Fossil

  const char *zRef = P("referer");
  if( zRef==0 ){
    zRef = P("HTTP_REFERER");
    if( zRef==0 ) zRef = zDefault;
  }
  return zRef;
}

/*
** If cgi_referer(0) returns a non-0 AND the referrer is from the same
** fossil app path (i.e. the referrer's path starts with g.zTop), this
** function returns the first path element of the referring page, up
** to, but not including, the first slash. Thus if he refer[r]er is
** https://foo.com/fossil.cgi/foo/bar, this returns "foo". The
** returned memory is malloc'd and needs to be freed by the caller.
*/
char * cgi_referer_fossil_page_name(){
  UrlData url;
  char * zPage = 0;
  const char * zRef = cgi_referer(0);

  if(zRef==0) return 0;
  memset(&url, 0, sizeof(url));
  url_parse_local(zRef, 0, &url);
  if(url.path==strstr(url.path, g.zTop)){
    /* g.zTop is, e.g., /cgi-bin/fossil.cgi,
       url.path is, e.g., /cgi-bin/fossil.cgi/page/... */
    char * zSlash = 0;
    zPage = url.path + strlen(g.zTop);
    if('/' == zPage[0]){
      *zPage++ = 0;
      if((zSlash = strstr(zPage,"/"))!=0){
        *zSlash = 0;
      }
      zPage = mprintf("%s", zPage);
    }else{ /*unexpected result*/
      zPage = 0;
    }
  }
  url_cleanup(&url);
  return zPage;
}


/*
** Return true if the current request appears to be safe from a
** Cross-Site Request Forgery (CSRF) attack.  Conditions that must
** be met:
**
**    *   The HTTP_REFERER must have the same origin

** WEBPAGE: style.css
**
** Return the style sheet.
*/
void page_style_css(void){
  Blob css = empty_blob;
  int i;
  char *zPage = cgi_referer_fossil_page_name();

  cgi_set_content_type("text/css");
  /* Emit all default rules... */
  for(i=1; cssDefaultList[i].elementClass; i++){
    char *z = blob_str(&css);
    if( !containsSelector(z, cssDefaultList[i].elementClass) ){
      blob_appendf(&css, "%s {\n%s}\n",

        "\n/***********************************************************\n"
        "** End of page-specific CSS for page %s.\n"
        "***********************************************************/\n",
        zPage);
    }
    fossil_free(zFile);
  }
  fossil_free(zPage);
  blob_append(&css,
     "\n/***********************************************************\n"
     "** All CSS which follows is supplied by the repository \"skin\".\n"
     "***********************************************************/\n",
     -1);
  blob_append(&css,skin_get("css"),-1);

  unsigned flags;  /* Boolean flags controlling URL processing */
  int useProxy;    /* Used to remember that a proxy is in use */
  char *proxyUrlPath;
  int proxyOrigPort; /* Tunneled port number for https through proxy */
};
#endif /* INTERFACE */

/*
** Frees (almost) all (char*) members of pUrlData and zeroes out
** pUrlData. Results are undefined if pUrlData passed an uninitialized
** object.
*/
void url_cleanup(UrlData *pUrlData){
  fossil_free(pUrlData->user);
  fossil_free(pUrlData->passwd);
  if(pUrlData->hostname != pUrlData->name){
    fossil_free(pUrlData->name);
  }
  fossil_free(pUrlData->hostname);
  fossil_free(pUrlData->path);
  fossil_free(pUrlData->canonical);
  /* ??? fossil_free(pUrlData->proxyAuth); */
  /* ??? fossil_free(pUrlData->fossil); */
  /* ??? fossil_free(pUrlData->proxyUrlPath); */
  memset(pUrlData, 0, sizeof(*pUrlData));
}

/*
** Parse the given URL.  Populate members of the provided UrlData structure
** as follows:
**
**      isFile      True if FILE:
**      isHttps     True if HTTPS: