catch poll_type manipulation

1 files changed, 24 insertions, 17 deletions

diff --git a/index.cgi b/index.cgi
index e0e1464..5146b0b 100755
--- a/index.cgi
+++ b/index.cgi
@@ -50,23 +50,30 @@ if $cgi.include?("create_poll") && $cgi.include?("poll_url")
 			createnotice = _("A Poll with this address already exists.")
 		else Dir.mkdir(POLLURL)
 			Dir.chdir(POLLURL)
-			VCS.init
-			File.symlink("../participate.rb","index.cgi")
-			VCS.add("index.cgi")
-			["atom","customize", "history", "overview", "edit_columns","access_control", "delete_poll", "invite_participants"].each{|f|
-				File.symlink("../#{f}.rb","#{f}.cgi")
-				VCS.add("#{f}.cgi")
-			}
-			["data.yaml",".htaccess",".htdigest"].each{|f|
-				File.open(f,"w").close
-				VCS.add(f)
-			}
-			Poll.new(CGI.escapeHTML(POLLTITLE),$cgi["poll_type"])
-			Dir.chdir("..")
-			$d.html.header["status"] = "REDIRECT"
-			$d.html.header["Cache-Control"] = "no-cache"
-			$d.html.header["Location"] = $conf.siteurl + POLLURL + "/edit_columns.cgi"
-			$d << _("The poll was created successfully. The link to your new poll is: %{link}") % {:link => "<br /><a href=\"#{POLLURL}\">#{POLLURL}</a>"}
+			begin
+				Poll.new(CGI.escapeHTML(POLLTITLE),$cgi["poll_type"])
+				VCS.init
+				File.symlink("../participate.rb","index.cgi")
+				VCS.add("index.cgi")
+				["atom","customize", "history", "overview", "edit_columns","access_control", "delete_poll", "invite_participants"].each{|f|
+					File.symlink("../#{f}.rb","#{f}.cgi")
+					VCS.add("#{f}.cgi")
+				}
+				["data.yaml",".htaccess",".htdigest"].each{|f|
+					File.open(f,"w").close
+					VCS.add(f)
+				}
+				Dir.chdir("..")
+				$d.html.header["status"] = "REDIRECT"
+				$d.html.header["Cache-Control"] = "no-cache"
+				$d.html.header["Location"] = $conf.siteurl + POLLURL + "/edit_columns.cgi"
+				$d << _("The poll was created successfully. The link to your new poll is: %{link}") % {:link => "<br /><a href=\"#{POLLURL}\">#{POLLURL}</a>"}
+			rescue WrongPollTypeError # should only happen in case of hacking
+				$d.html.header["status"] = "REDIRECT"
+				$d.html.header["Cache-Control"] = "no-cache"
+				$d.html.header["Location"] = "http://localhost/"
+				$d << _("Go away.")
+			end
 		end
 	end
 end