Commit: 0f97b833ddddf6153a8a9e5952b9bded656748a8

Author: Jon Adams | Date: 2009-11-03 19:18:55 -0800
xss scripting patches for author and content, truncated author name and css
diff --git a/views/anologue/view.html.php b/views/anologue/view.html.php index 38a5125..13da24c 100644 --- a/views/anologue/view.html.php +++ b/views/anologue/view.html.php @@ -36,9 +36,9 @@ <li class="ip"><?php echo $message->ip;?></li> <li class="author"> <?php echo $this->html->image('http://gravatar.com/avatar/<?php echo $message->email;?>?s=16&d=http://'.$_SERVER['HTTP_HOST'].'/img/anonymous.png'); ?> - &laquo; <?php echo $message->author;?> &raquo; + <span title="<?php echo $this->html->escape($message->author);?>">&laquo; <?php echo $this->html->escape($message->author);?> &raquo;</span> </li> - <li class="text"><div class="markdown"><?php echo $message->text; ?></div></li> + <li class="text"><div class="markdown"><?php echo $this->html->escape($message->text); ?></div></li> </ul> </li> <?php } ?> diff --git a/webroot/css/anologue.css b/webroot/css/anologue.css index e0ebd10..af3bbe7 100644 --- a/webroot/css/anologue.css +++ b/webroot/css/anologue.css @@ -46,6 +46,7 @@ p.last { padding:.5em 0 4em 0; } .anologue .message:hover li.time, .anologue .message:hover li.ip { opacity:.25; } .anologue li.author { font-weight:bold; white-space:nowrap; text-align:right; width:14em; left:5em; padding:1em .5em; } .anologue li.author img { float:right; margin:0 0 0 .5em; } + .anologue li.author span { max-width:11em; overflow:hidden; display:block; } .anologue li.text { position:relative; padding:.5em .5em .5em 20.5em; min-height:1em; } .anologue .text a { border-bottom:1px dotted #77458c; } .anologue .text .markdown { } diff --git a/webroot/js/anologue.js b/webroot/js/anologue.js index bace700..496ea80 100644 --- a/webroot/js/anologue.js +++ b/webroot/js/anologue.js @@ -71,7 +71,7 @@ var anologue = { var timeroo = new Date(); var timestamp = timeroo.getHours() + ':' + timeroo.getMinutes() + ':' + timeroo.getSeconds(); var id = 'message-' + $.md5(message.timestamp + message.author); - var html = '<li class="message" id="' + id + '" style="display:none;"><ul class="data"><li class="time">' + timestamp + '</li><li class="ip">' + message.ip + '</li><li class="author"><img class="gravatar" src="http://gravatar.com/avatar/' + message.email + '?s=16&d=' + this._config.icon + '" border="0" /> &laquo; ' + $('<div/>').text(message.author).html() + ' &raquo; </li><li class="text"><div class="markdown">' + $('<div/>').text(message.text).html() + '</div></li></ul></li>'; + var html = '<li class="message" id="' + id + '" style="display:none;"><ul class="data"><li class="time">' + timestamp + '</li><li class="ip">' + message.ip + '</li><li class="author"><img class="gravatar" src="http://gravatar.com/avatar/' + message.email + '?s=16&d=' + this._config.icon + '" border="0" /> <span title="' + $('<div/>').text(message.author).html() + '">&laquo; ' + $('<div/>').text(message.author).html() + ' &raquo;</span> </li><li class="text"><div class="markdown">' + $('<div/>').text(message.text).html() + '</div></li></ul></li>'; $("#anologue").append(html); var soundDisabled = $('#anologue-sound:checked').val(); if (!soundDisabled) {