0x2620/pandora
2
1
Fork 1
Code Issues 1.2k Pull requests Releases Wiki Activity

properly escape user names and list names

Browse source
This commit is contained in:
rolux 2012-02-22 10:14:07 +00:00
commit 13eec9346b
12 changed files with 68 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

5
static/js/pandora/account.js
View file

@ -379,7 +379,10 @@ pandora.ui.accountWelcomeDialog = function() {
.append(
Ox.Element()
.css({position: 'absolute', left: '96px', top: '16px', width: '192px'})
.html('Welcome, ' + pandora.user.username + '!<br/><br/>Your account has been created.')
.html(
'Welcome, ' + Ox.encodeHTMLEntities(pandora.user.username)
+ '!<br/><br/>Your account has been created.'
)
),
fixedSize: true,
height: 128,

6
static/js/pandora/folderBrowserList.js
View file

@ -38,6 +38,9 @@ pandora.ui.folderBrowserList = function(id) {
width: 16
},
{
format: function(value) {
return Ox.encodeHTMLEntities(value);
},
id: 'user',
operator: '+',
title: 'User',
@ -45,6 +48,9 @@ pandora.ui.folderBrowserList = function(id) {
width: Math.floor(columnWidth)
},
{
format: function(value) {
return Ox.encodeHTMLEntities(value);
},
id: 'name',
operator: '+',
title: 'List',

8
static/js/pandora/folderList.js
View file

@ -35,7 +35,7 @@ pandora.ui.folderList = function(id) {
},
{
format: function(value) {
return value.split(':').join(': ');
return Ox.encodeHTMLEntities(value.split(':').join(': '));
},
id: 'id',
operator: '+',
@ -49,12 +49,18 @@ pandora.ui.folderList = function(id) {
editable: function(data) {
return data.user == pandora.user.username;
},
format: function(value) {
return Ox.encodeHTMLEntities(value);
},
id: 'name',
input: {
autovalidate: pandora.ui.autovalidateListname
},
operator: '+',
tooltip: id == 'personal' ? 'Edit Title' : '',
unformat: function(value) {
return Ox.decodeHTMLEntities(value);
},
visible: id != 'favorite',
width: pandora.user.ui.sidebarWidth - 96
},

4
static/js/pandora/home.padma.js
View file

@ -466,7 +466,7 @@ pandora.ui.home = function() {
.appendTo($listsContent);
$listIcon[i] = Ox.Element({
element: '<img>',
tooltip: list.name
tooltip: Ox.encodeHTMLEntities(list.name)
})
.attr({
src: '/list/' + list.user + ':'
@ -556,7 +556,7 @@ pandora.ui.home = function() {
+ lists[selected].name + '/icon256.jpg'
});
$text.html(
'<b>' + lists[selected].name + '</b><br><br>'
'<b>' + Ox.encodeHTMLEntities(lists[selected].name) + '</b><br><br>'
+ lists[selected].description
);
}

5
static/js/pandora/listDialog.js
View file

@ -108,7 +108,7 @@ pandora.ui.listDialog = function(section) {
height: 312,
// keys: {enter: 'save', escape: 'cancel'},
removeOnClose: true,
title: 'List - ' + listData.name,
title: 'List - ' + Ox.encodeHTMLEntities(listData.name),
width: width
});
@ -243,6 +243,9 @@ pandora.ui.listGeneralPanel = function(listData) {
listData.name = result.data.name;
Ox.Request.clearCache('findLists');
pandora.$ui.info.updateListInfo();
pandora.$ui.listDialog.options({
title: 'List - ' + Ox.encodeHTMLEntities(listData.name) + ' - General'
});
}
});
}

22
static/js/pandora/logsDialog.js
View file

@ -60,34 +60,42 @@ pandora.ui.logsDialog = function() {
visible: false,
},
{
format: function(value) {
return Ox.encodeHTMLEntities(value);
},
id: 'user',
operator: '+',
title: 'User',
visible: true,
width: 72
},
{
id: 'created',
title: 'Date',
align: 'right',
format: function(value) {
return value.replace(/[TZ]/g, ' ');
},
id: 'created',
operator: '-',
title: 'Date',
visible: true,
width: 144
},
{
id: 'url',
title: 'URL',
format: function(value, data) {
format: function(value) {
return formatURL(value, data.line);
},
id: 'url',
operator: '+',
title: 'URL',
visible: true,
width: 320
},
{
format: function(value) {
return Ox.encodeHTMLEntities(value);
},
id: 'text',
operator: '+',
title: 'Text',
visible: true,
width: 640
@ -138,7 +146,7 @@ pandora.ui.logsDialog = function() {
margin: '16px',
MozUserSelect: 'text',
WebkitUserSelect: 'text'
}).html(value.text)),
}).text(value.text)),
height: height - 48,
keys: {enter: 'close', escape: 'close'},
maximizeButton: true,
@ -203,7 +211,7 @@ pandora.ui.logsDialog = function() {
.appendTo(that.$element.find('.OxButtonsbar'));
function formatURL(url, line) {
return url.split('?')[0] + ':' + line;
return Ox.encodeHTMLEntities(url.split('?')[0]) + ':' + line;
}
function renderLog(logData) {

6
static/js/pandora/menu.js
View file

@ -27,7 +27,7 @@ pandora.ui.mainMenu = function() {
]
) },
{ id: 'userMenu', title: 'User', items: [
{ id: 'username', title: 'User: ' + (isGuest ? 'not logged in' : pandora.user.username), disabled: true },
{ id: 'username', title: 'User: ' + (isGuest ? 'not logged in' : Ox.encodeHTMLEntities(pandora.user.username)), disabled: true },
{},
{ id: 'preferences', title: 'Preferences...', disabled: isGuest, keyboard: 'control ,' },
{ id: 'archives', title: 'Archives...', disabled: /*isGuest*/ true },
@ -455,7 +455,9 @@ pandora.ui.mainMenu = function() {
: lists[folder].map(function(list) {
return {
id: 'viewlist' + list.id,
title: (folder == 'favorite' ? list.user + ': ' : '') + list.name,
title: Ox.encodeHTMLEntities((
folder == 'favorite' ? list.user + ': ' : ''
) + list.name),
checked: list.id == pandora.user.ui._list
};
})

8
static/js/pandora/usersDialog.js
View file

@ -86,7 +86,7 @@ pandora.ui.usersDialog = function() {
format: function(value, data) {
return '<span style="opacity: ' + (
data.disabled ? 0.5 : 1
) + '">' + value + '</span>';
) + '">' + Ox.encodeHTMLEntities(value) + '</span>';
},
id: 'username',
operator: '+',
@ -389,7 +389,8 @@ pandora.ui.usersDialog = function() {
result.data.items.filter(function(item) {
return item.email;
}).map(function(item) {
return item.username + ' &lt;' + item.email + '&gt;';
return Ox.encodeHTMLEntities(item.username)
+ ' &lt;' + item.email + '&gt;';
}).join(', ')
),
removeOnClose: true,
@ -779,7 +780,8 @@ pandora.ui.usersDialog = function() {
: users.length == 1 ? (
users[0].level == 'guest'
? 'Guest'
: users[0].username + ' &lt;' + users[0].email + '&gt;'
: Ox.encodeHTMLEntities(users[0].username)
+ ' &lt;' + users[0].email + '&gt;'
)
: users.length + ' users selected';
$formLabel.options({title: title});

2
static/js/pandora/utils.js
View file

@ -389,7 +389,7 @@ pandora.enableDragAndDrop = function($list, canMove) {
].toLowerCase()
) + '</br> to ' + (
drag.target && !drag.target.selected
? 'the list "' + drag.target.name + '"'
? 'the list "' + Ox.encodeHTMLEntities(drag.target.name) + '"'
: 'another list'
);
}