instiki/app/views/wiki/new.rhtml
Jacques Distler 503f956084 Fix Two XSS Vulnerabilities
Unescaped  page names (in 'edit' an 'new' views).
Unsanitized HTTP_CLIENT_IP header.
2008-03-14 23:22:46 +00:00

34 lines
1.2 KiB
Plaintext

<%
@title = "Creating #{CGI.escapeHTML(WikiWords.separate(@page_name))}"
@content_width = 720
@hide_navigation = true
%>
<div id="MarkupHelp">
<%= render("#{@web.markup}_help") %>
<%= render 'wiki_words_help' %>
</div>
<div id="editForm">
<% form_tag({ :action => 'save', :web => @web.address, :id => @page_name },
{ 'id' => 'editForm', 'method' => 'post', 'onSubmit' => 'cleanAuthorName();', 'accept-charset' => 'utf-8' }) do %>
<div class="hidden"><textarea name="content1" id="content1">iam empty</textarea></div>
<textarea name="content" id="content"><%= h(flash[:content] || '') %></textarea>
<div id="editFormButtons">
<input type="submit" value="Submit" accesskey="s"/> as
<%= text_field_tag :author, @author,
:onfocus => "this.value == 'AnonymousCoward' ? this.value = '' : true;",
:onblur => "this.value == '' ? this.value = 'AnonymousCoward' : true" %>
</div>
<% end %>
</div>
<script type="text/javascript">
function cleanAuthorName() {
if (document.getElementById('authorName').value == "") {
document.getElementById('authorName').value = 'AnonymousCoward';
}
}
document.forms["editForm"].elements["content"].focus();
</script>