aboutsummaryrefslogtreecommitdiff
path: root/juick-www/src
diff options
context:
space:
mode:
Diffstat (limited to 'juick-www/src')
-rw-r--r--juick-www/src/main/java/com/juick/www/Discover.java3
-rw-r--r--juick-www/src/main/java/com/juick/www/Home.java3
-rw-r--r--juick-www/src/main/java/com/juick/www/NewMessage.java7
-rw-r--r--juick-www/src/main/java/com/juick/www/PageTemplates.java27
-rw-r--r--juick-www/src/main/java/com/juick/www/User.java9
-rw-r--r--juick-www/src/main/java/com/juick/www/Utils.java4
6 files changed, 17 insertions, 36 deletions
diff --git a/juick-www/src/main/java/com/juick/www/Discover.java b/juick-www/src/main/java/com/juick/www/Discover.java
index 1954aac9..4fd8c3b6 100644
--- a/juick-www/src/main/java/com/juick/www/Discover.java
+++ b/juick-www/src/main/java/com/juick/www/Discover.java
@@ -20,6 +20,7 @@ package com.juick.www;
import com.juick.server.AdsQueries;
import com.juick.server.MessagesQueries;
import com.juick.server.TagQueries;
+import org.apache.commons.lang3.StringEscapeUtils;
import org.springframework.jdbc.core.JdbcTemplate;
import javax.servlet.ServletException;
@@ -73,7 +74,7 @@ public class Discover {
int visitor_uid = visitor.getUID();
- String title = "*" + Utils.encodeHTML(paramTag.getName());
+ String title = "*" + StringEscapeUtils.escapeHtml4(paramTag.getName());
List<Integer> mids = MessagesQueries.getTag(sql, paramTag.TID, visitor_uid, paramBefore, (visitor_uid == 0) ? 40 : 20);
response.setContentType("text/html; charset=UTF-8");
diff --git a/juick-www/src/main/java/com/juick/www/Home.java b/juick-www/src/main/java/com/juick/www/Home.java
index e11ed6f4..462c47bb 100644
--- a/juick-www/src/main/java/com/juick/www/Home.java
+++ b/juick-www/src/main/java/com/juick/www/Home.java
@@ -19,6 +19,7 @@ package com.juick.www;
import com.juick.server.AdsQueries;
import com.juick.server.MessagesQueries;
+import org.apache.commons.lang3.StringEscapeUtils;
import org.springframework.jdbc.core.JdbcTemplate;
import javax.servlet.ServletException;
@@ -55,7 +56,7 @@ public class Home {
String paramShow = request.getParameter("show");
if (paramSearch != null) {
- title = "Поиск: " + Utils.encodeHTML(paramSearch);
+ title = "Поиск: " + StringEscapeUtils.escapeHtml4(paramSearch);
mids = MessagesQueries.getSearch(sql, sqlSearch, Utils.encodeSphinx(paramSearch), paramBefore);
} else if (paramShow == null) {
if (visitor.getUID() > 0) {
diff --git a/juick-www/src/main/java/com/juick/www/NewMessage.java b/juick-www/src/main/java/com/juick/www/NewMessage.java
index 56fe99cb..d45f1a4b 100644
--- a/juick-www/src/main/java/com/juick/www/NewMessage.java
+++ b/juick-www/src/main/java/com/juick/www/NewMessage.java
@@ -27,6 +27,7 @@ import com.juick.xmpp.extensions.JuickUser;
import com.juick.xmpp.extensions.Nickname;
import com.juick.xmpp.extensions.XOOB;
import net.coobird.thumbnailator.Thumbnails;
+import org.apache.commons.lang3.StringEscapeUtils;
import org.apache.commons.lang3.math.NumberUtils;
import org.springframework.jdbc.core.JdbcTemplate;
@@ -83,7 +84,7 @@ public class NewMessage {
if (body.length() > 4096) {
body = body.substring(0, 4096);
}
- body = Utils.encodeHTML(body);
+ body = StringEscapeUtils.escapeHtml4(body);
}
out.println("<p><textarea name=\"body\" class=\"newmessage\" rows=\"7\" cols=\"10\">" + body + "</textarea><br/>");
@@ -126,9 +127,9 @@ public class NewMessage {
}
String taglink = "";
try {
- taglink = "<a onclick=\"return addTag('" + Utils.encodeHTML(tags.get(i).getName()) + "')\" href=\"/" +
+ taglink = "<a onclick=\"return addTag('" + StringEscapeUtils.escapeHtml4(tags.get(i).getName()) + "')\" href=\"/" +
visitor.getUName() + "/?tag=" + URLEncoder.encode(tags.get(i).getName(), "utf-8") +
- "\" title=\"" + tags.get(i).UsageCnt + "\">" + Utils.encodeHTML(tags.get(i).getName()) + "</a>";
+ "\" title=\"" + tags.get(i).UsageCnt + "\">" + StringEscapeUtils.escapeHtml4(tags.get(i).getName()) + "</a>";
} catch (UnsupportedEncodingException e) {
}
int usagecnt = tags.get(i).UsageCnt;
diff --git a/juick-www/src/main/java/com/juick/www/PageTemplates.java b/juick-www/src/main/java/com/juick/www/PageTemplates.java
index be9a024c..5715acd3 100644
--- a/juick-www/src/main/java/com/juick/www/PageTemplates.java
+++ b/juick-www/src/main/java/com/juick/www/PageTemplates.java
@@ -22,6 +22,7 @@ import com.juick.Tag;
import com.juick.server.MessagesQueries;
import com.juick.server.TagQueries;
import com.juick.server.UserQueries;
+import org.apache.commons.lang3.StringEscapeUtils;
import org.springframework.jdbc.core.JdbcTemplate;
import org.springframework.util.StringUtils;
import ru.sape.Sape;
@@ -89,7 +90,7 @@ public class PageTemplates {
out.println("</ul></nav>");
out.print(" <div id=\"search\"><form action=\"/\"><input type=\"text\" name=\"search\" class=\"text\" placeholder=\"Поиск\"");
if (search != null) {
- out.print(" value=\"" + Utils.encodeHTML(search) + "\"");
+ out.print(" value=\"" + StringEscapeUtils.escapeHtml4(search) + "\"");
}
out.println("/></form></div>");
out.println(" <section id=\"headdiv\">");
@@ -135,7 +136,7 @@ public class PageTemplates {
public static String formatPopularTags(JdbcTemplate sql, int cnt) {
List<String> popularTags = TagQueries.getPopularTags(sql).stream()
- .map(t -> "<a href=\"/tag/" + URLEncoder.encode(t) + "\">" + Utils.encodeHTML(t) + "</a>").collect(Collectors.toList());
+ .map(t -> "<a href=\"/tag/" + URLEncoder.encode(t) + "\">" + StringEscapeUtils.escapeHtml4(t) + "</a>").collect(Collectors.toList());
return StringUtils.collectionToDelimitedString(popularTags, " ");
}
@@ -188,7 +189,7 @@ public class PageTemplates {
public static String formatTags(List<Tag> tags) {
String ret = "";
for (Tag tag : tags) {
- String tagName = tag.getName().replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+ String tagName = StringEscapeUtils.escapeHtml4(tag.getName());
try {
ret += " *<a href=\"/tag/" + URLEncoder.encode(tag.getName(), "utf-8") + "\"";
if (tag.UsageCnt < 2) {
@@ -202,26 +203,6 @@ public class PageTemplates {
return ret;
}
- public static String formatTags(List<String> tags, com.juick.User user) {
- String ret = "";
- for (String tag : tags) {
- tag = tag.replaceAll("<", "&lt;");
- tag = tag.replaceAll(">", "&gt;");
- try {
- ret += " *<a href=\"";
- if (user == null) {
- ret += "/tag/";
- } else {
- ret += "/" + user.getUName() + "/?tag=";
- }
- ret += URLEncoder.encode(tag, "utf-8") + "\">" + tag + "</a>";
- } catch (UnsupportedEncodingException e) {
- }
- }
-
- return ret;
- }
-
public static String formatDate(int minutes, Date fulldate) {
if (minutes < 1) {
return "сейчас";
diff --git a/juick-www/src/main/java/com/juick/www/User.java b/juick-www/src/main/java/com/juick/www/User.java
index 29218d0a..967d06c7 100644
--- a/juick-www/src/main/java/com/juick/www/User.java
+++ b/juick-www/src/main/java/com/juick/www/User.java
@@ -21,6 +21,7 @@ import com.juick.Tag;
import com.juick.server.MessagesQueries;
import com.juick.server.TagQueries;
import com.juick.server.UserQueries;
+import org.apache.commons.lang3.StringEscapeUtils;
import org.springframework.jdbc.core.JdbcTemplate;
import javax.servlet.ServletException;
@@ -89,10 +90,10 @@ public class User {
String title;
if (paramShow == null) {
if (paramTag != null) {
- title = "Блог " + user.getUName() + ": *" + Utils.encodeHTML(paramTag.getName());
+ title = "Блог " + user.getUName() + ": *" + StringEscapeUtils.escapeHtml4(paramTag.getName());
mids = MessagesQueries.getUserTag(sql, user.getUID(), paramTag.TID, privacy, paramBefore);
} else if (paramSearch != null) {
- title = "Блог " + user.getUName() + ": " + Utils.encodeHTML(paramSearch);
+ title = "Блог " + user.getUName() + ": " + StringEscapeUtils.escapeHtml4(paramSearch);
mids = MessagesQueries.getUserSearch(sql, sqlSearch, user.getUID(), Utils.encodeSphinx(paramSearch), privacy, paramBefore);
} else {
title = "Блог " + user.getUName();
@@ -132,7 +133,7 @@ public class User {
if (paramTag != null) {
out.println("<p class=\"page\"><a href=\"/tag/" +
URLEncoder.encode(paramTag.getName(), "UTF-8") + "\">← Все записи с тегом <b>" +
- Utils.encodeHTML(paramTag.getName()) + "</b></a></p>");
+ StringEscapeUtils.escapeHtml4(paramTag.getName()) + "</b></a></p>");
}
PageTemplates.printMessages(out, sql, user, mids, visitor, visitor.getUID() == 0 ? 4 : 5, 0);
@@ -328,7 +329,7 @@ public class User {
String ret = "";
int count = cnt > 0 ? Math.min(tags.size(), cnt) : tags.size();
for (int i = 0; i < count; i++) {
- String tag = Utils.encodeHTML(tags.get(i).getName());
+ String tag = StringEscapeUtils.escapeHtml4(tags.get(i).getName());
try {
tag = "<a href=\"./?tag=" + URLEncoder.encode(tags.get(i).getName(), "UTF-8") + "\" title=\""
+ tags.get(i).UsageCnt + "\" rel=\"nofollow\">" + tag + "</a>";
diff --git a/juick-www/src/main/java/com/juick/www/Utils.java b/juick-www/src/main/java/com/juick/www/Utils.java
index 24f78a1c..26e938a7 100644
--- a/juick-www/src/main/java/com/juick/www/Utils.java
+++ b/juick-www/src/main/java/com/juick/www/Utils.java
@@ -130,10 +130,6 @@ public class Utils {
}
}
- public static String encodeHTML(String str) {
- return str.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("'", "&apos;").replaceAll("\"", "&quot;").replaceAll("\n", "&#10;");
- }
-
public static String encodeSphinx(String str) {
return str.replaceAll("@", "\\\\@");
}