongName;
       push @WarnStack,"No short description supplied. Long description substituted.";
     }
@@ -150,16 +152,16 @@ if ($Action eq "Delete") {
     }
   } else {
     push @WarnStack,"No short or long description supplied. No topic created.";
-  }  
-} elsif ($TopicID || $ParentTopicID || $LongName || $ShortName) { 
+  }
+} elsif ($TopicID || $ParentTopicID || $LongName || $ShortName) {
   push @WarnStack,"No valid action was specified.";
-}  
- 
-if (@ActionStack) { 
+}
+
+if (@ActionStack) {
   ClearTopics();
   GetTopics();
   ActionReport();
-}  
+}
 
 EndPage();
 
@@ -167,18 +169,18 @@ print $query -> start_multipart_form('POST',"$TopicAdminister",'id="topic" name=
 
 print "<table class=\"MedPaddedTable\">\n";
 print "<tr>\n";
-print "<td colspan=\"2\">\n"; 
- AdministerActions(-form => "topic");      
+print "<td colspan=\"2\">\n";
+ AdministerActions(-form => "topic");
 print "</td>\n";
 print "</tr>\n";
 
 print "<tr>\n";
-print "<td rowspan=\"3\">\n"; 
- TopicScroll({ -helptext   => "Topic", -helplink => "topics", 
+print "<td rowspan=\"3\">\n";
+ TopicScroll({ -helptext   => "Topic", -helplink => "topics",
                -itemformat => "full",  -disabled => $TRUE,
-               -extratext  => "[Long description]", 
-            }); 
-print "</td>\n"; 
+               -extratext  => "[Long description]",
+            });
+print "</td>\n";
 print "<td>\n"; ShortDescriptionBox(-name => "shortdesc", -disabled => $TRUE);
 print "</td>\n";
 print "</tr>\n";
@@ -189,18 +191,18 @@ print "</td>\n";
 print "</tr>\n";
 
 print "<tr>\n";
-print "<td>\n"; 
+print "<td>\n";
  AdminRegardless();
 print "</td>\n";
 print "</tr>\n";
 
 print "<tr>\n";
-print "<td>\n";  
- TopicScroll({ -helptext   => "Parent Topic", -helplink => "parenttopic", 
+print "<td>\n";
+ TopicScroll({ -helptext   => "Parent Topic", -helplink => "parenttopic",
                -itemformat => "full",         -disabled => $TRUE,
                -name       => "parenttopic",
-               -extratext  => "[Long description]", 
-            }); 
+               -extratext  => "[Long description]",
+            });
 print "</td>\n";
 print "</tr>\n";
 
@@ -217,5 +219,5 @@ print $query -> end_multipart_form;
 
 DocDBNavBar();
 DocDBFooter($DBWebMasterEmail,$DBWebMasterName);
- 
+
 exit;
diff --git a/DocDB/cgi/UserAccessApply b/DocDB/cgi/UserAccessApply
index 483d2074..18f14c10 100755
--- a/DocDB/cgi/UserAccessApply
+++ b/DocDB/cgi/UserAccessApply
@@ -21,6 +21,7 @@
 
 use Benchmark;
 use CGI;
+use CGI::Untaint;
 use DBI;
 
 $StartTime = new Benchmark;
@@ -28,14 +29,15 @@ $StartTime = new Benchmark;
 require "DocDBGlobals.pm";
 require "Messages.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 require "ResponseElements.pm";
 require "SecuritySQL.pm";
 
 require "CertificateUtilities.pm";
 
 $query = new CGI;  # Global for subroutines
-
-%params = $query -> Vars;
+$query -> autoEscape(0);
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rwuser,$db_rwpass);
 
@@ -49,7 +51,7 @@ EndPage();
 ### Output Information
 
 my $CertificateStatus = &CertificateStatus();
-my $CertEmail = $params{email};
+my $CertEmail = $Untaint -> extract(-as_safehtml => "email") || "";
 
 unless ($CertEmail) {
   push @ErrorStack,"You must supply an e-mail address.";
@@ -87,8 +89,8 @@ if ($CertificateStatus eq "verified") {
 
 ### Get additional parameters
 
-  my $CertNote          = $params{certnote};
-  my @RequestedGroupIDs = split /\0/,$params{reqgroups};
+  my $CertNote = $Untaint -> extract(-as_safehtml => "certnote") || "";
+  my @RequestedGroupIDs = @{ $Untaint -> extract(-as_listofint => "reqgroups") || undef };
   my $UserName = $CertDN;
 
 ### Fill in DB tables
diff --git a/DocDB/cgi/WatchDocument b/DocDB/cgi/WatchDocument
index 43d73311..e8731c20 100755
--- a/DocDB/cgi/WatchDocument
+++ b/DocDB/cgi/WatchDocument
@@ -25,25 +25,27 @@
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
 use CGI;
+use CGI::Untaint;
 use DBI;
 
 require "DocDBGlobals.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 require "ResponseElements.pm";
 require "EmailSecurity.pm";
 require "NotificationSQL.pm";
 require "DocumentHTML.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rwuser,$db_rwpass);
 
-%params = $query -> Vars;
-
 # Collect parameters
 
-my $DocumentID  = $params{docid};
-my $UserName    = $params{username};
-my $Password    = $params{password};
+my $DocumentID = $Untaint -> extract(-as_integer => "docid") || 0;
+my $UserName = $Untaint -> extract(-as_safehtml => "username") || "";
+my $Password = $Untaint -> extract(-as_printable => "password") || "";
 
 $UserName =~ s/\s+//g;
 $Password =~ s/\s+//g;
diff --git a/DocDB/cgi/XMLUpload b/DocDB/cgi/XMLUpload
index 903404f2..3619aeb6 100755
--- a/DocDB/cgi/XMLUpload
+++ b/DocDB/cgi/XMLUpload
@@ -43,6 +43,7 @@ require "Security.pm";
 
 my $Twig = XML::Twig -> new();
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
 my %CGIParams = $query -> Vars;
 CreateConnection(-type => "rw");
 
diff --git a/DocDB/cgi/XSearch b/DocDB/cgi/XSearch
index daf60fb1..b6560a04 100755
--- a/DocDB/cgi/XSearch
+++ b/DocDB/cgi/XSearch
@@ -8,7 +8,7 @@
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -20,7 +20,7 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-use CGI qw(-nosticky);                                                                                      
+use CGI qw(-nosticky);
 use DBI;
 
 require "DocDBGlobals.pm";
@@ -47,17 +47,17 @@ my $LocalSearch = $CGIParams{"docdb-0"};
 CreateConnection(-type => "ro");
 
 print $query -> header( -charset => $HTTP_ENCODING );
-DocDBHeader("DocDB X-Search","",-scripts => ["PopUps"]); 
+DocDBHeader("DocDB X-Search","",-scripts => ["PopUps"]);
 
 if ($XSearchDescription) {
   print $XSearchDescription;
 } else {
-  print "<h3>Here you can search documents in other DocDB installations. 
+  print "<h3>Here you can search documents in other DocDB installations.
   Only public documents from those installations will be shown. If you
-  don't see the the installation you want, the 
+  don't see the the installation you want, the
   <a href=\"http://docdb.fnal.gov/DocDB-public/DocDB/XSearch\">DocDB
   site</a> may have what you are looking for.</h3>";
-}     
+}
 
 my @ExternalDocDBIDs = GetAllExternalDocDBs();
 
@@ -80,7 +80,7 @@ if ($LocalSearch || !$SearchText) {
   push @CheckArray, $query -> checkbox(-name  => "docdb-0", -label => "").$ShortProject;
 }
 foreach my $DocDBID (@ExternalDocDBIDs) {
-  my $Link = ExternalDocDBLink( {-docdbid => $DocDBID} ); 
+  my $Link = ExternalDocDBLink( {-docdbid => $DocDBID} );
   if ($CGIParams{"docdb-$DocDBID"} || !$SearchText) {
     push @CheckArray, $query -> checkbox(-name  => "docdb-$DocDBID", -checked => 'checked', -label => "").$Link;
   } else {
@@ -93,7 +93,7 @@ foreach my $DocDBID (@ExternalDocDBIDs) {
 my $NColumns = 1;
 if (scalar(@CheckArray) > 6) {
   $NColumns = 3;
-} elsif (scalar(@CheckArray) > 3) {  
+} elsif (scalar(@CheckArray) > 3) {
   $NColumns = 2;
 }
 
@@ -106,7 +106,7 @@ my $GotOne = $TRUE;
 
 while ($GotOne) {
   $GotOne = $FALSE;
-  my $Row = "<tr>\n"; 
+  my $Row = "<tr>\n";
   foreach my $ColumnRef (@ColumnRefs) {
     my $Element = shift @{$ColumnRef};
     if ($Element) {
@@ -118,8 +118,8 @@ while ($GotOne) {
   if ($GotOne) {
     $Table .= $Row;
   }
-}      
-$Table .= "</table>\n";   
+}
+$Table .= "</table>\n";
 
 # Print Search Table
 
@@ -136,7 +136,7 @@ print $Table;
 
 print '</td></tr>';
 print '<tr><td class="SubmitCell" colspan="2">';
-print $query -> submit (-value => "Cross Search");     
+print $query -> submit (-value => "Cross Search");
 print '</td></tr></table>';
 print $query -> end_multipart_form;
 
@@ -163,9 +163,9 @@ WarnPage();
 
 %XSearchDocs  = %FoundDocuments; # Make global for search
 my @Documents = reverse sort XSearchDocsByRelevance keys %FoundDocuments;
-%XSearchDocs  = (); 
+%XSearchDocs  = ();
 
-# Print document table 
+# Print document table
 
 if (@Documents) {
   print '<table class="Alternating DocumentList">';
@@ -178,20 +178,20 @@ if (@Documents) {
     print "<tr class=\"$RowClass\">";
     print "<td><a href=\"$URL\">$Identifier</a></td>\n";
     print "<td><a href=\"$URL\">$FoundDocuments{$Identifier}{Title}</a></td>\n";
-    
+
     print "<td>$FoundDocuments{$Identifier}{Author}";
     if ($FoundDocuments{$Identifier}{EtAl}) {
       print " <em>et al.</em>";
-    }  
+    }
     print "</td>\n";
-    
+
     print '<td class="Updated">',EuroDate($FoundDocuments{$Identifier}{Date}),"</td>\n";
-    
+
     print "</tr>\n";
   }
   print "</table>\n";
   print "<p><strong>Number of documents found: ",int($Row),"</strong></p>\n";
-}  
+}
 
 DocDBNavBar();
 DocDBFooter($DBWebMasterEmail,$DBWebMasterName);

From 516ded4ae3083ae20d51b1aa60a6d35a27206363 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Tue, 6 Aug 2013 15:26:46 -0500
Subject: [PATCH 099/163] Use SmartHTML for event and event group links

---
 DocDB/cgi/MeetingHTML.pm | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/DocDB/cgi/MeetingHTML.pm b/DocDB/cgi/MeetingHTML.pm
index 897f6496..bba2ff86 100644
--- a/DocDB/cgi/MeetingHTML.pm
+++ b/DocDB/cgi/MeetingHTML.pm
@@ -24,6 +24,8 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
+require "HTMLUtilities.pm";
+
 sub LocationBox (;%) {
   require "FormElements.pm";
 
@@ -895,9 +897,9 @@ sub EventGroupLink (%) {
   $Link .= $ListAllMeetings."?eventgroupid=".$EventGroupID;
   $Link .= "\">";
   if ($Format eq "short")  {
-    $Link .= $EventGroups{$EventGroupID}{ShortDescription};
+    $Link .= SmartHTML( {-text => $EventGroups{$EventGroupID}{ShortDescription}, } );
   } else {
-    $Link .= $EventGroups{$EventGroupID}{LongDescription};
+    $Link .= SmartHTML( {-text => $EventGroups{$EventGroupID}{LongDescription}, } );
   }
   $Link .= "</a>";
   return $Link;
@@ -931,14 +933,14 @@ sub EventLink (%) {
   if ($ToolTipMode eq "Date") {
     $ToolTip = EuroDate($Conferences{$EventID}{StartDate});
   } else {
-    $ToolTip = $Conferences{$EventID}{Full};
+    $ToolTip = SmartHTML( {-text => $Conferences{$EventID}{Full}, } );
   }
 
   my $Link  = "<a href=\"$URL\" class=\"$Class\" title=\"$ToolTip\">";
   if ($Format eq "long") {
-    $Link .= $Conferences{$EventID}{LongDescription};
+    $Link .= SmartHTML( {-text => $Conferences{$EventID}{LongDescription}, } );
   } else {
-    $Link .= $Conferences{$EventID}{Title};
+    $Link .= SmartHTML( {-text => $Conferences{$EventID}{Title}, } );
   }
   $Link .= "</a>";
 
@@ -964,8 +966,8 @@ sub ModifyEventLink ($) {
     $URL = "$MeetingModify?conferenceid=$EventID";
   }
 
-  my $Title = $Conferences{$EventID}{Title};
-  my $ToolTip = $Conferences{$EventID}{Full};
+  my $Title = SmartHTML( {-text => $Conferences{$EventID}{Title}, } );
+  my $ToolTip = SmartHTML( {-text => $Conferences{$EventID}{Full}, } );
 
   my $Link  = "<a href=\"$URL\">";
      $Link .= $Title;
@@ -1033,11 +1035,11 @@ sub EventsByGroup (%) {
   }
   print "<table class=\"$TableClass\">";
   print "<tr><td colspan=\"4\">\n";
-
+  my $ShortGroup = SmartHTML( {-text => $EventGroups{$EventGroupID}{ShortDescription}, } );
   if ($Mode eq "display") {
-    print "<strong>$Big<a href=\"$ListBy?eventgroupid=$EventGroupID\">$EventGroups{$EventGroupID}{ShortDescription}</a>$EBig</strong>\n";
+    print "<strong>$Big<a href=\"$ListBy?eventgroupid=$EventGroupID\">$ShortGroup</a>$EBig</strong>\n";
   } else {
-    print "<strong>$Big$EventGroups{$EventGroupID}{ShortDescription}$EBig</strong>\n";
+    print "<strong>$Big$ShortGroup$EBig</strong>\n";
   }
   if ($Preferences{Components}{iCal}) {
     print ' '.ICalLink({ -eventgroupid => $EventGroupID });

From a7fa493af5f41ec8fec1d50a5ccd236df10c8f54 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Tue, 6 Aug 2013 15:27:34 -0500
Subject: [PATCH 100/163] Localize

---
 DocDB/cgi/UntaintListOfHTML.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/DocDB/cgi/UntaintListOfHTML.pm b/DocDB/cgi/UntaintListOfHTML.pm
index 5d187f0c..3fe75937 100644
--- a/DocDB/cgi/UntaintListOfHTML.pm
+++ b/DocDB/cgi/UntaintListOfHTML.pm
@@ -35,7 +35,7 @@ sub is_valid {
   my $RawValue = $self->value;
   my @Values = split /\0/,$RawValue;
   my @SafeValues = ();
-  foreach $Value (@Values) {
+  foreach my $Value (@Values) {
     my $SafeValue = encode_entities_numeric($Value);
     push @SafeValues, $SafeValue;
   }

From f79ea8c81fa2a15142c5644403020d858ca5afe7 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Tue, 6 Aug 2013 15:56:09 -0500
Subject: [PATCH 101/163] Make a bunch of event stuff SmartHTML

---
 DocDB/cgi/MeetingHTML.pm | 55 ++++++++++++++++++++++------------------
 1 file changed, 31 insertions(+), 24 deletions(-)

diff --git a/DocDB/cgi/MeetingHTML.pm b/DocDB/cgi/MeetingHTML.pm
index bba2ff86..f2e1e11b 100644
--- a/DocDB/cgi/MeetingHTML.pm
+++ b/DocDB/cgi/MeetingHTML.pm
@@ -385,24 +385,25 @@ sub SessionSeparatorLink ($) {
 
   my $Text;
   my $ToolTip;
+  my $EventTitle = SmartHTML({-text=>$Conferences{$SessionSeparators{$SessionSeparatorID}{ConferenceID}}{Title}});
+  my $SeparatorTitle = SmartHTML({-text=>$SessionSeparators{$SessionSeparatorID}{Title}});
+  my $Location = SmartHTML({-text=>$SessionSeparators{$SessionSeparatorID}{Location}});
   if ($ToolTipMode eq "TimeAndLoc") {
     $ToolTip = EuroTimeHM($SessionSeparators{$SessionSeparatorID}{StartTime})." ".
                EuroDate($SessionSeparators{$SessionSeparatorID}{StartTime});
   } else {
-    $ToolTip = $Conferences{$SessionSeparators{$SessionSeparatorID}{ConferenceID}}{Title}
-               ." - ".$SessionSeparators{$SessionSeparatorID}{Title};
+    $ToolTip = $EventTitle." - ".$SeparatorTitle;
   }
   if ($SessionSeparators{$SessionSeparatorID}{Location}) {
-    $ToolTip .= " - ".$SessionSeparators{$SessionSeparatorID}{Location};
+    $ToolTip .= " - ".$Location;
   }
 
   # Would like to use newlines instead of -. See mozilla bugs Bug 67127 and 45375
 
   if ($Format eq "full") {
-    $Text = $Conferences{$SessionSeparators{$SessionSeparatorID}{ConferenceID}}{Title}
-            .":".$SessionSeparators{$SessionSeparatorID}{Title};
+    $Text = $EventTitle.":".$SeparatorTitle;
   } else {
-    $Text = $SessionSeparators{$SessionSeparatorID}{Title};
+    $Text = $SeparatorTitle;
   }
 
   my $Link = "<a href=\"$URL\" title=\"$ToolTip\">$Text</a>";
@@ -683,8 +684,8 @@ sub EventHeader ($) {
   require "SQLUtilities.pm";
   require "Utilities.pm";
 
-  my $SessionTitle       = $Sessions{$SessionID}{Title};
-  my $EventTitle         = $Conferences{$EventID}{LongDescription};
+  my $SessionTitle       = SmartHTML({-text=>$Sessions{$SessionID}{Title}});
+  my $EventTitle         = SmartHTML({-text=>$Conferences{$EventID}{LongDescription}});
   my $SessionStartTime   = $Sessions{$SessionID}{StartTime};
   my $SeparatorStartTime = $SessionSeparators{$SeparatorID}{StartTime};
 
@@ -725,11 +726,11 @@ sub EventHeader ($) {
   }
 
   if ($Conferences{$EventID}{Location}) {
-    $Fields{"Event Location"} = $Conferences{$EventID}{Location};
+    $Fields{"Event Location"} = SmartHTML({-text=>$Conferences{$EventID}{Location}});
   }
 
   if ($Conferences{$EventID}{AltLocation}) {
-    $Fields{"Alt. Event Location"} = $Conferences{$EventID}{AltLocation};
+    $Fields{"Alt. Event Location"} = SmartHTML({-text=>$Conferences{$EventID}{AltLocation}});
   }
 
   if (@{$Conferences{$EventID}{Topics}}) {
@@ -755,11 +756,11 @@ sub EventHeader ($) {
   }
 
   if ($Sessions{$SessionID}{Location} && $DisplayMode ne "SingleSession") {
-    $Fields{"Location"} = $Sessions{$SessionID}{Location};
+    $Fields{"Location"} = SmartHTML({-text=>$Sessions{$SessionID}{Location}});
   }
 
   if ($Sessions{$SessionID}{AltLocation} && $DisplayMode ne "SingleSession") {
-    $Fields{"Alt. Location"} = $Sessions{$SessionID}{AltLocation};
+    $Fields{"Alt. Location"} = SmartHTML({-text=>$Sessions{$SessionID}{AltLocation}});
   }
 
   if (@{$Sessions{$SessionID}{Topics}}) {
@@ -775,25 +776,26 @@ sub EventHeader ($) {
         -listformat => "br",    -sortby    => "name",
        });
   }
-
+  # FIXME: May need to HTML::decode folowed by URI::encode
   if ($Conferences{$EventID}{URL}) {
-    $Fields{"External URL"} = "<a href=\"$Conferences{$EventID}{URL}\">$Conferences{$EventID}{Title}</a>";
+    $Fields{"External URL"} = "<a href=\"$Conferences{$EventID}{URL}\">".
+                              SmartHTML({-text=>$Conferences{$EventID}{Title}})."</a>";
   }
 
   if ($Conferences{$EventID}{Preamble}) {
-    $Fields{"Event Info"}   = URLify(AddLineBreaks($Conferences{$EventID}{Preamble}));
+    $Fields{"Event Info"} = SmartHTML({-text=>$Conferences{$EventID}{Preamble}, -addLineBreaks=>$TRUE, -makeURLs=>$TRUE});
   }
 
   if ($Conferences{$EventID}{Epilogue} && $SeparatorID) {
-    $Fields{"Event Wrapup"} = URLify(AddLineBreaks($Conferences{$EventID}{Epilogue}));
+    $Fields{"Event Wrapup"} = SmartHTML({-text=>$Conferences{$EventID}{Epilogue}, -addLineBreaks=>$TRUE, -makeURLs=>$TRUE});
   }
 
   if ($Sessions{$SessionID}{Description}) {
-    $Fields{"Session Info"} = URLify(AddLineBreaks($Sessions{$SessionID}{Description}));
+    $Fields{"Session Info"} = SmartHTML({-text=>$Sessions{$SessionID}{Description}, -addLineBreaks=>$TRUE, -makeURLs=>$TRUE});
   }
 
   if ($SessionSeparators{$SeparatorID}{Description}) {
-    $Fields{"Session Info"} = URLify(AddLineBreaks($SessionSeparators{$SeparatorID}{Description}));
+    $Fields{"Session Info"} = SmartHTML({-text=>$SessionSeparators{$SeparatorID}{Description}, -addLineBreaks=>$TRUE, -makeURLs=>$TRUE});
   }
 
   my $HTML;
@@ -829,7 +831,7 @@ sub PrintMeetingEpilogue ($) {
     print '<table class="MedPaddedTable LeftHeader CenteredTable Alternating" id="EventEpilogue">';
     print '<tr class="Odd"><th>Event Wrapup:</th>';
     print "<td>\n";
-    print URLify(AddLineBreaks($Conferences{$ConferenceID}{Epilogue}));
+    print SmartHTML({-text=>$Conferences{$ConferenceID}{Epilogue}, -addLineBreaks=>$TRUE, -makeURLs=>$TRUE});
     print "</td></tr></table>\n";
   }
 }
@@ -843,6 +845,9 @@ sub SessionInfo ($) {
   require "SQLUtilities.pm";
 
   FetchSessionByID($SessionID);
+  my $Title = SmartHTML({-text=>$Sessions{$SessionID}{Title}});
+  my $Description = SmartHTML({-text=>$Sessions{$SessionID}{Description}, -addLineBreaks=>$TRUE, -makeURLs=>$TRUE});
+  my $Location = SmartHTML({-text=>$Sessions{$SessionID}{Location}});
 
   # DocumentList puts a class on every cell, this only on Date
 
@@ -850,9 +855,9 @@ sub SessionInfo ($) {
   $HTML .= "<tr class=\"$RowClass\">";
   $HTML .= '<td class="Date">'.EuroDateHM($Sessions{$SessionID}{StartTime}).'</td>';
   $HTML .= "<td><a href=\"$DisplayMeeting?sessionid=$SessionID\">";
-  $HTML .=     "$Sessions{$SessionID}{Title}</a></td>";
-  $HTML .= '<td>'.URLify(AddLineBreaks($Sessions{$SessionID}{Description})).'</td>';
-  $HTML .= '<td>'.$Sessions{$SessionID}{Location}              .'</td>';
+  $HTML .=     "$Title</a></td>";
+  $HTML .= '<td>'.$Description.'</td>';
+  $HTML .= '<td>'.$Location.'</td>';
   $HTML .= '<td>'.TopicListByID({
               -linktype   => "event", -topicids    => $Sessions{$SessionID}{Topics},
               -listformat => "br",    -listelement => "short", -sortby => "name",
@@ -874,13 +879,15 @@ sub PrintSessionSeparatorInfo ($) {
 
   FetchSessionSeparatorByID($SessionSeparatorID);
   my $Link = SessionSeparatorLink( {-sessionseparatorid => $SessionSeparatorID} );
+  my $Description = SmartHTML({-text=>$SessionSeparators{$SessionSeparatorID}{Description}, -addLineBreaks=>$TRUE, -makeURLs=>$TRUE});
+  my $Location = SmartHTML({-text=>$SessionSeparators{$SessionSeparatorID}{Location}});
 
   # DocumentList puts a class on every cell, this only on Date
 
   print "<td class=\"Date\">",EuroDateHM($SessionSeparators{$SessionSeparatorID}{StartTime}),"</td>\n";
   print "<td>$Link</td>\n";
-  print "<td>",URLify(AddLineBreaks($SessionSeparators{$SessionSeparatorID}{Description})),"</td>\n";
-  print "<td>",$SessionSeparators{$SessionSeparatorID}{Location},"</td>\n";
+  print "<td>",$Description,"</td>\n";
+  print "<td>",$Location,"</td>\n";
   print '<td>&nbsp;</td><td>&nbsp;</td>'; # Topics and Moderators
 }
 

From de6c88be038d62ea761c977ad51abbc8e65f5988 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Tue, 6 Aug 2013 16:00:19 -0500
Subject: [PATCH 102/163] Fix right sidebar

---
 DocDB/cgi/MeetingHTML.pm | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/DocDB/cgi/MeetingHTML.pm b/DocDB/cgi/MeetingHTML.pm
index f2e1e11b..a16c1b2c 100644
--- a/DocDB/cgi/MeetingHTML.pm
+++ b/DocDB/cgi/MeetingHTML.pm
@@ -621,7 +621,7 @@ sub PrintEventRightSidebar ($) {
     if ($EventID == $OtherEventID) {
 
       if ($DisplayMode eq "SingleSession" || $DisplayMode eq "Event") {
-        print "<li><strong>",$Conferences{$EventID}{Title},"</strong>\n";
+        print "<li><strong>",SmartHTML({-text=>$Conferences{$EventID}{Title}}),"</strong>\n";
       } else {
         print "<li>",EventLink(-eventid => $OtherEventID, -tooltip => "Date"),"\n";
       }
@@ -636,7 +636,7 @@ sub PrintEventRightSidebar ($) {
           my $OtherSeparatorID = $MeetingOrders{$MeetingOrderID}{SessionSeparatorID};
           if ($OtherSessionID) {
             if ($OtherSessionID == $SessionID) {
-              print "<li><strong>",$Sessions{$SessionID}{Title},"</strong></li>\n";
+              print "<li><strong>",SmartHTML({-text=>$Sessions{$SessionID}{Title}}),"</strong></li>\n";
             } else {
               FetchSessionByID($OtherSessionID);
               my $Link = SessionLink(-sessionid => $OtherSessionID,
@@ -645,7 +645,7 @@ sub PrintEventRightSidebar ($) {
             }
           } elsif ($OtherSeparatorID) {
             if ($OtherSeparatorID == $SeparatorID) {
-              print "<li><strong>",$SessionSeparators{$SeparatorID}{Title},"</strong></li>\n";
+              print "<li><strong>",SmartHTML({-text=>$SessionSeparators{$SeparatorID}{Title}}),"</strong></li>\n";
             } else {
               FetchSessionSeparatorByID($OtherSeparatorID);
               my $Link = SessionSeparatorLink({-sessionseparatorid => $OtherSeparatorID,

From 56ea31f49543c27e4cb3e1db1f8c222cdb9eb511 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Tue, 6 Aug 2013 16:51:07 -0500
Subject: [PATCH 103/163] Fix SessionLink, ListEventsBy

---
 DocDB/cgi/ListEventsBy   |  8 ++++----
 DocDB/cgi/MeetingHTML.pm | 17 ++++++++++-------
 2 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/DocDB/cgi/ListEventsBy b/DocDB/cgi/ListEventsBy
index 6be818d0..6c2955aa 100755
--- a/DocDB/cgi/ListEventsBy
+++ b/DocDB/cgi/ListEventsBy
@@ -171,8 +171,8 @@ if (@HashIDs) {
       }
 
       $Title    = SessionLink(-sessionid => $SessionID, -format => "full");
-      $Location = join '<br/>',$Sessions{$SessionID}{Location},
-                               $Sessions{$SessionID}{AltLocation};
+      $Location = join '<br/>',SmartHTML({-text=>$Sessions{$SessionID}{Location}}),
+                               SmartHTML({-text=>$Sessions{$SessionID}{AltLocation}});
       $Topics   = TopicListByID({ -linktype => "event", -listformat => "br", -sortby => "name",
                                   -topicids => $Sessions{$SessionID}{Topics}, });
 
@@ -193,8 +193,8 @@ if (@HashIDs) {
       }
 
       $Title    = EventLink(-eventid => $EventID,);
-      $Location = join '<br/>',$Conferences{$EventID}{Location},
-                               $Conferences{$EventID}{AltLocation};
+      $Location = join '<br/>',SmartHTML({-text=>$Conferences{$EventID}{Location}}),
+                               SmartHTML({-text=>$Conferences{$EventID}{AltLocation}});
       $Topics   = TopicListByID({ -linktype => "event", -listformat => "br", -sortby => "name",
                                   -topicids => $Conferences{$EventID}{Topics}, });
       $Time = 'All day/no time';
diff --git a/DocDB/cgi/MeetingHTML.pm b/DocDB/cgi/MeetingHTML.pm
index a16c1b2c..d7d0957a 100644
--- a/DocDB/cgi/MeetingHTML.pm
+++ b/DocDB/cgi/MeetingHTML.pm
@@ -337,33 +337,36 @@ sub SessionLink (%) {
 
   my $Text;
   my $ToolTip;
+  my $EventTitle = SmartHTML({-text=>$Conferences{$EventID}{Title}});
+  my $SessionTitle = SmartHTML({-text=>$Sessions{$SessionID}{Title}});
+  my $Location = SmartHTML({-text=>$Sessions{$SessionID}{Location}});
   if ($ToolTipMode eq "TimeAndLoc") {
     $ToolTip = EuroTimeHM($Sessions{$SessionID}{StartTime})." ".
                EuroDate($Sessions{$SessionID}{StartTime});
   } else {
     if ($Conferences{$EventID}{Title} eq $Sessions{$SessionID}{Title}) {
-      $ToolTip = $Sessions{$SessionID}{Title};
+      $ToolTip = $SessionTitle;
     } else {
-      $ToolTip = $Conferences{$EventID}{Title}." - ".$Sessions{$SessionID}{Title};
+      $ToolTip = $EventTitle." - ".$SessionTitle;
     }
   }
   if ($Sessions{$SessionID}{Location}) {
-    $ToolTip .= " - ".$Sessions{$SessionID}{Location};
+    $ToolTip .= " - ".$Location;
   }
   # Would like to use newlines instead of -. See mozilla bugs Bug 67127 and 45375
 
   if ($Format eq "full") {
     if ($Conferences{$EventID}{Title} && $Sessions{$SessionID}{Title} &&
         $Conferences{$EventID}{Title} ne $Sessions{$SessionID}{Title}) {
-      $Text = $Conferences{$EventID}{Title}.":".$Sessions{$SessionID}{Title};
+      $Text = $EventTitle.":".$SessionTitle;
     } else {
-      $Text = $Conferences{$EventID}{Title};
+      $Text = $EventTitle;
     }
   } else {
     if ($Text = $Sessions{$SessionID}{Title}) {
-      $Text = $Sessions{$SessionID}{Title};
+      $Text = $SessionTitle;
     } else {
-      $Text = $Conferences{$EventID}{Title};
+      $Text = $EventTitle;
     }
   }
 

From dbab0c0f26e45f7f1e0d9406e9afff2d58cd31e0 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 7 Aug 2013 10:45:42 -0500
Subject: [PATCH 104/163] Fix event selectors

---
 DocDB/cgi/MeetingHTML.pm | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/DocDB/cgi/MeetingHTML.pm b/DocDB/cgi/MeetingHTML.pm
index d7d0957a..6c305441 100644
--- a/DocDB/cgi/MeetingHTML.pm
+++ b/DocDB/cgi/MeetingHTML.pm
@@ -1146,10 +1146,10 @@ sub EventGroupSelect ($) {
   my %Labels        = ();
   foreach my $EventGroupID (@EventGroupIDs) {
     if ($Format eq "full") {
-      $Labels{$EventGroupID} = $EventGroups{$EventGroupID}{ShortDescription}.
-      ":".$EventGroups{$EventGroupID}{LongDescription};
+      $Labels{$EventGroupID} = SmartHTML({-text => $EventGroups{$EventGroupID}{ShortDescription}},).
+      ":".SmartHTML({-text => $EventGroups{$EventGroupID}{LongDescription}},);
     } else {
-      $Labels{$EventGroupID} = $EventGroups{$EventGroupID}{ShortDescription};
+      $Labels{$EventGroupID} = SmartHTML({-text => $EventGroups{$EventGroupID}{ShortDescription}},);
     }
   }
 
@@ -1188,8 +1188,8 @@ sub EventSelect ($) {
   my %Labels        = ();
   foreach my $ConferenceID (@ConferenceIDs) {
     if ($Format eq "full") {
-      $Labels{$ConferenceID} = $EventGroups{$Conferences{$ConferenceID}{EventGroupID}}{ShortDescription}.":".
-                               $Conferences{$ConferenceID}{Title} .
+      $Labels{$ConferenceID} = SmartHTML({-text => $EventGroups{$Conferences{$ConferenceID}{EventGroupID}}{ShortDescription}},).":".
+                               SmartHTML({-text => $Conferences{$ConferenceID}{Title}},).
                                " (".EuroDate($Conferences{$ConferenceID}{StartDate}).")";
     }
   }

From 8b43424bc27db91522932131f341e8f16a4df153 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 7 Aug 2013 11:03:43 -0500
Subject: [PATCH 105/163] Protect agains tags in old event groups as updating,
 try to fix SessionModify

---
 DocDB/cgi/EventAdministerForm | 5 +++--
 DocDB/cgi/SessionModify       | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/DocDB/cgi/EventAdministerForm b/DocDB/cgi/EventAdministerForm
index 71dd3300..7fc061a8 100755
--- a/DocDB/cgi/EventAdministerForm
+++ b/DocDB/cgi/EventAdministerForm
@@ -96,13 +96,14 @@ if ($SubForm eq "eventgroup") {
   if ($Action eq "Delete") {
     &DeleteEventGroup(-eventgroupid => $EventGroupID, -force => $Force);
   } elsif ($Action eq "Modify") {
+    my $OldShortDescription = SmartHTML({-text => $EventGroups{$EventGroupID}{ShortDescription}},);
     if ($ShortDescription) {
-      push @ActionStack,"Updated short description of $EventGroups{$EventGroupID}{ShortDescription}";
+      push @ActionStack,"Updated short description of $OldShortDescription";
       my $Update = $dbh->prepare("update EventGroup set ShortDescription=? where EventGroupID=?");
       $Update -> execute($ShortDescription,$EventGroupID);
     }
     if ($LongDescription) {
-      push @ActionStack,"Updated long description of $EventGroups{$EventGroupID}{ShortDescription}";
+      push @ActionStack,"Updated long description of $OldShortDescription";
       my $Update = $dbh->prepare("update EventGroup set LongDescription=? where EventGroupID=?");
       $Update -> execute($LongDescription,$EventGroupID);
     }
diff --git a/DocDB/cgi/SessionModify b/DocDB/cgi/SessionModify
index 2c9942b9..21fdd4cd 100755
--- a/DocDB/cgi/SessionModify
+++ b/DocDB/cgi/SessionModify
@@ -85,7 +85,7 @@ my $SessionMonth = $Untaint -> extract(-as_safehtml => "sessionmonth") || "";
 my $SessionYear = $Untaint -> extract(-as_integer => "sessionyear") || 0;
 my $SessionHour = $Untaint -> extract(-as_integer => "sessiontime") || 0;
 
-my @SessionOrderIDs = @{ $Untaint -> extract(-as_listofint => "sessionorderid") || undef };
+my @SessionOrderIDs = @{ $Untaint -> extract(-as_listofhtml => "sessionorderid") || undef };
 my @TalkOrders = @{ $Untaint -> extract(-as_listofhtml => "talkorder") || undef };
 my @TalkTitles = @{ $Untaint -> extract(-as_listofhtml => "talktitle") || undef };
 my @TalkNotes = @{ $Untaint -> extract(-as_listofhtml => "talknote") || undef };

From 1655ac8bdeea76ad1789195f642896f39422c61f Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 7 Aug 2013 11:18:36 -0500
Subject: [PATCH 106/163] Fix issues with UntaintListOfHTML

---
 DocDB/cgi/UntaintListOfHTML.pm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/DocDB/cgi/UntaintListOfHTML.pm b/DocDB/cgi/UntaintListOfHTML.pm
index 3fe75937..bc1564e2 100644
--- a/DocDB/cgi/UntaintListOfHTML.pm
+++ b/DocDB/cgi/UntaintListOfHTML.pm
@@ -22,12 +22,12 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-package CGI::Untaint::listofhtmls;
+package CGI::Untaint::listofhtml;
 
 $VERSION = '1.00';
 
 use strict;
-use base 'CGI::Untaint::object';
+use base 'CGI::Untaint::listofwords';
 use HTML::Entities qw(encode_entities_numeric);
 
 sub is_valid {

From da724a691e0b645a91dfa47150d720dc27a5c189 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 7 Aug 2013 11:37:43 -0500
Subject: [PATCH 107/163] Fix untaint list of HTML

---
 DocDB/cgi/UntaintListOfHTML.pm | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/DocDB/cgi/UntaintListOfHTML.pm b/DocDB/cgi/UntaintListOfHTML.pm
index bc1564e2..a5d1ecb9 100644
--- a/DocDB/cgi/UntaintListOfHTML.pm
+++ b/DocDB/cgi/UntaintListOfHTML.pm
@@ -30,6 +30,8 @@ use strict;
 use base 'CGI::Untaint::listofwords';
 use HTML::Entities qw(encode_entities_numeric);
 
+sub _untaint_re { qr/^(.*(\000)*)+$/ }
+
 sub is_valid {
   my $self = shift;
   my $RawValue = $self->value;

From 75daff35c1295a41856ca7ed8f60a9278395163d Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 7 Aug 2013 11:47:02 -0500
Subject: [PATCH 108/163] Safe preambles and epilogues

---
 DocDB/cgi/MeetingHTML.pm | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/DocDB/cgi/MeetingHTML.pm b/DocDB/cgi/MeetingHTML.pm
index 6c305441..6447b5e3 100644
--- a/DocDB/cgi/MeetingHTML.pm
+++ b/DocDB/cgi/MeetingHTML.pm
@@ -76,19 +76,21 @@ sub EventURLBox (;%) {
 
 sub ConferencePreambleBox {
   require "FormElements.pm";
+  my $SafePreamble = SmartHTML({-text=>$MeetingDefaultPreamble});
   my $ElementTitle = &FormElementTitle(-helplink  => "meetpreepi",
                                        -helptext  => "Event Preamble");
   print $ElementTitle,"\n";
-  print $query -> textarea (-name => 'meetpreamble', -default => $MeetingDefaultPreamble,
+  print $query -> textarea (-name => 'meetpreamble', -default => $SafePreamble,
                             -columns => 50, -rows => 7);
 };
 
 sub ConferenceEpilogueBox {
   require "FormElements.pm";
+  my $SafeEpilogue = SmartHTML({-text=>$MeetingDefaultEpilogue});
   my $ElementTitle = &FormElementTitle(-helplink  => "meetpreepi",
                                        -helptext  => "Event Epilogue");
   print $ElementTitle,"\n";
-  print $query -> textarea (-name => 'meetepilogue', -default => $MeetingDefaultEpilogue,
+  print $query -> textarea (-name => 'meetepilogue', -default => $SafeEpilogue,
                             -columns => 50, -rows => 7);
 };
 

From 1d096b34e55127a412f2620df4be78dd8fecf960 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 7 Aug 2013 11:56:36 -0500
Subject: [PATCH 109/163] Safe -> SmartHTML for text area

---
 DocDB/cgi/FormElements.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/DocDB/cgi/FormElements.pm b/DocDB/cgi/FormElements.pm
index 78f13fea..9c68bf60 100644
--- a/DocDB/cgi/FormElements.pm
+++ b/DocDB/cgi/FormElements.pm
@@ -381,7 +381,7 @@ sub TextArea (%) {
                                        -nobreak   => $NoBreak  ,
                                        -required  => $Required );
   print $ElementTitle,"\n";
-  print $query -> textarea (-name    => $Name,    -default   => &SafeHTML($Default),
+  print $query -> textarea (-name    => $Name,    -default   => SmartHTML({-text=>$Default}),
                             -columns => $Columns, -rows      => $Rows);
 }
 

From 73f01e5f3bb695d78b5d287746947150e9e7dda7 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 7 Aug 2013 13:10:53 -0500
Subject: [PATCH 110/163] Fix doctype buttons and list by topic

---
 DocDB/cgi/ListBy          | 5 +++--
 DocDB/cgi/RevisionHTML.pm | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/DocDB/cgi/ListBy b/DocDB/cgi/ListBy
index 51571761..24630aa4 100755
--- a/DocDB/cgi/ListBy
+++ b/DocDB/cgi/ListBy
@@ -118,8 +118,9 @@ if ($Days) {
     $SubTopicMessage = "(subtopic of ".TopicLink({-topicid => $ParentTopicID}).")";
   }
 
-  $Message = "These documents on <span class=\"Highlight\">$Topics{$TopicID}{Long}
-              </span> $SubTopicMessage ";
+  $Message = "These documents on <span class=\"Highlight\">".
+             SmartHTML({-text=>$Topics{$TopicID}{Long}}).
+             "</span> $SubTopicMessage ";
   if ($HasSubTopics) {
     $Message .= "and sub-topics ";
   }
diff --git a/DocDB/cgi/RevisionHTML.pm b/DocDB/cgi/RevisionHTML.pm
index 0d448e04..06a1e5f4 100644
--- a/DocDB/cgi/RevisionHTML.pm
+++ b/DocDB/cgi/RevisionHTML.pm
@@ -102,7 +102,7 @@ sub DocTypeButtons (%) {
   my %ShortTypes = ();
 
   foreach my $DocTypeID (@DocTypeIDs) {
-    $ShortTypes{$DocTypeID} = $DocumentTypes{$DocTypeID}{SHORT};
+    $ShortTypes{$DocTypeID} = SmartHTML({-text=>$DocumentTypes{$DocTypeID}{SHORT}});
   }
 
   my $ElementTitle = &FormElementTitle(-helplink  => "doctype" ,

From 7c87869d551d5443841a173d0c990a9453bf1007 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 7 Aug 2013 13:23:09 -0500
Subject: [PATCH 111/163] Fix ListEventsBy and ListGroupUsers

---
 DocDB/cgi/ListEventsBy   |  9 ++++++---
 DocDB/cgi/ListGroupUsers | 15 ++++++++++-----
 2 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/DocDB/cgi/ListEventsBy b/DocDB/cgi/ListEventsBy
index 6c2955aa..b72e6c44 100755
--- a/DocDB/cgi/ListEventsBy
+++ b/DocDB/cgi/ListEventsBy
@@ -92,7 +92,9 @@ if ($TopicID) {
       $EventHash{$ID} = $Hash{$ID};
     }
   }
-  $HTML .= "<h4>Events for <span class=\"Highlight\">$Topics{$TopicID}{Long} </span>";
+  $HTML .= "<h4>Events for <span class=\"Highlight\">";
+  $HTML .= SmartHTML({-text=>$Topics{$TopicID}{Long}});
+  $HTML .= " </span>";
   if (scalar(@ChildTopicIDs) > 1) {
     $HTML .= " and its sub-topics";
   }
@@ -106,8 +108,9 @@ if ($TopicID) {
 
   my $Link = AuthorLink($AuthorID);
 
-  $HTML .= "<h4>Events moderated by <span class=\"Highlight\">$Link of
-            $Institutions{$Authors{$AuthorID}{InstitutionID}}{LONG}</span>";
+  $HTML .= "<h4>Events moderated by <span class=\"Highlight\">$Link of";
+  $HTML .= SmartHTML({-text=>$Institutions{$Authors{$AuthorID}{InstitutionID}}{LONG}});
+  $HTML .= "</span>";
   if ($Preferences{Components}{iCal}) {
     $HTML .= ' '.ICalLink({ -authorid => $AuthorID });
   }
diff --git a/DocDB/cgi/ListGroupUsers b/DocDB/cgi/ListGroupUsers
index 6b262111..27bf7ee2 100755
--- a/DocDB/cgi/ListGroupUsers
+++ b/DocDB/cgi/ListGroupUsers
@@ -71,10 +71,11 @@ print "<p>These are the security groups withing DocDB and a summary of their
 print '<table class="CenteredTable LowPaddedTable">'."\n";
 print '<tr><th>Group</th><th>Description</th><th>Admin?</th><th>Create?</th><th>View?</th></tr>'."\n";
 foreach my $SecurityGroupID (@SecurityGroupIDs) {
+  my $Name = SmartHTML({-text => $SecurityGroups{$SecurityGroupID}{NAME}});
+  my $Description = SmartHTML({-text => $SecurityGroups{$SecurityGroupID}{Description}});
   print '<tr>';
-  print '<td><a href="#'.$SecurityGroups{$SecurityGroupID}{NAME}.'">'.
-        $SecurityGroups{$SecurityGroupID}{NAME}.'</a></td>';
-  print '<td>'.$SecurityGroups{$SecurityGroupID}{Description}.'</td>';
+  print '<td><a href="#'.$Name.'">'.$Name.'</a></td>';
+  print '<td>'.$Description.'</td>';
   print '<td>'.('No','Yes')[$SecurityGroups{$SecurityGroupID}{CanAdminister}].'</td>';
   print '<td>'.('No','Yes')[$SecurityGroups{$SecurityGroupID}{CanCreate}].    '</td>';
   print '<td>'.('No','Yes')[$SecurityGroups{$SecurityGroupID}{CanView}].      '</td>';
@@ -88,13 +89,17 @@ my @EmailUserIDs = sort EmailUserIDsByName GetEmailUserIDs();
 print "<h2>DocDB Users By Group</h2>\n";
 
 foreach my $SecurityGroupID (@SecurityGroupIDs) {
-  my $GroupName = $SecurityGroups{$SecurityGroupID}{NAME};
+  my $GroupName = SmartHTML({-text => $SecurityGroups{$SecurityGroupID}{NAME}});
+
   my @EmailUserIDs = sort EmailUserIDsByName FetchEmailUserIDsBySecurityGroup($SecurityGroupID);
   if (@EmailUserIDs) {
     print "<p><a name=\"$GroupName\" /><strong>$GroupName has these members:</strong></p>\n<ul>\n";
     foreach my $EmailUserID (@EmailUserIDs) {
       if ($EmailUser{$EmailUserID}{Name}) {
-        print "<li>$EmailUser{$EmailUserID}{Name} ($EmailUser{$EmailUserID}{Username}, $EmailUser{$EmailUserID}{EmailAddress})</li>\n";
+        my $Name = SmartHTML({-text => $EmailUser{$EmailUserID}{Name}});
+        my $Username = SmartHTML({-text => $EmailUser{$EmailUserID}{Username}});
+        my $Email = SmartHTML({-text => $EmailUser{$EmailUserID}{EmailAddress}});
+        print "<li>$Name ($Username, $Email)</li>\n";
       }
     }
     print "</ul>\n";

From 4ebbe15e51ba2f590c9926f80fde7e921d676ddd Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 7 Aug 2013 13:37:51 -0500
Subject: [PATCH 112/163] Fix ListGroups, ListKeywords, ListTypes

---
 DocDB/cgi/KeywordHTML.pm      | 2 +-
 DocDB/cgi/ListEventsBy        | 2 +-
 DocDB/cgi/ListGroups          | 2 +-
 DocDB/cgi/ResponseElements.pm | 4 ++--
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/DocDB/cgi/KeywordHTML.pm b/DocDB/cgi/KeywordHTML.pm
index 4e905f31..fa63711c 100644
--- a/DocDB/cgi/KeywordHTML.pm
+++ b/DocDB/cgi/KeywordHTML.pm
@@ -237,7 +237,7 @@ sub KeywordLinkByID ($;%) {
 
   &FetchKeyword($KeywordID);
   my $SafeShortKeyword = SmartHTML( {-text => $Keywords{$KeywordID}{Short}} );
-  my $SafeLongKeyword = SmartHTML( {-text => $Keywords{$KeywordID}{long}} );
+  my $SafeLongKeyword = SmartHTML( {-text => $Keywords{$KeywordID}{Long}} );
   my $UnsafeURI = decode_entities($Keywords{$KeywordID}{Short});
   my $SafeURI = uri_escape($UnsafeURI);
   my $Link;
diff --git a/DocDB/cgi/ListEventsBy b/DocDB/cgi/ListEventsBy
index b72e6c44..b3f3219c 100755
--- a/DocDB/cgi/ListEventsBy
+++ b/DocDB/cgi/ListEventsBy
@@ -108,7 +108,7 @@ if ($TopicID) {
 
   my $Link = AuthorLink($AuthorID);
 
-  $HTML .= "<h4>Events moderated by <span class=\"Highlight\">$Link of";
+  $HTML .= "<h4>Events moderated by <span class=\"Highlight\">$Link of ";
   $HTML .= SmartHTML({-text=>$Institutions{$Authors{$AuthorID}{InstitutionID}}{LONG}});
   $HTML .= "</span>";
   if ($Preferences{Components}{iCal}) {
diff --git a/DocDB/cgi/ListGroups b/DocDB/cgi/ListGroups
index 0b5a37c4..98237d4b 100755
--- a/DocDB/cgi/ListGroups
+++ b/DocDB/cgi/ListGroups
@@ -43,7 +43,7 @@ print "<tr><th>Group</th><th>Description</th></tr>\n";
 foreach my $GroupID (keys %SecurityGroups) {
   print "<tr>\n";
   print "<td>",SecurityLink( {-groupid => $GroupID} ),"</td>\n";
-  print "<td>",$SecurityGroups{$GroupID}{Description},"</td>\n";
+  print "<td>",SmartHTML({-text=>$SecurityGroups{$GroupID}{Description}}),"</td>\n";
   print "</tr>\n";
 }
 
diff --git a/DocDB/cgi/ResponseElements.pm b/DocDB/cgi/ResponseElements.pm
index 4d61976a..46ba8776 100644
--- a/DocDB/cgi/ResponseElements.pm
+++ b/DocDB/cgi/ResponseElements.pm
@@ -215,9 +215,9 @@ sub TypeLink {
     $link .= "<a href=\"$ListBy?typeid=$TypeID\">";
   }
   if ($mode eq "short") {
-    $link .= $DocumentTypes{$TypeID}{SHORT};
+    $link .= SmartHTML({-text => $DocumentTypes{$TypeID}{SHORT}});
   } else {
-    $link .= $DocumentTypes{$TypeID}{LONG};
+    $link .= SmartHTML({-text => $DocumentTypes{$TypeID}{LONG}});
   }
   unless ($Public) {
     $link .= "</a>";

From 77bc489d414f868291cc22baacb1d0ebb14f1ac7 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 7 Aug 2013 16:11:53 -0500
Subject: [PATCH 113/163] Debug

---
 DocDB/cgi/MeetingModify | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/DocDB/cgi/MeetingModify b/DocDB/cgi/MeetingModify
index af6cef6f..83e6ded4 100755
--- a/DocDB/cgi/MeetingModify
+++ b/DocDB/cgi/MeetingModify
@@ -90,6 +90,10 @@ my @MeetingModifyGroupIDs = @{ $Untaint -> extract(-as_listofint => "meetingmodi
 my @MeetingTopicIDs = @{ $Untaint -> extract(-as_listofint => "topics") || undef };
 my @MeetingModeratorIDs = @{ $Untaint -> extract(-as_listofint => "moderators") || undef };
 
+print STDERR "TopicIDs:",@MeetingTopicIDs,"\n";
+print STDERR "Moderators:",@MeetingModeratorIDs,"\n";
+print STDERR "Mode: $Mode\n";
+
 my @SessionYears = @{ $Untaint -> extract(-as_listofint => "sessionyear") || undef };
 my @SessionMonths = @{ $Untaint -> extract(-as_listofhtml => "sessionmonth") || undef };
 my @SessionDays = @{ $Untaint -> extract(-as_listofint => "sessionday") || undef };

From fcf8aff55d7515ef917e7186b2b25a139e0323cd Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 7 Aug 2013 16:25:41 -0500
Subject: [PATCH 114/163] Should not fetch conference when confID is 0

---
 DocDB/cgi/MeetingSQL.pm | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/DocDB/cgi/MeetingSQL.pm b/DocDB/cgi/MeetingSQL.pm
index ab409376..ca1e33a5 100644
--- a/DocDB/cgi/MeetingSQL.pm
+++ b/DocDB/cgi/MeetingSQL.pm
@@ -255,6 +255,9 @@ sub FetchEventByEventID { # Fetches an event by EventID
   unless ($LimitInfo) {
     push @DebugStack,"Getting all info for event $EventID.";
   }
+  unless ($EventID) {
+    return 0;
+  }  
   if ($Conferences{$EventID}{EventGroupID}) { # We already have this one
     if ($Conferences{$EventID}{HaveAllInfo} || $LimitInfo) {
       return $EventID;

From 9b82c88903cfb45337b0e8ebce023d574ad2d983 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 7 Aug 2013 16:34:50 -0500
Subject: [PATCH 115/163] Don't return values when input value is null

---
 DocDB/cgi/MeetingSQL.pm        |   8 ++-
 DocDB/cgi/TalkHintUtilities.pm | 104 +++++++++++++++++----------------
 DocDB/cgi/TalkSQL.pm           |  62 +++++++++++---------
 3 files changed, 95 insertions(+), 79 deletions(-)

diff --git a/DocDB/cgi/MeetingSQL.pm b/DocDB/cgi/MeetingSQL.pm
index ca1e33a5..e536ab96 100644
--- a/DocDB/cgi/MeetingSQL.pm
+++ b/DocDB/cgi/MeetingSQL.pm
@@ -257,7 +257,7 @@ sub FetchEventByEventID { # Fetches an event by EventID
   }
   unless ($EventID) {
     return 0;
-  }  
+  }
   if ($Conferences{$EventID}{EventGroupID}) { # We already have this one
     if ($Conferences{$EventID}{HaveAllInfo} || $LimitInfo) {
       return $EventID;
@@ -322,6 +322,9 @@ sub FetchEventByEventID { # Fetches an event by EventID
 
 sub FetchSessionsByConferenceID ($) {
   my ($ConferenceID) = @_;
+  unless ($ConferenceID) {
+    return undef;
+  }
   my $SessionID;
   my @SessionIDs = ();
   my $SessionList   = $dbh -> prepare(
@@ -369,6 +372,9 @@ sub ClearSessions () {
 sub FetchSessionByID ($) {
   my ($SessionID) = @_;
 
+  unless ($SessionID) {
+    return undef;
+  }
   if ($Sessions{$SessionID}{TimeStamp}) {
     return $SessionID;
   }
diff --git a/DocDB/cgi/TalkHintUtilities.pm b/DocDB/cgi/TalkHintUtilities.pm
index bac5d07b..4bafdda4 100644
--- a/DocDB/cgi/TalkHintUtilities.pm
+++ b/DocDB/cgi/TalkHintUtilities.pm
@@ -2,7 +2,7 @@
 # Description: Routines to deal with Talk Hints
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified: 
+#    Modified:
 #
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
@@ -10,7 +10,7 @@
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -26,13 +26,15 @@ sub ReHintTalksBySessionID ($) {
   require "MeetingSQL.pm";
   require "TalkSQL.pm";
   my ($SessionID) = @_;
-
+  unless ($SessionID) {
+    return;
+  }
   if ($Public) { # Can't write to DB
     return;
-  }  
+  }
 
   # Get valid Document IDs in the window
-  
+
   &FetchSessionByID($SessionID);
   my @SessionTalkIDs = &FetchSessionTalksBySessionID($SessionID);
   my %DocumentIDs    = &GetHintDocuments($SessionID,$TalkHintWindow);
@@ -41,39 +43,39 @@ sub ReHintTalksBySessionID ($) {
 
   # Loop over all session talk IDs
 
-  foreach my $SessionTalkID (@SessionTalkIDs) { 
+  foreach my $SessionTalkID (@SessionTalkIDs) {
     if($SessionTalks{$SessionTalkID}{Confirmed}) {next;}
     my @MatchedDocumentIDs = &TalkMatches($SessionTalkID,$TalkMatchThreshold,%DocumentIDs);
     my $BestDocumentID = shift @MatchedDocumentIDs;
     if ($BestDocumentID) {
-      my $BestDocUpdate = $dbh_w -> prepare("update SessionTalk set DocumentID=? where SessionTalkID=?"); 
+      my $BestDocUpdate = $dbh_w -> prepare("update SessionTalk set DocumentID=? where SessionTalkID=?");
       $BestDocUpdate -> execute($BestDocumentID,$SessionTalkID); # Update database
     } else {
-      my $BestDocUpdate = $dbh_w -> prepare("update SessionTalk set DocumentID=? where SessionTalkID=?"); 
+      my $BestDocUpdate = $dbh_w -> prepare("update SessionTalk set DocumentID=? where SessionTalkID=?");
       $BestDocUpdate -> execute(0,$SessionTalkID); # Update database
-    }   
+    }
   }
 }
 
 sub FuzzyStringMatch ($$) {
 #  use String::Approx qw(amatch);
-  
+
   # FIXME: Look at soundex and fuzzy matching, cookbook 1.16 and 6.13
-  
+
   my ($String1,$String2) = @_;
-  
+
   $String1 =~ s/\W//g; # FIXME: Should be better way to ignore ()'s
   $String2 =~ s/\W//g;
- 
+
   $String1 =~ tr/[A-Z]/[a-z]/;
   $String2 =~ tr/[A-Z]/[a-z]/;
-  
+
   my @Words1 = split /\s+/,$String1;
   my @Words2 = split /\s+/,$String2;
-  
-  @Words1 = &RemoveArray(\@Words1,@MatchIgnoreWords); 
-  @Words2 = &RemoveArray(\@Words2,@MatchIgnoreWords); 
-  
+
+  @Words1 = &RemoveArray(\@Words1,@MatchIgnoreWords);
+  @Words2 = &RemoveArray(\@Words2,@MatchIgnoreWords);
+
   my $Matches = 0;
   foreach my $Word (@Words1) {
     my $WordLength = length $Word;
@@ -83,31 +85,31 @@ sub FuzzyStringMatch ($$) {
         $Matches += $WordLength/6;
       } else {
         ++$Matches;
-      }		
-    }  
+      }
+    }
   }
-  
+
   my $NWords1 = @Words1;
   my $NWords2 = @Words2;
-  
+
   # Use NWords to calculate a "fraction" of matches, restrict to 3 - 10
-  
+
   $NWords = 3;
-  
+
   if ($NWords1 > $NWords) {$NWords = $NWords1;}
   if ($NWords2 > $NWords) {$NWords = $NWords2;}
   if ($NWords > 10)       {$NWords = 10;}
- 
+
   my $MatchScore = 0;
   if ($Matches >= 1.1) {
     $MatchScore = $Matches/$NWords * 10;
   }
-  return $MatchScore;  
+  return $MatchScore;
 }
 
 sub GetHintDocuments ($$) {
   my ($SessionID,$SearchDays) = @_;
-  
+
   require "MeetingSQL.pm";
   require "TalkSQL.pm";
   require "DocumentSQL.pm";
@@ -116,7 +118,7 @@ sub GetHintDocuments ($$) {
   require "AuthorSQL.pm";
   require "TalkHintSQL.pm";
   require "Utilities.pm";
-  
+
   &FetchSessionByID($SessionID);
   my @SessionTalkIDs   = &FetchSessionTalksBySessionID($SessionID);
   my $ConferenceID     = $Sessions{$SessionID}{ConferenceID};
@@ -126,21 +128,21 @@ sub GetHintDocuments ($$) {
   my $EndDate      = $Conferences{$ConferenceID}{EndDate};
 
   # Get list of documents already confirmed with any conference
-  
+
   my @ConfirmedDocumentIDs = &ConfirmedDocuments();
   my %ConfirmedDocumentIDs = ();
   foreach my $ConfirmedDocumentID (@ConfirmedDocumentIDs) {
     $ConfirmedDocumentIDs{$ConfirmedDocumentID} = 1;
   }
-  
-  my $DocumentList = $dbh -> prepare("select DocumentID from DocumentRevision where DocRevID=? and Obsolete=0"); 
+
+  my $DocumentList = $dbh -> prepare("select DocumentID from DocumentRevision where DocRevID=? and Obsolete=0");
 
   # Find documents in a time window
 
   my $TimedList = $dbh -> prepare("select DocRevID from DocumentRevision where ".
                                   "(RevisionDate>=? and RevisionDate<=?) or ".
                                   "(ABS(TO_DAYS(?)-TO_DAYS(RevisionDate))<=?) or ".
-                                  "(ABS(TO_DAYS(?)-TO_DAYS(RevisionDate))<=?)"); 
+                                  "(ABS(TO_DAYS(?)-TO_DAYS(RevisionDate))<=?)");
 
   $TimedList -> execute($StartDate,$EndDate,$StartDate,$SearchDays,$EndDate,$SearchDays);
   $TimedList -> bind_columns(undef, \($DocRevID));
@@ -149,10 +151,10 @@ sub GetHintDocuments ($$) {
     ($DocumentID) = $DocumentList -> fetchrow_array;
     if ($DocumentID && !$ConfirmedDocumentIDs{$DocumentID}) {
       $DocumentIDs{$DocumentID} = "Timed";
-    }   
+    }
   }
 
-  my $RevisionList = $dbh -> prepare("select DocRevID from RevisionEvent where ConferenceID=?"); 
+  my $RevisionList = $dbh -> prepare("select DocRevID from RevisionEvent where ConferenceID=?");
 
   $RevisionList -> execute($ConferenceID);
   $RevisionList -> bind_columns(undef, \($DocRevID));
@@ -170,22 +172,22 @@ sub GetHintDocuments ($$) {
 sub TalkMatches ($$@) {
 
   my ($SessionTalkID,$Threshold,%DocumentIDs) = @_;
-  
+
   require "Sorts.pm";
   require "DocumentSQL.pm";
   require "RevisionSQL.pm";
   require "TalkHintSQL.pm";
   require "AuthorUtilities.pm";
-  
+
   my @DocumentIDs = keys %DocumentIDs;
-  
+
   %TalkMatches = ();
 
   FetchSessionTalkByID($SessionTalkID);
 
   my $HintTitle     = $SessionTalks{$SessionTalkID}{HintTitle};
   my @TopicHintIDs  = FetchTopicHintsBySessionTalkID($SessionTalkID);
-  my @AuthorHintIDs = FetchAuthorHintsBySessionTalkID($SessionTalkID); 
+  my @AuthorHintIDs = FetchAuthorHintsBySessionTalkID($SessionTalkID);
 
   foreach my $DocumentID (@DocumentIDs) { # Check each document in the list
     FetchDocument($DocumentID);
@@ -202,7 +204,7 @@ sub TalkMatches ($$@) {
         my $HintTopic = $TopicHints{$TopicHintID}{TopicID};
         if ($HintTopic == $RevTopic) {
           ++$TopicMatches;
-        }   
+        }
       }
     }
 
@@ -212,7 +214,7 @@ sub TalkMatches ($$@) {
         my $HintAuthor = $AuthorHints{$AuthorHintID}{AuthorID};
         if ($HintAuthor == $RevAuthor) {
           ++$AuthorMatches;
-        }   
+        }
       }
     }
 
@@ -225,7 +227,7 @@ sub TalkMatches ($$@) {
       $MethodScore = 1;
     } elsif ($DocumentIDs{$DocumentID} eq "Event") {
       $MethodScore = 3;
-    } 
+    }
 
     my $FuzzyScore1 = FuzzyStringMatch($DocumentTitle,$HintTitle);
     my $FuzzyScore2 = FuzzyStringMatch($HintTitle,$DocumentTitle);
@@ -233,23 +235,23 @@ sub TalkMatches ($$@) {
 
     if ($FuzzyScore1 > $FuzzyScore2) { # Can be different since "test" matches "testbeam," not vvs.
       $FuzzyScore = $FuzzyScore1;
-    } else {	 
+    } else {
       $FuzzyScore = $FuzzyScore2;
     }
 
     my $Score = $MethodScore*($AuthorMatches+1)*(2*$TopicMatches+1)*($FuzzyScore+1);
-    push @DebugStack,"Checking $HintTitle vs. $DocumentID Method: $MethodScore Words: $FuzzyScore Authors: $AuthorMatches Topics: $TopicMatches Score: $Score"; 
+    push @DebugStack,"Checking $HintTitle vs. $DocumentID Method: $MethodScore Words: $FuzzyScore Authors: $AuthorMatches Topics: $TopicMatches Score: $Score";
 
     my $NoMatchScore = 1*(0+1)*(2*0+1)*(2*0+1);
     if ($Score > $Threshold && $Score > $NoMatchScore) { # Might loosen
       $TalkMatches{$DocumentID}{Score} = $Score;
     }
-  }  
-  
+  }
+
   my @MatchDocumentIDs = keys %TalkMatches;
-     @MatchDocumentIDs = reverse sort DocIDsByScore @MatchDocumentIDs; 
-     
-  return @MatchDocumentIDs;   
+     @MatchDocumentIDs = reverse sort DocIDsByScore @MatchDocumentIDs;
+
+  return @MatchDocumentIDs;
 }
 
 sub ConfirmedDocuments (;%) {
@@ -257,8 +259,8 @@ sub ConfirmedDocuments (;%) {
   # FIXME: Add parameters for ConferenceID, SessionID
 
   # Get list of documents already confirmed with a conference
-  
-  my $ConfirmedList = $dbh -> prepare("select DocumentID from SessionTalk where Confirmed=1"); 
+
+  my $ConfirmedList = $dbh -> prepare("select DocumentID from SessionTalk where Confirmed=1");
   my %ConfirmedDocumentIDs = ();
   $ConfirmedList -> execute();
   $ConfirmedList -> bind_columns(undef, \($DocumentID));
@@ -268,6 +270,6 @@ sub ConfirmedDocuments (;%) {
   my @ConfirmedDocumentIDs = sort keys %ConfirmedDocumentIDs;
 
   return @ConfirmedDocumentIDs;
-}  
+}
 
 1;
diff --git a/DocDB/cgi/TalkSQL.pm b/DocDB/cgi/TalkSQL.pm
index b87fd161..a1f30435 100644
--- a/DocDB/cgi/TalkSQL.pm
+++ b/DocDB/cgi/TalkSQL.pm
@@ -1,9 +1,9 @@
 #
-#        Name: TalkSQL.pm 
-# Description: Routines to access SQL tables related to talks for meetings 
+#        Name: TalkSQL.pm
+# Description: Routines to access SQL tables related to talks for meetings
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified: 
+#    Modified:
 #
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
@@ -11,7 +11,7 @@
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -32,6 +32,10 @@ sub FetchSessionTalksByConferenceID ($) {
   my ($ConferenceID) = @_;
   my $SessionTalkID;
   my @SessionTalkIDs = ();
+  unless ($ConferenceID) {
+    return @SessionTalkIDs;
+  }
+
   my $SessionTalkList   = $dbh -> prepare(
     "select SessionTalk.SessionTalkID from SessionTalk,Session ".
     "where Session.SessionID=SessionTalk.SessionID and Session.ConferenceID=?");
@@ -41,13 +45,17 @@ sub FetchSessionTalksByConferenceID ($) {
     $SessionTalkID = &FetchSessionTalkByID($SessionTalkID);
     push @SessionTalkIDs,$SessionTalkID;
   }
-  return @SessionTalkIDs; 
+  return @SessionTalkIDs;
 }
 
 sub FetchSessionTalksBySessionID ($) {
   my ($SessionID) = @_;
   my $SessionTalkID;
   my @SessionTalkIDs = ();
+  unless ($SessionID) {
+    return @SessionTalkIDs;
+  }
+
   my $SessionTalkList   = $dbh -> prepare(
     "select SessionTalkID from SessionTalk where SessionID=?");
   $SessionTalkList -> execute($SessionID);
@@ -56,12 +64,12 @@ sub FetchSessionTalksBySessionID ($) {
     $SessionTalkID = &FetchSessionTalkByID($SessionTalkID);
     push @SessionTalkIDs,$SessionTalkID;
   }
-  return @SessionTalkIDs; 
+  return @SessionTalkIDs;
 }
 
 sub FetchSessionTalkByID ($) {
   my ($SessionTalkID) = @_;
-  my ($SessionID,$DocumentID,$Confirmed,$Time,$HintTitle,$Note,$TimeStamp); 
+  my ($SessionID,$DocumentID,$Confirmed,$Time,$HintTitle,$Note,$TimeStamp);
   my $SessionTalkFetch = $dbh -> prepare(
     "select SessionID,DocumentID,Confirmed,Time,HintTitle,Note,TimeStamp ".
     "from SessionTalk where SessionTalkID=?");
@@ -69,7 +77,7 @@ sub FetchSessionTalkByID ($) {
     return $SessionTalkID;
   }
   $SessionTalkFetch -> execute($SessionTalkID);
-  ($SessionID,$DocumentID,$Confirmed,$Time,$HintTitle,$Note,$TimeStamp) = $SessionTalkFetch -> fetchrow_array; 
+  ($SessionID,$DocumentID,$Confirmed,$Time,$HintTitle,$Note,$TimeStamp) = $SessionTalkFetch -> fetchrow_array;
   if ($TimeStamp) {
     $SessionTalks{$SessionTalkID}{SessionID}  = $SessionID;
     $SessionTalks{$SessionTalkID}{DocumentID} = $DocumentID;
@@ -79,7 +87,7 @@ sub FetchSessionTalkByID ($) {
     $SessionTalks{$SessionTalkID}{Note}       = $Note;
     $SessionTalks{$SessionTalkID}{TimeStamp}  = $TimeStamp;
   }
-  return $SessionTalkID;  
+  return $SessionTalkID;
 }
 
 sub FetchTalkSeparatorsBySessionID ($) {
@@ -94,12 +102,12 @@ sub FetchTalkSeparatorsBySessionID ($) {
     $TalkSeparatorID = &FetchTalkSeparatorByID($TalkSeparatorID);
     push @TalkSeparatorIDs,$TalkSeparatorID;
   }
-  return @TalkSeparatorIDs; 
+  return @TalkSeparatorIDs;
 }
 
 sub FetchTalkSeparatorByID ($) {
   my ($TalkSeparatorID) = @_;
-  my ($SessionID,$Time,$Title,$Note,$TimeStamp); 
+  my ($SessionID,$Time,$Title,$Note,$TimeStamp);
   my $TalkSeparatorFetch = $dbh -> prepare(
     "select SessionID,Time,Title,Note,TimeStamp ".
     "from TalkSeparator where TalkSeparatorID=?");
@@ -107,7 +115,7 @@ sub FetchTalkSeparatorByID ($) {
     return $TalkSeparatorID;
   }
   $TalkSeparatorFetch -> execute($TalkSeparatorID);
-  ($SessionID,$Time,$Title,$Note,$TimeStamp) = $TalkSeparatorFetch -> fetchrow_array; 
+  ($SessionID,$Time,$Title,$Note,$TimeStamp) = $TalkSeparatorFetch -> fetchrow_array;
   if ($TimeStamp) {
     $TalkSeparators{$TalkSeparatorID}{SessionID} = $SessionID;
     $TalkSeparators{$TalkSeparatorID}{Time}	 = $Time;
@@ -115,8 +123,8 @@ sub FetchTalkSeparatorByID ($) {
     $TalkSeparators{$TalkSeparatorID}{Note}      = $Note;
     $TalkSeparators{$TalkSeparatorID}{TimeStamp} = $TimeStamp;
   }
-  
-  return $TalkSeparatorID;  
+
+  return $TalkSeparatorID;
 }
 
 sub FetchSessionOrdersBySessionID {
@@ -148,7 +156,7 @@ sub FetchSessionOrdersBySessionID {
     $SessionOrders{$SessionOrderID}{TalkOrder}	     = $TalkOrder;
     push @SessionOrderIDs,$SessionOrderID;
   }
-  return @SessionOrderIDs; 
+  return @SessionOrderIDs;
 }
 
 sub FetchSessionOrderByID ($) {
@@ -172,20 +180,20 @@ sub DeleteSessionTalk ($) {
 
   require "TalkHintSQL.pm";
 
-  my $TalkDelete  = $dbh -> prepare("delete from SessionTalk  where SessionTalkID=?"); 
-  my $OrderDelete = $dbh -> prepare("delete from SessionOrder where SessionTalkID=?"); 
+  my $TalkDelete  = $dbh -> prepare("delete from SessionTalk  where SessionTalkID=?");
+  my $OrderDelete = $dbh -> prepare("delete from SessionOrder where SessionTalkID=?");
 
   $TalkDelete  -> execute($SessionTalkID);
   $OrderDelete -> execute($SessionTalkID);
-  
-  &DeleteHints($SessionTalkID);  
+
+  &DeleteHints($SessionTalkID);
 }
 
 sub DeleteTalkSeparator ($) {
   my ($TalkSeparatorID) = @_;
 
-  my $SeparatorDelete = $dbh -> prepare("delete from TalkSeparator where TalkSeparatorID=?"); 
-  my $OrderDelete     = $dbh -> prepare("delete from SessionOrder  where TalkSeparatorID=?"); 
+  my $SeparatorDelete = $dbh -> prepare("delete from TalkSeparator where TalkSeparatorID=?");
+  my $OrderDelete     = $dbh -> prepare("delete from SessionOrder  where TalkSeparatorID=?");
 
   $SeparatorDelete -> execute($TalkSeparatorID);
   $OrderDelete     -> execute($TalkSeparatorID);
@@ -194,21 +202,21 @@ sub DeleteTalkSeparator ($) {
 sub ConfirmTalk (%) {
   require "RevisionSQL.pm";
   my %Params = @_;
-  
+
   my $DocumentID    = $Params{-docid}         || 0;
   my $SessionTalkID = $Params{-sessiontalkid} || 0;
   my $EventID       = $Params{-eventid}       || 0;
-  
+
   &FetchRevisionsByDocument($DocumentID);
   my $DocRevID = $DocRevIDs{$DocumentID}{$Documents{$DocumentID}{NVersions}};
-  
+
   my $Check = $dbh -> prepare("select RevEventID from RevisionEvent where DocRevID=? and ConferenceID=?");
   $Check -> execute($DocRevID,$EventID);
   my ($RevisionEventID) = $Check -> fetchrow_array;
   unless ($RevisionEventID) {
-    my $Insert = $dbh -> prepare("insert into RevisionEvent (RevEventID,DocRevID,ConferenceID) values (0,?,?)"); 
+    my $Insert = $dbh -> prepare("insert into RevisionEvent (RevEventID,DocRevID,ConferenceID) values (0,?,?)");
     $Insert -> execute($DocRevID,$EventID);
-  }  
-} 
+  }
+}
 
 1;

From ccf923fc11640db4258feb9e1cfd8cec2d023489 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 7 Aug 2013 16:51:10 -0500
Subject: [PATCH 116/163] MeetingOrderIDs are not integer

---
 DocDB/cgi/MeetingModify | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/DocDB/cgi/MeetingModify b/DocDB/cgi/MeetingModify
index 83e6ded4..22afd65f 100755
--- a/DocDB/cgi/MeetingModify
+++ b/DocDB/cgi/MeetingModify
@@ -57,10 +57,6 @@ my $print = $Untaint -> extract(-as_printable => "subform") || "";
 my $int = $Untaint -> extract(-as_integer => "eventgroups") || 0;
 my $html = $Untaint -> extract(-as_safehtml => "longdesc") || "";
 
-my @htmls = @{ $Untaint -> extract(-as_listofhtml => "defaultlists") || undef };
-my @words = @{ $Untaint -> extract(-as_listofwords => "defaultlists") || undef };
-my @ints = @{ $Untaint -> extract(-as_listofint => "topics") || undef };
-
 my $Mode = $Untaint -> extract(-as_safehtml => "mode") || "";
 my $NoSessions = $Untaint -> extract(-as_safehtml => "nosessions") || "";
 
@@ -90,10 +86,6 @@ my @MeetingModifyGroupIDs = @{ $Untaint -> extract(-as_listofint => "meetingmodi
 my @MeetingTopicIDs = @{ $Untaint -> extract(-as_listofint => "topics") || undef };
 my @MeetingModeratorIDs = @{ $Untaint -> extract(-as_listofint => "moderators") || undef };
 
-print STDERR "TopicIDs:",@MeetingTopicIDs,"\n";
-print STDERR "Moderators:",@MeetingModeratorIDs,"\n";
-print STDERR "Mode: $Mode\n";
-
 my @SessionYears = @{ $Untaint -> extract(-as_listofint => "sessionyear") || undef };
 my @SessionMonths = @{ $Untaint -> extract(-as_listofhtml => "sessionmonth") || undef };
 my @SessionDays = @{ $Untaint -> extract(-as_listofint => "sessionday") || undef };
@@ -105,7 +97,7 @@ my @SessionLocations = @{ $Untaint -> extract(-as_listofhtml => "sessionlocation
 my @SessionAltLocations = @{ $Untaint -> extract(-as_listofhtml => "sessionaltlocation") || undef };
 my @SessionTitles = @{ $Untaint -> extract(-as_listofhtml => "sessiontitle") || undef };
 my @SessionDescriptions = @{ $Untaint -> extract(-as_listofhtml => "sessiondescription") || undef };
-my @MeetingOrderIDs = @{ $Untaint -> extract(-as_listofint => "meetingorderid") || undef };
+my @MeetingOrderIDs = @{ $Untaint -> extract(-as_listofwords => "meetingorderid") || undef };
 my @SessionDeletes = @{ $Untaint -> extract(-as_listofwords => "sessiondelete") || undef };
 my @SessionShowAlls = @{ $Untaint -> extract(-as_listofwords => "sessionshowall") || undef };
 

From 3922b7856244bc97853f154fac8104223723162a Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Thu, 8 Aug 2013 14:29:02 -0500
Subject: [PATCH 117/163] Time is not an int since it includes minutes

---
 DocDB/cgi/MeetingModify | 44 ++++++++++++++++++++---------------------
 DocDB/cgi/SessionModify |  2 +-
 2 files changed, 23 insertions(+), 23 deletions(-)

diff --git a/DocDB/cgi/MeetingModify b/DocDB/cgi/MeetingModify
index 22afd65f..520cf42e 100755
--- a/DocDB/cgi/MeetingModify
+++ b/DocDB/cgi/MeetingModify
@@ -307,28 +307,28 @@ if ($Mode eq "create" || $Mode eq "modify") {
     # Key on MeetingOrderID to see if we are going to insert or update.
     if (grep /n/,$MeetingOrderID) {
       if ($SessionTitle || $SessionDescription) {
-	if ($SessionSeparatorFlags{$MeetingOrderID}) {
-          # Create a new separator
-          my $SessionSeparatorInsert = $dbh -> prepare(
-           "insert into SessionSeparator ".
-           "(SessionSeparatorID, ConferenceID, StartTime, Location, Title, Description) ".
-           "values (0,?,?,?,?,?)");
-          $SessionSeparatorInsert -> execute($ConferenceID,$SessionDate,$SessionLocation,$SessionTitle,$SessionDescription);
-          $SessionSeparatorID = $SessionSeparatorInsert -> {mysql_insertid}; # Works with MySQL only
-          push @ActionStack,"Created break: $SessionTitle";
-          ++$SessionsModified;
-	} else {
-          # Create a new session
-          $SessionID = InsertSession({
-              -eventid      => $ConferenceID,    -date        => $SessionDate,
-              -title        => $SessionTitle,    -description => $SessionDescription,
-              -location     => $SessionLocation, -altlocation => $SessionAltLocation,
-              -moderatorids => \@ModeratorIDs,   -topicids    => \@TopicIDs,
-              -showalltalks => $SessionShowAllFlags{$MeetingOrderID},
-          });
-          push @ActionStack,"Created session: $SessionTitle";
-          ++$SessionsModified;
-	}
+        if ($SessionSeparatorFlags{$MeetingOrderID}) {
+              # Create a new separator
+              my $SessionSeparatorInsert = $dbh -> prepare(
+               "insert into SessionSeparator ".
+               "(SessionSeparatorID, ConferenceID, StartTime, Location, Title, Description) ".
+               "values (0,?,?,?,?,?)");
+              $SessionSeparatorInsert -> execute($ConferenceID,$SessionDate,$SessionLocation,$SessionTitle,$SessionDescription);
+              $SessionSeparatorID = $SessionSeparatorInsert -> {mysql_insertid}; # Works with MySQL only
+              push @ActionStack,"Created break: $SessionTitle";
+              ++$SessionsModified;
+        } else {
+              # Create a new session
+              $SessionID = InsertSession({
+                  -eventid      => $ConferenceID,    -date        => $SessionDate,
+                  -title        => $SessionTitle,    -description => $SessionDescription,
+                  -location     => $SessionLocation, -altlocation => $SessionAltLocation,
+                  -moderatorids => \@ModeratorIDs,   -topicids    => \@TopicIDs,
+                  -showalltalks => $SessionShowAllFlags{$MeetingOrderID},
+              });
+              push @ActionStack,"Created session: $SessionTitle";
+              ++$SessionsModified;
+        }
         # Insert the order of the session or separator
         my $MeetingOrderInsert = $dbh -> prepare(
          "insert into MeetingOrder ".
diff --git a/DocDB/cgi/SessionModify b/DocDB/cgi/SessionModify
index 21fdd4cd..b6bf7cf1 100755
--- a/DocDB/cgi/SessionModify
+++ b/DocDB/cgi/SessionModify
@@ -83,7 +83,7 @@ if ($ShowAllTalks) {
 my $SessionDay = $Untaint -> extract(-as_integer => "sessionday") || 0;
 my $SessionMonth = $Untaint -> extract(-as_safehtml => "sessionmonth") || "";
 my $SessionYear = $Untaint -> extract(-as_integer => "sessionyear") || 0;
-my $SessionHour = $Untaint -> extract(-as_integer => "sessiontime") || 0;
+my $SessionHour = $Untaint -> extract(-as_safehtml => "sessiontime") || 0;
 
 my @SessionOrderIDs = @{ $Untaint -> extract(-as_listofhtml => "sessionorderid") || undef };
 my @TalkOrders = @{ $Untaint -> extract(-as_listofhtml => "talkorder") || undef };

From 09da519a393ebdf9d7ef38bf09b4765abef2e911 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Thu, 8 Aug 2013 14:36:51 -0500
Subject: [PATCH 118/163] Times are not ints

---
 DocDB/cgi/MeetingModify | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/DocDB/cgi/MeetingModify b/DocDB/cgi/MeetingModify
index 22afd65f..80e31823 100755
--- a/DocDB/cgi/MeetingModify
+++ b/DocDB/cgi/MeetingModify
@@ -89,7 +89,7 @@ my @MeetingModeratorIDs = @{ $Untaint -> extract(-as_listofint => "moderators")
 my @SessionYears = @{ $Untaint -> extract(-as_listofint => "sessionyear") || undef };
 my @SessionMonths = @{ $Untaint -> extract(-as_listofhtml => "sessionmonth") || undef };
 my @SessionDays = @{ $Untaint -> extract(-as_listofint => "sessionday") || undef };
-my @SessionHours = @{ $Untaint -> extract(-as_listofint => "sessiontime") || undef };
+my @SessionHours = @{ $Untaint -> extract(-as_listofhtml => "sessiontime") || undef };
 my @SessionOrders = @{ $Untaint -> extract(-as_listofhtml => "sessionorder") || undef };
 my @RawSessionSeparators = @{ $Untaint -> extract(-as_listofwords => "sessionseparator") || undef };
 

From 6fb1d53b995b2a99400f48aaf93a20e57b8ac301 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Mon, 12 Aug 2013 15:40:01 -0500
Subject: [PATCH 119/163] Fix external DocDBs

---
 DocDB/cgi/SearchForm  |  2 --
 DocDB/cgi/XRefHTML.pm | 12 +++++++-----
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/DocDB/cgi/SearchForm b/DocDB/cgi/SearchForm
index dd338580..d9e09e3a 100755
--- a/DocDB/cgi/SearchForm
+++ b/DocDB/cgi/SearchForm
@@ -52,8 +52,6 @@ GetSecurityGroups();
 GetJournals();
 GetDocTypes();
 
-#%params = $query -> Vars;
-
 print $query -> header( -charset => $HTTP_ENCODING );
 
 DocDBHeader("$Project Document Database Search","Document Database Search",
diff --git a/DocDB/cgi/XRefHTML.pm b/DocDB/cgi/XRefHTML.pm
index f5b34454..163f9dbb 100644
--- a/DocDB/cgi/XRefHTML.pm
+++ b/DocDB/cgi/XRefHTML.pm
@@ -21,6 +21,8 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
+require "HTMLUtilities.pm";
+
 sub PrintXRefInfo ($) {
   require "XRefSQL.pm";
   require "DocumentHTML.pm";
@@ -51,7 +53,7 @@ sub PrintXRefInfo ($) {
         if ($Version) {
           $DocumentLink .= "&amp;version=$Version";
         }
-        $DocumentLink .= "\">".$ExtProject."-doc-".$DocumentID;
+        $DocumentLink .= "\">".SmartHTML({-text=>$ExtProject})."-doc-".$DocumentID;
         if ($Version) {
           $DocumentLink .= "-v$Version";
         }
@@ -127,7 +129,7 @@ sub ExternalDocDBLink ($) {
   my $DocDBID = exists $ArgRef->{-docdbid} ? $ArgRef->{-docdbid} : 0;
   my $Link = "<a href=\"$ExternalDocDBs{$DocDBID}{PublicURL}/DocumentDatabase\"";
   $Link .= "title=\"$ExternalDocDBs{$DocDBID}{Description}\">";
-  $Link .= $ExternalDocDBs{$DocDBID}{Project};
+  $Link .= SmartHTML({-text=>$ExternalDocDBs{$DocDBID}{Project}});
   $Link .= '</a>';
   return $Link;
 }
@@ -160,10 +162,10 @@ sub ExternalDocDBSelect (;%) {
   my %Labels        = ();
   foreach my $ExternalDocDBID (@ExternalDocDBIDs) {
     if ($Format eq "full") {
-      $Labels{$ExternalDocDBID} = $ExternalDocDBs{$ExternalDocDBID}{Project}.
-      ":".$ExternalDocDBs{$ExternalDocDBID}{Description};
+      $Labels{$ExternalDocDBID} = SmartHTML({-text=>$ExternalDocDBs{$ExternalDocDBID}{Project}}).
+      ":".SmartHTML({-text=>$ExternalDocDBs{$ExternalDocDBID}{Description}});
     } else {
-      $Labels{$ExternalDocDBID} = $ExternalDocDBs{$ExternalDocDBID}{Project};
+      $Labels{$ExternalDocDBID} = SmartHTML({-text=>$ExternalDocDBs{$ExternalDocDBID}{Project}});
     }
   }
 

From d8f8f5d17734f4a8faef6933aa7578afe17f53da Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Mon, 12 Aug 2013 15:50:21 -0500
Subject: [PATCH 120/163] Safer XRefs, fix defined issue with version/date

---
 DocDB/cgi/ExternalDocDBAdministerForm | 8 ++++----
 DocDB/cgi/RetrieveFile                | 2 +-
 DocDB/cgi/XRefHTML.pm                 | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/DocDB/cgi/ExternalDocDBAdministerForm b/DocDB/cgi/ExternalDocDBAdministerForm
index 18570955..b054ab77 100755
--- a/DocDB/cgi/ExternalDocDBAdministerForm
+++ b/DocDB/cgi/ExternalDocDBAdministerForm
@@ -98,22 +98,22 @@ if ($SubForm eq "externaldocdb") {
     push @ActionStack,"Deleted reference to external DocDB";
   } elsif ($Action eq "Modify") {
     if ($ProjectName) {
-      push @ActionStack,"Updated project name of $ExternalDocDBs{$ExternalDocDBID}{Project}";
+      push @ActionStack,"Updated the project name.";
       my $Update = $dbh->prepare("update ExternalDocDB set Project=? where ExternalDocDBID=?");
       $Update -> execute($ProjectName,$ExternalDocDBID);
     }
     if ($Description) {
-      push @ActionStack,"Updated description of $ExternalDocDBs{$ExternalDocDBID}{Project}";
+      push @ActionStack,"Updated the description.";
       my $Update = $dbh->prepare("update ExternalDocDB set Description=? where ExternalDocDBID=?");
       $Update -> execute($Description,$ExternalDocDBID);
     }
     if ($PrivateURL) {
-      push @ActionStack,"Updated private URL of $ExternalDocDBs{$ExternalDocDBID}{Project}";
+      push @ActionStack,"Updated the private URL.";
       my $Update = $dbh->prepare("update ExternalDocDB set PrivateURL=? where ExternalDocDBID=?");
       $Update -> execute($PrivateURL,$ExternalDocDBID);
     }
     if ($PublicURL) {
-      push @ActionStack,"Updated public URL of $ExternalDocDBs{$ExternalDocDBID}{Project}";
+      push @ActionStack,"Updated the public URL.";
       my $Update = $dbh->prepare("update ExternalDocDB set PublicURL=? where ExternalDocDBID=?");
       $Update -> execute($PublicURL,$ExternalDocDBID);
     }
diff --git a/DocDB/cgi/RetrieveFile b/DocDB/cgi/RetrieveFile
index 66fac7c0..89e491cc 100755
--- a/DocDB/cgi/RetrieveFile
+++ b/DocDB/cgi/RetrieveFile
@@ -58,7 +58,7 @@ GetSecurityGroups();
 
 FetchDocument($DocumentID);
 
-if (defined $Version && defined $AsOf) {
+if ($Version && $AsOf) {
   push @ErrorStack,"You may not specify both a version and date.";
 }
 if (grep /\//,$FileName) {
diff --git a/DocDB/cgi/XRefHTML.pm b/DocDB/cgi/XRefHTML.pm
index 163f9dbb..39c3f051 100644
--- a/DocDB/cgi/XRefHTML.pm
+++ b/DocDB/cgi/XRefHTML.pm
@@ -128,7 +128,7 @@ sub ExternalDocDBLink ($) {
   my ($ArgRef) = @_;
   my $DocDBID = exists $ArgRef->{-docdbid} ? $ArgRef->{-docdbid} : 0;
   my $Link = "<a href=\"$ExternalDocDBs{$DocDBID}{PublicURL}/DocumentDatabase\"";
-  $Link .= "title=\"$ExternalDocDBs{$DocDBID}{Description}\">";
+  $Link .= 'title="'.SmartHTML({-text=>$ExternalDocDBs{$DocDBID}{Description}}).'">';
   $Link .= SmartHTML({-text=>$ExternalDocDBs{$DocDBID}{Project}});
   $Link .= '</a>';
   return $Link;

From 7d719fdc05261048e52103078d373d7a37a3bdef Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Mon, 12 Aug 2013 16:15:41 -0500
Subject: [PATCH 121/163] Filename for RetrieveFile need not be HTML safe

---
 DocDB/cgi/RetrieveFile | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/DocDB/cgi/RetrieveFile b/DocDB/cgi/RetrieveFile
index 89e491cc..294cb301 100755
--- a/DocDB/cgi/RetrieveFile
+++ b/DocDB/cgi/RetrieveFile
@@ -45,7 +45,7 @@ my $Untaint = CGI::Untaint -> new($query -> Vars);
 my $DocumentID = $Untaint -> extract(-as_integer => "docid") || 0;
 my $Version = $Untaint -> extract(-as_integer => "version") || 0;
 my $AsOf = $Untaint -> extract(-as_safehtml => "asof") || "";
-my $FileName = $Untaint -> extract(-as_safehtml => "filename") || "";
+my $FileName = $Untaint -> extract(-as_printable => "filename") || "";
 my $Extension = $Untaint -> extract(-as_safehtml => "extension") || "";
 
 unless ($DocumentID) {
@@ -90,11 +90,7 @@ if (defined $Version) {
 }
 
 unless (&CanAccess($DocumentID,$Version)) {
-  if ($remote_user) {
-    push @ErrorStack,"The $remote_user group is not authorized to view this document (or it does not exist).";
-  } else {
-    push @ErrorStack,"This document is not publicly accessible.";
-  }
+  push @ErrorStack,"You are not authorized to view this document (or it does not exist).";
 }
 
 unless ($DocRevID) {

From 7dfda424278ff77870c919fb4f9a76496d1a92c8 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Mon, 12 Aug 2013 16:19:29 -0500
Subject: [PATCH 122/163] Use default mime rather than magic since backticks
 are insecure

---
 DocDB/cgi/FileUtilities.pm | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/DocDB/cgi/FileUtilities.pm b/DocDB/cgi/FileUtilities.pm
index 75ecb94e..3aa47357 100644
--- a/DocDB/cgi/FileUtilities.pm
+++ b/DocDB/cgi/FileUtilities.pm
@@ -188,9 +188,12 @@ sub StreamFile (%) {
     my $Size = (stat $File)[7];
 
     $MimeType = mimetype($File);              # Try Mime-info first
+
     unless ($MimeType) {
-      $MimeType = `$FileMagic -ib \"$File\"`; # Use magic as a backup
-      chomp $MimeType;
+      # This is unsafe. Until we can figure out a way to do this, comment it out. Could use IPC::Run if we had it
+#      $MimeType = `$FileMagic -ib \"$File\"`; # Use magic as a backup
+#      chomp $MimeType;
+      $MimeType = 'binary/octet-stream'
       print STDERR "DocDB: MIME info not found, defaulting to \"magic\" which says: $MimeType\n";
     }
 
@@ -225,7 +228,7 @@ sub StreamFile (%) {
   } else {
     print $query -> header( -charset => $HTTP_ENCODING );
     print $query -> start_html,
-          "There was a problem. File $File does not exist.",
+          "There was a problem. The file does not exist.",
           $query -> end_html;
   }
 }

From 1508b163c683a714ed466ef567e46bd0de042181 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Mon, 12 Aug 2013 16:21:11 -0500
Subject: [PATCH 123/163] Missing semicolon

---
 DocDB/cgi/FileUtilities.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/DocDB/cgi/FileUtilities.pm b/DocDB/cgi/FileUtilities.pm
index 3aa47357..345a8d42 100644
--- a/DocDB/cgi/FileUtilities.pm
+++ b/DocDB/cgi/FileUtilities.pm
@@ -193,7 +193,7 @@ sub StreamFile (%) {
       # This is unsafe. Until we can figure out a way to do this, comment it out. Could use IPC::Run if we had it
 #      $MimeType = `$FileMagic -ib \"$File\"`; # Use magic as a backup
 #      chomp $MimeType;
-      $MimeType = 'binary/octet-stream'
+      $MimeType = 'binary/octet-stream';
       print STDERR "DocDB: MIME info not found, defaulting to \"magic\" which says: $MimeType\n";
     }
 

From 02706db6b01c2158800c6e3e00f37e464b39e1d4 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Mon, 19 Aug 2013 16:17:54 -0500
Subject: [PATCH 124/163] Remove params from overlooked things

---
 DocDB/cgi/AddFilesForm         | 19 ++++++++---------
 DocDB/cgi/CertificateApplyForm |  2 --
 DocDB/cgi/Defaults.pm          | 37 +++++++++++++++++++++++-----------
 DocDB/cgi/DocDBHelp            | 19 ++++++++---------
 DocDB/cgi/DocumentAddForm      | 23 ++++++++++++---------
 DocDB/cgi/RetrieveArchive      |  5 +++--
 DocDB/cgi/ShowDocument         | 35 ++++++++++++++++----------------
 7 files changed, 78 insertions(+), 62 deletions(-)

diff --git a/DocDB/cgi/AddFilesForm b/DocDB/cgi/AddFilesForm
index e92be391..991469e1 100755
--- a/DocDB/cgi/AddFilesForm
+++ b/DocDB/cgi/AddFilesForm
@@ -27,6 +27,7 @@
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
 use CGI qw(-nosticky);
+use CGI::Untaint;
 use DBI;
 
 require "DocDBGlobals.pm";
@@ -45,21 +46,21 @@ require "FileHTML.pm";
 require "Cookies.pm";
 require "Defaults.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 require "Scripts.pm";
 
 $query = new CGI;  # Global for subroutines
 $query -> autoEscape(0);
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 
 &GetSecurityGroups;
 &GetPrefsCookie;
 
-%params = $query -> Vars;
-
-$DocumentID    = $params{docid};
-$Upload        = $params{upload};
-$NumberUploads = $params{numfile};
-#$Version done later
+my $DocumentID = $Untaint -> extract(-as_integer => "docid") || 0;
+my $Upload = $Untaint -> extract(-as_safehtml => "upload") || undef;
+my $NumberUploads = $Untaint -> extract(-as_integer => "numfile") || 0; # Global since not passed (oversight)
+my $InputVersion = $Untaint -> extract(-as_integer => "version") || undef;
 
 # Set defaults
 
@@ -77,11 +78,11 @@ unless ($DocumentID) {
 
 &FetchDocument($DocumentID);
 
-if ($params{version} eq "0") {
+if ($InputVersion eq "0") {
   $Version = 0;
 } else {
-  if ($params{version}) {
-    $Version = $params{version};
+  if ($InputVersion) {
+    $Version = $InputVersion;
   } else {
     $Version = $Documents{$DocumentID}{NVersions};
   }
diff --git a/DocDB/cgi/CertificateApplyForm b/DocDB/cgi/CertificateApplyForm
index a2819099..d67f1efa 100755
--- a/DocDB/cgi/CertificateApplyForm
+++ b/DocDB/cgi/CertificateApplyForm
@@ -37,8 +37,6 @@ require "CertificateUtilities.pm";
 
 $query = new CGI;  # Global for subroutines
 
-%params = $query -> Vars;
-
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 
 ### Start HTML
diff --git a/DocDB/cgi/Defaults.pm b/DocDB/cgi/Defaults.pm
index 43419ce3..557d8f46 100644
--- a/DocDB/cgi/Defaults.pm
+++ b/DocDB/cgi/Defaults.pm
@@ -29,10 +29,13 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
+use CGI::Untaint;
 
 sub SetAuthorMode {
-  if ($params{authormode}) {
-    $AuthorMode = $params{authormode};
+  my $Untaint = CGI::Untaint -> new($query -> Vars);
+  my $Param = $Untaint -> extract(-as_safehtml => "authormode") || "";
+  if ($Param) {
+    $AuthorMode = $Param;
   } else {
     $AuthorMode = $AuthorModePref;
   }
@@ -42,8 +45,10 @@ sub SetAuthorMode {
 }
 
 sub SetTopicMode {
-  if ($params{topicmode}) {
-    $TopicMode = $params{topicmode};
+  my $Untaint = CGI::Untaint -> new($query -> Vars);
+  my $Param = $Untaint -> extract(-as_safehtml => "topicmode") || "";
+  if ($Param) {
+    $TopicMode = $Param;
   } else {
     $TopicMode = $TopicModePref;
   }
@@ -53,8 +58,10 @@ sub SetTopicMode {
 }
 
 sub SetUploadMethod {
-  if ($params{upload}) {
-    $Upload = $params{upload};
+  my $Untaint = CGI::Untaint -> new($query -> Vars);
+  my $Param = $Untaint -> extract(-as_safehtml => "upload") || "";
+  if ($Param) {
+    $Upload = $Param;
   } else {
     $Upload = $UploadMethodPref;
   }
@@ -64,8 +71,10 @@ sub SetUploadMethod {
 }
 
 sub SetDateOverride {
-  if ($params{overdate}) {
-    $Overdate = $params{overdate};
+  my $Untaint = CGI::Untaint -> new($query -> Vars);
+  my $Param = $Untaint -> extract(-as_safehtml => "overdate") || "";
+  if ($Param) {
+    $Overdate = $Param;
   } else {
     $Overdate = $DateOverridePref;
   }
@@ -74,8 +83,12 @@ sub SetDateOverride {
 sub SetFileOptions {
   my ($DocRevID) = @_;
 
-  if ($params{archive}) {
-    $Archive = $params{archive};
+  my $Untaint = CGI::Untaint -> new($query -> Vars);
+  my $InputArchive = $Untaint -> extract(-as_safehtml => "archive") || "";
+  my $InputNumFile = $Untaint -> extract(-as_safehtml => "numfile") || "";
+
+  if ($InputArchive) {
+    $Archive = $InputArchive;
   } else {
     $Archive = $UploadTypePref
   }
@@ -86,8 +99,8 @@ sub SetFileOptions {
     $Archive = "single";
   }
 
-  if ($params{numfile}) {               # User has selected
-    $NumberUploads = $params{numfile};
+  if ($InputNumFile) {               # User has selected
+    $NumberUploads = $InputNumFile;
   } elsif ($NumFilesPref && $mode ne "update") {             # User has a pref
     if ($Meeting  || $OtherMeeting) {
       if ($NumFilesPref < 3) {
diff --git a/DocDB/cgi/DocDBHelp b/DocDB/cgi/DocDBHelp
index 7f74adea..2e08bc8e 100755
--- a/DocDB/cgi/DocDBHelp
+++ b/DocDB/cgi/DocDBHelp
@@ -1,17 +1,17 @@
 #! /usr/bin/env perl
 #
 # Description: Usually called as a pop-up, this looks up in docdb.hlp
-#              the information on a specific topic. 
+#              the information on a specific topic.
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified: 
+#    Modified:
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -23,7 +23,7 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-use CGI;                                                                                      
+use CGI;
 use XML::Parser::PerlSAX;
 use XML::PatAct::MatchName;
 use XML::PatAct::ToObjects;
@@ -51,7 +51,7 @@ my $ProjectPatterns = [
 
 if (-e "ProjectHelp.xml") {
   $ProjectHelp = 1;
-}  
+}
 
 my $DefaultMatcher = XML::PatAct::MatchName -> new(Patterns => $DefaultPatterns);
 my $DefaultHandler = XML::PatAct::ToObjects -> new(Patterns => $DefaultPatterns,
@@ -70,12 +70,13 @@ if ($ProjectHelp) {
 
 # Start page
 
-$query = new CGI;  
+$query = new CGI;
+$query -> autoEscape(0);
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 print $query -> header( -charset => $HTTP_ENCODING );
 &DocDBHeader("$Project DocDB Help","",-nobody => $TRUE);
 
-%params = $query -> Vars;
-$helpterm = $params{term};   # Extract term user wants help for
+$helpterm = $Untaint -> extract(-as_safehtml => "term") || "";
 
 # Parse XML into hashes, pull out desired text
 
@@ -127,6 +128,6 @@ if ($DefaultText || $ProjectText) {
   }
 } else {
   print "<b><big>No help available on this topic.</big></b><p>\n";
-}  
+}
 
 &DocDBFooter($DBWebMasterEmail,$DBWebMasterName,-nobody => $TRUE);
diff --git a/DocDB/cgi/DocumentAddForm b/DocDB/cgi/DocumentAddForm
index d43058a4..33a50b7d 100755
--- a/DocDB/cgi/DocumentAddForm
+++ b/DocDB/cgi/DocumentAddForm
@@ -26,6 +26,7 @@
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
 use CGI qw(-nosticky);
+use CGI::Untaint;
 use DBI;
 
 require "DocDBGlobals.pm";
@@ -45,6 +46,7 @@ require "TopicSQL.pm";
 require "ResponseElements.pm";
 require "FormElements.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 require "Utilities.pm";
 require "Defaults.pm";
 require "Security.pm";
@@ -70,14 +72,15 @@ $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 &GetDocTypes;
 &GetPrefsCookie;
 
-%params = $query -> Vars;
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 
-my $DocumentID   = $params{docid};
-my $ConferenceID = $params{conferenceid};
-my $SessionID    = $params{sessionid};
-my $Version      = $params{version};
-my @PreTopics    = $query -> param('pretopic');
-   $mode         = $params{mode}; # FIXME: Can't be my since used in subroutines
+my $DocumentID = $Untaint -> extract(-as_integer => "docid") || 0;
+my $ConferenceID = $Untaint -> extract(-as_integer => "conferenceid") || undef;
+my $SessionID = $Untaint -> extract(-as_integer => "sessionid") || undef;
+my $Version = $Untaint -> extract(-as_integer => "version") || undef;
+my $InputVersion = $Untaint -> extract(-as_integer => "version") || undef;
+my @PreTopics = @{ $Untaint -> extract(-as_listofint => "pretopic") || undef };
+   $mode = $Untaint -> extract(-as_safehtml => "mode") || "";  # FIXME: Can't be "my" since used in subroutines
 
 if ($mode ne "add"    && $mode ne "reserve" &&
     $mode ne "update" && $mode ne "updatedb") {
@@ -106,7 +109,7 @@ unless (CanCreate()) {
   push @ErrorStack,"You are not allowed to modify or create documents.";
 }
 if ($mode eq "update" || $mode eq "updatedb") {
-  unless ($params{docid}) {
+  unless ($DocumentID) {
     push @ErrorStack,"You must supply a document number to modify a document.";
   }
 }
@@ -190,7 +193,7 @@ if ($mode eq "update" || $mode eq "updatedb") { # Need to read in last version v
   $DocTypeIDDefault    = $DocRevisions{$DocRevID}{DocTypeID};
   @SecurityDefaults    = GetRevisionSecurityGroups($DocRevID);
   unless (@SecurityDefaults) {
-    @SecurityDefaults = (0);	
+    @SecurityDefaults = (0);
   }
   my @AuthorRevIDs     = GetRevisionAuthors($DocRevID);
      @AuthorRevIDs     = sort AuthorRevIDsByOrder @AuthorRevIDs;
@@ -291,7 +294,7 @@ my $UniqueID = time."-".(int rand (2**31-1));
 print $query -> hidden(-name => 'uniqueid',  -default => $UniqueID);
 
 if ($mode eq "updatedb") {
-  if (defined $params{version}) {
+  if (defined $InputVersion) {
     print $query -> hidden(-name => 'version',   -default => $Version);
   }
 }
diff --git a/DocDB/cgi/RetrieveArchive b/DocDB/cgi/RetrieveArchive
index d4d48d03..76a5765f 100755
--- a/DocDB/cgi/RetrieveArchive
+++ b/DocDB/cgi/RetrieveArchive
@@ -46,6 +46,7 @@ my $Untaint = CGI::Untaint -> new($query -> Vars);
 
 my $Type = $Untaint -> extract(-as_printable => "type") || "";
 my $DocumentID = $Untaint -> extract(-as_integer => "docid") || 0;
+my $InputVersion = $Untaint -> extract(-as_integer => "version") || undef;
 
 unless ($DocumentID) {
   push @ErrorStack,"You are must supply a document number!";
@@ -59,8 +60,8 @@ $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 &GetSecurityGroups;
 &FetchDocument($DocumentID);
 
-if (defined $params{version}) {
-  $Version = $params{version};
+if (defined $InputVersion) {
+  $Version = $InputVersion;
 } else {
   $Version = $Documents{$DocumentID}{NVersions};
 }
diff --git a/DocDB/cgi/ShowDocument b/DocDB/cgi/ShowDocument
index d96f80a8..3e3e1627 100755
--- a/DocDB/cgi/ShowDocument
+++ b/DocDB/cgi/ShowDocument
@@ -8,7 +8,7 @@
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -21,6 +21,7 @@
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
 use CGI;
+use CGI::Untaint;
 use DBI;
 
 require "DocDBGlobals.pm";
@@ -30,6 +31,7 @@ require "DocumentSQL.pm";
 require "RevisionSQL.pm";
 require "FSUtilities.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 require "Security.pm";
 require "Scripts.pm";
 require "SQLChecks.pm";
@@ -37,21 +39,18 @@ require "SQLChecks.pm";
 require "RevisionHTML.pm";
 
 $query = new CGI;  # Global for subroutines
+$query -> autoEscape(0);
+my $Untaint = CGI::Untaint -> new($query -> Vars);
 
-%params = $query -> Vars;
-
-   $DocumentID = $params{docid};
-   $DocumentID =~ s/^\s+//; # Remove leading and trailing spaces
-   $DocumentID =~ s/\s+$//;
-   $Version    = $params{version};
-   $AsOf       = $params{asof};
-my $OutFormat  = $params{outformat} || "HTML";
+   $DocumentID = $Untaint -> extract(-as_integer => "docid") || 0;
+   $Version = $Untaint -> extract(-as_integer => "version") || undef;
+   $AsOf = $Untaint -> extract(-as_safehtml => "asof") || "";
+my $OutFormat = $Untaint -> extract(-as_safehtml => "outformat") || "HTML";
    $OutFormat =~ tr/[a-z]/[A-Z]/;
 
-
 unless ($DocumentID) {
   push @ErrorStack,"You are must supply a document number!";
-}  
+}
 
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 
@@ -89,8 +88,8 @@ if (&CanAccess($DocumentID,$Version)) {
     push @ErrorStack,"The $remote_user group is not authorized to view this document (or it does not exist).";
   } else {
     push @ErrorStack,"This document is not publicly accessible.";
-  }  
-} 
+  }
+}
 
 # Print appropriate header
 
@@ -98,7 +97,7 @@ if ($OutFormat eq 'XML') {
   require "XMLOutput.pm";
   unless ($NoXMLHead) {
     print XMLHeader();
-  }  
+  }
   NewXMLOutput();
 } else {
   print $query -> header( -charset => $HTTP_ENCODING );
@@ -113,13 +112,13 @@ unless ($DocRevID) { # Probably never executed since CanAccess fails.
 
 if ($OutFormat eq 'XML') {
   my %XMLDisplay = ("All" => $TRUE);
-  my $DocumentXML = DocumentXMLOut( {-docid   => $DocRevisions{$DocRevID}{DOCID}, 
-                                     -version => $DocRevisions{$DocRevID}{Version}, 
-                                     -display => \%XMLDisplay, 
+  my $DocumentXML = DocumentXMLOut( {-docid   => $DocRevisions{$DocRevID}{DOCID},
+                                     -version => $DocRevisions{$DocRevID}{Version},
+                                     -display => \%XMLDisplay,
                                     } );
   if ($DocumentXML) {
     $DocumentXML -> paste(last_child => $DocDBXML);
-  }  
+  }
 } else {
   EndPage();
   PrintRevisionInfo($DocRevID, -showversions => 1);

From f555f1d1369369681f21ea8e786a9a490c5e1338 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Tue, 20 Aug 2013 10:32:54 -0500
Subject: [PATCH 125/163] Missed use statement for help, asof should be undef
 by default

---
 DocDB/cgi/DocDBHelp    | 2 ++
 DocDB/cgi/ShowDocument | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/DocDB/cgi/DocDBHelp b/DocDB/cgi/DocDBHelp
index 2e08bc8e..fc779e66 100755
--- a/DocDB/cgi/DocDBHelp
+++ b/DocDB/cgi/DocDBHelp
@@ -24,6 +24,7 @@
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
 use CGI;
+use CGI::Untaint;
 use XML::Parser::PerlSAX;
 use XML::PatAct::MatchName;
 use XML::PatAct::ToObjects;
@@ -32,6 +33,7 @@ use XML::Grove::AsCanonXML;
 
 require "DocDBGlobals.pm";
 require "HTMLUtilities.pm";
+require "UntaintInput.pm";
 
 my $DefaultPatterns = [
   'helpfile'    => [ qw{ -holder                                  } ],
diff --git a/DocDB/cgi/ShowDocument b/DocDB/cgi/ShowDocument
index 3e3e1627..454a8dc2 100755
--- a/DocDB/cgi/ShowDocument
+++ b/DocDB/cgi/ShowDocument
@@ -44,7 +44,7 @@ my $Untaint = CGI::Untaint -> new($query -> Vars);
 
    $DocumentID = $Untaint -> extract(-as_integer => "docid") || 0;
    $Version = $Untaint -> extract(-as_integer => "version") || undef;
-   $AsOf = $Untaint -> extract(-as_safehtml => "asof") || "";
+   $AsOf = $Untaint -> extract(-as_safehtml => "asof") || undef;
 my $OutFormat = $Untaint -> extract(-as_safehtml => "outformat") || "HTML";
    $OutFormat =~ tr/[a-z]/[A-Z]/;
 

From 7a74a0e6d609f1dcc9be4746009313e0d0161ee7 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Tue, 20 Aug 2013 13:50:28 -0500
Subject: [PATCH 126/163] Make first author safe

---
 DocDB/cgi/AuthorHTML.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/DocDB/cgi/AuthorHTML.pm b/DocDB/cgi/AuthorHTML.pm
index 26e463fc..fea0f5bd 100644
--- a/DocDB/cgi/AuthorHTML.pm
+++ b/DocDB/cgi/AuthorHTML.pm
@@ -44,7 +44,7 @@ sub FirstAuthor ($;$) {
   if ($Institution) {
     FetchInstitution($Authors{$FirstID}{InstitutionID});
     $AuthorLink .= "<br/><em>".
-                   $Institutions{$Authors{$FirstID}{InstitutionID}}{SHORT}.
+                   SmartHTML({-text=>$Institutions{$Authors{$FirstID}{InstitutionID}}{SHORT}}).
                    "</em>";
   }
   return $AuthorLink;

From 990b57122e3aec86a29ab954f19f8ca3fa18b919 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Thu, 29 Aug 2013 14:08:25 -0500
Subject: [PATCH 127/163] Insert 'attachment' to headers for some MS Office
 data types

---
 DocDB/cgi/DocDBGlobals.pm  |  1 +
 DocDB/cgi/FileUtilities.pm | 12 +++++++++++-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/DocDB/cgi/DocDBGlobals.pm b/DocDB/cgi/DocDBGlobals.pm
index 98821844..b3c0a948 100644
--- a/DocDB/cgi/DocDBGlobals.pm
+++ b/DocDB/cgi/DocDBGlobals.pm
@@ -97,6 +97,7 @@ $Preferences{Options}{DynamicFullList}{Private} = $FALSE; # Generate Full docume
 $Preferences{Options}{DynamicFullList}{Public}  = $FALSE; # Generate Full document list by dynamically for public db
 
 $Preferences{Options}{AlwaysRetrieveFile}       = $FALSE; # Always use RetrieveFile instead of File Links
+$Preferences{Options}{FileEndingsForAttachment} = ("doc","docx","xls","xlsx","ppt","pptx","pps","ppsx");
 
 $Preferences{Options}{SubmitAgree}              = ""; # "Put text here to make users agree to a privacy statement or some-such. <br/><b>I agree:</b>"
 
diff --git a/DocDB/cgi/FileUtilities.pm b/DocDB/cgi/FileUtilities.pm
index df1c1ec1..3c939f68 100644
--- a/DocDB/cgi/FileUtilities.pm
+++ b/DocDB/cgi/FileUtilities.pm
@@ -196,8 +196,18 @@ sub StreamFile (%) {
 
     my @Parts = split /\//,$File;
     my $ShortFile = pop @Parts;
+    my $AttachmentString = "";
+    if (defined($Preferences{Options}{FileEndingsForAttachment})) {
+      my $Search = $ShortFile;
+      my $AttachRegex = join "|", $Preferences{Options}{FileEndingsForAttachment};
+      if ($Search =~ m/\.($AttachRegex})$/i) {
+         $AttachmentString = "attachment;";
+      }
+    }
+
+
     print "Content-Type: $MimeType\n", # Print header
-          "Content-Disposition: filename=\"$ShortFile\"\n",
+          "Content-Disposition: $AttachmentString filename=\"$ShortFile\"\n",
           "Content-Length: $Size\n\n";
 
     select STDOUT;

From e614833fea92e8ad3ae9482e83bea2c92351d108 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Thu, 29 Aug 2013 14:38:28 -0500
Subject: [PATCH 128/163] Build topic descendant list

---
 DocDB/cgi/TopicUtilities.pm | 49 +++++++++++++++++++++++--------------
 1 file changed, 30 insertions(+), 19 deletions(-)

diff --git a/DocDB/cgi/TopicUtilities.pm b/DocDB/cgi/TopicUtilities.pm
index ccf94cfd..e73c7087 100644
--- a/DocDB/cgi/TopicUtilities.pm
+++ b/DocDB/cgi/TopicUtilities.pm
@@ -1,12 +1,12 @@
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified: 
+#    Modified:
 
 # Copyright 2001-2009 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -22,52 +22,54 @@ sub AllRootTopics {
   require "TopicSQL.pm";
 
   GetTopics();
-  
+
   my @TopicIDs = keys %Topics;
   my @RootIDs  = ();
-  
+
   foreach my $TopicID (@TopicIDs) {
     unless (@{$TopicParents{$TopicID}}) {
       push @RootIDs,$TopicID;
-    }  
+    }
   }
-  
+
   return @RootIDs;
 }
 
 sub TopicAndSubTopics {
   my ($ArgRef) = @_;
   my $TopicID = exists $ArgRef->{-topicid} ? $ArgRef->{-topicid} : 0;
-  
+
   require "TopicSQL.pm";
   require "Utilities.pm";
 
   GetTopics();
-  
+
   my @TopicIDs = ($TopicID);
-  
+
   foreach my $ChildID (@{$TopicChildren{$TopicID}}) {
     my @ChildIDs = TopicAndSubTopics({ -topicid => $ChildID });
     push @TopicIDs,@ChildIDs;
   }
-  
-  return Unique(@TopicIDs);  
+
+  return Unique(@TopicIDs);
 }
 
 sub BuildTopicProvenance {
   %TopicProvenance = ();
-  
-  # When finished, @{$TopicProvenance{$TopicID}} is an array for every $TopicID, 
-  # which has that TopicID as its first element, its parent as its second, 
+  %TopicDescendants = ();
+
+  # When finished, @{$TopicProvenance{$TopicID}} is an array for every $TopicID,
+  # which has that TopicID as its first element, its parent as its second,
   # grandparent as the third, etc.
-  
+  # @{$TopicDescendants{$TopicID}} is a list of all children, grandchildren, etc for a topic.
+
   foreach my $TopicID (keys %Topics) {
     push @{$TopicProvenance{$TopicID}},$TopicID;
   }
-  
+
   # Check each provenance entry to see if we can append to the list
   # FIXME: Cannot deal with multiple parents.
-  
+
   my $Found = $TRUE;
   while ($Found) {
     $Found = $FALSE;
@@ -79,10 +81,19 @@ sub BuildTopicProvenance {
         my @ParentIDs = @{$TopicParents{$LastID}};
         my $FirstParentID = pop @ParentIDs;
         push @{$TopicProvenance{$TopicID}},$FirstParentID;
-      }  
+      }
+    }
+  }
+
+  foreach my $TopicID (keys %Topics) {
+    my @IDs = @{$TopicProvenance{$TopicID}};
+    foreach my $ID (@IDs) {
+      if ($ID != $TopicID) {
+        push @{$TopicDescendants{$TopicID}}, $ID;
+      }
     }
   }
-  
+
   return;
 }
 

From b7dbfd531e3abfd5983efd52810f7e1b6a3c2ff5 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Thu, 29 Aug 2013 15:09:18 -0500
Subject: [PATCH 129/163] Protect against administering topics wrong and the
 consequences if it slips through.

---
 DocDB/cgi/TopicAdminister   | 78 +++++++++++++++++++------------------
 DocDB/cgi/TopicUtilities.pm |  6 ++-
 2 files changed, 46 insertions(+), 38 deletions(-)

diff --git a/DocDB/cgi/TopicAdminister b/DocDB/cgi/TopicAdminister
index 9ba14288..5747e852 100755
--- a/DocDB/cgi/TopicAdminister
+++ b/DocDB/cgi/TopicAdminister
@@ -2,18 +2,18 @@
 #
 # Description: This script is called by AdministerForm and does administration
 #              on Topics in the DB. TopicAdd is simpler and can only add
-#              topics. TopicAdd is most useful in setting up a new DB, while 
-#              TopicAdminister will be more useful in maintaining an existing DB. 
+#              topics. TopicAdd is most useful in setting up a new DB, while
+#              TopicAdminister will be more useful in maintaining an existing DB.
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified: 
+#    Modified:
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -42,11 +42,11 @@ require "DBUtilities.pm";
 require "HTMLUtilities.pm";
 
 require "TopicHTML.pm";
-require "TopicSQL.pm"; 
+require "TopicSQL.pm";
 
 $query = new CGI;  # Global for subroutines
 
-# Parameters to script 
+# Parameters to script
 
 my $Untaint = CGI::Untaint -> new($query -> Vars);
 
@@ -82,12 +82,12 @@ DocDBHeader("Topic Administration","",-scripts => ["PopUps","TopicAdminDisable"]
 
 unless (CanAdminister()) {
   push @ErrorStack,$Msg_AdminNoLogin;
-}  
+}
 EndPage();
 GetTopics();
 
 if ($Action eq "Delete") {
-  # FIXME?: Force option is not going to be compatible with children with 
+  # FIXME?: Force option is not going to be compatible with children with
   # multiple parents In that case we would need to determine if any topics
   # would be orphaned and  then delete those, but not ones with another
   # parent
@@ -98,41 +98,45 @@ if ($Action eq "Delete") {
     push @WarnStack,$Msg_ModTopicEmpty;
   }
 
-# Deal with name changes     
+# Deal with name changes
 
-  if ($TopicID && $ShortName) { 
+  if ($TopicID && $ShortName) {
     push @ActionStack,"Updated short description of topic.";
     my $Update = $dbh -> prepare("update Topic set ShortDescription=? where TopicID=?");
     $Update -> execute($ShortName,$TopicID);
   }
-  if ($TopicID && $LongName) { 
+  if ($TopicID && $LongName) {
     push @ActionStack,"Updated long description of topic.";
     my $Update = $dbh -> prepare("update Topic set LongDescription=? where TopicID=?");
     $Update -> execute($LongName,$TopicID);
   }
 
-# Deal with parent changes   
+# Deal with parent changes
 
   if ($TopicID && $ParentTopicID && $ParentTopicID == $TopicID) {
     push @WarnStack,"You cannot set a topic to be its own parent. No action taken.";
-  }  
+  }
+
+  if (grep $ParentTopicID, @{$TopicDescendants{$TopicID}}) {
+    push @WarnStack,"The topic you tried to modify has the proposed parent as one of its descendants. No action taken.";
+  }
 
-  if ($TopicID && $ParentTopicID && $ParentTopicID != $TopicID) { 
+  if ($TopicID && $ParentTopicID && $ParentTopicID != $TopicID) {
     push @ActionStack,"Updated parent topic of (sub)topic.";
-   
+
     my $Delete = $dbh -> prepare("delete from TopicHierarchy where TopicID=?");
     my $Insert = $dbh -> prepare("insert into TopicHierarchy (TopicHierarchyID,TopicID,ParentTopicID) values (0,?,?)");
-   
+
     $Delete -> execute($TopicID);
     $Insert -> execute($TopicID,$ParentTopicID);
   }
 } elsif ($Action eq "New") {
 
   if ($ShortName || $LongName) {
-    if (!$LongName) { 
+    if (!$LongName) {
       $LongName = $ShortName;
       push @WarnStack,"No long description supplied. Short description substituted.";
-    } elsif (!$ShortName) { 
+    } elsif (!$ShortName) {
       $ShortName = $LongName;
       push @WarnStack,"No short description supplied. Long description substituted.";
     }
@@ -150,16 +154,16 @@ if ($Action eq "Delete") {
     }
   } else {
     push @WarnStack,"No short or long description supplied. No topic created.";
-  }  
-} elsif ($TopicID || $ParentTopicID || $LongName || $ShortName) { 
+  }
+} elsif ($TopicID || $ParentTopicID || $LongName || $ShortName) {
   push @WarnStack,"No valid action was specified.";
-}  
- 
-if (@ActionStack) { 
+}
+
+if (@ActionStack) {
   ClearTopics();
   GetTopics();
   ActionReport();
-}  
+}
 
 EndPage();
 
@@ -167,18 +171,18 @@ print $query -> start_multipart_form('POST',"$TopicAdminister",'id="topic" name=
 
 print "<table class=\"MedPaddedTable\">\n";
 print "<tr>\n";
-print "<td colspan=\"2\">\n"; 
- AdministerActions(-form => "topic");      
+print "<td colspan=\"2\">\n";
+ AdministerActions(-form => "topic");
 print "</td>\n";
 print "</tr>\n";
 
 print "<tr>\n";
-print "<td rowspan=\"3\">\n"; 
- TopicScroll({ -helptext   => "Topic", -helplink => "topics", 
+print "<td rowspan=\"3\">\n";
+ TopicScroll({ -helptext   => "Topic", -helplink => "topics",
                -itemformat => "full",  -disabled => $TRUE,
-               -extratext  => "[Long description]", 
-            }); 
-print "</td>\n"; 
+               -extratext  => "[Long description]",
+            });
+print "</td>\n";
 print "<td>\n"; ShortDescriptionBox(-name => "shortdesc", -disabled => $TRUE);
 print "</td>\n";
 print "</tr>\n";
@@ -189,18 +193,18 @@ print "</td>\n";
 print "</tr>\n";
 
 print "<tr>\n";
-print "<td>\n"; 
+print "<td>\n";
  AdminRegardless();
 print "</td>\n";
 print "</tr>\n";
 
 print "<tr>\n";
-print "<td>\n";  
- TopicScroll({ -helptext   => "Parent Topic", -helplink => "parenttopic", 
+print "<td>\n";
+ TopicScroll({ -helptext   => "Parent Topic", -helplink => "parenttopic",
                -itemformat => "full",         -disabled => $TRUE,
                -name       => "parenttopic",
-               -extratext  => "[Long description]", 
-            }); 
+               -extratext  => "[Long description]",
+            });
 print "</td>\n";
 print "</tr>\n";
 
@@ -217,5 +221,5 @@ print $query -> end_multipart_form;
 
 DocDBNavBar();
 DocDBFooter($DBWebMasterEmail,$DBWebMasterName);
- 
+
 exit;
diff --git a/DocDB/cgi/TopicUtilities.pm b/DocDB/cgi/TopicUtilities.pm
index e73c7087..671e0da8 100644
--- a/DocDB/cgi/TopicUtilities.pm
+++ b/DocDB/cgi/TopicUtilities.pm
@@ -80,6 +80,10 @@ sub BuildTopicProvenance {
         $Found = $TRUE;
         my @ParentIDs = @{$TopicParents{$LastID}};
         my $FirstParentID = pop @ParentIDs;
+        if (grep $FirstParentID, @{$TopicProvenance{$TopicID}}) {
+          push @ErrorStack, "Detected a topic loop where topic $TopicID has topic $FirstParentID as a parent multiple times. Aborting.";
+          return;
+        }
         push @{$TopicProvenance{$TopicID}},$FirstParentID;
       }
     }
@@ -89,7 +93,7 @@ sub BuildTopicProvenance {
     my @IDs = @{$TopicProvenance{$TopicID}};
     foreach my $ID (@IDs) {
       if ($ID != $TopicID) {
-        push @{$TopicDescendants{$TopicID}}, $ID;
+        push @{$TopicDescendants{$ID}}, $TopicID;
       }
     }
   }

From 33fe3d3e7e234f5bd3c34680c77543641fab6ae9 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Thu, 29 Aug 2013 15:23:49 -0500
Subject: [PATCH 130/163] Protect against administering topics wrong and the
 consequences if it slips through.

---
 DocDB/cgi/TopicUtilities.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/DocDB/cgi/TopicUtilities.pm b/DocDB/cgi/TopicUtilities.pm
index 671e0da8..ceb41419 100644
--- a/DocDB/cgi/TopicUtilities.pm
+++ b/DocDB/cgi/TopicUtilities.pm
@@ -80,7 +80,7 @@ sub BuildTopicProvenance {
         $Found = $TRUE;
         my @ParentIDs = @{$TopicParents{$LastID}};
         my $FirstParentID = pop @ParentIDs;
-        if (grep $FirstParentID, @{$TopicProvenance{$TopicID}}) {
+        if (grep {$_ eq $FirstParentID} @{$TopicProvenance{$TopicID}}) {
           push @ErrorStack, "Detected a topic loop where topic $TopicID has topic $FirstParentID as a parent multiple times. Aborting.";
           return;
         }

From 1baa1e75dc13eda6cb57d064d1c425b800749ce7 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Fri, 30 Aug 2013 14:15:31 -0500
Subject: [PATCH 131/163] Add EndPage at correct spots

---
 DocDB/cgi/ListTopics      | 3 ++-
 DocDB/cgi/TopicAdminister | 4 +++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/DocDB/cgi/ListTopics b/DocDB/cgi/ListTopics
index 352333e1..ba92b758 100755
--- a/DocDB/cgi/ListTopics
+++ b/DocDB/cgi/ListTopics
@@ -7,7 +7,7 @@
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -34,6 +34,7 @@ GetTopics();
 
 print $query -> header( -charset => $HTTP_ENCODING );
 DocDBHeader("List of Topics");
+EndPage();
 
 TopicsTable();
 
diff --git a/DocDB/cgi/TopicAdminister b/DocDB/cgi/TopicAdminister
index 5747e852..d400fac8 100755
--- a/DocDB/cgi/TopicAdminister
+++ b/DocDB/cgi/TopicAdminister
@@ -118,9 +118,11 @@ if ($Action eq "Delete") {
   }
 
   if (grep $ParentTopicID, @{$TopicDescendants{$TopicID}}) {
-    push @WarnStack,"The topic you tried to modify has the proposed parent as one of its descendants. No action taken.";
+    push @ErrorStack,"The topic you tried to modify has the proposed parent as one of its descendants. No action taken.";
   }
 
+  EndPage();
+
   if ($TopicID && $ParentTopicID && $ParentTopicID != $TopicID) {
     push @ActionStack,"Updated parent topic of (sub)topic.";
 

From 2d583d8702f6515bb433d0d6d0b701c618801cbe Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Fri, 30 Aug 2013 14:18:47 -0500
Subject: [PATCH 132/163] Add EndPage at correct spots

---
 DocDB/cgi/ListTopics | 1 +
 1 file changed, 1 insertion(+)

diff --git a/DocDB/cgi/ListTopics b/DocDB/cgi/ListTopics
index ba92b758..6eaf292a 100755
--- a/DocDB/cgi/ListTopics
+++ b/DocDB/cgi/ListTopics
@@ -26,6 +26,7 @@ require "DocDBGlobals.pm";
 require "TopicSQL.pm";
 require "TopicHTML.pm";
 require "HTMLUtilities.pm";
+require "ResponseElements.pm";
 
 $query = new CGI;  # Global for subroutines
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);

From 0abb62c28cd296c8ba069684038caef3cf50813c Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Tue, 3 Sep 2013 13:36:22 -0500
Subject: [PATCH 133/163] Fix renamed parameter in DeleteDocument

---
 DocDB/cgi/DeleteDocument | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/DocDB/cgi/DeleteDocument b/DocDB/cgi/DeleteDocument
index ccaa6556..d576f163 100755
--- a/DocDB/cgi/DeleteDocument
+++ b/DocDB/cgi/DeleteDocument
@@ -39,7 +39,7 @@ $query = new CGI;  # Global for subroutines
 $query -> autoEscape(0);
 my $Untaint = CGI::Untaint -> new($query -> Vars);
 
-my $DocumentID = $Untaint -> extract(-as_integer => "documentid") || 0;
+my $DocumentID = $Untaint -> extract(-as_integer => "docid") || 0;
 my $Password = $Untaint -> extract(-as_printable => "password") || "";
 my $Username = $Untaint -> extract(-as_printable => "admuser") || "";
 

From 8427e87eaac73671f535e067653906bbaf140799 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Tue, 3 Sep 2013 13:52:46 -0500
Subject: [PATCH 134/163] Tag 8.7.19

---
 DocDB/cgi/DocDBVersion.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/DocDB/cgi/DocDBVersion.pm b/DocDB/cgi/DocDBVersion.pm
index 31b0cb14..d3fe363f 100644
--- a/DocDB/cgi/DocDBVersion.pm
+++ b/DocDB/cgi/DocDBVersion.pm
@@ -20,6 +20,6 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-$DocDBVersion = "8.7.18";
+$DocDBVersion = "8.7.19";
 
 1;

From 8ba239cc0065dabc0d8a6bfb5857fad0f19c0f1d Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Tue, 3 Sep 2013 15:58:13 -0500
Subject: [PATCH 135/163] Convert remaining uses of URLify, Paragraphize,
 AddLineBreaks, SafeHTML to SmartHTML and remove

---
 DocDB/cgi/DocumentHTML.pm  |  6 ++---
 DocDB/cgi/HTMLUtilities.pm |  2 --
 DocDB/cgi/MeetingHTML.pm   |  5 ++--
 DocDB/cgi/Utilities.pm     | 52 --------------------------------------
 4 files changed, 6 insertions(+), 59 deletions(-)

diff --git a/DocDB/cgi/DocumentHTML.pm b/DocDB/cgi/DocumentHTML.pm
index a0505635..25d214a1 100644
--- a/DocDB/cgi/DocumentHTML.pm
+++ b/DocDB/cgi/DocumentHTML.pm
@@ -266,7 +266,7 @@ sub DocumentTable (%) {
       } elsif ($Field eq "Abstract") { # Abstract
         PrintAbstract($DocRevisions{$DocRevID}{Abstract}, {-format => "bare"} );
       } elsif ($Field eq "DocNotes") { # Notes and Changes
-        print AddLineBreaks(URLify($DocRevisions{$DocRevID}{Note}));
+        print SmartHTML({-text=>$DocRevisions{$DocRevID}{Note}, -addLineBreaks=>$TRUE, -makeURLs=>$TRUE});
       } elsif ($Field eq "Files") {    # Files in document
         require "FileHTML.pm";
         ShortFileListByRevID($DocRevID, $SkipVersions);
@@ -297,9 +297,9 @@ sub DocumentTable (%) {
         }
       } elsif ($Field eq "TalkNotes") {
         if ($SessionTalkID) {
-          print URLify( AddLineBreaks($SessionTalks{$SessionTalkID}{Note}) );
+          print SmartHTML({-text=>$SessionTalks{$SessionTalkID}{Note}, -addLineBreaks=>$TRUE, -makeURLs=>$TRUE});
         } elsif ($TalkSeparatorID) {
-          print URLify( AddLineBreaks($TalkSeparators{$TalkSeparatorID}{Note}) );
+          print SmartHTML({-text=>$TalkSeparators{$TalkSeparatorID}{Note}, -addLineBreaks=>$TRUE, -makeURLs=>$TRUE});
         }
       } elsif ($Field eq "Edit") {
         if ($SessionOrderID) {
diff --git a/DocDB/cgi/HTMLUtilities.pm b/DocDB/cgi/HTMLUtilities.pm
index 25226199..097d98c2 100644
--- a/DocDB/cgi/HTMLUtilities.pm
+++ b/DocDB/cgi/HTMLUtilities.pm
@@ -24,8 +24,6 @@
 
 require "ProjectRoutines.pm";
 
-# FIXME: Remove URLify, Paragraphize, AddLineBreaks, SafeHTML (possibly) from Utitlities.pm
-
 sub SmartHTML ($) {
   my ($ArgRef) = @_;
   my $Text          = exists $ArgRef->{-text}          ?  $ArgRef->{-text}          : "";
diff --git a/DocDB/cgi/MeetingHTML.pm b/DocDB/cgi/MeetingHTML.pm
index 6447b5e3..e1797b5c 100644
--- a/DocDB/cgi/MeetingHTML.pm
+++ b/DocDB/cgi/MeetingHTML.pm
@@ -531,8 +531,9 @@ sub PrintSessionHeader ($) {
   }
 
   if ($Sessions{$SessionID}{Description}) {
-    my $Description = AddLineBreaks($Sessions{$SessionID}{Description});
-    print "<div class=\"SessionDescription\"> ",URLify($Description),"</div>\n";
+    print "<div class=\"SessionDescription\"> ";
+    print SmartHTML({-text=>$Sessions{$SessionID}{Description}, -addLineBreaks=>$TRUE, -makeURLs=>$TRUE});
+    print "</div>\n";
   }
 }
 
diff --git a/DocDB/cgi/Utilities.pm b/DocDB/cgi/Utilities.pm
index 98b79bb4..4b072dd1 100644
--- a/DocDB/cgi/Utilities.pm
+++ b/DocDB/cgi/Utilities.pm
@@ -89,34 +89,6 @@ sub IndexOf {
   }
 }
 
-sub URLify { # Adapted from Perl Cookbook, 6.21
-  my ($Text) = @_;
-
-  $urls = '(http|telnet|gopher|file|wais|ftp|https)';
-  $ltrs = '\w';
-  $gunk = '/#~:.?+=&%@!\-';
-  $punc = '.:?\-';
-  $any  = "${ltrs}${gunk}${punc}";
-  $Text =~ s{
-              \b                    # start at word boundary
-              (                     # begin $1  {
-               $urls     :          # need resource and a colon
-               [$any] +?            # followed by on or more
-                                    #  of any valid character, but
-                                    #  be conservative and take only
-                                    #  what you need to....
-              )                     # end   $1  }
-              (?=                   # look-ahead non-consumptive assertion
-               [$punc]*             # either 0 or more punctuation
-               [^$any]              #   followed by a non-url char
-               |                    # or else
-               $                    #   then end of the string
-              )
-             }{<a href="$1">$1</a>}igox;
-  $Text = &SafeHTML($Text);
-  return $Text;
-}
-
 sub AddTime ($;$) {
   my ($TimeA,$TimeB) = @_;
 
@@ -137,30 +109,6 @@ sub AddTime ($;$) {
   return $TimeString;
 }
 
-sub Paragraphize {
-  my ($Text) = @_;
-  $Text =~ s/\s*\n\s*\n\s*/<p\/>/g; # Replace two new lines and any space with <p>
-  $Text =~ s/<p\/>/<p\/>\n/g;
-  $Text = SafeHTML($Text);
-  return $Text;
-}
-
-sub AddLineBreaks {
-  my ($Text) = @_;
-  $Text =~ s/\s*\n\s*\n\s*/<p\/>/g; # Replace two new lines and any space with <p>
-  $Text =~ s/\s*\n\s*/<br\/>\n/g;
-  $Text =~ s/<p\/>/<p\/>\n/g;
-  $Text = SafeHTML($Text);
-  return $Text;
-}
-
-sub SafeHTML {
-  my ($Text) = @_;
-  $Text =~ s/\&/\&amp;/g;
-  $Text =~ s/\&amp;amp;/\&amp;/g;
-  return $Text;
-}
-
 sub Printable ($) {
   my ($Text) = @_;
   $Text =~ tr/[\040-\377\r\n\t]//cd;

From a869753ad6d3ce43d93d78eb3886d6c44b419ac9 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Tue, 3 Sep 2013 16:05:44 -0500
Subject: [PATCH 136/163] Make error, warning, debug output safe

---
 DocDB/cgi/ResponseElements.pm | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/DocDB/cgi/ResponseElements.pm b/DocDB/cgi/ResponseElements.pm
index 46ba8776..4ffe3f2b 100644
--- a/DocDB/cgi/ResponseElements.pm
+++ b/DocDB/cgi/ResponseElements.pm
@@ -53,7 +53,7 @@ sub WarnPage () { # Non-fatal errors
              request: </dt>\n";
     }
     foreach $message (@WarnStack) {
-      print "<dd>$message</dd>\n";
+      print "<dd>".SmartHTML({-text=>$message})."</dd>\n";
     }
     print "</dl>\n";
   }
@@ -67,7 +67,7 @@ sub DebugPage (;$) { # Debugging output
     print "<dl class=\"debug\">\n";
     print "<dt class=\"Warning\">Debugging messages: $CheckPoint</dt>\n";
     foreach my $Message (@DebugStack) {
-      print "<dd>$Message</dd>\n";
+      print "<dd>".SmartHTML({-text=>$Message})."</dd>\n";
     }
     print "</dl>\n";
   } elsif ($CheckPoint && $DebugOutput) {
@@ -106,7 +106,7 @@ sub ErrorPage { # Fatal errors, continues page
              request:</dt>\n";
     }
     foreach $message (@ErrorStack) {
-      print "<dd>$message</dd>\n";
+      print "<dd>".SmartHTML({-text=>$message})."</dd>\n";
     }
     print "</dl>\n";
     print "<p/>\n";
@@ -120,7 +120,7 @@ sub ActionReport {
     print "<dl class=\"Action\">\n";
     print "<dt class=\"Action\">Action(s) taken:</dt>\n";
     foreach $Message (@ActionStack) {
-      print "<dd>$Message</dd>\n";
+      print "<dd>".SmartHTML({-text=>$Message})."</dd>\n";
     }
     print "</dl>\n";
   }

From 17420ffc873d5450c71c884806ab1018f66b3106 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Tue, 3 Sep 2013 16:38:08 -0500
Subject: [PATCH 137/163] Sanitize email addresses and usernames (DNs) wherever
 they occur since we don't feel we can sanitize on input

---
 DocDB/cgi/BulkCertificateInsert |  4 ++--
 DocDB/cgi/EmailAdministerForm   |  6 +++---
 DocDB/cgi/EmailSecurity.pm      | 12 ++++++------
 DocDB/cgi/EmailUserHTML.pm      | 34 ++++++++++++++++-----------------
 DocDB/cgi/MailNotification.pm   | 10 +++++-----
 DocDB/cgi/WatchDocument         |  6 +++---
 6 files changed, 36 insertions(+), 36 deletions(-)

diff --git a/DocDB/cgi/BulkCertificateInsert b/DocDB/cgi/BulkCertificateInsert
index 69958624..a3e6acb0 100755
--- a/DocDB/cgi/BulkCertificateInsert
+++ b/DocDB/cgi/BulkCertificateInsert
@@ -106,11 +106,11 @@ if ($Action eq "Insert") {
         next;
       }
       unless ($Email && $Name) {
-        push @WarnStack,"You must supply a name and e-mail address for the user $Name. Not inserted.";
+        push @WarnStack,"You must supply a name and e-mail address for the user. Not inserted.";
         next;
       }
       unless (@GroupIDs) {
-        push @WarnStack,"You did not specify any groups. $Name inserted with membership in no groups.";
+        push @WarnStack,"You did not specify any groups. The users was inserted with membership in no groups.";
       }
       $UserInsert -> execute($Username,$Name,$Email,$CanSign);
       my $EmailUserID = $UserInsert -> {mysql_insertid}; # Works with MySQL only
diff --git a/DocDB/cgi/EmailAdministerForm b/DocDB/cgi/EmailAdministerForm
index f7a250df..55d254b4 100755
--- a/DocDB/cgi/EmailAdministerForm
+++ b/DocDB/cgi/EmailAdministerForm
@@ -239,8 +239,8 @@ if ($EmailUserID) {
     my $Link = $EmailAdministerForm."?emailuserid=$EmailUserID";
 
     print "<tr class=\"$RowClass\">\n";
-    print "<td><a href=\"$Link\">$EmailUser{$EmailUserID}{Name}</a>    </td>\n";
-    print "<td><a href=\"$Link\">$EmailUser{$EmailUserID}{Username}</a></td>\n";
+    print "<td><a href=\"$Link\">".SmartHTML({-text => $EmailUser{$EmailUserID}{Name}})."</a></td>\n";
+    print "<td><a href=\"$Link\">".SmartHTML({-text => $EmailUser{$EmailUserID}{Username}})."</a></td>\n";
     print "<td>$Verified</td>\n";
     print "<td>$CanSign</td>\n";
     print "<td>$Groups</td>\n";
@@ -259,7 +259,7 @@ if ($EmailUserID) {
       print "<p><a name=\"$SecurityGroup\" /><strong>$SecurityGroup has these members:</strong></p>\n<ul>\n";
       foreach my $EmailUserID (@EmailUserIDs) {
         if ($EmailUser{$EmailUserID}{Name}) {
-          print "<li>$EmailUser{$EmailUserID}{Name} ($EmailUser{$EmailUserID}{Username}, $EmailUser{$EmailUserID}{EmailAddress})</li>\n";
+          print "<li>".SmartHTML({-text => "$EmailUser{$EmailUserID}{Name} ($EmailUser{$EmailUserID}{Username}, $EmailUser{$EmailUserID}{EmailAddress})"})."</li>\n";
         } else {
           print "<li>Unknown (ID: $EmailUserID)</li>\n";
         }
diff --git a/DocDB/cgi/EmailSecurity.pm b/DocDB/cgi/EmailSecurity.pm
index a4b5a8d5..4c1f3dde 100644
--- a/DocDB/cgi/EmailSecurity.pm
+++ b/DocDB/cgi/EmailSecurity.pm
@@ -77,9 +77,9 @@ sub UserPrefForm ($) {
     print "<tr><th>\n";
     print $query -> hidden(-name => 'username', -default => $Username);
     print $query -> hidden(-name => 'digest', -default => $Digest);
-    print "Username:</th>\n<td>$Username</td></tr>";
+    print "Username:</th>\n<td>".SmartHTML({-text => $Username})."</td></tr>";
   } elsif ($UserValidation eq "certificate") {
-    print "<tr><th>Username:</th>\n<td>$Username</td></tr>";
+    print "<tr><th>Username:</th>\n<td>".SmartHTML({-text => $Username})."</td></tr>";
   } else {
     print "<tr><th>Username:</th>\n<td>";
     print $query -> textfield(-name => 'username', -default => $Username,
@@ -94,16 +94,16 @@ sub UserPrefForm ($) {
   if  ($UserValidation eq "certificate") {
     print "<tr><th>Real name:</th>\n<td>$Name</td></tr>\n";
     print "<tr><th>E-mail address:</th>\n<td>";
-    print $query -> textfield(-name => 'email',    -default => $EmailAddress,
+    print $query -> textfield(-name => 'email',    -default => SmartHTML({-text => $EmailAddress}),
                               -size => 24, -maxlength => 64);
     print "</td></tr>\n";
   } else {
     print "<tr><th>Real name:</th>\n<td>";
-    print $query -> textfield(-name => 'name',     -default => $Name,
+    print $query -> textfield(-name => 'name',     -default => SmartHTML({-text => $Name}),
                               -size => 24, -maxlength => 128);
     print "</td></tr>\n";
     print "<tr><th>E-mail address:</th>\n<td>";
-    print $query -> textfield(-name => 'email',    -default => $EmailAddress,
+    print $query -> textfield(-name => 'email',    -default => SmartHTML({-text => $EmailAddress}),
                               -size => 24, -maxlength => 64);
     print "</td></tr>\n";
     print "<tr><th>New password:</th>\n<td>";
@@ -129,7 +129,7 @@ sub UserPrefForm ($) {
     my @UserGroupIDs = &FetchUserGroupIDs($EmailUserID);
     foreach my $UserGroupID (@UserGroupIDs) {
       &FetchSecurityGroup($UserGroupID);
-      print "<li>$SecurityGroups{$UserGroupID}{NAME}</li>\n";
+      print "<li>".SmartHTML({-text => $SecurityGroups{$UserGroupID}{NAME}})."</li>\n";
     }
     print "</ul></td></tr>\n";
   }
diff --git a/DocDB/cgi/EmailUserHTML.pm b/DocDB/cgi/EmailUserHTML.pm
index 65ab7fdd..76879385 100644
--- a/DocDB/cgi/EmailUserHTML.pm
+++ b/DocDB/cgi/EmailUserHTML.pm
@@ -4,7 +4,7 @@
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -18,49 +18,49 @@
 
 sub PrintEmailUserInfo ($) {
   my ($EmailUserID) = @_;
-  
+
   require "NotificationSQL.pm";
   require "SecuritySQL.pm";
   require "MailNotification.pm";
- 
-  FetchEmailUser($EmailUserID);  
-  
+
+  FetchEmailUser($EmailUserID);
+
   print "<tr>\n";
   print "<td>\n";
 
   print "<table class=\"LowPaddedTable LeftHeader\">\n";
   print "<tr>\n";
-  print "<th>Username:</th><td>$EmailUser{$EmailUserID}{Username}</td>\n"; 
+  print "<th>Username:</th><td>".SmartHTML({-text => $EmailUser{$EmailUserID}{Username}})."</td>\n";
   print "</tr><tr>\n";
-  print "<th>Name:</th><td>$EmailUser{$EmailUserID}{Name}</td>\n"; 
+  print "<th>Name:</th><td>".SmartHTML({-text => $EmailUser{$EmailUserID}{Name}})."</td>\n";
   print "</tr><tr>\n";
-  print "<th>E-mail:</th><td>$EmailUser{$EmailUserID}{EmailAddress}</td>\n"; 
+  print "<th>E-mail:</th><td>".SmartHTML({-text => $EmailUser{$EmailUserID}{EmailAddress}})."</td>\n";
   print "</tr><tr>\n";
   print "<th>Verified:</th>";
-  print "<td>".("No","Yes")[$EmailUser{$EmailUserID}{Verified}]."</td>\n"; 
+  print "<td>".("No","Yes")[$EmailUser{$EmailUserID}{Verified}]."</td>\n";
   print "</tr><tr>\n";
   print "<th>HTML:</th>";
-  print "<td>".("No","Yes")[$EmailUser{$EmailUserID}{PreferHTML}]."</td>\n"; 
+  print "<td>".("No","Yes")[$EmailUser{$EmailUserID}{PreferHTML}]."</td>\n";
   print "</tr><tr>\n";
   print "<th>Can Sign:</th>";
-  print "<td>".("No","Yes")[$EmailUser{$EmailUserID}{CanSign}]."</td>\n"; 
+  print "<td>".("No","Yes")[$EmailUser{$EmailUserID}{CanSign}]."</td>\n";
   print "</tr><tr>\n";
-  
+
   # Groups user belongs (or wants to belong to)
-  
+
   print "<th>Groups:</th>";
-  print "<td>\n"; 
+  print "<td>\n";
   my @UserGroupIDs = FetchUserGroupIDs($EmailUserID);
   if (@UserGroupIDs) {
     print "<ul>\n";
     foreach my $UserGroupID (@UserGroupIDs) {
       FetchSecurityGroup($UserGroupID);
-      print "<li>$SecurityGroups{$UserGroupID}{NAME}</li>\n";
+      print "<li>".SmartHTML({-text => $SecurityGroups{$UserGroupID}{NAME}})."</li>\n";
     }
     print "</ul>\n";
   } else {
     print "&nbsp;\n";
-  }       
+  }
   print "</td>\n";
   print "</tr>\n";
   print "</table>\n";
@@ -76,7 +76,7 @@ sub PrintEmailUserInfo ($) {
 
   print "<td>\n";
   DisplayNotification($EmailUserID,"Weekly");
-  print "</td>\n"; 
+  print "</td>\n";
 
   print "</tr>\n";
 }
diff --git a/DocDB/cgi/MailNotification.pm b/DocDB/cgi/MailNotification.pm
index 41ca89aa..5d9b7d27 100644
--- a/DocDB/cgi/MailNotification.pm
+++ b/DocDB/cgi/MailNotification.pm
@@ -25,6 +25,8 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
+require "HTMLUtilities.pm";
+
 sub MailNotices (%) {
 
   unless ($MailInstalled) {
@@ -136,9 +138,7 @@ sub MailNotices (%) {
     RevisionMailBody($DocRevID);   # Write the body
     $Mailer -> close;              # Complete the message and send it
     my $Addressees = join ', ',@Addressees;
-    $Addressees =~ s/\&/\&amp\;/g;
-    $Addressees =~ s/</\&lt\;/g;
-    $Addressees =~ s/>/\&gt\;/g;
+    $Addressees = SmartHTML({-text => $Addressees});
 
     print $Feedback,$Addressees,"<p>";
   }
@@ -467,8 +467,8 @@ sub EmailUserSelect (%) {
   my @EmailUserIDs = &GetEmailUserIDs;
   foreach my $EmailUserID (@EmailUserIDs) {
     &FetchEmailUser($EmailUserID);
-    $EmailUserLabels{$EmailUserID} = $EmailUser{$EmailUserID}{Name}.
-                                     ' ['.$EmailUser{$EmailUserID}{Username}.']';
+    my $Text = $EmailUser{$EmailUserID}{Name}.' ['.$EmailUser{$EmailUserID}{Username}.']';
+    $EmailUserLabels{$EmailUserID} = SmartHTML({-text => $Text});
   }
 
   @EmailUserIDs = sort EmailUserIDsByName @EmailUserIDs;
diff --git a/DocDB/cgi/WatchDocument b/DocDB/cgi/WatchDocument
index e8731c20..059cbe9a 100755
--- a/DocDB/cgi/WatchDocument
+++ b/DocDB/cgi/WatchDocument
@@ -79,9 +79,9 @@ EndPage();
 
 my $DocumentLink = &DocumentLink(-docid => $DocumentID, -noversion => $TRUE);
 
-print "An e-mail will be sent to $EmailUser{$EmailUserID}{Name}
-       ($EmailUser{$EmailUserID}{EmailAddress}) when $DocumentLink changes.<p/>\n";
-
+print SmartHTML({-text => "An e-mail will be sent to $EmailUser{$EmailUserID}{Name}
+       ($EmailUser{$EmailUserID}{EmailAddress}) when $DocumentLink changes."});
+print "<p/>\n";
 
 &InsertEmailDocumentImmediate(-emailuserid => $EmailUserID, -docid => $DocumentID);
 

From 9899b2d89ea8fd5371de654b66d0990f6a270854 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 4 Sep 2013 09:06:42 -0500
Subject: [PATCH 138/163] Release notes for 8.7.19

---
 DocDB/doc/CHANGES | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/DocDB/doc/CHANGES b/DocDB/doc/CHANGES
index d594b9d8..59a785a6 100644
--- a/DocDB/doc/CHANGES
+++ b/DocDB/doc/CHANGES
@@ -1,7 +1,14 @@
+8.7.19
+ Fix case where infinite loop is caused if topic parent is set to a descendant
+ Add ability to add "attachment" in StreamFile for some extensions. Helps with Office
+
+8.7.18
+ Use full DN from certificate as username, not CN which is not unique
+
 8.7.17
  Don't loose security when updating public docs
  Modified Resecure from Laura
- 
+
 8.7.16
  Fix exclusion list for zip files
  Increase limit on related documents

From dbb88bcff8f9471a73bb124c839a5adbe610832e Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 4 Sep 2013 09:22:50 -0500
Subject: [PATCH 139/163] release notes

---
 DocDB/doc/CHANGES | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/DocDB/doc/CHANGES b/DocDB/doc/CHANGES
index d594b9d8..fa71db4d 100644
--- a/DocDB/doc/CHANGES
+++ b/DocDB/doc/CHANGES
@@ -1,7 +1,12 @@
+next
+ Fix lots of potential cross-site scripting problems by making (nearly) all
+ inputs valid HTML and doing the same with database output. Databases will now
+ contain a mix of escaped HTML and things with bare &, >, < etc.
+
 8.7.17
  Don't loose security when updating public docs
  Modified Resecure from Laura
- 
+
 8.7.16
  Fix exclusion list for zip files
  Increase limit on related documents

From fa7e7dd9e89061fb0083c8d6535a91395428af1d Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 4 Sep 2013 14:40:44 -0500
Subject: [PATCH 140/163] Sanitize or remove user input

---
 DocDB/cgi/InstitutionAdminister | 2 +-
 DocDB/cgi/ListBy                | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/DocDB/cgi/InstitutionAdminister b/DocDB/cgi/InstitutionAdminister
index d2c5ea3c..e450f719 100755
--- a/DocDB/cgi/InstitutionAdminister
+++ b/DocDB/cgi/InstitutionAdminister
@@ -83,7 +83,7 @@ if      ($Action eq "Delete") { # Delete institutions
   } else {
     my $InstitutionDelete = $dbh -> prepare("delete from Institution where InstitutionID=?");
     $InstitutionDelete -> execute($InstitutionID);
-    print "<b>$Institutions{$InstitutionID}{LONG} has been deleted.</b><br>\n";
+    print "<b>The institution has been deleted.</b><br>\n";
   }
 } elsif ($Action eq "Modify") { # Modify institutions
   unless ($InstitutionID) {
diff --git a/DocDB/cgi/ListBy b/DocDB/cgi/ListBy
index 24630aa4..4d022bda 100755
--- a/DocDB/cgi/ListBy
+++ b/DocDB/cgi/ListBy
@@ -127,7 +127,7 @@ if ($Days) {
   $Message .= "are available:";
   my %Hash = GetEventHashByTopic($TopicID);
   if (%Hash) {
-    $Message .= '<br/>(List <a href="'.$ListEventsBy.'?topicid='.$TopicID.'">events</a> on '.$Topics{$TopicID}{Long}.')';
+    $Message .= '<br/>(List <a href="'.$ListEventsBy.'?topicid='.$TopicID.'">events</a> on '.SmartHTML({-text=>$Topics{$TopicID}{Long}}).')';
   }
 } elsif ($AuthorID) {
 

From f9ea65f3404363805aabb5cbb25b8ab44c9cf136 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 4 Sep 2013 14:49:31 -0500
Subject: [PATCH 141/163] Use typedint for ShowDocument

---
 DocDB/cgi/DeleteConfirm  | 2 +-
 DocDB/cgi/DeleteDocument | 2 +-
 DocDB/cgi/ShowDocument   | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/DocDB/cgi/DeleteConfirm b/DocDB/cgi/DeleteConfirm
index 377e570c..2bc9eedb 100755
--- a/DocDB/cgi/DeleteConfirm
+++ b/DocDB/cgi/DeleteConfirm
@@ -51,7 +51,7 @@ $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 
 my $Untaint = CGI::Untaint -> new($query -> Vars);
 
-my $DocumentID = $Untaint -> extract(-as_integer => "documentid") || 0;
+my $DocumentID = $Untaint -> extract(-as_typedint => "documentid") || 0;
 
 @ErrorStack = ();
 
diff --git a/DocDB/cgi/DeleteDocument b/DocDB/cgi/DeleteDocument
index d576f163..a228a97f 100755
--- a/DocDB/cgi/DeleteDocument
+++ b/DocDB/cgi/DeleteDocument
@@ -39,7 +39,7 @@ $query = new CGI;  # Global for subroutines
 $query -> autoEscape(0);
 my $Untaint = CGI::Untaint -> new($query -> Vars);
 
-my $DocumentID = $Untaint -> extract(-as_integer => "docid") || 0;
+my $DocumentID = $Untaint -> extract(-as_typedint => "docid") || 0;
 my $Password = $Untaint -> extract(-as_printable => "password") || "";
 my $Username = $Untaint -> extract(-as_printable => "admuser") || "";
 
diff --git a/DocDB/cgi/ShowDocument b/DocDB/cgi/ShowDocument
index a5728a80..ea66b792 100755
--- a/DocDB/cgi/ShowDocument
+++ b/DocDB/cgi/ShowDocument
@@ -45,8 +45,8 @@ $query = new CGI;  # Global for subroutines
 $query -> autoEscape(0);
 my $Untaint = CGI::Untaint -> new($query -> Vars);
 
-   $DocumentID = $Untaint -> extract(-as_integer => "docid") || 0;
-   $Version = $Untaint -> extract(-as_integer => "version") || undef;
+   $DocumentID = $Untaint -> extract(-as_typedint => "docid") || 0;
+   $Version = $Untaint -> extract(-as_typedint => "version") || undef;
    $AsOf = $Untaint -> extract(-as_safehtml => "asof") || undef;
 my $OutFormat = $Untaint -> extract(-as_safehtml => "outformat") || "HTML";
    $OutFormat =~ tr/[a-z]/[A-Z]/;

From 94d0fe9f2439e552a4742b18af7d558db1ddc6b7 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 4 Sep 2013 14:55:33 -0500
Subject: [PATCH 142/163] Use typedint for ConfirmTalkHint

---
 DocDB/cgi/ConfirmTalkHint | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/DocDB/cgi/ConfirmTalkHint b/DocDB/cgi/ConfirmTalkHint
index 5040d4cc..aae9a1e9 100755
--- a/DocDB/cgi/ConfirmTalkHint
+++ b/DocDB/cgi/ConfirmTalkHint
@@ -54,8 +54,8 @@ my $Untaint = CGI::Untaint -> new($query -> Vars);
 @ErrorStack = ();
 @WarnStack  = ();
 
-my $DocumentID = $Untaint -> extract(-as_integer => "documentid") || 0;
-my $SessionTalkID = $Untaint -> extract(-as_integer => "sessiontalkid") || 0;
+my $DocumentID = $Untaint -> extract(-as_typedint => "documentid") || 0;
+my $SessionTalkID = $Untaint -> extract(-as_typedint => "sessiontalkid") || 0;
 
 unless ($DocumentID) {
   push @ErrorStack,"You are must supply a document number!";

From 59c76b25f086cc82f3ff404ff1b588c4a932e220 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Fri, 6 Sep 2013 12:56:28 -0500
Subject: [PATCH 143/163] Fix list in hash

---
 DocDB/cgi/DocDBGlobals.pm  | 2 +-
 DocDB/cgi/FileUtilities.pm | 3 +--
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/DocDB/cgi/DocDBGlobals.pm b/DocDB/cgi/DocDBGlobals.pm
index b3c0a948..8628a688 100644
--- a/DocDB/cgi/DocDBGlobals.pm
+++ b/DocDB/cgi/DocDBGlobals.pm
@@ -97,7 +97,7 @@ $Preferences{Options}{DynamicFullList}{Private} = $FALSE; # Generate Full docume
 $Preferences{Options}{DynamicFullList}{Public}  = $FALSE; # Generate Full document list by dynamically for public db
 
 $Preferences{Options}{AlwaysRetrieveFile}       = $FALSE; # Always use RetrieveFile instead of File Links
-$Preferences{Options}{FileEndingsForAttachment} = ("doc","docx","xls","xlsx","ppt","pptx","pps","ppsx");
+@{$Preferences{Options}{FileEndingsForAttachment}} = ("doc","docx","xls","xlsx","ppt","pptx","pps","ppsx");
 
 $Preferences{Options}{SubmitAgree}              = ""; # "Put text here to make users agree to a privacy statement or some-such. <br/><b>I agree:</b>"
 
diff --git a/DocDB/cgi/FileUtilities.pm b/DocDB/cgi/FileUtilities.pm
index 3c939f68..fa5203dd 100644
--- a/DocDB/cgi/FileUtilities.pm
+++ b/DocDB/cgi/FileUtilities.pm
@@ -199,13 +199,12 @@ sub StreamFile (%) {
     my $AttachmentString = "";
     if (defined($Preferences{Options}{FileEndingsForAttachment})) {
       my $Search = $ShortFile;
-      my $AttachRegex = join "|", $Preferences{Options}{FileEndingsForAttachment};
+      my $AttachRegex = join "|", @{$Preferences{Options}{FileEndingsForAttachment}};
       if ($Search =~ m/\.($AttachRegex})$/i) {
          $AttachmentString = "attachment;";
       }
     }
 
-
     print "Content-Type: $MimeType\n", # Print header
           "Content-Disposition: $AttachmentString filename=\"$ShortFile\"\n",
           "Content-Length: $Size\n\n";

From 2b67f91c3da77d99e07a2e43bac281a42fc91041 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Mon, 9 Sep 2013 09:33:24 -0500
Subject: [PATCH 144/163] Stray } in attachment

---
 DocDB/cgi/FileUtilities.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/DocDB/cgi/FileUtilities.pm b/DocDB/cgi/FileUtilities.pm
index fa5203dd..54c482dd 100644
--- a/DocDB/cgi/FileUtilities.pm
+++ b/DocDB/cgi/FileUtilities.pm
@@ -200,7 +200,7 @@ sub StreamFile (%) {
     if (defined($Preferences{Options}{FileEndingsForAttachment})) {
       my $Search = $ShortFile;
       my $AttachRegex = join "|", @{$Preferences{Options}{FileEndingsForAttachment}};
-      if ($Search =~ m/\.($AttachRegex})$/i) {
+      if ($Search =~ m/\.($AttachRegex)$/i) {
          $AttachmentString = "attachment;";
       }
     }

From 52e680fdb05eed02d7fd37615fd25a0abaa6719e Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Tue, 10 Sep 2013 14:51:55 -0500
Subject: [PATCH 145/163] Abort and warn about topic loops in a couple more
 places

---
 DocDB/cgi/DocumentAddForm | 8 ++++----
 DocDB/cgi/MeetingModify   | 2 ++
 DocDB/cgi/SessionModify   | 3 +++
 DocDB/cgi/TopicHTML.pm    | 8 +++++++-
 4 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/DocDB/cgi/DocumentAddForm b/DocDB/cgi/DocumentAddForm
index 27e0bd22..4e69e141 100755
--- a/DocDB/cgi/DocumentAddForm
+++ b/DocDB/cgi/DocumentAddForm
@@ -63,6 +63,9 @@ require "TalkHTML.pm";
 $query = new CGI;  # Global for subroutines
 $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 
+@ErrorStack = ();
+@WarnStack = ();
+
 &GetAuthors;
 &GetTopics;
 &GetSecurityGroups;
@@ -98,9 +101,6 @@ if      ($mode eq "add") {
   DocDBHeader("$Project Document Update",     "Document Update",      -scripts => \@Scripts);
 }
 
-@ErrorStack = ();
-@WarnStack = ();
-
 unless (CanCreate()) {
   push @ErrorStack,"You are not allowed to modify or create documents.";
 }
@@ -189,7 +189,7 @@ if ($mode eq "update" || $mode eq "updatedb") { # Need to read in last version v
   $DocTypeIDDefault    = $DocRevisions{$DocRevID}{DocTypeID};
   @SecurityDefaults    = GetRevisionSecurityGroups($DocRevID);
   unless (@SecurityDefaults) {
-    @SecurityDefaults = (0);	
+    @SecurityDefaults = (0);
   }
   my @AuthorRevIDs     = GetRevisionAuthors($DocRevID);
      @AuthorRevIDs     = sort AuthorRevIDsByOrder @AuthorRevIDs;
diff --git a/DocDB/cgi/MeetingModify b/DocDB/cgi/MeetingModify
index 1f611d00..55599d59 100755
--- a/DocDB/cgi/MeetingModify
+++ b/DocDB/cgi/MeetingModify
@@ -206,6 +206,8 @@ foreach my $CheckTitle (@CheckTitles) { # Check session times
   }
 }
 
+GetTopics();
+
 EndPage();
 
 my $SessionsModified = 0;
diff --git a/DocDB/cgi/SessionModify b/DocDB/cgi/SessionModify
index 6dc77f73..4da6b5b5 100755
--- a/DocDB/cgi/SessionModify
+++ b/DocDB/cgi/SessionModify
@@ -194,6 +194,9 @@ if ($SessionID) {
   push @ErrorStack,"You must specify a session or event to modify. You probably arrived
   here by error.";
 }
+
+GetTopics();
+
 EndPage();
 
 if ($SingleSession && $EventID) { # Grab single session ID in single session mode
diff --git a/DocDB/cgi/TopicHTML.pm b/DocDB/cgi/TopicHTML.pm
index 795b59a5..a23dc3f6 100644
--- a/DocDB/cgi/TopicHTML.pm
+++ b/DocDB/cgi/TopicHTML.pm
@@ -127,7 +127,13 @@ sub TopicLink ($) {
     my @ParentTopicIDs = FetchTopicParents( {-topicid => $TopicID});
     if (@ParentTopicIDs) {
       my ($ParentTopicID) = @ParentTopicIDs;
-      $Link .= TopicLink({-topicid => $ParentTopicID, -format => $Format,} );
+      my $NextLink = TopicLink({-topicid => $ParentTopicID, -format => $Format,} );
+      my $Search = $Link;
+      if ($Search =~ m/$NextLink/) {
+         push @ErrorStack,"Topic loop in topic $TopicID detected. Aborting. Contact an administrator.";
+         return;
+      }
+      $Link .= $NextLink;
       $Link .= $Separator;
     }
   }

From e9b6f62e09f8d9f549286c1aa9f5c4a7d17cc254 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Tue, 10 Sep 2013 17:11:36 -0500
Subject: [PATCH 146/163] Revert changes to TopicHTML, add require to
 SessionModify

---
 DocDB/cgi/SessionModify | 2 ++
 DocDB/cgi/TopicHTML.pm  | 8 +-------
 2 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/DocDB/cgi/SessionModify b/DocDB/cgi/SessionModify
index 4da6b5b5..c3a94e3e 100755
--- a/DocDB/cgi/SessionModify
+++ b/DocDB/cgi/SessionModify
@@ -54,6 +54,8 @@ require "MeetingSQL.pm";
 require "TalkHintSQL.pm";
 require "TalkSQL.pm";
 
+require "TopicSQL.pm";
+
 $query = new CGI;  # Global for subroutines
 
 &GetPrefsCookie;
diff --git a/DocDB/cgi/TopicHTML.pm b/DocDB/cgi/TopicHTML.pm
index a23dc3f6..795b59a5 100644
--- a/DocDB/cgi/TopicHTML.pm
+++ b/DocDB/cgi/TopicHTML.pm
@@ -127,13 +127,7 @@ sub TopicLink ($) {
     my @ParentTopicIDs = FetchTopicParents( {-topicid => $TopicID});
     if (@ParentTopicIDs) {
       my ($ParentTopicID) = @ParentTopicIDs;
-      my $NextLink = TopicLink({-topicid => $ParentTopicID, -format => $Format,} );
-      my $Search = $Link;
-      if ($Search =~ m/$NextLink/) {
-         push @ErrorStack,"Topic loop in topic $TopicID detected. Aborting. Contact an administrator.";
-         return;
-      }
-      $Link .= $NextLink;
+      $Link .= TopicLink({-topicid => $ParentTopicID, -format => $Format,} );
       $Link .= $Separator;
     }
   }

From 8a479ac44a953a0b111d904ed3ac908736baf182 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Thu, 12 Sep 2013 13:27:24 -0500
Subject: [PATCH 147/163] Remove HTML from Action, Error, WarnStack

---
 DocDB/cgi/AddFiles                    | 4 ++--
 DocDB/cgi/AuthorAdd                   | 2 +-
 DocDB/cgi/EventAdministerForm         | 4 ++--
 DocDB/cgi/ExternalDocDBAdministerForm | 2 +-
 DocDB/cgi/FSUtilities.pm              | 2 +-
 DocDB/cgi/MeetingSQL.pm               | 4 ++--
 DocDB/cgi/ProcessDocumentAdd          | 4 ++--
 DocDB/cgi/TopicAdminister             | 2 +-
 DocDB/cgi/TopicSQL.pm                 | 6 +++---
 9 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/DocDB/cgi/AddFiles b/DocDB/cgi/AddFiles
index b2355f43..f1d2d311 100755
--- a/DocDB/cgi/AddFiles
+++ b/DocDB/cgi/AddFiles
@@ -96,9 +96,9 @@ if ($DocumentID && $Version) {
 }
 
 if ($Preferences{Options}{SubmitAgree} && !$SubmitAgree) {
-  push @ErrorStack,'You must check the box near with this statement: <br/>'.
+  push @ErrorStack,'You must check the box near with this statement: \n'.
                    $Preferences{Options}{SubmitAgree}.
-                   '<br/>to add files to the document.';
+                   '\nto add files to the document.';
 }
 
 if ($PreserveSigs && !CanPreserveSigs()) {
diff --git a/DocDB/cgi/AuthorAdd b/DocDB/cgi/AuthorAdd
index 35888586..29c33ad3 100755
--- a/DocDB/cgi/AuthorAdd
+++ b/DocDB/cgi/AuthorAdd
@@ -73,7 +73,7 @@ $AuthorInsert -> execute($FirstName,$MiddleInitials,$LastName,$InstitutionID);
 my $AuthorID = $AuthorInsert -> {mysql_insertid}; # Works with MySQL only
 
 if ($AuthorID) {
-  push @ActionStack,"$FirstName $MiddleInitials $LastName has been added as an author. You can <a href=\"$AuthorAddForm\">add another</a> author.";
+  push @ActionStack,"$FirstName $MiddleInitials $LastName has been added as an author.";
 } else {
   unless (@ErrorStack) {
     push @ErrorStack,"Something unknown went wrong. Contact an administrator.";
diff --git a/DocDB/cgi/EventAdministerForm b/DocDB/cgi/EventAdministerForm
index 7fc061a8..dd91d814 100755
--- a/DocDB/cgi/EventAdministerForm
+++ b/DocDB/cgi/EventAdministerForm
@@ -108,7 +108,7 @@ if ($SubForm eq "eventgroup") {
       $Update -> execute($LongDescription,$EventGroupID);
     }
   } elsif ($Action eq "New") {
-    push @ActionStack,"New event group with description <strong>$ShortDescription</strong> inserted";
+    push @ActionStack,"New event group with description $ShortDescription inserted";
     my $Insert = $dbh -> prepare("insert into EventGroup (ShortDescription,LongDescription) values (?,?)");
     $Insert -> execute($ShortDescription,$LongDescription);
   } else {
@@ -118,7 +118,7 @@ if ($SubForm eq "eventgroup") {
   if ($Action eq "Delete") {
     &DeleteEvent(-eventid => $EventID, -force => $Force);
   } else {
-    push @WarnStack,"Only \"Delete\" is a valid action";
+    push @WarnStack,"Only \"Delete\" is a valid action for events.";
   }
 }
 
diff --git a/DocDB/cgi/ExternalDocDBAdministerForm b/DocDB/cgi/ExternalDocDBAdministerForm
index b054ab77..0929a523 100755
--- a/DocDB/cgi/ExternalDocDBAdministerForm
+++ b/DocDB/cgi/ExternalDocDBAdministerForm
@@ -118,7 +118,7 @@ if ($SubForm eq "externaldocdb") {
       $Update -> execute($PublicURL,$ExternalDocDBID);
     }
   } elsif ($Action eq "New") {
-    push @ActionStack,"New external DocDB for <strong>$ProjectName</strong> added";
+    push @ActionStack,"New external DocDB for $ProjectName added";
     my $Insert = $dbh -> prepare("insert into ExternalDocDB (Project,Description,PrivateURL,PublicURL) values (?,?,?,?)");
     $Insert -> execute($ProjectName,$Description,$PrivateURL,$PublicURL);
   } else {
diff --git a/DocDB/cgi/FSUtilities.pm b/DocDB/cgi/FSUtilities.pm
index f59226a4..db10e269 100644
--- a/DocDB/cgi/FSUtilities.pm
+++ b/DocDB/cgi/FSUtilities.pm
@@ -284,7 +284,7 @@ sub DownloadURLs (%) {
     if ($Files{$FileKey}{URL}) {
       my $URL = $Files{$FileKey}{URL};
       unless (&ValidFileURL($URL)) {
-        push @ErrorStack,"The URL <tt>$URL</tt> is not well formed. Don't forget ".
+        push @ErrorStack,"The URL $URL is not well formed. Don't forget ".
                          "http:// on the front and a file name after the last /.";
       }
       my @Options = ();
diff --git a/DocDB/cgi/MeetingSQL.pm b/DocDB/cgi/MeetingSQL.pm
index e536ab96..a309d87f 100644
--- a/DocDB/cgi/MeetingSQL.pm
+++ b/DocDB/cgi/MeetingSQL.pm
@@ -640,7 +640,7 @@ sub DeleteEventGroup (%) {
 
   my $Delete = $dbh -> prepare("delete from EventGroup where EventGroupID=?");
   $Delete -> execute($EventGroupID);
-  push @ActionStack,"Event group <strong>$EventGroups{$EventGroupID}{LongDescription}</strong> deleted";
+  push @ActionStack,"Event group $EventGroups{$EventGroupID}{LongDescription} deleted";
 
   return 1;
 }
@@ -690,7 +690,7 @@ sub DeleteEvent (%) {
   $Delete          -> execute($EventID);
   $DeleteTopic     -> execute($EventID);
   $DeleteModerator -> execute($EventID);
-  push @ActionStack,"Event <strong>$Conferences{$EventID}{Title}</strong> deleted";
+  push @ActionStack,"Event $Conferences{$EventID}{Title} deleted";
   if (@DocRevIDs) {
     my $Delete = $dbh -> prepare("delete from RevisionEvent where ConferenceID=?");
     $Delete -> execute($EventID);
diff --git a/DocDB/cgi/ProcessDocumentAdd b/DocDB/cgi/ProcessDocumentAdd
index b4d40e0d..ab4c2557 100755
--- a/DocDB/cgi/ProcessDocumentAdd
+++ b/DocDB/cgi/ProcessDocumentAdd
@@ -328,9 +328,9 @@ if ($Mode eq "update" || $Mode eq "updatedb") {
 }
 
 if ($Preferences{Options}{SubmitAgree} && !$SubmitAgree) {
-  push @ErrorStack,'You must check the box near with this statement: <br/>'.
+  push @ErrorStack,'You must check the box near with this statement: \n'.
                    $Preferences{Options}{SubmitAgree}.
-                   '<br/>to submit the document.';
+                   '\nto submit the document.';
 }
 
 ### Final checks
diff --git a/DocDB/cgi/TopicAdminister b/DocDB/cgi/TopicAdminister
index 495cf5ab..67c31b49 100755
--- a/DocDB/cgi/TopicAdminister
+++ b/DocDB/cgi/TopicAdminister
@@ -148,7 +148,7 @@ if ($Action eq "Delete") {
       $Insert -> execute($TopicID,$ParentTopicID);
       push @ActionStack,"New sub-topic created with descriptions $ShortName and $LongName.";
     } else {
-      push @ActionStack,"New <span class=\"Highlight\">root-level topic</span> created with descriptions $ShortName and $LongName.";
+      push @ActionStack,"New root-level topic created with descriptions $ShortName and $LongName.";
     }
   } else {
     push @WarnStack,"No short or long description supplied. No topic created.";
diff --git a/DocDB/cgi/TopicSQL.pm b/DocDB/cgi/TopicSQL.pm
index 29b0ae33..e87360b7 100644
--- a/DocDB/cgi/TopicSQL.pm
+++ b/DocDB/cgi/TopicSQL.pm
@@ -278,7 +278,7 @@ sub DeleteTopic ($) {
   if ($Abort) {
     return 0;
   }
- 
+
   my $TopicDelete     = $dbh -> prepare("delete from Topic          where TopicID=?");
   my $RevisionDelete  = $dbh -> prepare("delete from RevisionTopic  where TopicID=?");
   my $HintDelete      = $dbh -> prepare("delete from TopicHint      where TopicID=?");
@@ -302,9 +302,9 @@ sub DeleteTopic ($) {
   }
 
   if ($Force) {
-    push @ActionStack,"Topic <strong>$Topics{$TopicID}{LongDescription}</strong>, all sub-topics, all associations, and all associations to sub-topics deleted.";
+    push @ActionStack,"Topic $Topics{$TopicID}{LongDescription}, all sub-topics, all associations, and all associations to sub-topics deleted.";
   } else {
-    push @ActionStack,"Topic <strong>$Topics{$TopicID}{LongDescription}</strong> deleted.";
+    push @ActionStack,"Topic $Topics{$TopicID}{LongDescription} deleted.";
   }
   return 1;
 }

From e053457e07a9847acf51ea7ea2cb32872e296e9b Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Fri, 13 Sep 2013 10:08:41 -0500
Subject: [PATCH 148/163] Do grep of item in list correctly

---
 DocDB/cgi/TopicAdminister | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/DocDB/cgi/TopicAdminister b/DocDB/cgi/TopicAdminister
index d400fac8..71fed293 100755
--- a/DocDB/cgi/TopicAdminister
+++ b/DocDB/cgi/TopicAdminister
@@ -117,7 +117,7 @@ if ($Action eq "Delete") {
     push @WarnStack,"You cannot set a topic to be its own parent. No action taken.";
   }
 
-  if (grep $ParentTopicID, @{$TopicDescendants{$TopicID}}) {
+  if (grep {$_ eq $ParentTopicID} @{$TopicDescendants{$TopicID}}) {
     push @ErrorStack,"The topic you tried to modify has the proposed parent as one of its descendants. No action taken.";
   }
 

From f6d0883b18dd58001c84d6c681bb959f1da47a06 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Mon, 16 Sep 2013 16:45:52 -0500
Subject: [PATCH 149/163] Add version string

---
 DocDB/cgi/DocDBVersion.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/DocDB/cgi/DocDBVersion.pm b/DocDB/cgi/DocDBVersion.pm
index fc34b84a..c6aa930e 100644
--- a/DocDB/cgi/DocDBVersion.pm
+++ b/DocDB/cgi/DocDBVersion.pm
@@ -20,6 +20,6 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-$DocDBVersion = "8.7.19";
+$DocDBVersion = "8.7.20";
 
 1;

From dc5857c095b1c7bd9d19d77ed5df49469d89479f Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Tue, 24 Sep 2013 14:18:09 -0500
Subject: [PATCH 150/163] Wrong regexp

---
 DocDB/cgi/UntaintInteger.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/DocDB/cgi/UntaintInteger.pm b/DocDB/cgi/UntaintInteger.pm
index cfda06c2..c3b2e789 100644
--- a/DocDB/cgi/UntaintInteger.pm
+++ b/DocDB/cgi/UntaintInteger.pm
@@ -28,7 +28,7 @@ $VERSION = '1.00';
 use strict;
 use base 'CGI::Untaint::object';
 
-sub _untaint_re { qr/^\s+([+-]?\d+)\s+$/ }
+sub _untaint_re { qr/^\s*([+-]?\d+)\s*$/ }
 
 sub is_valid {
   my $self = shift;

From b7b13f118d53c6fe50ac6c91eeb339cb660fca5c Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Mon, 30 Sep 2013 16:25:06 -0500
Subject: [PATCH 151/163] Bug in extracting parent value, minor style changes

---
 DocDB/cgi/AdvancedInstructions.pm | 56 +++++++++++++++----------------
 DocDB/cgi/FileUtilities.pm        |  7 ++--
 DocDB/cgi/GroupAdminister         |  2 +-
 3 files changed, 33 insertions(+), 32 deletions(-)

diff --git a/DocDB/cgi/AdvancedInstructions.pm b/DocDB/cgi/AdvancedInstructions.pm
index 171cdacc..72327e83 100644
--- a/DocDB/cgi/AdvancedInstructions.pm
+++ b/DocDB/cgi/AdvancedInstructions.pm
@@ -1,17 +1,17 @@
-# Description: The generic instructions for DocDB. This is mostly HTML, but making 
+# Description: The generic instructions for DocDB. This is mostly HTML, but making
 #              it a script allows us to eliminate parts of it that we don't want
 #              and get it following everyone's style, and allows groups to add
 #              to it with ProjectMessages.
 #
 #      Author: Eric Vaandering (ewv@fnal.gov)
-#    Modified: 
+#    Modified:
 
 # Copyright 2001-2013 Eric Vaandering, Lynn Garren, Adam Bryant
 
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -61,7 +61,7 @@ sub AdvancedInstructionsBody {
   <p>You can also construct URL's that link to your document. The URL is of the form
   <tt>$ShowDocument?docid=XXXX&amp;version=XX</tt>,
   where the X's represent <i>just the numbers</i> of the document and version.
-  (I.e. leave off the ``$ShortProject-doc-'' and ``-v.'') As above, you can leave off the
+  (I.e. leave off the <q>$ShortProject-doc-</q> and <q>-v.</q>) As above, you can leave off the
   <tt>&amp;version=XX</tt> to refer to the latest version.</p>
 
   <p><strong>Using "as of" instead of version number:</strong> Instead of specifying a version
@@ -70,11 +70,11 @@ sub AdvancedInstructionsBody {
 
   <h3>Linking to files in a document</h3>
 
-  <p>There is a script interface which fetches files from DocDB. The URL is 
+  <p>There is a script interface which fetches files from DocDB. The URL is
   <tt>$RetrieveFile?docid=XXXX&amp;version=XX&amp;filename=xxxxxx</tt>.
   The version number can be left off to get files from the latest version number.
   The filename can also be left off. If there is only one file marked <q>Main</q>
-  that file will be retrieved. 
+  that file will be retrieved.
   An alternate form is
   <tt>$RetrieveFile?docid=XXXX&amp;version=XX&amp;extension=xxx</tt>,
   so for instance you can specify PDF as the extension to retrieve the PDF file
@@ -94,16 +94,16 @@ sub AdvancedInstructionsBody {
   The most useful searches are by author, topic, keyword, or events.</p>
 
   <p>
-  To link to a topic, you must first find out the topic ID number. 
-  The easiest way to do this is to simply click on that topic from the 
+  To link to a topic, you must first find out the topic ID number.
+  The easiest way to do this is to simply click on that topic from the
   <a href="$ListTopics">list by topic</a> page.
-  The URL for a single topic will be 
-  <tt>$ListBy?topicid=xxx</tt>. 
-  Similarly, links to documents by authors are most easily found by the 
+  The URL for a single topic will be
+  <tt>$ListBy?topicid=xxx</tt>.
+  Similarly, links to documents by authors are most easily found by the
   <a href="$ListAuthors">list by author</a> page.
   </p>
   <p>
-  Use the search form to link to a keyword: 
+  Use the search form to link to a keyword:
   <tt>$Search?keywordsearchmode=anysub&amp;keywordsearch=xxxxxxx</tt>.
   </p>
   <p>
@@ -126,7 +126,7 @@ sub AdvancedInstructionsBody {
   have values of <tt>AND</tt> and <tt>OR</tt>. For instance, if you specify two authors,
   <tt>innerlogic=OR</tt> will return documents by <i>either</i> author while <tt>AND</tt>
   will require the document to be authored by <i>both</i> people. To understand
-  <tt>outerlogic</tt>, take the example of searching for an author and a topic. 
+  <tt>outerlogic</tt>, take the example of searching for an author and a topic.
   <tt>outerlogic=OR</tt> will require a document to either have the correct author or the
   correct topic, while <tt>AND</tt> will require both. Both options can be specified at the
   same time. <tt>outerlogic</tt> defaults to <tt>AND</tt> and <tt>innerlogic</tt> defaults
@@ -161,7 +161,7 @@ sub AdvancedInstructionsBody {
    more than one are specified, <i>only one</i> word must be found</li>
    <li><tt>searchmode=allsub</tt> as above, but <i>all</i> words must be found</li>
    <li><tt>searchmode=anyword</tt> or <tt>allword</tt> like above, but the word must be found surrounded by spaces</li>
-  </ul> 
+  </ul>
   <p>
   More modes can be added if required. To search for more than one word, place the code for a space (%20) between
   them.  </p>
@@ -182,13 +182,13 @@ sub AdvancedInstructionsBody {
   <a name="xml" />
   <h1>XML Interface</h1>
 
-  <p>An XML interface for retrieving information from and submiting information to DocDB is 
+  <p>An XML interface for retrieving information from and submiting information to DocDB is
      partially complete. It is not fully complete, but it may satisfy the most common needs.</p>
-     
+
   <a name="xmldown" />
   <h2>XML Downloads</h2>
 
-  <p>Any link to <tt>Search</tt> or <tt>ShowDocument</tt> described above will generate XML 
+  <p>Any link to <tt>Search</tt> or <tt>ShowDocument</tt> described above will generate XML
      output if <tt>&amp;outformat=xml</tt> is added to the parameter list. <tt>Search</tt> returns
      a summary of the found documents while <tt>ShowDocument</tt> returns all the meta-info for
      the document.</p>
@@ -198,7 +198,7 @@ sub AdvancedInstructionsBody {
      the XML output). Future improvements  to the XML facilities of DocDB may include XML output
      from <tt>ListBy</tt>, XML output of events, and  XML output of topic, author and other lists.
      If any of these enhancements would be useful to you, please contact your  administrator or
-     the developers.</p>  
+     the developers.</p>
 
   <a name="xmlup" />
   <h2>XML Uploads</h2>
@@ -206,9 +206,9 @@ sub AdvancedInstructionsBody {
   <p>Since version 8.4 DocDB has supported uploads of XML data describing documents. This is
      done with the <a href="$XMLUpload">XMLUpload</a> script. The XML output of ShowDocument
      described above can be used almost directly to create a new document. One new XML element
-     must be added to such an XMLFile and a second element is optional. Both elements must be 
+     must be added to such an XMLFile and a second element is optional. Both elements must be
      added as children of &lt;docdb&gt; (at the same level as &lt;document&gt;).</p>
-     
+
   <p>The first XML element is <tt>control</tt> which has two parameters: <tt>mode</tt> and
      <tt>usedate</tt>. <tt>mode</tt> must be one of three values, <q>new</q>, <q>bump</q>, or <q>updatedb</q>. New
      ignores the  document ID in the uploaded XML and creates a new document with the included
@@ -223,25 +223,25 @@ sub AdvancedInstructionsBody {
        &lt;mode&gt;new&lt;/mode&gt;
        &lt;usedate&gt;yes&lt;/usedate&gt;
      &lt;/control&gt;
-     </pre> 
+     </pre>
 
   <p>The second element XML element (which is optional) is <tt>authentication</tt> which contains
      the  username and password needed to download the file(s) in the document from the remote
      source. It will look like this:</p>
-     
+
      <pre>
      &lt;authentication&gt;
        &lt;username&gt;http-basic-username&lt;/username&gt;
        &lt;password&gt;http-basic-password&lt;/password&gt;
      &lt;/authentication&gt;
-     </pre> 
-     
-  <p>Generally speaking, when DocDB is processing an XML file, the <tt>id</tt> numbers describing 
+     </pre>
+
+  <p>Generally speaking, when DocDB is processing an XML file, the <tt>id</tt> numbers describing
      things  like topics, events, etc. are used and the names of those things shown in the XML
      file are ignored. Also, not all information  about a document van be uploaded via XML. This
      can be changed if there is a need for it. </p>
 
-  <p>If the <tt>id</tt> numbers are missing, DocDB attempts a text match for the following 
+  <p>If the <tt>id</tt> numbers are missing, DocDB attempts a text match for the following
      information:</p>
   <ul>
    <li>Document submitter (based on <tt>firstname</tt> and <tt>lastname</tt>)</li>
@@ -256,9 +256,9 @@ sub AdvancedInstructionsBody {
        as well</li>
   </ul>
 
-  <p>Finally, you will notice that there is no provision for adding files via XML. 
+  <p>Finally, you will notice that there is no provision for adding files via XML.
      This could be added but was not needed at the moment.</p>
-     
+
   <a name="program" />
   <h1>Programatic Interface</h1>
 
diff --git a/DocDB/cgi/FileUtilities.pm b/DocDB/cgi/FileUtilities.pm
index 11412852..146b1241 100644
--- a/DocDB/cgi/FileUtilities.pm
+++ b/DocDB/cgi/FileUtilities.pm
@@ -191,10 +191,11 @@ sub StreamFile (%) {
 
     unless ($MimeType) {
       # This is unsafe. Until we can figure out a way to do this, comment it out. Could use IPC::Run if we had it
-#      $MimeType = `$FileMagic -ib \"$File\"`; # Use magic as a backup
-#      chomp $MimeType;
+      # $MimeType = `$FileMagic -ib \"$File\"`; # Use magic as a backup
+      # chomp $MimeType;
+      # print STDERR "DocDB: MIME info not found, defaulting to \"magic\" which says: $MimeType\n";
       $MimeType = 'binary/octet-stream';
-      print STDERR "DocDB: MIME info not found, defaulting to \"magic\" which says: $MimeType\n";
+      print STDERR "DocDB: MIME info not found, defaulting to binary/octet-stream\n";
     }
 
     my @Parts = split /\//,$File;
diff --git a/DocDB/cgi/GroupAdminister b/DocDB/cgi/GroupAdminister
index 11fd4e42..07de410f 100755
--- a/DocDB/cgi/GroupAdminister
+++ b/DocDB/cgi/GroupAdminister
@@ -55,7 +55,7 @@ my $Force = $Untaint -> extract(-as_printable => "admforce") || "";
 
 my $Description = $Untaint -> extract(-as_safehtml => "description") || "";
 my $Name = $Untaint -> extract(-as_safehtml => "name") || "";
-my $ParentID = $Untaint -> extract(-as_integer => "ParentID") || 0;
+my $ParentID = $Untaint -> extract(-as_integer => "parent") || 0;
 my @ChildIDs = @{ $Untaint -> extract(-as_listofint => "child") || undef };
 my $View = $Untaint -> extract(-as_printable => "view") || "";
 my $Create = $Untaint -> extract(-as_printable => "create") || "";

From c2bfa1faebc2da78ad95d5b8b6d2bffa113c9310 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Fri, 11 Oct 2013 10:51:13 -0500
Subject: [PATCH 152/163] Allow ?, =, + in URL unmodified

---
 DocDB/cgi/HTMLUtilities.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/DocDB/cgi/HTMLUtilities.pm b/DocDB/cgi/HTMLUtilities.pm
index 097d98c2..ae935304 100644
--- a/DocDB/cgi/HTMLUtilities.pm
+++ b/DocDB/cgi/HTMLUtilities.pm
@@ -31,7 +31,7 @@ sub SmartHTML ($) {
   my $AddLineBreaks = exists $ArgRef->{-addLineBreaks} ?  $ArgRef->{-addLineBreaks} : $FALSE;
 
   # Escape text into &x1234; format ignoring a alphanumerics and a few special characters
-  $Text =~ s{([^\:\/\.\-\w\s&#%;]|&(?!#?\w+;))}{"&#x".sprintf("%x", unpack(U,$1)).";"}ge;
+  $Text =~ s{([^\:\/\.\-\?\=\+\w\s&#%;]|&(?!#?\w+;))}{"&#x".sprintf("%x", unpack(U,$1)).";"}ge;
 
   # Turn found URLs into hyperlinks, adapted from Perl Cookbook, 6.21
   if ($MakeURLs) {

From 4b68edf5214538d1c6612c037700cba2abf079cb Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Fri, 11 Oct 2013 13:11:24 -0500
Subject: [PATCH 153/163] wrong parameter name on DeleteConfirm

---
 DocDB/cgi/DeleteConfirm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/DocDB/cgi/DeleteConfirm b/DocDB/cgi/DeleteConfirm
index 2bc9eedb..c9ccd7ee 100755
--- a/DocDB/cgi/DeleteConfirm
+++ b/DocDB/cgi/DeleteConfirm
@@ -51,7 +51,7 @@ $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 
 my $Untaint = CGI::Untaint -> new($query -> Vars);
 
-my $DocumentID = $Untaint -> extract(-as_typedint => "documentid") || 0;
+my $DocumentID = $Untaint -> extract(-as_typedint => "docid") || 0;
 
 @ErrorStack = ();
 

From f9e7016628ec690c69e3ace38b3eb5be211319c1 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Fri, 11 Oct 2013 10:51:13 -0500
Subject: [PATCH 154/163] Allow ?, =, + in URL unmodified

---
 DocDB/cgi/HTMLUtilities.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/DocDB/cgi/HTMLUtilities.pm b/DocDB/cgi/HTMLUtilities.pm
index 097d98c2..ae935304 100644
--- a/DocDB/cgi/HTMLUtilities.pm
+++ b/DocDB/cgi/HTMLUtilities.pm
@@ -31,7 +31,7 @@ sub SmartHTML ($) {
   my $AddLineBreaks = exists $ArgRef->{-addLineBreaks} ?  $ArgRef->{-addLineBreaks} : $FALSE;
 
   # Escape text into &x1234; format ignoring a alphanumerics and a few special characters
-  $Text =~ s{([^\:\/\.\-\w\s&#%;]|&(?!#?\w+;))}{"&#x".sprintf("%x", unpack(U,$1)).";"}ge;
+  $Text =~ s{([^\:\/\.\-\?\=\+\w\s&#%;]|&(?!#?\w+;))}{"&#x".sprintf("%x", unpack(U,$1)).";"}ge;
 
   # Turn found URLs into hyperlinks, adapted from Perl Cookbook, 6.21
   if ($MakeURLs) {

From 68d17769322f83e71151914cb2035bd0e0c814c2 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Fri, 11 Oct 2013 13:11:24 -0500
Subject: [PATCH 155/163] wrong parameter name on DeleteConfirm

---
 DocDB/cgi/DeleteConfirm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/DocDB/cgi/DeleteConfirm b/DocDB/cgi/DeleteConfirm
index 2bc9eedb..c9ccd7ee 100755
--- a/DocDB/cgi/DeleteConfirm
+++ b/DocDB/cgi/DeleteConfirm
@@ -51,7 +51,7 @@ $dbh   = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
 
 my $Untaint = CGI::Untaint -> new($query -> Vars);
 
-my $DocumentID = $Untaint -> extract(-as_typedint => "documentid") || 0;
+my $DocumentID = $Untaint -> extract(-as_typedint => "docid") || 0;
 
 @ErrorStack = ();
 

From 4e494503161b843d959ab991e1ccb784a0646afd Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Tue, 15 Oct 2013 14:34:02 -0500
Subject: [PATCH 156/163] Fix setting view to public

---
 DocDB/cgi/ProcessDocumentAdd | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/DocDB/cgi/ProcessDocumentAdd b/DocDB/cgi/ProcessDocumentAdd
index ab4c2557..bf0a93e4 100755
--- a/DocDB/cgi/ProcessDocumentAdd
+++ b/DocDB/cgi/ProcessDocumentAdd
@@ -127,6 +127,12 @@ my @AuthorIDs = @{ $Untaint -> extract(-as_listofint => "authors") || undef };
 my $AuthorManual = $Untaint -> extract(-as_safehtml => "authormanual") || "";
 
 my @ViewGroupIDs = @{ $Untaint -> extract(-as_listofint => "security") || undef };
+
+# Don't understand this but untaint of a list with the value "0" produces an empty list. Untaint as printable does not help.
+my $ViewGroupRaw = $query -> param("security");
+if ($ViewGroupRaw eq "0") {
+  @ViewGroupIDs = (0);
+}
 my @ModifyGroupIDs = @{ $Untaint -> extract(-as_listofint => "modify") || undef };
 
 # Journal Info

From c5941de133ced8bcd650f371da312b33ab461ac1 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Tue, 15 Oct 2013 14:44:55 -0500
Subject: [PATCH 157/163] Change default version from 0 to undef

---
 DocDB/cgi/DocDBVersion.pm | 2 +-
 DocDB/cgi/RetrieveFile    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/DocDB/cgi/DocDBVersion.pm b/DocDB/cgi/DocDBVersion.pm
index c6aa930e..aea52bf0 100644
--- a/DocDB/cgi/DocDBVersion.pm
+++ b/DocDB/cgi/DocDBVersion.pm
@@ -20,6 +20,6 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-$DocDBVersion = "8.7.20";
+$DocDBVersion = "8.7.20rc4";
 
 1;
diff --git a/DocDB/cgi/RetrieveFile b/DocDB/cgi/RetrieveFile
index 294cb301..76af9d5a 100755
--- a/DocDB/cgi/RetrieveFile
+++ b/DocDB/cgi/RetrieveFile
@@ -43,7 +43,7 @@ $query -> autoEscape(0);
 my $Untaint = CGI::Untaint -> new($query -> Vars);
 
 my $DocumentID = $Untaint -> extract(-as_integer => "docid") || 0;
-my $Version = $Untaint -> extract(-as_integer => "version") || 0;
+my $Version = $Untaint -> extract(-as_integer => "version") || undef;
 my $AsOf = $Untaint -> extract(-as_safehtml => "asof") || "";
 my $FileName = $Untaint -> extract(-as_printable => "filename") || "";
 my $Extension = $Untaint -> extract(-as_safehtml => "extension") || "";

From ddc7a0921c840abc57b4f121848969eb76ae3e58 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Tue, 15 Oct 2013 14:47:32 -0500
Subject: [PATCH 158/163] Change default version from 0 to undef

---
 DocDB/cgi/RetrieveFile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/DocDB/cgi/RetrieveFile b/DocDB/cgi/RetrieveFile
index 76af9d5a..0f9fad48 100755
--- a/DocDB/cgi/RetrieveFile
+++ b/DocDB/cgi/RetrieveFile
@@ -44,7 +44,7 @@ my $Untaint = CGI::Untaint -> new($query -> Vars);
 
 my $DocumentID = $Untaint -> extract(-as_integer => "docid") || 0;
 my $Version = $Untaint -> extract(-as_integer => "version") || undef;
-my $AsOf = $Untaint -> extract(-as_safehtml => "asof") || "";
+my $AsOf = $Untaint -> extract(-as_safehtml => "asof") || undef;
 my $FileName = $Untaint -> extract(-as_printable => "filename") || "";
 my $Extension = $Untaint -> extract(-as_safehtml => "extension") || "";
 

From 920955f29c5546903722b7b146425c9239396201 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 16 Oct 2013 08:46:46 -0500
Subject: [PATCH 159/163] Detect URLs with ; in them

---
 DocDB/cgi/HTMLUtilities.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/DocDB/cgi/HTMLUtilities.pm b/DocDB/cgi/HTMLUtilities.pm
index ae935304..2929212c 100644
--- a/DocDB/cgi/HTMLUtilities.pm
+++ b/DocDB/cgi/HTMLUtilities.pm
@@ -37,7 +37,7 @@ sub SmartHTML ($) {
   if ($MakeURLs) {
     my $urls = '(http|telnet|gopher|file|wais|ftp|https)';
     my $ltrs = '\w';
-    my $gunk = '/#~:.?+=&%@!\-';
+    my $gunk = '/#~:.?+=&%@!{};\-';
     my $punc = '.:?\-';
     my $any  = "${ltrs}${gunk}${punc}";
     $Text =~ s{

From b4e577b1e6c32447edc0124cd693038d21fa0e28 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Wed, 16 Oct 2013 08:48:57 -0500
Subject: [PATCH 160/163] RC5

---
 DocDB/cgi/DocDBVersion.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/DocDB/cgi/DocDBVersion.pm b/DocDB/cgi/DocDBVersion.pm
index aea52bf0..3d0bdb81 100644
--- a/DocDB/cgi/DocDBVersion.pm
+++ b/DocDB/cgi/DocDBVersion.pm
@@ -20,6 +20,6 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-$DocDBVersion = "8.7.20rc4";
+$DocDBVersion = "8.7.20rc5";
 
 1;

From 9ed5513ec3bef05decb87ee64565770ac7ab50b7 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Thu, 17 Oct 2013 14:00:43 -0500
Subject: [PATCH 161/163] Don't send special characters out in e-mail

---
 DocDB/cgi/EmailUtilities.pm   | 16 +++++++++-------
 DocDB/cgi/MailNotification.pm | 26 ++++++++++++++------------
 DocDB/cgi/WatchDocument       |  2 +-
 3 files changed, 24 insertions(+), 20 deletions(-)

diff --git a/DocDB/cgi/EmailUtilities.pm b/DocDB/cgi/EmailUtilities.pm
index fcb32b13..95992e47 100644
--- a/DocDB/cgi/EmailUtilities.pm
+++ b/DocDB/cgi/EmailUtilities.pm
@@ -3,7 +3,7 @@
 #    This file is part of DocDB.
 
 #    DocDB is free software; you can redistribute it and/or modify
-#    it under the terms of version 2 of the GNU General Public License 
+#    it under the terms of version 2 of the GNU General Public License
 #    as published by the Free Software Foundation.
 
 #    DocDB is distributed in the hope that it will be useful,
@@ -15,32 +15,34 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
+use HTML::Entities;
+
 sub SendEmail (%) {
   unless ($MailInstalled) {
     return 0;
-  }    
+  }
 
   require Mail::Send;          #FIXME: Why not use?
   require Mail::Mailer;
   my (%Params) = @_;
-  
+
   my %Headers = ();
   my @Addressees = @{$Params{-to}};
   my $From       =   $Params{-from}    || "$Project Document Database <$DBWebMasterEmail>";
   my $Subject    =   $Params{-subject} || "$Project Document Database";
   my $Body       =   $Params{-body}    || "";
-     
+
   my %Headers = ();
-   
+
   if (@Addressees) {
     print "Sending mail to: ",join ", ",@Addressees,"<br/>\n";
     my $Mailer = new Mail::Mailer 'smtp', Server => $MailServer;
     $Headers{To}      = \@Addressees;
     $Headers{From}    = $From;
     $Headers{Subject} = $Subject;
-    
+
     $Mailer -> open(\%Headers);    # Start mail with headers
-    print $Mailer $Body;
+    print $Mailer HTML::Entities::decode_entities($Body);
     $Mailer -> close;              # Complete the message and send it
   }
   return int(@Addressees);
diff --git a/DocDB/cgi/MailNotification.pm b/DocDB/cgi/MailNotification.pm
index 5d9b7d27..b2f8303a 100644
--- a/DocDB/cgi/MailNotification.pm
+++ b/DocDB/cgi/MailNotification.pm
@@ -25,6 +25,8 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
+use HTML::Entities;
+
 require "HTMLUtilities.pm";
 
 sub MailNotices (%) {
@@ -134,7 +136,7 @@ sub MailNotices (%) {
     $Headers{Subject} = $Subject;
 
     $Mailer -> open(\%Headers);    # Start mail with headers
-    print $Mailer $Message;
+    print $Mailer HTML::Entities::decode_entities($Message);
     RevisionMailBody($DocRevID);   # Write the body
     $Mailer -> close;              # Complete the message and send it
     my $Addressees = join ', ',@Addressees;
@@ -208,20 +210,20 @@ sub RevisionMailBody ($) {
 
   # Construct the mail body
 
-  print $Mailer "       Title: ",$DocRevisions{$DocRevID}{Title},"\n";
-  print $Mailer " Document ID: ",$FullID,"\n";
-  print $Mailer "         URL: ",$URL,"\n";
-  print $Mailer "        Date: ",$DocRevisions{$DocRevID}{DATE},"\n";
-  print $Mailer "Submitted by: ",$Submitter,"\n";
-  print $Mailer "     Authors: ",$Authors,"\n";
-  print $Mailer "      Topics: ",$Topics,"\n";
+  print $Mailer "       Title: ",HTML::Entities::decode_entities($DocRevisions{$DocRevID}{Title}),"\n";
+  print $Mailer " Document ID: ",HTML::Entities::decode_entities($FullID),"\n";
+  print $Mailer "         URL: ",HTML::Entities::decode_entities($URL),"\n";
+  print $Mailer "        Date: ",HTML::Entities::decode_entities($DocRevisions{$DocRevID}{DATE}),"\n";
+  print $Mailer "Submitted by: ",HTML::Entities::decode_entities($Submitter),"\n";
+  print $Mailer "     Authors: ",HTML::Entities::decode_entities($Authors),"\n";
+  print $Mailer "      Topics: ",HTML::Entities::decode_entities($Topics),"\n";
   if ($Events) {
-    print $Mailer "      Events: ",$Events,"\n";
+    print $Mailer "      Events: ",HTML::Entities::decode_entities($Events),"\n";
   }
-  print $Mailer "    Keywords: ",$DocRevisions{$DocRevID}{Keywords},"\n";
-  print $Mailer "    Abstract: ",$DocRevisions{$DocRevID}{Abstract},"\n";
+  print $Mailer "    Keywords: ",HTML::Entities::decode_entities($DocRevisions{$DocRevID}{Keywords}),"\n";
+  print $Mailer "    Abstract: ",HTML::Entities::decode_entities($DocRevisions{$DocRevID}{Abstract}),"\n";
   if ($DocRevisions{$DocRevID}{Note}) {
-    print $Mailer "       Notes: ",$DocRevisions{$DocRevID}{Note},"\n";
+    print $Mailer "       Notes: ",HTML::Entities::decode_entities($DocRevisions{$DocRevID}{Note}),"\n";
   }
 }
 
diff --git a/DocDB/cgi/WatchDocument b/DocDB/cgi/WatchDocument
index 059cbe9a..3c9e3a33 100755
--- a/DocDB/cgi/WatchDocument
+++ b/DocDB/cgi/WatchDocument
@@ -80,7 +80,7 @@ EndPage();
 my $DocumentLink = &DocumentLink(-docid => $DocumentID, -noversion => $TRUE);
 
 print SmartHTML({-text => "An e-mail will be sent to $EmailUser{$EmailUserID}{Name}
-       ($EmailUser{$EmailUserID}{EmailAddress}) when $DocumentLink changes."});
+       ($EmailUser{$EmailUserID}{EmailAddress}) when Document $DocumentID changes."});
 print "<p/>\n";
 
 &InsertEmailDocumentImmediate(-emailuserid => $EmailUserID, -docid => $DocumentID);

From 259ba5506d1013ebbc928d0d9f82a39c124ef982 Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Thu, 17 Oct 2013 14:05:43 -0500
Subject: [PATCH 162/163] RC6

---
 DocDB/cgi/DocDBVersion.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/DocDB/cgi/DocDBVersion.pm b/DocDB/cgi/DocDBVersion.pm
index 3d0bdb81..7abfc308 100644
--- a/DocDB/cgi/DocDBVersion.pm
+++ b/DocDB/cgi/DocDBVersion.pm
@@ -20,6 +20,6 @@
 #    along with DocDB; if not, write to the Free Software
 #    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
-$DocDBVersion = "8.7.20rc5";
+$DocDBVersion = "8.7.20rc6";
 
 1;

From 3754cacf728f10700c8ecd3daddeb8c33bf8b1df Mon Sep 17 00:00:00 2001
From: Eric Vaandering <ericvaandering@gmail.com>
Date: Thu, 17 Oct 2013 14:09:00 -0500
Subject: [PATCH 163/163] Don't send special characters out in e-mail

---
 DocDB/cgi/EmailUtilities.pm   | 2 +-
 DocDB/cgi/MailNotification.pm | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/DocDB/cgi/EmailUtilities.pm b/DocDB/cgi/EmailUtilities.pm
index 95992e47..aecf3c95 100644
--- a/DocDB/cgi/EmailUtilities.pm
+++ b/DocDB/cgi/EmailUtilities.pm
@@ -39,7 +39,7 @@ sub SendEmail (%) {
     my $Mailer = new Mail::Mailer 'smtp', Server => $MailServer;
     $Headers{To}      = \@Addressees;
     $Headers{From}    = $From;
-    $Headers{Subject} = $Subject;
+    $Headers{Subject} = HTML::Entities::decode_entities($Subject);
 
     $Mailer -> open(\%Headers);    # Start mail with headers
     print $Mailer HTML::Entities::decode_entities($Body);
diff --git a/DocDB/cgi/MailNotification.pm b/DocDB/cgi/MailNotification.pm
index b2f8303a..1979a6a8 100644
--- a/DocDB/cgi/MailNotification.pm
+++ b/DocDB/cgi/MailNotification.pm
@@ -133,7 +133,7 @@ sub MailNotices (%) {
 
     $Headers{To} = \@Addressees;
     $Headers{From} = "$Project Document Database <$DBWebMasterEmail>";
-    $Headers{Subject} = $Subject;
+    $Headers{Subject} = HTML::Entities::decode_entities($Subject);
 
     $Mailer -> open(\%Headers);    # Start mail with headers
     print $Mailer HTML::Entities::decode_entities($Message);