make linking of notes with <speci"a'l> chars work

diff --git a/README.rst b/README.rst
index 0e3113f3b28c46d6b45f01054aaf7b987ef4541d..d9ef609481f58c5f71fd44ca71428492330e44e9 100644 (file)
--- a/README.rst
+++ b/README.rst
@@ -72,3 +72,14 @@ Home page
 __ http://apps.owncloud.com/content/show.php?action=content&content=166654
 __ http://git.cweiske.de/grauphel.git/
 __ https://github.com/cweiske/grauphel
+
+
+=================
+Development hints
+=================
+* JSON coming from Tomboy: Title is html-escaped already
+  (e.g. ``>`` is ``>``).
+  We store it that way in the database, so there is no need to escape the
+  output.
+* ``latest-sync-revision`` sent from Tomboy during PUT sync is already
+  incremented by 1.

diff --git a/lib/notestorage.php b/lib/notestorage.php
index 7ecf049af02a21fb3e351201c65e4ebcc91d5995..0aeef9e63e86f30a5a27ef7f7446c9e3e6e1c611 100644 (file)
--- a/lib/notestorage.php
+++ b/lib/notestorage.php
@@ -246,9 +246,13 @@ class NoteStorage
     }
 
     /**
-     * Load a GUID of a note by the note title
+     * Load a GUID of a note by the note title.
      *
-     * @param string  $title Note title
+     * The note title is stored html-escaped in the database because we
+     * get it that way from tomboy. Thus we have to escape the search
+     * input, too.
+     *
+     * @param string $title Note title.
      *
      * @return string GUID, NULL if note could not be found
      */
@@ -257,7 +261,7 @@ class NoteStorage
         $row = \OC_DB::executeAudited(
             'SELECT note_guid FROM `*PREFIX*grauphel_notes`'
             . ' WHERE `note_user` = ? AND `note_title` = ?',
-            array($this->username, $title)
+            array($this->username, htmlspecialchars($title))
         )->fetchRow();
 
         if ($row === false) {

diff --git a/templates/gui-note.php b/templates/gui-note.php
index a7e05874e18bebd3210dcd4d6199de796150323e..296a0d283465e24d4c448645a3ff5cb69700993d 100644 (file)
--- a/templates/gui-note.php
+++ b/templates/gui-note.php
@@ -6,7 +6,7 @@
 <script type="text/javascript" src="<?php p(OCP\Util::linkTo('grauphel','js/grauphel.js')); ?>"></script>
 
 <div id="app-content" class="content">
- <h1><?php p($_['note']->title); ?></h1>
+ <h1><?php echo ($_['note']->title); ?></h1>
  <p class="muted">
   Last modified:
   <?php p(\OCP\Util::formatDate(strtotime($_['note']->{'last-change-date'}))); ?>

diff --git a/templates/tag.php b/templates/tag.php
index 8c7eecc2a4f8b0b98613ddc4b251b8b8b0361f43..850b03450289f7ea992ca7046368b36d497fa26d 100644 (file)
--- a/templates/tag.php
+++ b/templates/tag.php
@@ -18,7 +18,7 @@
     <?php foreach ($_['notes'] as $note) { ?>
      <tr id="note-<?php p($note['guid']); ?>">
       <td>
-       <a class="cellclick" href="<?php p(OCP\Util::linkToRoute('grauphel.gui.note', array('guid' => $note['guid']))); ?>"><?php p($note['title']); ?></a>
+       <a class="cellclick" href="<?php p(OCP\Util::linkToRoute('grauphel.gui.note', array('guid' => $note['guid']))); ?>"><?php echo ($note['title']); ?></a>
       </td>
       <td>
       </td>