Changeset 27259 for main/trunk

Timestamp:

2013-04-26T15:51:49+12:00 (11 years ago)

Author:

ak19

Message:

1. Some feedback when a user comment has been added. 2. Basic html escaping before user-provided values are submitted.

Location:

main/trunk/greenstone2/macros

Files:

• document.dm (modified) (3 diffs)
• english.dm (modified) (1 diff)

main/trunk/greenstone2/macros/document.dm

@@ -144 +144 @@
 </p>
 
-<input type="submit" value="_textaddcomment_" onclick="addUserComment(document.AddUserCommentForm.username.value, document.AddUserCommentForm.comment.value, document.AddUserCommentForm.d.value); return false;">
+<input type="submit" value="_textaddcomment_" onclick="addUserComment(document.AddUserCommentForm.username.value, document.AddUserCommentForm.comment.value, document.AddUserCommentForm.d.value, document); return false;">
+<label id="usercommentfeedback"></label>
 </form>
 )
+
 <script type="text/javascript">  
-    function addUserComment(_username, _comment, _docid) \{
+
+    // http://stackoverflow.com/questions/3830244/get-current-date-time-in-seconds
+    function safeHTML(str) \{
+         return str.replace("&", "&amp;").replace("<", "&lt;").replace(">", "&gt;").replace('"',"&quot;").replace("'","&#x27;").replace("/", "&#x2F;"); //"\\""
+    \} 
+
+    function addUserComment(_username, _comment, _docid, doc) \{
         // Need to the add user comment meta of username, timestamp and comment to the
         // topmost section of the document. So only get the docId up to any period mark:
@@ -155 +163 @@
             _docid = _docid.substring(0, period);
         \}
+        
+        // Entity encode the values before storing (at least <, >, /. And single and double quote, ampersand)
+        // http://stackoverflow.com/questions/6020714/escape-html-using-jquery
+        _username = safeHTML(_username);
+        _comment = safeHTML(_comment);      
 
         // Want to store username, timestamp and comment in import/metadata.xml, archives/doc.xml
@@ -210 +223 @@
         // GSAPI already knows the collection
         gsapi.setMetadataArray(docArray, "accumulate","import|archives|index");
-
+        //doc.AddUserCommentForm.comment.value = "submitted";
+        doc.getElementById("usercommentfeedback").innerHTML = "_textcommentsubmitted_"; //"submitted"; // <p id="feedback"></p>
     \}
 </script>

main/trunk/greenstone2/macros/english.dm

@@ -337 +337 @@
 
 _textcommentusername_ {User name:}
-_textaddusercomment_ {Add user comment:}
+_textaddusercomment_ {Comment:}
 _textaddcomment_ {add comment}
+_textcommentsubmitted_ {Comment Submitted}
 
 _textgoto_ {go to page}