Fix escaping

Some data was HTML-escaped in the API results. Now data in API results is (hopefully) all raw and clients have to escape as needed. One client is, obviously, taginfo itself and a few places have been changed to do the right escaping now. Fixes #19.
taginfo · Jan 30, 2013 · 59ca7dc · 59ca7dc
1 parent ce090c5
commit 59ca7dc
Show file tree

Hide file tree

Showing 6 changed files with 16 additions and 16 deletions.
diff --git a/web/lib/api/v4/relation.rb b/web/lib/api/v4/relation.rb
@@ -132,11 +132,11 @@ class Taginfo < Sinatra::Base
         res = @db.execute('SELECT * FROM wiki.relation_pages LEFT OUTER JOIN wiki.wiki_images USING (image) WHERE rtype = ? ORDER BY lang', rtype)
 
         return res.map{ |row| {
-                :lang             => h(row['lang']),
-                :language         => h(::Language[row['lang']].native_name),
-                :language_en      => h(::Language[row['lang']].english_name),
-                :title            => h(row['title']),
-                :description      => h(row['description']),
+                :lang             => row['lang'],
+                :language         => ::Language[row['lang']].native_name,
+                :language_en      => ::Language[row['lang']].english_name,
+                :title            => row['title'],
+                :description      => row['description'],
                 :image            => {
                     :title            => row['image'],
                     :width            => row['width'].to_i,

diff --git a/web/lib/utils.rb b/web/lib/utils.rb
@@ -140,11 +140,11 @@ def api(version, path, doc=nil, &block)
 # Used in wiki api calls
 def get_wiki_result(res)
     return res.map{ |row| {
-            :lang             => h(row['lang']),
-            :language         => h(::Language[row['lang']].native_name),
-            :language_en      => h(::Language[row['lang']].english_name),
-            :title            => h(row['title']),
-            :description      => h(row['description']),
+            :lang             => row['lang'],
+            :language         => ::Language[row['lang']].native_name,
+            :language_en      => ::Language[row['lang']].english_name,
+            :title            => row['title'],
+            :description      => row['description'],
             :image            => {
                 :title            => row['image'],
                 :width            => row['width'].to_i,
@@ -175,7 +175,7 @@ def get_josm_style_rules_result(total, res)
             :key        => row['k'],
             :value      => row['v'],
             :value_bool => row['b'],
-            :rule       => h(row['rule']),
+            :rule       => row['rule'],
             :area_color => row['area_color'] ? h(row['area_color'].sub(/^.*#/, '#')) : '',
             :line_color => row['line_color'] ? h(row['line_color'].sub(/^.*#/, '#')) : '',
             :line_width => row['line_width'] ? row['line_width'].to_i : 0,

diff --git a/web/public/js/taginfo.js b/web/public/js/taginfo.js
@@ -197,7 +197,7 @@ function link_to_wiki(title, options) {
 
     return link(
         url_for_wiki(title, options),
-        title,
+        html_escape(title),
         { target: '_blank', 'class': 'extlink' }
     );
 }

diff --git a/web/viewsjs/key.js.erb b/web/viewsjs/key.js.erb
@@ -49,7 +49,7 @@ var create_flexigrid_for = {
                         hover_expand(link_to_value(key, row.value)),
                         fmt_value_with_percent(row.count, row.fraction),
                         fmt_checkmark(row.in_wiki),
-                        row.description
+                        html_escape(row.description)
                     ] };
                 });
                 delete data.data;
@@ -105,7 +105,7 @@ var create_flexigrid_for = {
                         return { 'cell': [
                             fmt_language(row.lang, row.language, row.language_en),
                             link_to_wiki(row.title),
-                            row.description,
+                            html_escape(row.description),
                             fmt_wiki_image_popup(row.image),
                             fmt_type_icon('node',     row.on_node) + 
                             fmt_type_icon('way',      row.on_way) + 

diff --git a/web/viewsjs/relation.js.erb b/web/viewsjs/relation.js.erb
@@ -75,7 +75,7 @@ var create_flexigrid_for = {
                         return { 'cell': [
                             fmt_language(row.lang, row.language, row.language_en),
                             link_to_wiki(row.title),
-                            row.description,
+                            html_escape(row.description),
                             fmt_wiki_image_popup(row.image)
                         ]};
                     })

diff --git a/web/viewsjs/tag.js.erb b/web/viewsjs/tag.js.erb
@@ -85,7 +85,7 @@ var create_flexigrid_for = {
                         return { 'cell': [
                             fmt_language(row.lang, row.language, row.language_en),
                             link_to_wiki(row.title),
-                            row.description,
+                            html_escape(row.description),
                             fmt_wiki_image_popup(row.image),
                             fmt_type_icon('node',     row.on_node) + 
                             fmt_type_icon('way',      row.on_way) +