fixes #48

bromagosa · Aug 12, 2016 · 0ca492b · 0ca492b
1 parent 9543f76
commit 0ca492b
Show file tree

Hide file tree

Showing 6 changed files with 11 additions and 10 deletions.
diff --git a/app.lua b/app.lua
@@ -5,7 +5,7 @@
 
 local lapis = require 'lapis'
 local app = lapis.Application()
-local db = require 'lapis.db' 
+local db = require 'lapis.db'
 
 app:enable('etlua')
 app.layout = require 'views.layout'

diff --git a/views/carousel.etlua b/views/carousel.etlua
@@ -15,7 +15,7 @@
                 }
             };
             // The second part of the query needs to be enclosed between double commas, as SQL strings are enclosed by single ones
-            ajax_<%= id %>.open('GET', '/api/projects/<%= collection %>/5/' + offset_<%= id %> + "<%= '/' .. (username or '') %>?list=<%- list or '' %>&notes=<%- notes or '' %>", true);
+            ajax_<%= id %>.open('GET', '/api/projects/<%= collection %>/5/' + offset_<%= id %> + "<%= '/' .. (username or '') %>?list=<%= list or '' %>&notes=<%= notes or '' %>", true);
             ajax_<%= id %>.send();
         };
         function update<%= id %>() {

diff --git a/views/inplace.etlua b/views/inplace.etlua
@@ -6,7 +6,7 @@
                 document.getElementById('<%= id %>').classList.add('flash');
             }
         };
-        ajax_<%= id %>.open('POST', '/api/<%- path %>/update/<%- property %>');
+        ajax_<%= id %>.open('POST', '/api/<%= path %>/update/<%= property %>');
         ajax_<%= id %>.send(document.getElementById('<%= id %>').textContent); 
     };
     function checkKey_<%= id %> (event, element) {
@@ -21,5 +21,5 @@
     contenteditable="true"
     onblur="update_<%= id %>()"
     onfocus="document.getElementById('<%= id %>').classList.remove('flash');"
-    onkeypress="checkKey_<%= id %>(event, this)"><%- content %>
+    onkeypress="checkKey_<%= id %>(event, this)"><%= content %>
 </span>
diff --git a/views/myprojects.etlua b/views/myprojects.etlua
@@ -80,7 +80,7 @@
 
         element.classList.add('selected');
 
-        document.getElementById('open-button').href = "/users/<%- session.username %>/projects/" + encodeURIComponent(projectName);
+        document.getElementById('open-button').href = "/users/<%= session.username %>/projects/" + encodeURIComponent(projectName);
         document.getElementById('share-button').innerHTML = element.children[2].textContent == '✔' ? 'Unshare' : 'Share';
     };
 
@@ -132,7 +132,7 @@
                                 selectProject();
                             }
                         };
-                        ajax.open('GET', '/api/users/<%- session.username %>/projects/' + encodeURIComponent(currentProject) + '/delete', true);
+                        ajax.open('GET', '/api/users/<%= session.username %>/projects/' + encodeURIComponent(currentProject) + '/delete', true);
                         ajax.send();
                     }
                 },
@@ -150,7 +150,7 @@
             }
         };
 
-        ajax.open('GET', '/api/users/<%- session.username %>/projects/' + encodeURIComponent(currentProject) + '/visibility/?ispublic=' + !isPublic, true);
+        ajax.open('GET', '/api/users/<%= session.username %>/projects/' + encodeURIComponent(currentProject) + '/visibility/?ispublic=' + !isPublic, true);
         ajax.send();
     };
 </script>

diff --git a/views/project.etlua b/views/project.etlua
@@ -1,10 +1,11 @@
+<% local util = require 'lapis.util' %>
 <div class="project-container">
     <div class="project pure-g">
         <div class="postcard pure-u-1-2">
             <span class="title-text">
                 <%- project.projectname %>
             </span>
-            <span class="author">by <a href="/users/<%- project.username %>"><%- project.username %></a></span>
+            <span class="author">by <a href="/users/<%= util.escape(project.username) %>"><%- project.username %></a></span>
             <img class="big-thumbnail" src="<%= project.thumbnail %>">
             <div class="stats pure-g">
                 <div class="pure-u-1-2">
@@ -36,7 +37,7 @@
                       <%= project.notes ~= '' and project.notes or 'This project has no notes.' %>
                 <% end %>
             </span>
-            <a class="pure-button red-button" align="center" href="/run#present:Username=<%- project.username %>&ProjectName=<%- project.projectname %>">Open Project</a>
+            <a class="pure-button red-button" align="center" href="/run#present:Username=<%= util.escape(project.username) %>&ProjectName=<%= util.escape(project.projectname) %>">Open Project</a>
         </div>
     </div>
 </div>

diff --git a/views/topbar.etlua b/views/topbar.etlua
@@ -30,7 +30,7 @@
                 <a href="#" id="menuLink1" class="pure-menu-link"><%- session.username %></a>
                 <ul class="pure-menu-children pure-u-3-24">
                     <li class="pure-menu-item"><a class="pure-menu-link" href="/myprojects">My Projects</a></li>
-                    <li class="pure-menu-item"><a class="pure-menu-link" href="/users/<%- session.username %>">My Profile</a></li>
+                    <li class="pure-menu-item"><a class="pure-menu-link" href="/users/<%= session.username %>">My Profile</a></li>
                     <li class="pure-menu-item"><a class="pure-menu-link" href="/migration">Migration</a></li>
                     <li class="pure-menu-item"><a class="pure-menu-link" href="/logout">Log Out</a></li>
                 </ul>