[fix] Properly escape ids and attachment names

ZavenArra · Mar 2, 2012 · 5d2128f · 5d2128f
1 parent b44f7dc
commit 5d2128f
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 10 deletions.
diff --git a/lib/cradle/database/attachments.js b/lib/cradle/database/attachments.js
@@ -10,7 +10,7 @@ Database.prototype.getAttachment = function (id, attachmentName, callback) {
 
     return this.connection.rawRequest({
         method: 'GET', 
-        path: '/' + [this.name, id, attachmentName].map(querystring.escape).join('/')
+        path: '/' + [this.name, querystring.escape(id), attachmentName].join('/')
     }, callback);
 };
 
@@ -40,7 +40,7 @@ Database.prototype.removeAttachment = function (doc, attachmentName, callback) {
 
     this.query({
         method: 'DELETE',
-        path: [id, attachmentName].join('/'),
+        path: [querystring.escape(id), attachmentName].join('/'),
         query: { rev: rev }
     }, callback);
 };
@@ -78,7 +78,7 @@ Database.prototype.saveAttachment = function (doc, attachment, callback) {
     }
 
     options.method = 'PUT';
-    options.path = '/' + [this.name, id, attachmentName].map(querystring.escape).join('/');
+    options.path = '/' + [this.name, querystring.escape(id), attachmentName].join('/');
     options.headers = {
         'Content-Type': attachment['content-type'] 
             || attachment['contentType']

diff --git a/test/database-attachment-test.js b/test/database-attachment-test.js
@@ -36,7 +36,7 @@ vows.describe('cradle/database/attachments').addBatch({
                             id: res.id, 
                             rev: res.rev
                         }, {
-                            name: 'foo.txt', 
+                            name: 'cached/foo.txt', 
                             'Content-Type': 'text/plain', 
                             body: 'Foo!'
                         }, function () {
@@ -49,8 +49,8 @@ vows.describe('cradle/database/attachments').addBatch({
                 },
                 "with the _attachments": function (cached) {
                     assert.ok(cached._attachments);
-                    assert.ok(cached._attachments['foo.txt']);
-                    assert.equal(cached._attachments['foo.txt'].stub, true);
+                    assert.ok(cached._attachments['cached/foo.txt']);
+                    assert.equal(cached._attachments['cached/foo.txt'].stub, true);
                 },
                 "and is valid enough to re-save": {
                     topic: function (cached, db) {
@@ -61,7 +61,7 @@ vows.describe('cradle/database/attachments').addBatch({
                         });
                     },
                     "has the attachment": function (res) {
-                        var att = res._attachments['foo.txt'];
+                        var att = res._attachments['cached/foo.txt'];
                         assert.equal(att.stub, true);
                         assert.equal(att.content_type, 'text/plain');
                         assert.equal(att.length, 4);
@@ -293,7 +293,7 @@ vows.describe('cradle/database/attachments').addBatch({
                     assert.ok(res.ok);
                 }
             },
-            "when it doesnt exist": {
+            "when the document doesnt exist": {
                 topic: function (db) {
                     db.removeAttachment({
                         id: 'YUNOEXIST',
@@ -318,15 +318,15 @@ vows.describe('cradle/database/attachments').addBatch({
                 topic: function (db) {
                     var that = this;
                     db.get('attachment-cacher', function (err, doc) {
-                        db.removeAttachment(doc._id, 'foo.txt', that.callback);
+                        db.removeAttachment(doc._id, 'cached/foo.txt', that.callback);
                     });
                 },
                 "should remove the attachment": function (err, res) {
                     assert.isNull(err);
                     assert.ok(res.ok);
                 }
             },
-            "when it doesnt exist": {
+            "when the document doesnt exist": {
                 topic: function (db) {
                     db.removeAttachment({
                         id: 'YUNOEXIST',