deac/instiki
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Escape Page name

Browse source 
Use escape_javascript() in page name-changing javascript.
This commit is contained in:
Jacques Distler 2009-06-21 00:39:24 -05:00
parent 2ffa1ea007
commit a049d27222
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
app/views/wiki/edit.rhtml
View file

@ -46,7 +46,7 @@ function toggleVisibility() {
var span = document.getElementById('title_change');
if (span.style.display =='inline') {
span.style.display ='none';
document.getElementById('new_name').value = "<%= @page.name %>";
document.getElementById('new_name').value = "<%= escape_javascript(@page.name) %>";
var content = document.getElementById('content').value
document.getElementById('content').value = content.replace(/\[\[!redirects <%= Regexp.escape(@page.name) %>\]\]\n/, '')
}
@ -55,9 +55,9 @@ function toggleVisibility() {
}
function addRedirect(){
if (document.getElementById('new_name').value != "<%= @page.name %>" ) {
if (document.getElementById('new_name').value != "<%= escape_javascript(@page.name) %>" ) {
var content = document.getElementById('content');
content.value = '[[!redirects <%= @page.name %>]]\n' + content.value
content.value = '[[!redirects <%= escape_javascript(@page.name) %>]]\n' + content.value
}
}