Attachment #22980 for bug #59233

View | Details | Raw Unified | Return to bug 59233
Collapse All | Expand All




   '-f -P- -');

# spooler-specific file converters, default for the specific spooler when
# none of the converters above is chosen. Remove weird characters from the
# command line arguments to enhance security
my @fixed_args = 
    (defined($ARGV[0])?removespecialchars($ARGV[0]):"",
     defined($ARGV[1])?removespecialchars($ARGV[1]):"",
     defined($ARGV[2])?removespecialchars($ARGV[2]):"",
     defined($ARGV[3])?removespecialchars($ARGV[3]):"",
     defined($ARGV[4])?removespecialchars($ARGV[4]):"");
my $spoolerfileconverters = {
    'cups' => "${programdir}texttops '$fixed_args[0]' '$fixed_args[1]' '$fixed_args[2]' " .
		"'$fixed_args[3]' '$fixed_args[4] page-top=36 page-bottom=36 " .


# "PPD": PPD file name for CUPS or PPR (if we run as PPR RIP)
if (defined($ENV{'PPD'})) {
    # Clean the file name from weird characters which could cause
    # unexpected behaviour
    $ppdfile = removespecialchars($ENV{'PPD'});
    # CUPS and PPR (RIP filter) use the "PPD" environment variable to 
    # make the PPD file name available (we set CUPS here preliminarily,
    # in the next step we check for PPR)
    $spooler = 'cups';
}


    # PPR 1.5 allows the user to specify options for the PPR RIP with the 
    # "--ripopts" option on the "ppr" command line. They are provided to
    # the RIP via the "PPR_RIPOPTS" environment variable.
    # Clean the option string from weird characters which could cause
    # unexpected behaviour
    $optstr .= removespecialchars("$ENV{'PPR_RIPOPTS'} ");
    # We have PPR
    $spooler = 'ppr';
}

# "LPOPTS": Option settings for some LPD implementations (ex: GNUlpr)
if (defined($ENV{'LPOPTS'})) {
    my @lpopts = split(/,/, removespecialchars($ENV{'LPOPTS'}));
    foreach my $opt (@lpopts) {
	$opt =~ s/^\s+//;
	$opt =~ s/\s+$//;

# options this way when printing without spooler.

# Make one option string with a non-printable character as separator,
# So we can parse it more easily.

# To avoid the separator to be in the options itselves, it is filters
# out of the options. This does not break anything as having non
# printable characters in the command line options does not make sense
# nor is this needed. This way misinterpretation and even abuse is
# prevented.

my $argstr = "\x01" . 
    join("\x01", map { removeunprintables($_) } @ARGV) . "\x01";

# Debug mode activated via command line
if ($argstr =~ s/\x01--debug\x01/\x01/) {


## Start debug logging
if ($debug) {
    # If we are not in debug mode, we do this later, as we must find out at
    # first which spooler is used. When printing without spooler we
    # suppress logging because foomatic-rip is called directly on the
    # command line and so we avoid logging onto the console.

	shift @pc;
	foreach (@pc) {
		if( /^ppd=(.*)$/ or  /^ppdfile=(.*)$/ ){
			$ppdfile = removespecialchars($1) if $1;
		}
	}
} elsif ($argstr =~ s/\x01--lprng\x01/\x01/g) {

# PPD file name given via the command line
# allow duplicates, and use the last specified one
while ( ($spooler ne 'lprng') and ($argstr =~ s/\x01-p(\x01|)([^\x01]+)\x01/\x01/)) {
    $ppdfile = removeshellescapes($2);
}
while ($argstr =~ s/\x01--ppd(\x01|=|)([^\x01]+)\x01/\x01/) {
    $ppdfile = removeshellescapes($2);
}

# Check for LPD/GNUlpr by typical options which the spooler puts onto

    foreach my $opt (@lpopts) {
	$opt =~ s/^\s+//;
	$opt =~ s/\s+$//;
	$opt = removeshellescapes($opt);
	if ($opt =~ /\s+/) {
	    $opt = "\"$opt\"";
	}

# Job title and options for stock LPD
if ($argstr =~ s/\x01-[jJ](\x01|)([^\x01]+)\x01/\x01/) {
    # An LPD
    $jobtitle = removeshellescapes($2);
    # Classic LPD hack
    if ($spooler eq "lpd") {
	$optstr .= "$jobtitle ";

    my $opt = $2;
    $opt =~ s/^\s+//;
    $opt =~ s/\s+$//;
    $opt = removeshellescapes($opt);
    if ($opt =~ /\s+/) {
	$opt = "\"$opt\"";
    }


# Printer for spooler-less printing or PDQ
if ($argstr =~ s/\x01-d(\x01|)([^\x01]+)\x01/\x01/) {
    $printer = removeshellescapes($2);
}
# Printer for spooler-less printing, PDQ, or LPRng
if ($argstr =~ s/\x01-P(\x01|)([^\x01]+)\x01/\x01/) {
    $printer = removeshellescapes($2);
}

# Were we called from a PDQ wrapper?

	$genpdqfile = ">&STDOUT";
    } else {
	if ($1 eq 'gen') {
	    $genpdqfile = "> " . removeshellescapes($4);
	} else {
	    $genpdqfile = ">> " . removeshellescapes($4);
	}
    }
    # Do we want to have a PDQ driver declaration for a raw printer?

    my @definitions;
    for my $file (("lib/interface.sh", "lib/signal.sh")) {
	
	open FILE, "< $file" || do {
	    print $logh "error opening $file.\n";
	    next;
	};

	# PPR directory.
	
	# Get all command line parameters
	$ppr_printer = removeshellescapes($rargs[0]);
	$ppr_address = $rargs[1];
	$ppr_options = removeshellescapes($rargs[2]);
	$ppr_jobbreak = $rargs[3];
	$ppr_feedback = $rargs[4];
	$ppr_codes = $rargs[5];
	$ppr_jobname = removeshellescapes($rargs[6]);
	$ppr_routing = removeshellescapes($rargs[7]);
	$ppr_for = $rargs[8];
	$ppr_filetype = $rargs[9];
	$ppr_filetoprint = removeshellescapes($rargs[10]);
	
	# Common job parameters
	$printer = $ppr_printer;

	
	# Get the path of the PPD file from the queue configuration
	$ppdfile = `LANG=en_US; ppad show $ppr_printer | grep PPDFile`;
	$ppdfile = removeshellescapes($ppdfile);
	$ppdfile =~ s/PPDFile:\s+//;
	if ($ppdfile !~ m!^/!) {
	    $ppdfile = "../../share/ppr/PPDFiles/$ppdfile";

    $cups_filename );
if ($spooler eq 'cups') {
    # Get all command line parameters
    $cups_jobid = removeshellescapes($rargs[0]);
    $cups_user = removeshellescapes($rargs[1]);
    $cups_jobtitle = removeshellescapes($rargs[2]);
    $cups_copies = removeshellescapes($rargs[3]);
    $cups_options = removeshellescapes($rargs[4]);
    $cups_filename = removeshellescapes($rargs[5]);

    # Common job parameters
    #$printer = $cups_printer;

    ($spooler eq 'gnulpr')) {

    # Get PPD file name as the last command line argument
    $ppdfile = removeshellescapes($rargs[$#rargs]);

}


# No spooler, CPS, or PDQ
if (($spooler eq 'direct') || ($spooler eq 'cps') || ($spooler eq 'pdq')) {
    # Which files do we want to print?
    @filelist = map { removeshellescapes($_) } @rargs;
}




# Load the PPD file and build a data structure for the renderer's
# command line and the options
open PPD, "< $ppdfile" || do {
    print $logh "error opening $ppdfile.\n";
    rip_die ("Unable to open PPD file $ppdfile",
	     $EXIT_PRNERR_NORETRY_BAD_SETTINGS);

    return %conf;
}

sub removeunprintables {
    # Remove unprintable characters
    my $str = $_[0];
    $str =~ s/[\x00-\x1f]//g;
    return $str;
}

sub removeshellescapes {
    # Remove shell escape characters
    my $str = $_[0];
    $str =~ s/[\|<>&!\$\'\"\#\*\?\(\)\[\]\{\}]//g;
    return $str;
}

sub removespecialchars {
    # Remove unprintable and shell escape characters
    return removeshellescapes(removeunprintables($_[0]));
}

sub unhtmlify {
    # Replace HTML/XML entities by the original characters
    my $str = $_[0];

Return to bug 59233

Lines 239-251 Link Here

(-)foomatic-rip.in.orig (-37 / +72 lines)
239	'-f -P- -');	239	'-f -P- -');
240		240
241	# spooler-specific file converters, default for the specific spooler when	241	# spooler-specific file converters, default for the specific spooler when
242	# none of the converters above is chosen.	242	# none of the converters above is chosen. Remove weird characters from the
243	my @fixed_args = (	243	# command line arguments to enhance security
244	defined($ARGV[0])?$ARGV[0]:"",	244	my @fixed_args =
245	defined($ARGV[1])?$ARGV[1]:"",	245	(defined($ARGV[0])?removespecialchars($ARGV[0]):"",
246	defined($ARGV[2])?$ARGV[2]:"",	246	defined($ARGV[1])?removespecialchars($ARGV[1]):"",
247	defined($ARGV[3])?$ARGV[3]:"",	247	defined($ARGV[2])?removespecialchars($ARGV[2]):"",
248	defined($ARGV[4])?$ARGV[4]:"" );	248	defined($ARGV[3])?removespecialchars($ARGV[3]):"",
		249	defined($ARGV[4])?removespecialchars($ARGV[4]):"");
249	my $spoolerfileconverters = {	250	my $spoolerfileconverters = {
250	'cups' => "${programdir}texttops '$fixed_args[0]' '$fixed_args[1]' '$fixed_args[2]' " .	251	'cups' => "${programdir}texttops '$fixed_args[0]' '$fixed_args[1]' '$fixed_args[2]' " .
251	"'$fixed_args[3]' '$fixed_args[4] page-top=36 page-bottom=36 " .	252	"'$fixed_args[3]' '$fixed_args[4] page-top=36 page-bottom=36 " .
Lines 283-292 Link Here
283		284
284	# "PPD": PPD file name for CUPS or PPR (if we run as PPR RIP)	285	# "PPD": PPD file name for CUPS or PPR (if we run as PPR RIP)
285	if (defined($ENV{'PPD'})) {	286	if (defined($ENV{'PPD'})) {
286	$ppdfile = $ENV{'PPD'};	287	# Clean the file name from weird characters which could cause
		288	# unexpected behaviour
		289	$ppdfile = removespecialchars($ENV{'PPD'});
287	# CUPS and PPR (RIP filter) use the "PPD" environment variable to	290	# CUPS and PPR (RIP filter) use the "PPD" environment variable to
288	# make the PPD file name available (we set CUPS here preliminarily,	291	# make the PPD file name available (we set CUPS here preliminarily,
289	# in the next step we check for PPR	292	# in the next step we check for PPR)
290	$spooler = 'cups';	293	$spooler = 'cups';
291	}	294	}
292		295
Lines 301-314 Link Here
301	# PPR 1.5 allows the user to specify options for the PPR RIP with the	304	# PPR 1.5 allows the user to specify options for the PPR RIP with the
302	# "--ripopts" option on the "ppr" command line. They are provided to	305	# "--ripopts" option on the "ppr" command line. They are provided to
303	# the RIP via the "PPR_RIPOPTS" environment variable.	306	# the RIP via the "PPR_RIPOPTS" environment variable.
304	$optstr .= "$ENV{'PPR_RIPOPTS'} ";	307	# Clean the option string from weird characters which could cause
		308	# unexpected behaviour
		309	$optstr .= removespecialchars("$ENV{'PPR_RIPOPTS'} ");
305	# We have PPR	310	# We have PPR
306	$spooler = 'ppr';	311	$spooler = 'ppr';
307	}	312	}
308		313
309	# "LPOPTS": Option settings for some LPD implementations (ex: GNUlpr)	314	# "LPOPTS": Option settings for some LPD implementations (ex: GNUlpr)
310	if (defined($ENV{'LPOPTS'})) {	315	if (defined($ENV{'LPOPTS'})) {
311	my @lpopts = split(/,/, $ENV{'LPOPTS'});	316	my @lpopts = split(/,/, removespecialchars($ENV{'LPOPTS'}));
312	foreach my $opt (@lpopts) {	317	foreach my $opt (@lpopts) {
313	$opt =~ s/^\s+//;	318	$opt =~ s/^\s+//;
314	$opt =~ s/\s+$//;	319	$opt =~ s/\s+$//;
Lines 331-338 Link Here
331	# options this way when printing without spooler.	336	# options this way when printing without spooler.
332		337
333	# Make one option string with a non-printable character as separator,	338	# Make one option string with a non-printable character as separator,
334	# So we can parse it more easily	339	# So we can parse it more easily.
335	my $argstr = "\x01" . join("\x01",@ARGV) . "\x01";	340
		341	# To avoid the separator to be in the options itselves, it is filters
		342	# out of the options. This does not break anything as having non
		343	# printable characters in the command line options does not make sense
		344	# nor is this needed. This way misinterpretation and even abuse is
		345	# prevented.
		346
		347	my $argstr = "\x01" .
		348	join("\x01", map { removeunprintables($_) } @ARGV) . "\x01";
336		349
337	# Debug mode activated via command line	350	# Debug mode activated via command line
338	if ($argstr =~ s/\x01--debug\x01/\x01/) {	351	if ($argstr =~ s/\x01--debug\x01/\x01/) {
Lines 373-379 Link Here
373		386
374	## Start debug logging	387	## Start debug logging
375	if ($debug) {	388	if ($debug) {
376	# If we are not debug mode, we do this later, as we must find out at	389	# If we are not in debug mode, we do this later, as we must find out at
377	# first which spooler is used. When printing without spooler we	390	# first which spooler is used. When printing without spooler we
378	# suppress logging because foomatic-rip is called directly on the	391	# suppress logging because foomatic-rip is called directly on the
379	# command line and so we avoid logging onto the console.	392	# command line and so we avoid logging onto the console.
Lines 405-411 Link Here
405	shift @pc;	418	shift @pc;
406	foreach (@pc) {	419	foreach (@pc) {
407	if( /^ppd=(.)$/ or /^ppdfile=(.)$/ ){	420	if( /^ppd=(.)$/ or /^ppdfile=(.)$/ ){
408	$ppdfile = $1 if $1;	421	$ppdfile = removespecialchars($1) if $1;
409	}	422	}
410	}	423	}
411	} elsif ($argstr =~ s/\x01--lprng\x01/\x01/g) {	424	} elsif ($argstr =~ s/\x01--lprng\x01/\x01/g) {
Lines 417-426 Link Here
417	# PPD file name given via the command line	430	# PPD file name given via the command line
418	# allow duplicates, and use the last specified one	431	# allow duplicates, and use the last specified one
419	while ( ($spooler ne 'lprng') and ($argstr =~ s/\x01-p(\x01\|)([^\x01]+)\x01/\x01/)) {	432	while ( ($spooler ne 'lprng') and ($argstr =~ s/\x01-p(\x01\|)([^\x01]+)\x01/\x01/)) {
420	$ppdfile = $2;	433	$ppdfile = removeshellescapes($2);
421	}	434	}
422	while ($argstr =~ s/\x01--ppd(\x01\|=\|)([^\x01]+)\x01/\x01/) {	435	while ($argstr =~ s/\x01--ppd(\x01\|=\|)([^\x01]+)\x01/\x01/) {
423	$ppdfile = $2;	436	$ppdfile = removeshellescapes($2);
424	}	437	}
425		438
426	# Check for LPD/GNUlpr by typical options which the spooler puts onto	439	# Check for LPD/GNUlpr by typical options which the spooler puts onto
Lines 447-452 Link Here
447	foreach my $opt (@lpopts) {	460	foreach my $opt (@lpopts) {
448	$opt =~ s/^\s+//;	461	$opt =~ s/^\s+//;
449	$opt =~ s/\s+$//;	462	$opt =~ s/\s+$//;
		463	$opt = removeshellescapes($opt);
450	if ($opt =~ /\s+/) {	464	if ($opt =~ /\s+/) {
451	$opt = "\"$opt\"";	465	$opt = "\"$opt\"";
452	}	466	}
Lines 459-465 Link Here
459	# Job title and options for stock LPD	473	# Job title and options for stock LPD
460	if ($argstr =~ s/\x01-[jJ](\x01\|)([^\x01]+)\x01/\x01/) {	474	if ($argstr =~ s/\x01-[jJ](\x01\|)([^\x01]+)\x01/\x01/) {
461	# An LPD	475	# An LPD
462	$jobtitle = $2;	476	$jobtitle = removeshellescapes($2);
463	# Classic LPD hack	477	# Classic LPD hack
464	if ($spooler eq "lpd") {	478	if ($spooler eq "lpd") {
465	$optstr .= "$jobtitle ";	479	$optstr .= "$jobtitle ";
Lines 477-482 Link Here
477	my $opt = $2;	491	my $opt = $2;
478	$opt =~ s/^\s+//;	492	$opt =~ s/^\s+//;
479	$opt =~ s/\s+$//;	493	$opt =~ s/\s+$//;
		494	$opt = removeshellescapes($opt);
480	if ($opt =~ /\s+/) {	495	if ($opt =~ /\s+/) {
481	$opt = "\"$opt\"";	496	$opt = "\"$opt\"";
482	}	497	}
Lines 490-500 Link Here
490		505
491	# Printer for spooler-less printing or PDQ	506	# Printer for spooler-less printing or PDQ
492	if ($argstr =~ s/\x01-d(\x01\|)([^\x01]+)\x01/\x01/) {	507	if ($argstr =~ s/\x01-d(\x01\|)([^\x01]+)\x01/\x01/) {
493	$printer = $2;	508	$printer = removeshellescapes($2);
494	}	509	}
495	# Printer for spooler-less printing, PDQ, or LPRng	510	# Printer for spooler-less printing, PDQ, or LPRng
496	if ($argstr =~ s/\x01-P(\x01\|)([^\x01]+)\x01/\x01/) {	511	if ($argstr =~ s/\x01-P(\x01\|)([^\x01]+)\x01/\x01/) {
497	$printer = $2;	512	$printer = removeshellescapes($2);
498	}	513	}
499		514
500	# Were we called from a PDQ wrapper?	515	# Were we called from a PDQ wrapper?
Lines 515-523 Link Here
515	$genpdqfile = ">&STDOUT";	530	$genpdqfile = ">&STDOUT";
516	} else {	531	} else {
517	if ($1 eq 'gen') {	532	if ($1 eq 'gen') {
518	$genpdqfile = "> $4";	533	$genpdqfile = "> " . removeshellescapes($4);
519	} else {	534	} else {
520	$genpdqfile = ">> $4";	535	$genpdqfile = ">> " . removeshellescapes($4);
521	}	536	}
522	}	537	}
523	# Do we want to have a PDQ driver declaration for a raw printer?	538	# Do we want to have a PDQ driver declaration for a raw printer?
Lines 571-577 Link Here
571	my @definitions;	586	my @definitions;
572	for my $file (("lib/interface.sh", "lib/signal.sh")) {	587	for my $file (("lib/interface.sh", "lib/signal.sh")) {
573		588
574	open FILE, "$file" \|\| do {	589	open FILE, "< $file" \|\| do {
575	print $logh "error opening $file.\n";	590	print $logh "error opening $file.\n";
576	next;	591	next;
577	};	592	};
Lines 608-624 Link Here
608	# PPR directory.	623	# PPR directory.
609		624
610	# Get all command line parameters	625	# Get all command line parameters
611	$ppr_printer = $rargs[0];	626	$ppr_printer = removeshellescapes($rargs[0]);
612	$ppr_address = $rargs[1];	627	$ppr_address = $rargs[1];
613	$ppr_options = $rargs[2];	628	$ppr_options = removeshellescapes($rargs[2]);
614	$ppr_jobbreak = $rargs[3];	629	$ppr_jobbreak = $rargs[3];
615	$ppr_feedback = $rargs[4];	630	$ppr_feedback = $rargs[4];
616	$ppr_codes = $rargs[5];	631	$ppr_codes = $rargs[5];
617	$ppr_jobname = $rargs[6];	632	$ppr_jobname = removeshellescapes($rargs[6]);
618	$ppr_routing = $rargs[7];	633	$ppr_routing = removeshellescapes($rargs[7]);
619	$ppr_for = $rargs[8];	634	$ppr_for = $rargs[8];
620	$ppr_filetype = $rargs[9];	635	$ppr_filetype = $rargs[9];
621	$ppr_filetoprint = $rargs[10];	636	$ppr_filetoprint = removeshellescapes($rargs[10]);
622		637
623	# Common job parameters	638	# Common job parameters
624	$printer = $ppr_printer;	639	$printer = $ppr_printer;
Lines 630-635 Link Here
630		645
631	# Get the path of the PPD file from the queue configuration	646	# Get the path of the PPD file from the queue configuration
632	$ppdfile = `LANG=en_US; ppad show $ppr_printer \| grep PPDFile`;	647	$ppdfile = `LANG=en_US; ppad show $ppr_printer \| grep PPDFile`;
		648	$ppdfile = removeshellescapes($ppdfile);
633	$ppdfile =~ s/PPDFile:\s+//;	649	$ppdfile =~ s/PPDFile:\s+//;
634	if ($ppdfile !~ m!^/!) {	650	if ($ppdfile !~ m!^/!) {
635	$ppdfile = "../../share/ppr/PPDFiles/$ppdfile";	651	$ppdfile = "../../share/ppr/PPDFiles/$ppdfile";
Lines 646-657 Link Here
646	$cups_filename );	662	$cups_filename );
647	if ($spooler eq 'cups') {	663	if ($spooler eq 'cups') {
648	# Get all command line parameters	664	# Get all command line parameters
649	$cups_jobid = $rargs[0];	665	$cups_jobid = removeshellescapes($rargs[0]);
650	$cups_user = $rargs[1];	666	$cups_user = removeshellescapes($rargs[1]);
651	$cups_jobtitle = $rargs[2];	667	$cups_jobtitle = removeshellescapes($rargs[2]);
652	$cups_copies = $rargs[3];	668	$cups_copies = removeshellescapes($rargs[3]);
653	$cups_options = $rargs[4];	669	$cups_options = removeshellescapes($rargs[4]);
654	$cups_filename = $rargs[5];	670	$cups_filename = removeshellescapes($rargs[5]);
655		671
656	# Common job parameters	672	# Common job parameters
657	#$printer = $cups_printer;	673	#$printer = $cups_printer;
Lines 673-679 Link Here
673	($spooler eq 'gnulpr')) {	689	($spooler eq 'gnulpr')) {
674		690
675	# Get PPD file name as the last command line argument	691	# Get PPD file name as the last command line argument
676	$ppdfile = $rargs[$#rargs];	692	$ppdfile = removeshellescapes($rargs[$#rargs]);
677		693
678	}	694	}
679		695
Lines 681-687 Link Here
681	# No spooler, CPS, or PDQ	697	# No spooler, CPS, or PDQ
682	if (($spooler eq 'direct') \|\| ($spooler eq 'cps') \|\| ($spooler eq 'pdq')) {	698	if (($spooler eq 'direct') \|\| ($spooler eq 'cps') \|\| ($spooler eq 'pdq')) {
683	# Which files do we want to print?	699	# Which files do we want to print?
684	@filelist = @rargs;	700	@filelist = map { removeshellescapes($_) } @rargs;
685	}	701	}
686		702
687		703
Lines 936-942 Link Here
936		952
937	# Load the PPD file and build a data structure for the renderer's	953	# Load the PPD file and build a data structure for the renderer's
938	# command line and the options	954	# command line and the options
939	open PPD, "$ppdfile" \|\| do {	955	open PPD, "< $ppdfile" \|\| do {
940	print $logh "error opening $ppdfile.\n";	956	print $logh "error opening $ppdfile.\n";
941	rip_die ("Unable to open PPD file $ppdfile",	957	rip_die ("Unable to open PPD file $ppdfile",
942	$EXIT_PRNERR_NORETRY_BAD_SETTINGS);	958	$EXIT_PRNERR_NORETRY_BAD_SETTINGS);
Lines 4698-4703 Link Here
4698	return %conf;	4714	return %conf;
4699	}	4715	}
4700		4716
		4717	sub removeunprintables {
		4718	# Remove unprintable characters
		4719	my $str = $_[0];
		4720	$str =~ s/[\x00-\x1f]//g;
		4721	return $str;
		4722	}
		4723
		4724	sub removeshellescapes {
		4725	# Remove shell escape characters
		4726	my $str = $_[0];
		4727	$str =~ s/[\\|<>&!\$\'\"\#\*\?\(\)\[\]\{\}]//g;
		4728	return $str;
		4729	}
		4730
		4731	sub removespecialchars {
		4732	# Remove unprintable and shell escape characters
		4733	return removeshellescapes(removeunprintables($_[0]));
		4734	}
		4735
4701	sub unhtmlify {	4736	sub unhtmlify {
4702	# Replace HTML/XML entities by the original characters	4737	# Replace HTML/XML entities by the original characters
4703	my $str = $_[0];	4738	my $str = $_[0];