From 5eba485cf7dac1a7e0e7e2dbadf37efb6ed8d897 Mon Sep 17 00:00:00 2001
From: Kálmán Viktor <kviktor@cloud.bme.hu>
Date: Wed, 22 Oct 2014 10:21:55 +0200
Subject: [PATCH] dashboard: escape html/or use .text instead of .html where needed
---
circle/dashboard/static/dashboard/dashboard.js | 23 +++++++++++++++++++----
circle/dashboard/static/dashboard/disk-list.js | 23 -----------------------
circle/dashboard/static/dashboard/group-details.js | 2 +-
circle/dashboard/static/dashboard/node-details.js | 2 +-
circle/dashboard/static/dashboard/node-list.js | 34 ----------------------------------
5 files changed, 21 insertions(+), 63 deletions(-)
delete mode 100644 circle/dashboard/static/dashboard/disk-list.js
diff --git a/circle/dashboard/static/dashboard/dashboard.js b/circle/dashboard/static/dashboard/dashboard.js
index 3f1d22d..5a03abb 100644
--- a/circle/dashboard/static/dashboard/dashboard.js
+++ b/circle/dashboard/static/dashboard/dashboard.js
@@ -428,7 +428,7 @@ function generateVmHTML(pk, name, host, icon, _status, fav, is_last) {
return '<a href="/dashboard/vm/' + pk + '/" class="list-group-item' +
(is_last ? ' list-group-item-last' : '') + '">' +
'<span class="index-vm-list-name">' +
- '<i class="fa ' + icon + '" title="' + _status + '"></i> ' + name +
+ '<i class="fa ' + icon + '" title="' + _status + '"></i> ' + safe_tags_replace(name) +
'</span>' +
'<small class="text-muted"> ' + host + '</small>' +
'<div class="pull-right dashboard-vm-favourite" data-vm="' + pk + '">' +
@@ -441,14 +441,14 @@ function generateVmHTML(pk, name, host, icon, _status, fav, is_last) {
function generateGroupHTML(url, name, is_last) {
return '<a href="' + url + '" class="list-group-item real-link' + (is_last ? " list-group-item-last" : "") +'">'+
- '<i class="fa fa-users"></i> '+ name +
+ '<i class="fa fa-users"></i> '+ safe_tags_replace(name) +
'</a>';
}
function generateNodeHTML(name, icon, _status, url, is_last) {
return '<a href="' + url + '" class="list-group-item real-link' + (is_last ? ' list-group-item-last' : '') + '">' +
'<span class="index-node-list-name">' +
- '<i class="fa ' + icon + '" title="' + _status + '"></i> ' + name +
+ '<i class="fa ' + icon + '" title="' + _status + '"></i> ' + safe_tags_replace(name) +
'</span>' +
'<div style="clear: both;"></div>' +
'</a>';
@@ -456,7 +456,7 @@ function generateNodeHTML(name, icon, _status, url, is_last) {
function generateNodeTagHTML(name, icon, _status, label , url) {
return '<a href="' + url + '" class="label ' + label + '" >' +
- '<i class="fa ' + icon + '" title="' + _status + '"></i> ' + name +
+ '<i class="fa ' + icon + '" title="' + _status + '"></i> ' + safe_tags_replace(name) +
'</a> ';
}
@@ -678,3 +678,18 @@ function getParameterByName(name) {
results = regex.exec(location.search);
return results == null ? "" : decodeURIComponent(results[1].replace(/\+/g, " "));
}
+
+
+var tagsToReplace = {
+ '&': '&',
+ '<': '<',
+ '>': '>'
+};
+
+function replaceTag(tag) {
+ return tagsToReplace[tag] || tag;
+}
+
+function safe_tags_replace(str) {
+ return str.replace(/[&<>]/g, replaceTag);
+}
diff --git a/circle/dashboard/static/dashboard/disk-list.js b/circle/dashboard/static/dashboard/disk-list.js
deleted file mode 100644
index 4796106..0000000
--- a/circle/dashboard/static/dashboard/disk-list.js
+++ /dev/null
@@ -1,23 +0,0 @@
-$(function() {
- $(".disk-list-disk-percentage").each(function() {
- var disk = $(this).data("disk-pk");
- var element = $(this);
- refreshDisk(disk, element);
- });
-});
-
-function refreshDisk(disk, element) {
- $.get("/dashboard/disk/" + disk + "/status/", function(result) {
- if(result.percentage == null || result.failed == "True") {
- location.reload();
- } else {
- var diff = result.percentage - parseInt(element.html());
- var refresh = 5 - diff;
- refresh = refresh < 1 ? 1 : (result.percentage == 0 ? 1 : refresh);
- if(isNaN(refresh)) refresh = 2; // this should not happen
-
- element.html(result.percentage);
- setTimeout(function() {refreshDisk(disk, element)}, refresh * 1000);
- }
- });
-}
diff --git a/circle/dashboard/static/dashboard/group-details.js b/circle/dashboard/static/dashboard/group-details.js
index 11b696e..664619f 100644
--- a/circle/dashboard/static/dashboard/group-details.js
+++ b/circle/dashboard/static/dashboard/group-details.js
@@ -14,7 +14,7 @@
data: {'new_name': name},
headers: {"X-CSRFToken": getCookie('csrftoken')},
success: function(data, textStatus, xhr) {
- $("#group-details-h1-name").html(data['new_name']).show();
+ $("#group-details-h1-name").text(data['new_name']).show();
$('#group-details-rename').hide();
// addMessage(data['message'], "success");
},
diff --git a/circle/dashboard/static/dashboard/node-details.js b/circle/dashboard/static/dashboard/node-details.js
index 15d87e8..ca58f78 100644
--- a/circle/dashboard/static/dashboard/node-details.js
+++ b/circle/dashboard/static/dashboard/node-details.js
@@ -15,7 +15,7 @@ $(function() {
data: {'new_name': name},
headers: {"X-CSRFToken": getCookie('csrftoken')},
success: function(data, textStatus, xhr) {
- $("#node-details-h1-name").html(data['new_name']).show();
+ $("#node-details-h1-name").text(data['new_name']).show();
$('#node-details-rename').hide();
// addMessage(data['message'], "success");
},
diff --git a/circle/dashboard/static/dashboard/node-list.js b/circle/dashboard/static/dashboard/node-list.js
index 4411422..9fbea33 100644
--- a/circle/dashboard/static/dashboard/node-list.js
+++ b/circle/dashboard/static/dashboard/node-list.js
@@ -12,40 +12,6 @@ $(function() {
tr.removeClass('danger');
}
- /* rename */
- $("#node-list-rename-button, .node-details-rename-button").click(function() {
- $("#node-list-column-name", $(this).closest("tr")).hide();
- $("#node-list-rename", $(this).closest("tr")).css('display', 'inline');
- });
-
- /* rename ajax */
- $('.node-list-rename-submit').click(function() {
- var row = $(this).closest("tr")
- var name = $('#node-list-rename-name', row).val();
- var url = '/dashboard/node/' + row.children("td:first-child").text().replace(" ", "") + '/';
- $.ajax({
- method: 'POST',
- url: url,
- data: {'new_name': name},
- headers: {"X-CSRFToken": getCookie('csrftoken')},
- success: function(data, textStatus, xhr) {
-
- $("#node-list-column-name", row).html(
- $("<a/>", {
- 'class': "real-link",
- href: "/dashboard/node/" + data['node_pk'] + "/",
- text: data['new_name']
- })
- ).show();
- $('#node-list-rename', row).hide();
- // addMessage(data['message'], "success");
- },
- error: function(xhr, textStatus, error) {
- addMessage("Error during renaming!", "danger");
- }
- });
- return false;
- });
function statuschangeSuccess(tr){
var tspan=tr.children('.enabled').children();
--
libgit2 0.26.0