add #REQUIREheavoids

1 files changed, 32 insertions, 17 deletions

diff --git a/zzcxz.cgi b/zzcxz.cgi
index 00f9ab4..96e8734 100755
--- a/zzcxz.cgi
+++ b/zzcxz.cgi
@@ -48,6 +48,7 @@ local function parse_qs(str,sep)
 	local values = {}
 	for key,val in str:gmatch(string.format('([^%q=]+)(=*[^%q=]*)', sep, sep)) do
 		local key = decode(key)
+		
 		local keys = {}
 		key = key:gsub('%[([^%]]*)%]', function(v)
 				-- extract keys between balanced brackets
@@ -92,7 +93,7 @@ local function parse_qs(str,sep)
 	return values
 end
 
-local cookies = env "HTTP_COOKIE" and parse_qs(env "HTTP_COOKIE","; ") or {}
+local cookies = env "HTTP_COOKIE" and parse_qs(env "HTTP_COOKIE",";%s") or {}
 local flags = {}
 for k,v in pairs(cookies) do
 	local flag = k:match "flag_(.+)"
@@ -150,7 +151,7 @@ local not_found = function()
 		}, { status = '404 not found' }
 end
 
-local function parse_directive(line, directives)
+local function parse_directive(line, directives, tmp_flags)
 	flags = flags or {}
 	local directive, args = line:match "^#([A-Za-z]+)%s*(.-)\n?$"
 	directive = directive and directive:lower()
@@ -173,12 +174,16 @@ local function parse_directive(line, directives)
 			return
 		end
 		directives.flags_updated[flagname] = text
-		flags[flagname] = text
+		tmp_flags[flagname] = text
 	elseif directive == "unset" then
 		local flagname = args:match "^%s*(%w+)%s*$"
 		if not flagname then return end
 		directives.flags_updated[flagname] = false
-		flags[flagname] = nil
+		tmp_flags[flagname] = nil
+	elseif directive == "require" then
+		local flagname = args:match "^%s*(%w+)%s*$"
+		if not flagname then return end
+		directives.require[flagname] = true
 	else
 		return
 	end
@@ -188,7 +193,11 @@ end
 local load_page
 local function convert_markup(m)
 	local result = {}
-	local directives = {flags_updated = {}}
+	local tmp_flags = {}
+	for name, value in pairs(flags) do
+		tmp_flags[name] = value
+	end
+	local directives = {flags_updated = {}, require = {}}
 	local code_block = false
 	for line in (m..'\n'):gmatch "(.-)\n" do
 		if not code_block then
@@ -196,7 +205,7 @@ local function convert_markup(m)
 				goto continue
 			end
 			if line:sub(1,1) == '#' and
-					parse_directive(line, directives, flags) then
+				parse_directive(line, directives, tmp_flags) then
 				goto continue
 			end
 
@@ -238,8 +247,16 @@ local function convert_markup(m)
 
 	return table.concat(result), directives
 end
-
-local function parse_page(s)
+local function target_requirements(p)
+	local page = load_page(p, false, true)
+	if not page then return true end
+	local _,directives = convert_markup(page.content)
+	for k,v in pairs(directives.require) do
+		if not flags[k] then return false end
+	end
+	return true
+end
+local function parse_page(s, dont_recurse)
 	local page = {}
 	page.title = s:match "^(.-)\n"
 	page.actions = {}
@@ -259,7 +276,7 @@ local function parse_page(s)
 	return page
 end
 
-function load_page(p, raw)
+function load_page(p, raw, dont_recurse)
 	if not p:match("^%w%w%w%w%w$") then return nil end
 	local f, bee = io.open('content/'..p)
 	if not f then return nil end
@@ -267,7 +284,7 @@ function load_page(p, raw)
 	f:close()
 	if not s then return nil end
 	if raw then return s end
-	return parse_page(s)
+	return parse_page(s, dont_recurse)
 end
 
 local function new_action(page, action, result)
@@ -328,16 +345,14 @@ map["^/g/(%w%w%w%w%w)$"] = function(p)
 	local page = load_page(p)
 	if not page then return not_found() end
 	local _, directives = convert_markup(page.content)
-	local cookies = {}
-	for k,v in pairs(directives.flags) do
-		table.insert(cookies,"flag_"..k.."="..url_encode(v).."; Secure")
-	end
 	if env "REQUEST_METHOD" ~= "POST" then
 		local actions = {}
 		for _,a in ipairs(page.actions) do
-			table.insert(actions,
-				('<li><a href="%s">%s</a></li>'):format(
-					html_encode(a.target), html_encode(a.action)))
+			if target_requirements(a.target) then
+				table.insert(actions,
+					('<li><a href="%s">%s</a></li>'):format(
+						html_encode(a.target), html_encode(a.action)))
+			end
 		end
 		if not directives.deadend then
 			table.insert(actions,