Changeset 27366 for main/trunk

Timestamp:

2013-05-17T17:43:28+12:00 (11 years ago)

Author:

ak19

Message:

1. Handling quotes and colons in user comments: since these are sent and retrieved from metadata-server.pl as JSON strings, the quotes and colons in user-added meta needs to be protected since JSON uses these characters for packaging up data. 2. Cosmetic changes to baseaction: clarified some comments.

Location:

main/trunk/greenstone2

Files:

• macros/style.dm (modified) (1 diff)
• perllib/cgiactions/baseaction.pm (modified) (2 diffs)
• perllib/cgiactions/metadataaction.pm (modified) (3 diffs)

main/trunk/greenstone2/macros/style.dm

@@ -363 +363 @@
     divtime.appendChild(txt);
 
+    // any quotes and colons in the fields would have been protected for transmitting as JSON
+    // so decode their entity values
+    comment = comment.replace(/"/gmi, '"');
+    comment = comment.replace(/&58;/gmi, ':');
+
     divgroup.appendChild(divcomment);
     txt=document.createTextNode(comment);

main/trunk/greenstone2/perllib/cgiactions/baseaction.pm

@@ -294 +294 @@
         
         my ($year,$mon,$mday,$hour,$min,$sec) = split(/[\s\/:]+/, $keycreation_time); # split by space, /, :
+                           # (also ensures whitespace surrounding keycreateion_time is trimmed)
         my $key_timestamp = timelocal($sec,$min,$hour,$mday,$mon-1,$year);
         
@@ -321 +322 @@
     # The following code which tests whether the user is in the required group 
     # seems to have been copied over from gliserver.pl.
-    # But for metadata-server.pl, when user comments are added through the set-metadata functions,
+    # But when user comments are added through the set-metadata functions for metadata-server.pl
+    # (which is the first feature for which baseaction::authenticate_user() is actually used)
     # the user doesn't need to be a specific collection's editor in order to add comments to that collection.
     # So we no longer check the user is in the group here.

main/trunk/greenstone2/perllib/cgiactions/metadataaction.pm

@@ -663 +663 @@
         if($metapos ne "all") { # get the value at a single metapos
 
-        $metavalue = $doc_rec->{$metaname}->[$metapos];     
+        $metavalue = $doc_rec->{$metaname}->[$metapos];
+
+        # protect any double quotes and colons in the metavalue before putting it into JSON
+        $metavalue =~ s/\"/"/g if defined $metavalue;
+        $metavalue =~ s/\:/&58;/g if defined $metavalue;
+
         $json_result_str .= "{\"metapos\":\"$metapos\",\"metavalue\":\"$metavalue\"}";
 
@@ -672 +677 @@
 
         while (defined $metavalue) {
+
+            # protect any double quotes and colons in the metavalue before putting it into JSON
+            $metavalue =~ s/\"/"/g;
+            $metavalue =~ s/\:/&58;/g;
+
             if($first_metaval) {        
             $first_metaval = 0;
@@ -681 +691 @@
 
             $metapos++;
-            $metavalue = $doc_rec->{$metaname}->[$metapos];         
+            $metavalue = $doc_rec->{$metaname}->[$metapos];
         }
         }