diff options
| -rw-r--r-- | share/www/database.html | 10 | ||||
| -rw-r--r-- | share/www/document.html | 4 | ||||
| -rw-r--r-- | share/www/index.html | 2 | ||||
| -rw-r--r-- | share/www/script/couch_test_runner.js | 7 | ||||
| -rw-r--r-- | share/www/script/futon.browse.js | 17 | ||||
| -rw-r--r-- | share/www/script/futon.format.js | 5 | ||||
| -rw-r--r-- | share/www/script/futon.js | 3 | ||||
| -rw-r--r-- | share/www/session.html | 2 |
8 files changed, 33 insertions, 17 deletions
diff --git a/share/www/database.html b/share/www/database.html index 39507398..f1d8dbd6 100644 --- a/share/www/database.html +++ b/share/www/database.html @@ -71,17 +71,17 @@ specific language governing permissions and limitations under the License. }); // Restore preferences/state - $("#documents thead th.key").toggleClass("desc", $.futon.storage.get("desc")); - var reduce = $.futon.storage.get("reduce"); + $("#documents thead th.key").toggleClass("desc", !!$.futon.storage.get("desc")); + var reduce = !!$.futon.storage.get("reduce"); $("#reduce :checkbox")[0].checked = reduce; - $("#grouplevel select").val($.futon.storage.get("group_level")); + $("#grouplevel select").val(parseInt($.futon.storage.get("group_level"))); $("#grouplevel").toggleClass("disabled", !reduce).find("select").each(function() { this.disabled = !reduce; }); - $("#perpage").val($.futon.storage.get("per_page")); + $("#perpage").val(parseInt($.futon.storage.get("per_page"))); - var staleViews = $.futon.storage.get("stale"); + var staleViews = !!$.futon.storage.get("stale"); $("#staleviews :checkbox")[0].checked = staleViews; page.populateViewsMenu(); diff --git a/share/www/document.html b/share/www/document.html index b6f42018..ee0f3475 100644 --- a/share/www/document.html +++ b/share/www/document.html @@ -42,9 +42,9 @@ specific language governing permissions and limitations under the License. }); $(function() { - $("h1 a.dbname").text(page.dbName) + $("h1 a.dbname").text(encodeURIComponent(page.dbName)) .attr("href", "database.html?" + encodeURIComponent(page.db.name)); - $("h1 strong").text(page.docId); + $("h1 strong").text(encodeURIComponent(page.docId)); $("h1 a.raw").attr("href", "/" + encodeURIComponent(page.db.name) + "/" + encodeURIComponent(page.docId)); page.updateFieldListing(); diff --git a/share/www/index.html b/share/www/index.html index e34dbde1..975f5986 100644 --- a/share/www/index.html +++ b/share/www/index.html @@ -34,7 +34,7 @@ specific language governing permissions and limitations under the License. this.updateSelection(location.pathname + "index.html"); }); } - var dbsPerPage = $.futon.storage.get("per_page"); + var dbsPerPage = parseInt($.futon.storage.get("per_page")); if (dbsPerPage) $("#perpage").val(dbsPerPage); $("#perpage").change(function() { page.updateDatabaseListing(); diff --git a/share/www/script/couch_test_runner.js b/share/www/script/couch_test_runner.js index 2eab9c16..56787e9a 100644 --- a/share/www/script/couch_test_runner.js +++ b/share/www/script/couch_test_runner.js @@ -14,6 +14,13 @@ function loadScript(url) { + // disallow loading remote URLs + if((url.substr(0, 7) == "http://") + || (url.substr(0, 2) == "//") + || (url.substr(0, 5) == "data:") + || (url.substr(0, 11) == "javsacript:")) { + throw "Not loading remote test scripts"; + } if (typeof document != "undefined") document.write('<script src="'+url+'"></script>'); }; diff --git a/share/www/script/futon.browse.js b/share/www/script/futon.browse.js index 5f687941..65acbdeb 100644 --- a/share/www/script/futon.browse.js +++ b/share/www/script/futon.browse.js @@ -97,7 +97,10 @@ // Page class for browse/database.html CouchDatabasePage: function() { var urlParts = location.search.substr(1).split("/"); - var dbName = decodeURIComponent(urlParts.shift()); + var dbName = decodeURIComponent(urlParts.shift()) + + var dbNameRegExp = new RegExp("[^a-z0-9\_\$\(\)\+\/\-]", "g"); + dbName = dbName.replace(dbNameRegExp, ""); $.futon.storage.declareWithPrefix(dbName + ".", { desc: {}, @@ -119,7 +122,7 @@ if (viewName) { this.redirecting = true; location.href = "database.html?" + encodeURIComponent(dbName) + - "/" + viewName; + "/" + encodeURIComponent(viewName); } } var db = $.couch.db(dbName); @@ -372,7 +375,8 @@ var path = $.couch.encodeDocId(doc._id) + "/_view/" + encodeURIComponent(viewNames[j]); var option = $(document.createElement("option")) - .attr("value", path).text(viewNames[j]).appendTo(optGroup); + .attr("value", path).text(encodeURIComponent(viewNames[j])) + .appendTo(optGroup); if (path == viewName) { option[0].selected = true; } @@ -408,7 +412,7 @@ } var viewCode = resp.views[localViewName]; page.viewLanguage = resp.language || "javascript"; - $("#language").val(page.viewLanguage); + $("#language").val(encodeURIComponent(page.viewLanguage)); page.updateViewEditor(viewCode.map, viewCode.reduce || ""); $("#viewcode button.revert, #viewcode button.save").attr("disabled", "disabled"); page.storedViewCode = viewCode; @@ -420,7 +424,7 @@ page.updateViewEditor(page.storedViewCode.map, page.storedViewCode.reduce || ""); page.viewLanguage = page.storedViewLanguage; - $("#language").val(page.viewLanguage); + $("#language").val(encodeURIComponent(page.viewLanguage)); $("#viewcode button.revert, #viewcode button.save").attr("disabled", "disabled"); page.isDirty = false; if (callback) callback(); @@ -504,7 +508,8 @@ callback({ docid: "Cannot save to " + data.docid + " because its language is \"" + doc.language + - "\", not \"" + page.viewLanguage + "\"." + "\", not \"" + + encodeURIComponent(page.viewLanguage) + "\"." }); return; } diff --git a/share/www/script/futon.format.js b/share/www/script/futon.format.js index 0d536e36..31880764 100644 --- a/share/www/script/futon.format.js +++ b/share/www/script/futon.format.js @@ -16,7 +16,10 @@ escape: function(string) { return string.replace(/&/g, "&") .replace(/</g, "<") - .replace(/>/g, ">"); + .replace(/>/g, ">") + .replace(/"/, """) + .replace(/'/, "';") + ; }, // JSON pretty printing diff --git a/share/www/script/futon.js b/share/www/script/futon.js index 200d6ec5..c4647ed1 100644 --- a/share/www/script/futon.js +++ b/share/www/script/futon.js @@ -215,9 +215,10 @@ function $$(node) { recentDbs.sort(); $.each(recentDbs, function(idx, name) { if (name) { + name = encodeURIComponent(name); $("#dbs").append("<li>" + "<button class='remove' title='Remove from list' value='" + name + "'></button>" + - "<a href='database.html?" + encodeURIComponent(name) + "' title='" + name + "'>" + name + + "<a href='database.html?" + name + "' title='" + name + "'>" + name + "</a></li>"); } }); diff --git a/share/www/session.html b/share/www/session.html index 581640b0..0ebd943d 100644 --- a/share/www/session.html +++ b/share/www/session.html @@ -36,7 +36,7 @@ specific language governing permissions and limitations under the License. } m = qp.match(/reason=(.*)/); if (m) { - reason = decodeURIComponent(m[1]); + reason = $.futon.escape(decodeURIComponent(m[1])); } }); if (reason) { |