summaryrefslogtreecommitdiff
path: root/share/www
diff options
context:
space:
mode:
authorJan Lehnardt <jan@apache.org>2010-11-02 22:16:54 +0000
committerJan Lehnardt <jan@apache.org>2010-11-02 22:16:54 +0000
commit4e244a75bf6b352c94a21a131b1ecdcb74e6d3e3 (patch)
tree63a24d7d9e3d1bcba17160a022c616fd8682a1cf /share/www
parent51741863f99edb5bd21e9991aff5d4d718ba4b50 (diff)
Escape URL and cookie input.
git-svn-id: https://svn.apache.org/repos/asf/couchdb/branches/1.0.x@1030262 13f79535-47bb-0310-9956-ffa450edef68
Diffstat (limited to 'share/www')
-rw-r--r--share/www/database.html10
-rw-r--r--share/www/document.html4
-rw-r--r--share/www/index.html2
-rw-r--r--share/www/script/couch_test_runner.js7
-rw-r--r--share/www/script/futon.browse.js17
-rw-r--r--share/www/script/futon.format.js5
-rw-r--r--share/www/script/futon.js3
-rw-r--r--share/www/session.html2
8 files changed, 33 insertions, 17 deletions
diff --git a/share/www/database.html b/share/www/database.html
index 39507398..f1d8dbd6 100644
--- a/share/www/database.html
+++ b/share/www/database.html
@@ -71,17 +71,17 @@ specific language governing permissions and limitations under the License.
});
// Restore preferences/state
- $("#documents thead th.key").toggleClass("desc", $.futon.storage.get("desc"));
- var reduce = $.futon.storage.get("reduce");
+ $("#documents thead th.key").toggleClass("desc", !!$.futon.storage.get("desc"));
+ var reduce = !!$.futon.storage.get("reduce");
$("#reduce :checkbox")[0].checked = reduce;
- $("#grouplevel select").val($.futon.storage.get("group_level"));
+ $("#grouplevel select").val(parseInt($.futon.storage.get("group_level")));
$("#grouplevel").toggleClass("disabled", !reduce).find("select").each(function() {
this.disabled = !reduce;
});
- $("#perpage").val($.futon.storage.get("per_page"));
+ $("#perpage").val(parseInt($.futon.storage.get("per_page")));
- var staleViews = $.futon.storage.get("stale");
+ var staleViews = !!$.futon.storage.get("stale");
$("#staleviews :checkbox")[0].checked = staleViews;
page.populateViewsMenu();
diff --git a/share/www/document.html b/share/www/document.html
index b6f42018..ee0f3475 100644
--- a/share/www/document.html
+++ b/share/www/document.html
@@ -42,9 +42,9 @@ specific language governing permissions and limitations under the License.
});
$(function() {
- $("h1 a.dbname").text(page.dbName)
+ $("h1 a.dbname").text(encodeURIComponent(page.dbName))
.attr("href", "database.html?" + encodeURIComponent(page.db.name));
- $("h1 strong").text(page.docId);
+ $("h1 strong").text(encodeURIComponent(page.docId));
$("h1 a.raw").attr("href", "/" + encodeURIComponent(page.db.name) +
"/" + encodeURIComponent(page.docId));
page.updateFieldListing();
diff --git a/share/www/index.html b/share/www/index.html
index e34dbde1..975f5986 100644
--- a/share/www/index.html
+++ b/share/www/index.html
@@ -34,7 +34,7 @@ specific language governing permissions and limitations under the License.
this.updateSelection(location.pathname + "index.html");
});
}
- var dbsPerPage = $.futon.storage.get("per_page");
+ var dbsPerPage = parseInt($.futon.storage.get("per_page"));
if (dbsPerPage) $("#perpage").val(dbsPerPage);
$("#perpage").change(function() {
page.updateDatabaseListing();
diff --git a/share/www/script/couch_test_runner.js b/share/www/script/couch_test_runner.js
index 451a454a..fbffbbb6 100644
--- a/share/www/script/couch_test_runner.js
+++ b/share/www/script/couch_test_runner.js
@@ -14,6 +14,13 @@
function loadScript(url) {
+ // disallow loading remote URLs
+ if((url.substr(0, 7) == "http://")
+ || (url.substr(0, 2) == "//")
+ || (url.substr(0, 5) == "data:")
+ || (url.substr(0, 11) == "javsacript:")) {
+ throw "Not loading remote test scripts";
+ }
if (typeof document != "undefined") document.write('<script src="'+url+'"></script>');
};
diff --git a/share/www/script/futon.browse.js b/share/www/script/futon.browse.js
index 5f687941..65acbdeb 100644
--- a/share/www/script/futon.browse.js
+++ b/share/www/script/futon.browse.js
@@ -97,7 +97,10 @@
// Page class for browse/database.html
CouchDatabasePage: function() {
var urlParts = location.search.substr(1).split("/");
- var dbName = decodeURIComponent(urlParts.shift());
+ var dbName = decodeURIComponent(urlParts.shift())
+
+ var dbNameRegExp = new RegExp("[^a-z0-9\_\$\(\)\+\/\-]", "g");
+ dbName = dbName.replace(dbNameRegExp, "");
$.futon.storage.declareWithPrefix(dbName + ".", {
desc: {},
@@ -119,7 +122,7 @@
if (viewName) {
this.redirecting = true;
location.href = "database.html?" + encodeURIComponent(dbName) +
- "/" + viewName;
+ "/" + encodeURIComponent(viewName);
}
}
var db = $.couch.db(dbName);
@@ -372,7 +375,8 @@
var path = $.couch.encodeDocId(doc._id) + "/_view/" +
encodeURIComponent(viewNames[j]);
var option = $(document.createElement("option"))
- .attr("value", path).text(viewNames[j]).appendTo(optGroup);
+ .attr("value", path).text(encodeURIComponent(viewNames[j]))
+ .appendTo(optGroup);
if (path == viewName) {
option[0].selected = true;
}
@@ -408,7 +412,7 @@
}
var viewCode = resp.views[localViewName];
page.viewLanguage = resp.language || "javascript";
- $("#language").val(page.viewLanguage);
+ $("#language").val(encodeURIComponent(page.viewLanguage));
page.updateViewEditor(viewCode.map, viewCode.reduce || "");
$("#viewcode button.revert, #viewcode button.save").attr("disabled", "disabled");
page.storedViewCode = viewCode;
@@ -420,7 +424,7 @@
page.updateViewEditor(page.storedViewCode.map,
page.storedViewCode.reduce || "");
page.viewLanguage = page.storedViewLanguage;
- $("#language").val(page.viewLanguage);
+ $("#language").val(encodeURIComponent(page.viewLanguage));
$("#viewcode button.revert, #viewcode button.save").attr("disabled", "disabled");
page.isDirty = false;
if (callback) callback();
@@ -504,7 +508,8 @@
callback({
docid: "Cannot save to " + data.docid +
" because its language is \"" + doc.language +
- "\", not \"" + page.viewLanguage + "\"."
+ "\", not \"" +
+ encodeURIComponent(page.viewLanguage) + "\"."
});
return;
}
diff --git a/share/www/script/futon.format.js b/share/www/script/futon.format.js
index 0d536e36..31880764 100644
--- a/share/www/script/futon.format.js
+++ b/share/www/script/futon.format.js
@@ -16,7 +16,10 @@
escape: function(string) {
return string.replace(/&/g, "&amp;")
.replace(/</g, "&lt;")
- .replace(/>/g, "&gt;");
+ .replace(/>/g, "&gt;")
+ .replace(/"/, "&quot;")
+ .replace(/'/, "&#39;;")
+ ;
},
// JSON pretty printing
diff --git a/share/www/script/futon.js b/share/www/script/futon.js
index 200d6ec5..c4647ed1 100644
--- a/share/www/script/futon.js
+++ b/share/www/script/futon.js
@@ -215,9 +215,10 @@ function $$(node) {
recentDbs.sort();
$.each(recentDbs, function(idx, name) {
if (name) {
+ name = encodeURIComponent(name);
$("#dbs").append("<li>" +
"<button class='remove' title='Remove from list' value='" + name + "'></button>" +
- "<a href='database.html?" + encodeURIComponent(name) + "' title='" + name + "'>" + name +
+ "<a href='database.html?" + name + "' title='" + name + "'>" + name +
"</a></li>");
}
});
diff --git a/share/www/session.html b/share/www/session.html
index 581640b0..0ebd943d 100644
--- a/share/www/session.html
+++ b/share/www/session.html
@@ -36,7 +36,7 @@ specific language governing permissions and limitations under the License.
}
m = qp.match(/reason=(.*)/);
if (m) {
- reason = decodeURIComponent(m[1]);
+ reason = $.futon.escape(decodeURIComponent(m[1]));
}
});
if (reason) {