incubator-allura-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From brond...@apache.org
Subject [20/28] git commit: [#2835] ticket:308 Safer matches highlighting
Date Wed, 24 Apr 2013 18:13:54 GMT
[#2835] ticket:308 Safer matches highlighting


Project: http://git-wip-us.apache.org/repos/asf/incubator-allura/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-allura/commit/6c49711f
Tree: http://git-wip-us.apache.org/repos/asf/incubator-allura/tree/6c49711f
Diff: http://git-wip-us.apache.org/repos/asf/incubator-allura/diff/6c49711f

Branch: refs/heads/master
Commit: 6c49711f033fb1d94ba594f865ec5b3500941c0b
Parents: 27016ef
Author: Igor Bondarenko <jetmind2@gmail.com>
Authored: Mon Apr 1 14:21:16 2013 +0000
Committer: Dave Brondsema <dbrondsema@slashdotmedia.com>
Committed: Wed Apr 24 16:34:42 2013 +0000

----------------------------------------------------------------------
 Allura/allura/lib/search.py                        |   22 +++++++++++----
 .../allura/templates/widgets/search_results.html   |    4 +-
 2 files changed, 18 insertions(+), 8 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/incubator-allura/blob/6c49711f/Allura/allura/lib/search.py
----------------------------------------------------------------------
diff --git a/Allura/allura/lib/search.py b/Allura/allura/lib/search.py
index 6c96d4a..97a67da 100644
--- a/Allura/allura/lib/search.py
+++ b/Allura/allura/lib/search.py
@@ -45,6 +45,8 @@ def solarize(obj):
     text = doc['text']
     text = g.markdown.convert(text)
     doc['text'] = jinja2.Markup.escape(text).striptags()
+    # striptags decodes html entities, so we should escape them again
+    doc['text'] = jinja2.Markup.escape(doc['text'])
     return doc
 
 class SearchError(SolrError):
@@ -132,8 +134,8 @@ def search_app(q='', fq=None, app=True, **kw):
             'pf': 'title^2 text',
             'fq': fq,
             'hl': 'true',
-            'hl.simple.pre': '<strong>',
-            'hl.simple.post': '</strong>',
+            'hl.simple.pre': '#ALLURA-HIGHLIGHT-START#',
+            'hl.simple.post': '#ALLURA-HIGHLIGHT-END#',
             'sort': sort,
         }
         if not history:
@@ -158,10 +160,18 @@ def search_app(q='', fq=None, app=True, **kw):
                 return doc
             def add_matches(doc):
                 m = matches.get(doc['id'], {})
-                doc['title_match'] = h.get_first(m, 'title')
-                doc['text_match'] = h.get_first(m, 'text')
-                if not doc['text_match']:
-                    doc['text_match'] = h.get_first(doc, 'text')
+                title = h.get_first(m, 'title')
+                text = h.get_first(m, 'text')
+                if title:
+                    title = (jinja2.escape(title)
+                                   .replace('#ALLURA-HIGHLIGHT-START#', jinja2.Markup('<strong>'))
+                                   .replace('#ALLURA-HIGHLIGHT-END#', jinja2.Markup('</strong>')))
+                if text:
+                    text = (jinja2.escape(text)
+                                  .replace('#ALLURA-HIGHLIGHT-START#', jinja2.Markup('<strong>'))
+                                  .replace('#ALLURA-HIGHLIGHT-END#', jinja2.Markup('</strong>')))
+                doc['title_match'] = title
+                doc['text_match'] = text or h.get_first(doc, 'text')
                 return doc
             results = imap(historize_urls, results)
             results = imap(add_matches, results)

http://git-wip-us.apache.org/repos/asf/incubator-allura/blob/6c49711f/Allura/allura/templates/widgets/search_results.html
----------------------------------------------------------------------
diff --git a/Allura/allura/templates/widgets/search_results.html b/Allura/allura/templates/widgets/search_results.html
index 2eaaf61..464dab4 100644
--- a/Allura/allura/templates/widgets/search_results.html
+++ b/Allura/allura/templates/widgets/search_results.html
@@ -65,7 +65,7 @@
     <p>
     <a href="{{doc['url_paginated'] or doc['url_s']}}">
       {% if doc.title_match %}
-        {{ doc.title_match|safe }}
+        {{ doc.title_match }}
       {% else %}
         {{ h.get_first(doc, 'title') or h.get_first(doc, 'title_s') -}}  {#-  title_s is
legacy -#}
       {% endif %}
@@ -73,7 +73,7 @@
     {% if doc['type_s'] %}<span class="gray"><sup>{{ '(%s)' % doc['type_s'] }}</sup></span>{%
endif %}
     <br>
     {% if doc.text_match %}
-      <span class="text-match">{{ doc.text_match|safe }}</span><br>
+      <span class="text-match">{{ doc.text_match }}</span><br>
     {% endif %}
     <span class="gray">Last updated: {{ h.ago_string(doc['mod_date_dt']) }}</span>
     </p>


Mime
View raw message