Bläddra i källkod

[search] Escape extracode in HTML widget

Romain Rigaux 11 år sedan
förälder
incheckning
bcc362a218

Filskillnaden har hållts tillbaka eftersom den är för stor
+ 0 - 0
apps/search/src/search/fixtures/initial_search_examples.json


+ 2 - 2
apps/search/src/search/models.py

@@ -291,7 +291,7 @@ class Collection(models.Model):
     if self.enabled is not None:
       props['collection']['enabled'] = self.enabled
     
-    # tmp for dev    
+    # tmp for dev
     if 'rows' not in props['collection']['template']:
       props['collection']['template']['rows'] = 10
     if 'enabled' not in props['collection']:
@@ -306,7 +306,7 @@ class Collection(models.Model):
       id_field = id_field[0]
   
     TEMPLATE = {
-      "extracode": "<style type=\"text/css\">\nem {\n  font-weight: bold;\n  background-color: yellow;\n}</style>",
+      "extracode": escape("<style type=\"text/css\">\nem {\n  font-weight: bold;\n  background-color: yellow;\n}</style>\n\n<script>\n</script>"),
       "highlighting": [""],
       "properties": {"highlighting_enabled": True},
       "template": """

+ 2 - 2
apps/search/src/search/templates/search.mako

@@ -47,7 +47,7 @@ ${ commonheader(_('Search'), "search", user, "80px") | n,unicode }
     % endif 
   </div>  
   
-  <form data-bind="visible: columns().length == 0">  
+  <form data-bind="visible: $root.isEditing() && columns().length == 0">  
     ${ _('Select a search index') }
     <!-- ko if: columns().length == 0 -->
     <select data-bind="options: $root.initial.collections, value: $root.collection.name">
@@ -194,7 +194,7 @@ ${ commonheader(_('Search'), "search", user, "80px") | n,unicode }
 </div>
 
 <div id="emptyDashboardEditing" data-bind="fadeVisible: isEditing() && columns().length == 0 && previewColumns() == ''">
-  <div style="float:right; padding-top: 90px; margin-left: 20px; text-align: center; width: 260px">${ _('Click on a layout to start your dashboard!') }</div>
+  <div style="float:right; padding-top: 90px; margin-left: 20px; text-align: center; width: 260px">${ _('Pick an index and Click on a layout to start your dashboard!') }</div>
   <img src="/search/static/art/hint_arrow_horiz_flipped.png" />
 </div>
 

+ 4 - 1
apps/search/src/search/views.py

@@ -21,6 +21,7 @@ import logging
 from django.core.urlresolvers import reverse
 from django.http import HttpResponse
 from django.utils.encoding import smart_str
+from django.utils.html import escape
 from django.utils.translation import ugettext as _
 from django.shortcuts import redirect
 
@@ -150,7 +151,9 @@ def save(request):
   
   collection = json.loads(request.POST.get('collection', '{}')) # TODO perms
   layout = json.loads(request.POST.get('layout', '{}')) 
-    
+ 
+  collection['template']['extracode'] = escape(collection['template']['extracode']) # Escape HTML
+  
   if collection:
     if collection['id']:
       hue_collection = Collection.objects.get(id=collection['id'])

+ 2 - 1
apps/search/static/js/search.ko.js

@@ -358,7 +358,8 @@ var Collection = function (vm, collection) {
   self.template.fieldsSelected.subscribe(function () {
     vm.search();
   });
-  self.template.extracode.extend({rateLimit: {timeout: 1000 * 60 * 60, method: "notifyWhenChangesStop"}}); // No live js/css update
+  self.template.extracode($("<span>").html(self.template.extracode()).text()); // Unescape HTML
+  self.template.extracode.extend({rateLimit: {timeout: 3000, method: "notifyWhenChangesStop"}});
   self.template.template.extend({rateLimit: {timeout: 3000, method: "notifyWhenChangesStop"}});
   self.template.template.subscribe(function () {
     vm.search();

Vissa filer visades inte eftersom för många filer har ändrats