Update edit identifiers

cps/db.py

@@ -173,6 +173,9 @@ def __repr__(self):
             return "https://www.databazeknih.cz/knihy/{0}".format(self.val)
         elif self.val.lower().startswith("javascript:"):
             return quote(self.val)
+        elif self.val.lower().startswith("data:"):
+            link , __, __ = str.partition(self.val, ",")
+            return link
         else:
             return "{0}".format(self.val)
 

cps/editbooks.py

@@ -27,9 +27,10 @@
 from uuid import uuid4
 from markupsafe import escape  # dependency of flask
 from functools import wraps
+import re
 
 try:
-    from lxml.html.clean import clean_html
+    from lxml.html.clean import clean_html, Cleaner
 except ImportError:
     clean_html = None
 
@@ -599,6 +600,8 @@ def identifier_list(to_save, book):
         val_key = id_val_prefix + type_key[len(id_type_prefix):]
         if val_key not in to_save.keys():
             continue
+        if to_save[val_key].startswith("data:"):
+            to_save[val_key], __, __ = str.partition(to_save[val_key], ",")
         result.append(db.Identifiers(to_save[val_key], type_value, book.id))
     return result
 

cps/templates/detail.html

@@ -164,7 +164,7 @@ <h2 id="title">{{ entry.title }}</h2>
                     <p>
                         <span class="glyphicon glyphicon-link"></span>
                         {% for identifier in entry.identifiers %}
-                            <a href="{{ identifier }}" target="_blank" class="btn btn-xs btn-success"
+                            <a href="{{ identifier|escape }}" target="_blank" class="btn btn-xs btn-success"
                                role="button">{{ identifier.format_type() }}</a>
                         {% endfor %}
                     </p>