From 14b6c54b03f2164f568d25d6d54327117b149fa8 Mon Sep 17 00:00:00 2001
From: Andrew Dolgov <fox@bah.spb.su>
Date: Sat, 19 May 2007 14:47:51 +0100
Subject: [PATCH] fix tag quote issues

---
 functions.php           | 25 ++++++++++++++++---------
 modules/backend-rpc.php |  6 +++++-
 viewfeed.js             |  6 +++++-
 3 files changed, 26 insertions(+), 11 deletions(-)

diff --git a/functions.php b/functions.php
index 289ae3648a..4b1fae84ae 100644
--- a/functions.php
+++ b/functions.php
@@ -925,13 +925,9 @@ function update_rss_feed($link, $feed_url, $feed, $ignore_daemon = false) {
 						
 						foreach ($entry_tags as $tag) {
 
-							$tag = mb_strtolower($tag, 'utf-8');
+							$tag = sanitize_tag($tag);
 							$tag = db_escape_string($tag);
 
-							$tag = str_replace("+", " ", $tag);	
-							$tag = str_replace("\"", "", $tag);	
-							$tag = str_replace("technorati tag: ", "", $tag);
-
 							if (!tag_is_valid($tag)) continue;
 							
 							$result = db_query($link, "SELECT id FROM ttrss_tags		
@@ -942,8 +938,6 @@ function update_rss_feed($link, $feed_url, $feed, $ignore_daemon = false) {
 	
 							if ($result && db_num_rows($result) == 0) {
 								
-	//							print "tagging $entry_id as $tag<br>";
-	
 								db_query($link, "INSERT INTO ttrss_tags 
 									(owner_uid,tag_name,post_int_id)
 									VALUES ('$owner_uid','$tag', '$entry_int_id')");
@@ -3561,8 +3555,10 @@ function outputArticleXML($link, $id, $feed_id, $mark_as_read = true) {
 
 			while ($tmp_line = db_fetch_assoc($tmp_result)) {
 				$num_tags++;
-				$tag = $tmp_line["tag_name"];				
-				$tag_str = "<a href=\"javascript:viewfeed('$tag')\">$tag</a>, "; 
+				$tag = $tmp_line["tag_name"];
+				$tag_escaped = str_replace("'", "\\'", $tag);
+
+				$tag_str = "<a href=\"javascript:viewfeed('$tag_escaped')\">$tag</a>, ";
 				
 				if ($num_tags == 6) {
 					$tags_str .= "<a href=\"javascript:showBlockElement('allEntryTags')\">...</a>";
@@ -3988,4 +3984,15 @@ function print_checkpoint($n, $s) {
 		echo sprintf("<!-- CP[$n] %.4f seconds -->", $ts - $s);
 		return $ts;
 	}
+
+	function sanitize_tag($tag) {
+		$tag = trim($tag);
+
+		$tag = mb_strtolower($tag, 'utf-8');
+
+		$tag = str_replace("+", " ", $tag);	
+		$tag = str_replace("technorati tag: ", "", $tag);
+
+		return $tag;
+	}
 ?>
diff --git a/modules/backend-rpc.php b/modules/backend-rpc.php
index 425a855fca..e70b75524a 100644
--- a/modules/backend-rpc.php
+++ b/modules/backend-rpc.php
@@ -202,7 +202,9 @@ function handle_rpc_request($link) {
 		}
 
 		if ($subop == "setArticleTags") {
+
 			$id = db_escape_string($_GET["id"]);
+
 			$tags_str = db_escape_string($_GET["tags_str"]);
 
 			$tags = array_unique(trim_array(split(",", $tags_str)));
@@ -220,7 +222,7 @@ function handle_rpc_request($link) {
 					post_int_id = $int_id AND owner_uid = '".$_SESSION["uid"]."'");
 
 				foreach ($tags as $tag) {
-					$tag = trim($tag);
+					$tag = sanitize_tag($tag);	
 
 					if (!tag_is_valid($tag)) {
 						continue;
@@ -229,6 +231,8 @@ function handle_rpc_request($link) {
 					if (preg_match("/^[0-9]*$/", $tag)) {
 						continue;
 					}
+
+//					print "<!-- $tag -->";
 					
 					if ($tag != '') {
 						db_query($link, "INSERT INTO ttrss_tags 
diff --git a/viewfeed.js b/viewfeed.js
index 604af1bae0..18264eb63d 100644
--- a/viewfeed.js
+++ b/viewfeed.js
@@ -727,7 +727,11 @@ function editTagsSave() {
 
 	var query = Form.serialize("tag_edit_form");
 
-	xmlhttp_rpc.open("GET", "backend.php?op=rpc&subop=setArticleTags&" + query, true);			
+	query = "backend.php?op=rpc&subop=setArticleTags&" + query;
+
+	debug(query);
+
+	xmlhttp_rpc.open("GET", query, true);			
 	xmlhttp_rpc.onreadystatechange=tag_saved_callback;
 	xmlhttp_rpc.send(null);