Merge remote-tracking branch 'origin/dev' into dev-binnchx

public/js/app/note.js

@@ -609,7 +609,7 @@ Note.renderChangedNote = function(changedNote) {
 	// 找到左侧相应的note
 	var $leftNoteNav = $(tt('[noteId="?"]', changedNote.NoteId));
 	if(changedNote.Title) {
-		$leftNoteNav.find(".item-title").html(changedNote.Title);
+		$leftNoteNav.find(".item-title").text(changedNote.Title);
 	}
 	if(changedNote.Desc) {
 		$leftNoteNav.find(".desc").html(changedNote.Desc);
@@ -774,6 +774,11 @@ Note.renderNotes = function(notes, forNewNote, isShared) {
 			})(i), i*2000);
 	}
 }
+
+Note._toHtmlEntity = function(html){
+	return (html + '').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+};
+
 Note._renderNotes = function(notes, forNewNote, isShared, tang) { // 第几趟
 	var baseClasses = "item-my";
 	if(isShared) {
@@ -789,9 +794,9 @@ Note._renderNotes = function(notes, forNewNote, isShared, tang) { // 第几趟
 		var note = notes[i];
 		var tmp;
 		if(note.ImgSrc) {
-			tmp = tt(Note.itemTpl, classes, note.NoteId, note.ImgSrc, note.Title, Notebook.getNotebookTitle(note.NotebookId), goNowToDatetime(note.UpdatedTime), note.Desc);
+			tmp = tt(Note.itemTpl, classes, note.NoteId, note.ImgSrc, Note._toHtmlEntity(note.Title), Notebook.getNotebookTitle(note.NotebookId), goNowToDatetime(note.UpdatedTime), note.Desc);
 		} else {
-			tmp = tt(Note.itemTplNoImg, classes, note.NoteId, note.Title, Notebook.getNotebookTitle(note.NotebookId), goNowToDatetime(note.UpdatedTime), note.Desc);
+			tmp = tt(Note.itemTplNoImg, classes, note.NoteId, Note._toHtmlEntity(note.Title), Notebook.getNotebookTitle(note.NotebookId), goNowToDatetime(note.UpdatedTime), note.Desc);
 		}
 		if(!note.IsBlog) {
 			tmp = $(tmp);
@@ -849,12 +854,12 @@ Note.newNote = function(notebookId, isShare, fromUserId, isMarkdown) {
 	}
 
 	var notebook = Notebook.getNotebook(notebookId);
-	var notebookTitle = notebook ? notebook.Title : "";
+	var notebookTitle = notebook ? Note._toHtmlEntity(notebook.Title) : "";
 	var curDate = getCurDate();
 	if(isShare) {
-		newItem = tt(Note.newItemTpl, baseClasses, fromUserId, note.NoteId, note.Title, notebookTitle, curDate, "");
+		newItem = tt(Note.newItemTpl, baseClasses, fromUserId, note.NoteId, Note._toHtmlEntity(note.Title), notebookTitle, curDate, "");
 	} else {
-		newItem = tt(Note.newItemTpl, baseClasses, "", note.NoteId, note.Title, notebookTitle, curDate, "");
+		newItem = tt(Note.newItemTpl, baseClasses, "", note.NoteId, Note._toHtmlEntity(note.Title), notebookTitle, curDate, "");
 	}
 
 	// notebook是否是Blog
@@ -1118,7 +1123,7 @@ Note.hideReadOnly = function() {
 // read only
 Note.renderNoteReadOnly = function(note) {
 	Note.showReadOnly();
-	$("#noteReadTitle").html(note.Title);
+	$("#noteReadTitle").text(note.Title);
 
 	Tag.renderReadOnlyTags(note.Tags);
 
@@ -1590,7 +1595,7 @@ var Attach = {
 		for(var i = 0; i < attachNum; ++i) {
 			var each = attachs[i];
 			html += '<li class="clearfix" data-id="' + each.AttachId + '">' +
-						'<div class="attach-title">' + each.Title + '</div>' + 
+						'<div class="attach-title">' + Note._toHtmlEntity(each.Title) + '</div>' +
 						'<div class="attach-process"> ' +
 						'	  <button class="btn btn-sm btn-warning delete-attach" data-loading-text="..."><i class="fa fa-trash-o"></i></button> ' +
 						'	  <button type="button" class="btn btn-sm btn-primary download-attach"><i class="fa fa-download"></i></button> ' +

public/js/app/notebook.js

@@ -54,7 +54,7 @@ Notebook.getNotebook = function(notebookId) {
 Notebook.getNotebookTitle = function(notebookId) {
 	var notebook = Notebook.cache[notebookId];
 	if(notebook) {
-		return notebook.Title;
+		return Note._toHtmlEntity(notebook.Title);
 	} else {
 		return "未知";
 	}
@@ -399,7 +399,7 @@ Notebook.getChangedNotebooks = function(notebooks) {
 		if(!isEmpty(notebook.Subs)) {
 			classes = "dropdown-submenu";
 		}
-		var eachForNew = tt('<li role="presentation" class="clearfix ?"><div class="new-note-left pull-left" title="为该笔记本新建笔记" href="#" notebookId="?">?</div><div title="为该笔记本新建markdown笔记" class="new-note-right pull-left" notebookId="?">M</div>', classes, notebook.NotebookId, notebook.Title, notebook.NotebookId);
+		var eachForNew = tt('<li role="presentation" class="clearfix ?"><div class="new-note-left pull-left" title="为该笔记本新建笔记" href="#" notebookId="?">?</div><div title="为该笔记本新建markdown笔记" class="new-note-right pull-left" notebookId="?">M</div>', classes, notebook.NotebookId, Note._toHtmlEntity(notebook.Title), notebook.NotebookId);
 
 		if(!isEmpty(notebook.Subs)) {
 			eachForNew  += "<ul class='dropdown-menu'>";
@@ -477,12 +477,12 @@ Notebook.renderShareNotebooks = function(sharedUserInfos, shareNotebooks) {
 
 		userNotebooks.ShareNotebooks = [{NotebookId: "-2", Title: "默认共享"}].concat(userNotebooks.ShareNotebooks)
 
-		var username = userInfo.Username || userInfo.Email;
+		var username = Note._toHtmlEntity(userInfo.Username || userInfo.Email);
 		var header = tt('<div class="folderNote closed"><div class="folderHeader"><a><h1 title="? 的共享"><i class="fa fa-angle-right"></i>?</h1></a></div>', username, username);
 		var body = '<ul class="folderBody">';
 		for(var j in userNotebooks.ShareNotebooks) {
 			var notebook = userNotebooks.ShareNotebooks[j];
-			body += tt('<li><a notebookId="?">?</a></li>', notebook.NotebookId, notebook.Title)
+			body += tt('<li><a notebookId="?">?</a></li>', notebook.NotebookId, Note._toHtmlEntity(notebook.Title))
 		}
 		body += "</ul>";
 
@@ -511,7 +511,7 @@ Notebook.changeNotebookNavForNewNote = function(notebookId, title) {
 	}
 
 	if(!Notebook.isAllNotebookId(notebookId) && !Notebook.isTrashNotebookId(notebookId)) {
-		$("#curNotebookForNewNote").html(title).attr("notebookId", notebookId);
+		$("#curNotebookForNewNote").text(title).attr("notebookId", notebookId);
 	} else if(!$("#curNotebookForNewNote").attr("notebookId")) {
 		// 但又没有一个笔记, 默认选第一个吧
 		// 这里很可能会死循环, 万一用户没有其它笔记呢?
@@ -555,7 +555,7 @@ Notebook.changeNotebookNav = function(notebookId) {
 	}
 
 	// 2
-	$("#curNotebookForListNote").html(notebook.Title);
+	$("#curNotebookForListNote").text(notebook.Title);
 
 	// 3
 	Notebook.changeNotebookNavForNewNote(notebookId, notebook.Title);

public/js/app/tag-min.js

@@ -1 +1 @@
-Tag.classes={"蓝色":"label label-blue","红色":"label label-red","绿色":"label label-green","黄色":"label label-yellow",blue:"label label-blue",red:"label label-red",green:"label label-green",yellow:"label label-yellow"};Tag.mapCn2En={"蓝色":"blue","红色":"red","绿色":"green","黄色":"yellow"};Tag.mapEn2Cn={blue:"蓝色",red:"红色",green:"绿色",yellow:"黄色"};Tag.t=$("#tags");Tag.getTags=function(){var tags=[];Tag.t.children().each(function(){var text=$(this).text();text=text.substring(0,text.length-1);text=Tag.mapCn2En[text]||text;tags.push(text)});return tags};Tag.clearTags=function(){Tag.t.html("")};Tag.renderTags=function(tags){Tag.t.html("");if(isEmpty(tags)){return}for(var i=0;i<tags.length;++i){var tag=tags[i];Tag.appendTag(tag)}};function revertTagStatus(){$("#addTagTrigger").show();$("#addTagInput").hide()}function hideTagList(event){$("#tagDropdown").removeClass("open");if(event){event.stopPropagation()}}function showTagList(event){$("#tagDropdown").addClass("open");if(event){event.stopPropagation()}}Tag.renderReadOnlyTags=function(tags){$("#noteReadTags").html("");if(isEmpty(tags)){$("#noteReadTags").html(getMsg("noTag"))}var i=true;function getNextDefaultClasses(){if(i){return"label label-default";i=false}else{i=true;return"label label-info"}}for(var i in tags){var text=tags[i];text=Tag.mapEn2Cn[text]||text;var classes=Tag.classes[text];if(!classes){classes=getNextDefaultClasses()}tag=tt('<span class="?">?</span>',classes,text);$("#noteReadTags").append(tag)}};Tag.appendTag=function(tag){var isColor=false;var classes,text;if(typeof tag=="object"){classes=tag.classes;text=tag.text;if(!text){return}}else{tag=$.trim(tag);text=tag;if(!text){return}var classes=Tag.classes[text];if(classes){isColor=true}else{classes="label label-default"}}if(LEA.locale=="zh"){text=Tag.mapEn2Cn[text]||text}tag=tt('<span class="?">?<i title="'+getMsg("delete")+'">X</i></span>',classes,text);$("#tags").children().each(function(){if(isColor){var tagHtml=$("<div></div>").append($(this).clone()).html();if(tagHtml==tag){$(this).remove()}}else if(text+"X"==$(this).text()){$(this).remove()}});$("#tags").append(tag);hideTagList();if(!isColor){reRenderTags()}};function reRenderTags(){var defautClasses=["label label-default","label label-info"];var i=0;$("#tags").children().each(function(){var thisClasses=$(this).attr("class");if(thisClasses=="label label-default"||thisClasses=="label label-info"){$(this).removeClass(thisClasses).addClass(defautClasses[i%2]);i++}})}Tag.renderTagNav=function(tags){tags=tags||[];for(var i in tags){var tag=tags[i];if(tag=="red"||tag=="blue"||tag=="yellow"||tag=="green"){continue}var text=Tag.mapEn2Cn[tag]||tag;var classes=Tag.classes[tag]||"label label-default";$("#tagNav").append(tt('<li data-tag="?"><a> <span class="?">?</span></li>',text,classes,text))}};$(function(){$("#addTagTrigger").click(function(){$(this).hide();$("#addTagInput").show().focus().val("")});$("#addTagInput").click(function(event){showTagList(event)});$("#addTagInput").blur(function(){var val=$(this).val();if(val){Tag.appendTag(val,true)}return;$("#addTagTrigger").show();$("#addTagInput").hide()});$("#addTagInput").keydown(function(e){if(e.keyCode==13){hideTagList();if($("#addTagInput").val()){$(this).trigger("blur");$("#addTagTrigger").trigger("click")}else{$(this).trigger("blur")}}});$("#tagColor li").click(function(event){var a;if($(this).attr("role")){a=$(this).find("span")}else{a=$(this)}Tag.appendTag({classes:a.attr("class"),text:a.text()})});$("#tags").on("click","i",function(){$(this).parent().remove();reRenderTags()});function searchTag(){var tag=$.trim($(this).data("tag"));Note.curChangedSaveIt();Note.clearAll();$("#tagSearch").html($(this).html()).show();showLoading();ajaxGet("/note/searchNoteByTags",{tags:[tag]},function(notes){hideLoading();if(notes){Note.renderNotes(notes);if(!isEmpty(notes)){Note.changeNote(notes[0].NoteId)}}})}$("#myTag .folderBody").on("click","li",searchTag);$("#minTagNav").on("click","li",searchTag)});
+Tag.classes={"蓝色":"label label-blue","红色":"label label-red","绿色":"label label-green","黄色":"label label-yellow",blue:"label label-blue",red:"label label-red",green:"label label-green",yellow:"label label-yellow"};Tag.mapCn2En={"蓝色":"blue","红色":"red","绿色":"green","黄色":"yellow"};Tag.mapEn2Cn={blue:"蓝色",red:"红色",green:"绿色",yellow:"黄色"};Tag.t=$("#tags");Tag.getTags=function(){var tags=[];Tag.t.children().each(function(){var text=$(this).text();text=text.substring(0,text.length-1);text=Tag.mapCn2En[text]||text;tags.push(text)});return tags};Tag.clearTags=function(){Tag.t.html("")};Tag.renderTags=function(tags){Tag.t.html("");if(isEmpty(tags)){return}for(var i=0;i<tags.length;++i){var tag=tags[i];Tag.appendTag(tag)}};function revertTagStatus(){$("#addTagTrigger").show();$("#addTagInput").hide()}function hideTagList(event){$("#tagDropdown").removeClass("open");if(event){event.stopPropagation()}}function showTagList(event){$("#tagDropdown").addClass("open");if(event){event.stopPropagation()}}Tag.renderReadOnlyTags=function(tags){$("#noteReadTags").html("");if(isEmpty(tags)){$("#noteReadTags").html(getMsg("noTag"))}var i=true;function getNextDefaultClasses(){if(i){return"label label-default";i=false}else{i=true;return"label label-info"}}for(var i in tags){var text=tags[i];text=Tag.mapEn2Cn[text]||text;var classes=Tag.classes[text];if(!classes){classes=getNextDefaultClasses()}tag=tt('<span class="?">?</span>',classes,Note._toHtmlEntity(text));$("#noteReadTags").append(tag)}};Tag.appendTag=function(tag){var isColor=false;var classes,text;if(typeof tag=="object"){classes=tag.classes;text=tag.text;if(!text){return}}else{tag=$.trim(tag);text=tag;if(!text){return}var classes=Tag.classes[text];if(classes){isColor=true}else{classes="label label-default"}}if(LEA.locale=="zh"){text=Tag.mapEn2Cn[text]||text}tag=tt('<span class="?">?<i title="'+getMsg("delete")+'">X</i></span>',classes,Note._toHtmlEntity(text));$("#tags").children().each(function(){if(isColor){var tagHtml=$("<div></div>").append($(this).clone()).html();if(tagHtml==tag){$(this).remove()}}else if(text+"X"==$(this).text()){$(this).remove()}});$("#tags").append(tag);hideTagList();if(!isColor){reRenderTags()}};function reRenderTags(){var defautClasses=["label label-default","label label-info"];var i=0;$("#tags").children().each(function(){var thisClasses=$(this).attr("class");if(thisClasses=="label label-default"||thisClasses=="label label-info"){$(this).removeClass(thisClasses).addClass(defautClasses[i%2]);i++}})}Tag.renderTagNav=function(tags){tags=tags||[];for(var i in tags){var tag=tags[i];if(tag=="red"||tag=="blue"||tag=="yellow"||tag=="green"){continue}var text=Note._toHtmlEntity(Tag.mapEn2Cn[tag]||tag);var classes=Tag.classes[tag]||"label label-default";$("#tagNav").append(tt('<li data-tag="?"><a> <span class="?">?</span></li>',text,classes,text))}};$(function(){$("#addTagTrigger").click(function(){$(this).hide();$("#addTagInput").show().focus().val("")});$("#addTagInput").click(function(event){showTagList(event)});$("#addTagInput").blur(function(){var val=$(this).val();if(val){Tag.appendTag(val,true)}return;$("#addTagTrigger").show();$("#addTagInput").hide()});$("#addTagInput").keydown(function(e){if(e.keyCode==13){hideTagList();if($("#addTagInput").val()){$(this).trigger("blur");$("#addTagTrigger").trigger("click")}else{$(this).trigger("blur")}}});$("#tagColor li").click(function(event){var a;if($(this).attr("role")){a=$(this).find("span")}else{a=$(this)}Tag.appendTag({classes:a.attr("class"),text:a.text()})});$("#tags").on("click","i",function(){$(this).parent().remove();reRenderTags()});function searchTag(){var tag=$.trim($(this).data("tag"));Note.curChangedSaveIt();Note.clearAll();$("#tagSearch").html($(this).html()).show();showLoading();ajaxGet("/note/searchNoteByTags",{tags:[tag]},function(notes){hideLoading();if(notes){Note.renderNotes(notes);if(!isEmpty(notes)){Note.changeNote(notes[0].NoteId)}}})}$("#myTag .folderBody").on("click","li",searchTag);$("#minTagNav").on("click","li",searchTag)});

public/js/app/tag.js

@@ -108,7 +108,7 @@ Tag.renderReadOnlyTags = function(tags) {
 		if(!classes) {
 			classes = getNextDefaultClasses();
 		}
-		tag = tt('<span class="?">?</span>', classes, text);
+		tag = tt('<span class="?">?</span>', classes, Note._toHtmlEntity(text));
 
 		$("#noteReadTags").append(tag);
 	}
@@ -144,7 +144,7 @@ Tag.appendTag = function(tag) {
 	if(LEA.locale == "zh") {
 		text = Tag.mapEn2Cn[text] || text;
 	}
-	tag = tt('<span class="?">?<i title="' + getMsg("delete") + '">X</i></span>', classes, text);
+	tag = tt('<span class="?">?<i title="' + getMsg("delete") + '">X</i></span>', classes, Note._toHtmlEntity(text));
 
 	// 避免重复
 	$("#tags").children().each(function() {
@@ -192,7 +192,7 @@ Tag.renderTagNav = function(tags) {
 		if(tag == "red" || tag == "blue" || tag == "yellow" || tag == "green") {
 			continue;
 		}
-		var text = Tag.mapEn2Cn[tag] || tag;
+		var text = Note._toHtmlEntity(Tag.mapEn2Cn[tag] || tag);
 		var classes = Tag.classes[tag] || "label label-default";
 		$("#tagNav").append(tt('<li data-tag="?"><a> <span class="?">?</span></li>', text, classes, text));
 	}