--- parser3/src/classes/file.C	2009/06/24 09:03:57	1.194
+++ parser3/src/classes/file.C	2009/08/08 13:30:20	1.199
@@ -5,7 +5,7 @@
 	Author: Alexandr Petrosian <paf@design.ru> (http://paf.design.ru)
 */
 
-static const char * const IDENT_FILE_C="$Date: 2009/06/24 09:03:57 $";
+static const char * const IDENT_FILE_C="$Date: 2009/08/08 13:30:20 $";
 
 #include "pa_config_includes.h"
 
@@ -43,7 +43,7 @@ extern String sql_offset_name;
 class MFile: public Methoded {
 public: // VStateless_class
 	
-	Value* create_new_value(Pool&, HashStringValue*) { return new VFile(); }
+	Value* create_new_value(Pool&) { return new VFile(); }
 
 public: // Methoded
 	bool used_directly() { return true; }
@@ -214,11 +214,11 @@ static void _load(Request& r, MethodPara
 		if(param_index>1){
 			const String& luser_file_name=params.as_string(param_index, FILE_NAME_MUST_BE_STRING);
 			if(!luser_file_name.is_empty())
-				user_file_name=luser_file_name.cstr(String::L_FILE_SPEC);
+				user_file_name=luser_file_name.taint_cstr(String::L_FILE_SPEC);
 		}
 	}
 	if(!user_file_name)
-		user_file_name=lfile_name.cstr(String::L_FILE_SPEC);
+		user_file_name=lfile_name.taint_cstr(String::L_FILE_SPEC);
 
 	size_t offset=0;
 	size_t limit=0;
@@ -273,15 +273,15 @@ static void _create(Request& r, MethodPa
 			"only text mode is currently supported");
 
 	const char* user_file_name_cstr=r.absolute(
-		params.as_no_junction(1, FILE_NAME_MUST_NOT_BE_CODE).as_string()).cstr(String::L_FILE_SPEC);
+		params.as_no_junction(1, FILE_NAME_MUST_NOT_BE_CODE).as_string()).taint_cstr(String::L_FILE_SPEC);
 
 	const String& content=params.as_string(2, "content must be string");
-	const char* content_cstr=content.cstr(String::L_UNSPECIFIED); // explode content, honor tainting changes
+	const String::Body content_body=content.cstr_to_string_body_untaint(String::L_AS_IS); // explode content, honor tainting changes
 
 	VString* vcontent_type=new VString(r.mime_type_of(user_file_name_cstr));
 	
 	VFile& self=GET_SELF(r, VFile);
-	self.set(true/*tainted*/, content_cstr, strlen(content_cstr), user_file_name_cstr, vcontent_type);
+	self.set(true/*tainted*/, content_body.cstr(), content_body.length(), user_file_name_cstr, vcontent_type);
 
 	self.set_mode(true/*as_text*/);
 }
@@ -297,7 +297,7 @@ static void _stat(Request& r, MethodPara
 		size,
 		atime, mtime, ctime);
 	
-	const char* user_file_name=lfile_name.cstr(String::L_FILE_SPEC);
+	const char* user_file_name=lfile_name.taint_cstr(String::L_FILE_SPEC);
 
 	VFile& self=GET_SELF(r, VFile);
 
@@ -344,7 +344,7 @@ static void append_env_pair(
 			throw Exception(PARSER_RUNTIME,
 				new String(akey, String::L_TAINTED),
 				"not safe environment variable");
-		info->env->put(akey, avalue->as_string().cstr_to_string_body(String::L_UNSPECIFIED, 0, info->charsets));
+		info->env->put(akey, avalue->as_string().cstr_to_string_body_untaint(String::L_AS_IS, 0, info->charsets));
 	}
 }
 #ifndef DOXYGEN
@@ -370,7 +370,7 @@ static void pass_cgi_header_attribute(
 
 static void append_to_argv(Request& r, ArrayString& argv, const String* str){
 	if(!str->is_empty())
-		argv+=new String(str->cstr_to_string_body(String::L_UNSPECIFIED, 0, &r.charsets), String::L_AS_IS);
+		argv+=new String(str->cstr_to_string_body_untaint(String::L_AS_IS, 0, &r.charsets), String::L_AS_IS);
 }
 
 /// @todo fix `` in perl - they produced flipping consoles and no output to perl
@@ -452,7 +452,7 @@ static void _exec_cgi(Request& r, Method
 				if(const String* sstdin=info.vstdin->get_string()) {
 					in->append(*sstdin, String::L_CLEAN, true);
 				} else
-					if(VFile* vfile=static_cast<VFile *>(info.vstdin->as("file", false)))
+					if(VFile* vfile=static_cast<VFile *>(info.vstdin->as("file")))
 						in->append_know_length((const char* )vfile->value_ptr(), vfile->value_size(), String::L_TAINTED);
 					else
 						throw Exception(PARSER_RUNTIME,
@@ -466,7 +466,6 @@ static void _exec_cgi(Request& r, Method
 	ArrayString argv;
 	if(param_index < params.count()) {
 		// influence tainting 
-		// main target -- URLencoding of tainted pieces to String::L_URI lang
 		Temp_client_charset temp(r.charsets, charset? *charset: r.charsets.source());
 
 		for(size_t i=param_index; i<params.count(); i++) {
@@ -620,7 +619,7 @@ static void _list(Request& r, MethodPara
 	if(params.count()>1){
 		Value& regexp=params.as_no_junction(1, "regexp must not be code");
 		if(regexp.is_defined()){
-			if(Value* value=regexp.as(VREGEX_TYPE, false)){
+			if(Value* value=regexp.as(VREGEX_TYPE)){
 				vregex=static_cast<VRegex*>(value);
 			} else {
 				vregex=new VRegex(r.charsets.source(), &regexp.as_string(), 0/*options*/);
@@ -630,7 +629,7 @@ static void _list(Request& r, MethodPara
 		}
 	}
 
-	const char* absolute_path_cstr=r.absolute(relative_path.as_string()).cstr(String::L_FILE_SPEC);
+	const char* absolute_path_cstr=r.absolute(relative_path.as_string()).taint_cstr(String::L_FILE_SPEC);
 
 	Table::columns_type columns(new ArrayString);
 	*columns+=new String("name");
@@ -849,8 +848,8 @@ static void _sql(Request& r, MethodParam
 
 	Temp_lang temp_lang(r, String::L_SQL);
 	const String& statement_string=r.process_to_string(statement);
-	const char* statement_cstr=
-		statement_string.cstr(String::L_UNSPECIFIED, r.connection());
+	const char* statement_cstr=statement_string.untaint_cstr(r.flang, r.connection());
+
 	File_sql_event_handlers handlers(statement_string, statement_cstr);
 
 	ulong limit=SQL_NO_LIMIT;