From: Christian Weiske <cweiske@cweiske.de>
Date: Fri, 24 Oct 2014 05:39:12 +0000 (+0200)
Subject: make linking of notes with <speci"a'l> chars work
X-Git-Tag: v0.4.0~13
X-Git-Url: https://git.cweiske.de/grauphel.git/commitdiff_plain/93298095b3c4455aa1a4c676d6e2f9915ca06caa?ds=sidebyside

make linking of notes with <speci"a'l> chars work
---

diff --git a/README.rst b/README.rst
index 0e3113f..d9ef609 100644
--- a/README.rst
+++ b/README.rst
@@ -72,3 +72,14 @@ Home page
 __ http://apps.owncloud.com/content/show.php?action=content&content=166654
 __ http://git.cweiske.de/grauphel.git/
 __ https://github.com/cweiske/grauphel
+
+
+=================
+Development hints
+=================
+* JSON coming from Tomboy: Title is html-escaped already
+  (e.g. ``>`` is ``&gt;``).
+  We store it that way in the database, so there is no need to escape the
+  output.
+* ``latest-sync-revision`` sent from Tomboy during PUT sync is already
+  incremented by 1.
diff --git a/lib/notestorage.php b/lib/notestorage.php
index 7ecf049..0aeef9e 100644
--- a/lib/notestorage.php
+++ b/lib/notestorage.php
@@ -246,9 +246,13 @@ class NoteStorage
     }
 
     /**
-     * Load a GUID of a note by the note title
+     * Load a GUID of a note by the note title.
      *
-     * @param string  $title Note title
+     * The note title is stored html-escaped in the database because we
+     * get it that way from tomboy. Thus we have to escape the search
+     * input, too.
+     *
+     * @param string $title Note title.
      *
      * @return string GUID, NULL if note could not be found
      */
@@ -257,7 +261,7 @@ class NoteStorage
         $row = \OC_DB::executeAudited(
             'SELECT note_guid FROM `*PREFIX*grauphel_notes`'
             . ' WHERE `note_user` = ? AND `note_title` = ?',
-            array($this->username, $title)
+            array($this->username, htmlspecialchars($title))
         )->fetchRow();
 
         if ($row === false) {
diff --git a/templates/gui-note.php b/templates/gui-note.php
index a7e0587..296a0d2 100644
--- a/templates/gui-note.php
+++ b/templates/gui-note.php
@@ -6,7 +6,7 @@
 <script type="text/javascript" src="<?php p(OCP\Util::linkTo('grauphel','js/grauphel.js')); ?>"></script>
 
 <div id="app-content" class="content">
- <h1><?php p($_['note']->title); ?></h1>
+ <h1><?php echo ($_['note']->title); ?></h1>
  <p class="muted">
   Last modified:
   <?php p(\OCP\Util::formatDate(strtotime($_['note']->{'last-change-date'}))); ?>
diff --git a/templates/tag.php b/templates/tag.php
index 8c7eecc..850b034 100644
--- a/templates/tag.php
+++ b/templates/tag.php
@@ -18,7 +18,7 @@
     <?php foreach ($_['notes'] as $note) { ?>
      <tr id="note-<?php p($note['guid']); ?>">
       <td>
-       <a class="cellclick" href="<?php p(OCP\Util::linkToRoute('grauphel.gui.note', array('guid' => $note['guid']))); ?>"><?php p($note['title']); ?></a>
+       <a class="cellclick" href="<?php p(OCP\Util::linkToRoute('grauphel.gui.note', array('guid' => $note['guid']))); ?>"><?php echo ($note['title']); ?></a>
       </td>
       <td>
       </td>