a5e08f7bcc
I installed the rails_xss plugin, for the main purpose of seeing what will break with Rails 3.0 (where the behaviour of the plugin is the default). I think I've fixed everything, but let me know if you see stuff that is HTML-escaped, which shouldn't be. As a side benefit, we now use Erubis, rather than ERB, to render templates. They tell me it's faster ...
78 lines
3 KiB
Plaintext
78 lines
3 KiB
Plaintext
<%-
|
|
@title = "Editing #{@page.name.escapeHTML}".html_safe
|
|
@content_width = 720
|
|
@hide_navigation = true
|
|
-%>
|
|
|
|
<div id="MarkupHelp">
|
|
<%= render(:file => "#{@web.markup}_help") -%>
|
|
<%= render(:file => 'wiki_words_help') unless @web.brackets_only? -%>
|
|
</div>
|
|
|
|
<% form_tag({ :action => 'save', :web => @web.address, :id => @page.name },
|
|
{ 'id' => 'editForm', 'method' => 'post', 'onsubmit' => 'cleanAuthorName()',
|
|
'accept-charset' => 'utf-8' }) do %>
|
|
<div>
|
|
<textarea name="content" id="content" rows="24" cols="60"><%= h(flash[:content] ||
|
|
(params['content'] ? params['content'] : @page.content).purify) %></textarea>
|
|
<% if @page_name != 'HomePage' -%>
|
|
<p>
|
|
<%= check_box_tag :alter_title, value = "1", checked=false,
|
|
'onchange' => "toggleVisibility();" %> <label for="alter_title">Change page name.</label><br/>
|
|
<span id="title_change" style="display:none"><label for="new_name">New name:</label> <%= text_field_tag :new_name, h(@page.name.purify),
|
|
:onblur => "addRedirect();" %></span>
|
|
</p>
|
|
<% else -%>
|
|
<%= hidden_field_tag 'new_name', @page_name %>
|
|
<% end%>
|
|
<div id="editFormButtons">
|
|
<input type="submit" value="Submit" accesskey="s"/> as
|
|
<%= text_field_tag :author, h(@author.purify),
|
|
:onfocus => "this.value == 'AnonymousCoward' ? this.value = '' : true;",
|
|
:onblur => "this.value == '' ? this.value = 'AnonymousCoward' : true" %>
|
|
|
|
|
<span>
|
|
<%= link_to('Cancel', {:web => @web.address, :action => 'cancel_edit', :id => @page.name},
|
|
{:accesskey => 'c'}) %>
|
|
<span class="unlock">(unlocks page)</span>
|
|
</span>
|
|
</div>
|
|
</div>
|
|
<%- end -%>
|
|
|
|
<script type="text/javascript">
|
|
<!--//--><![CDATA[//><!--
|
|
function toggleVisibility() {
|
|
var span = document.getElementById('title_change');
|
|
if (span.style.display =='inline') {
|
|
span.style.display ='none';
|
|
document.getElementById('new_name').value = "<%= escape_javascript(@page.name) %>";
|
|
var content = document.getElementById('content').value
|
|
document.getElementById('content').value = content.replace(/\[\[!redirects <%= Regexp.escape(@page.name).gsub('/', '\\/') %>\]\]\n/, '')
|
|
}
|
|
else
|
|
span.style.display ='inline'
|
|
}
|
|
|
|
function addRedirect(){
|
|
var e = document.getElementById('new_name').value;
|
|
if ( e != "<%= escape_javascript(@page.name) %>" && e != '') {
|
|
var content = document.getElementById('content');
|
|
content.value = '[[!redirects <%= escape_javascript(@page.name) %>]]\n' + content.value
|
|
}
|
|
}
|
|
|
|
function cleanAuthorName() {
|
|
if (document.getElementById('authorName').value == "") {
|
|
document.getElementById('authorName').value = 'AnonymousCoward';
|
|
}
|
|
}
|
|
|
|
document.forms["editForm"].elements["content"].focus();
|
|
<%- if [:markdownMML, :markdownPNG, :markdown].include?(@web.markup) and !@page.categories.include?('S5-slideshow') -%>
|
|
setupSVGedit('<%= compute_public_path("editor/svg-editor.html", "svg-edit").split(/\?/)[0] %>');
|
|
addS5button('<%= @page.name.escapeHTML %>');
|
|
<%- end -%>
|
|
//--><!]]>
|
|
</script>
|