" + txt + "
"); - if (msg.getAttachmentType() != null) { - out.println(" "); - } - out.print(" "); - - out.print(" "); - out.print(""); - for (int i = 0; i < tags.size(); i++) { - if (i > 0) { - out.print(" "); - } - String taglink = StringUtils.EMPTY; - try { - taglink = "" + StringEscapeUtils.escapeHtml4(tags.get(i).getTag().getName()) + ""; - } catch (UnsupportedEncodingException e) { - } - int usagecnt = tags.get(i).getUsageCount(); - if (usagecnt <= max / 5 + min) { - out.print("" + taglink + ""); - } else if (usagecnt <= max / 5 * 2 + min) { - out.print(taglink); - } else if (usagecnt <= max / 5 * 3 + min) { - out.print("" + taglink + ""); - } else if (usagecnt <= max / 5 * 4 + min) { - out.print("" + taglink + ""); - } else { - out.print("" + taglink + ""); + model.addAttribute("visitor", visitor); + if (body == null) { + body = StringUtils.EMPTY; + } else { + if (body.length() > 4096) { + body = body.substring(0, 4096); } + body = StringEscapeUtils.escapeHtml4(body); } - out.println("
"); + model.addAttribute("body", body); + model.addAttribute("visitor", visitor); + model.addAttribute("tags", tagService.getUserTagStats(visitor.getUid()).stream() + .sorted((e1, e2) -> Integer.compare(e2.getUsageCount(), e1.getUsageCount())).map(t -> t.getTag().getName()).collect(Collectors.toList())); + return "views/post"; } @PostMapping("/post") - public void doPostMessage(HttpServletRequest request, HttpServletResponse response, @RequestParam(required = false) String img, + public String postResult(@RequestParam(required = false) String img, @RequestParam String body, - @RequestParam(required = false) MultipartFile attach) throws IOException { + @RequestParam(required = false, name = "tags") String tagsStr, + @RequestParam(required = false) MultipartFile attach, ModelMap model) throws IOException { com.juick.User visitor = UserUtils.getCurrentUser(); if (visitor.getUid() == 0) { - response.sendError(HttpServletResponse.SC_FORBIDDEN); - return; + throw new HttpForbiddenException(); } if (body == null || body.length() < 1 || body.length() > 4096) { - response.sendError(HttpServletResponse.SC_BAD_REQUEST); - return; + throw new HttpBadRequestException(); } body = body.replace("\r", StringUtils.EMPTY); - ListСообщение опубликовано
"); - out.println("Поделитесь своим новым постом в социальных сетях:
"); - if (crosspostService.getTwitterTokens(visitor.getUid()).isPresent()) { - out.println(""); - } - out.println(""); - out.println(""); - if (crosspostService.getFacebookToken(visitor.getUid()).isPresent()) { - out.println(""); - } - out.println(""); - out.println("Ссылка на сообщение: http://juick.com/" + mid + "
"); - out.println("Чтобы добавлять сообщения и комментарии, представьтесь.
"); - } - out.println("Теги:
+{{ tags(visitor.name, tags) }} +{% endblock %} +{% block "column" %} +{% endblock %} \ No newline at end of file diff --git a/juick-www/src/main/webapp/WEB-INF/views/post_success.html b/juick-www/src/main/webapp/WEB-INF/views/post_success.html new file mode 100644 index 00000000..dd96495f --- /dev/null +++ b/juick-www/src/main/webapp/WEB-INF/views/post_success.html @@ -0,0 +1,22 @@ +{% extends "layouts/content" %} +{% block content %} +Сообщение опубликовано
+Поделитесь своим новым постом в социальных сетях:
+{%if sharetwi | default('') is not empty %} + +{% endif %} + +{%if facebook | default('') is not empty %} + +{% endif %} +Ссылка на сообщение: {{ url | raw }}
+{% endblock %} +{% block "column" %} +{% include "views/partial/usercolumn" %} +{% endblock %} \ No newline at end of file diff --git a/juick-www/src/main/webapp/WEB-INF/views/test.html b/juick-www/src/main/webapp/WEB-INF/views/test.html new file mode 100644 index 00000000..7700be6f --- /dev/null +++ b/juick-www/src/main/webapp/WEB-INF/views/test.html @@ -0,0 +1,2 @@ +{% import "views/macros/tags" %} +{{ tags("ugnich", tagsList)}} \ No newline at end of file diff --git a/juick-www/src/test/java/com/juick/www/WebAppTests.java b/juick-www/src/test/java/com/juick/www/WebAppTests.java index 98df3660..d09bded2 100644 --- a/juick-www/src/test/java/com/juick/www/WebAppTests.java +++ b/juick-www/src/test/java/com/juick/www/WebAppTests.java @@ -22,6 +22,7 @@ import com.gargoylesoftware.htmlunit.WebClient; import com.gargoylesoftware.htmlunit.css.StyleElement; import com.gargoylesoftware.htmlunit.html.HtmlPage; import com.juick.Message; +import com.juick.Tag; import com.juick.User; import com.juick.configuration.MockDataConfiguration; import com.juick.server.configuration.BaseWebConfiguration; @@ -31,6 +32,10 @@ import com.juick.test.util.MockUtils; import com.juick.www.configuration.SapeConfiguration; import com.juick.www.configuration.WwwAppConfiguration; import com.juick.www.configuration.WwwServletConfiguration; +import com.mitchellbosecke.pebble.PebbleEngine; +import com.mitchellbosecke.pebble.error.PebbleException; +import com.mitchellbosecke.pebble.template.PebbleTemplate; +import org.apache.commons.text.StringEscapeUtils; import org.junit.Before; import org.junit.Test; import org.junit.runner.RunWith; @@ -44,9 +49,9 @@ import org.springframework.web.context.WebApplicationContext; import javax.inject.Inject; import java.io.IOException; -import java.util.Collections; -import java.util.List; -import java.util.Optional; +import java.io.StringWriter; +import java.io.Writer; +import java.util.*; import java.util.stream.Collectors; import java.util.stream.IntStream; import java.util.stream.StreamSupport; @@ -81,6 +86,9 @@ public class WebAppTests { @Inject MessagesService messagesService; + @Inject + PebbleEngine pebbleEngine; + @Before public void setup() { webClient = MockMvcWebClientBuilder.webAppContextSetup(this.wac).build(); @@ -176,6 +184,15 @@ public class WebAppTests { return display == null || !display.getValue().equals("none"); }).count(); assertThat(visibleItems, equalTo(1L)); - + } + @Test + public void correctTagsEscaping() throws PebbleException, IOException { + PebbleTemplate template = pebbleEngine.getTemplate("views/test"); + Writer writer = new StringWriter(); + template.evaluate(writer, + Collections.singletonMap("tagsList", + Collections.singletonList(StringEscapeUtils.escapeHtml4(new Tag(">_<").getName())))); + String output = writer.toString().trim(); + assertThat(output, equalTo(">_<")); } } -- cgit v1.2.3