Project

General

Profile

« Previous | Next » 

Revision 7678

escape reserved XML characters when constructing a pathquery from user input (&). https://projects.ecoinformatics.org/ecoinfo/issues/3017

View differences:

lib/style/skins/sanparks/searchPathQuery.js
1
function encodeXML(theString) {
2
	return theString.replace(/&/g, '&')
3
		.replace(/</g, '&lt;')
4
		.replace(/>/g, '&gt;')
5
		.replace(/"/g, '&quot;');
6
}
7

  
1 8
function generateQueryString(organizationScope, anyValue, searchFields) {
9
	// make sure it is valid XML
10
	var searchTerm = encodeXML(anyValue);
11
	
2 12
	var queryString = ""; 
3 13
	queryString += "<pathquery version='1.2'>";
4 14
	queryString += "<returndoctype>metadata</returndoctype>";
......
31 41
		queryString += "<querygroup operator='UNION'>";
32 42
		for (var i = 0; i < searchFields.length; i++) {
33 43
			queryString += "<queryterm casesensitive='false' searchmode='contains'>";
34
			queryString += "<value>" + anyValue + "</value>";
44
			queryString += "<value>" + searchTerm + "</value>";
35 45
			queryString += "<pathexpr>" + searchFields[i] +"</pathexpr>";
36 46
			queryString += "</queryterm>";
37 47
		}
......
39 49
	}
40 50
	else {
41 51
		queryString += "<queryterm casesensitive='false' searchmode='contains'>";
42
		queryString += "<value>" + anyValue + "</value>";
52
		queryString += "<value>" + searchTerm + "</value>";
43 53
		queryString += "</queryterm>";
44 54
	}
45 55
	
lib/style/skins/parc/search.js
1
function encodeXML(theString) {
2
	return theString.replace(/&/g, '&amp;')
3
		.replace(/</g, '&lt;')
4
		.replace(/>/g, '&gt;')
5
		.replace(/"/g, '&quot;');
6
}
7

  
1 8
function trim(stringToTrim) {
2 9
    return stringToTrim.replace(/^\s*/, '').replace(/\s*$/,'');
3 10
}
4 11

  
5 12
function checkSearch(submitFormObj) {
6 13
    var searchString = trim(submitFormObj.searchstring.value);
14
	searchString = encodeXML(searchString);
7 15
    var checkBox = document.getElementById("searchAll");
8 16

  
9 17
    if (searchString=="") {
lib/style/skins/obfs/index.jsp
44 44
          src="<%=STYLE_COMMON_URL%>/branding.js"></script>
45 45
  <script language="Javascript">
46 46

  
47
		function encodeXML(theString) {
48
			return theString.replace(/&/g, '&amp;')
49
				.replace(/</g, '&lt;')
50
				.replace(/>/g, '&gt;')
51
				.replace(/"/g, '&quot;');
52
		}
53
		
47 54
        function trim(stringToTrim) {
48 55
                return stringToTrim.replace(/^\s*/, '').replace(/\s*$/,'');
49 56
        }
50 57

  
51 58
        function checkSearch(submitFormObj) {
52
                var searchString = trim(submitFormObj.searchstring.value);
53
		var checkBox = document.getElementById("searchAll");
59
        	var searchString = trim(submitFormObj.searchstring.value);
60
    		searchString = encodeXML(searchString);
61
			var checkBox = document.getElementById("searchAll");
54 62

  
55 63
                if (searchString=="") {
56 64
                       if (confirm("Show *all* data?")) {
lib/style/skins/nrs/index.jsp
44 44
          src="<%=STYLE_COMMON_URL%>/branding.js"></script>
45 45
  <script language="Javascript">
46 46

  
47
		function encodeXML(theString) {
48
			return theString.replace(/&/g, '&amp;')
49
				.replace(/</g, '&lt;')
50
				.replace(/>/g, '&gt;')
51
				.replace(/"/g, '&quot;');
52
		}
53
  
47 54
        function trim(stringToTrim) {
48 55
                return stringToTrim.replace(/^\s*/, '').replace(/\s*$/,'');
49 56
        }
50 57

  
51 58
        function checkSearch(submitFormObj) {
52
                var searchString = trim(submitFormObj.searchstring.value);
59
		var searchString = trim(submitFormObj.searchstring.value);
60
		searchString = encodeXML(searchString);
53 61
		var checkBox = document.getElementById("searchAll");
54 62

  
55 63
                if (searchString=="") {
lib/style/skins/saeon/searchPathQuery.js
1
function encodeXML(theString) {
2
	return theString.replace(/&/g, '&amp;')
3
		.replace(/</g, '&lt;')
4
		.replace(/>/g, '&gt;')
5
		.replace(/"/g, '&quot;');
6
}
7

  
1 8
function generateQueryString(organizationScope, anyValue, searchFields) {
9
	// make sure it is valid XML
10
	var searchTerm = encodeXML(anyValue);
11
	
2 12
	var queryString = ""; 
3 13
	queryString += "<pathquery version='1.2'>";
4 14
	queryString += "<returndoctype>metadata</returndoctype>";
......
31 41
		queryString += "<querygroup operator='UNION'>";
32 42
		for (var i = 0; i < searchFields.length; i++) {
33 43
			queryString += "<queryterm casesensitive='false' searchmode='contains'>";
34
			queryString += "<value>" + anyValue + "</value>";
44
			queryString += "<value>" + searchTerm + "</value>";
35 45
			queryString += "<pathexpr>" + searchFields[i] +"</pathexpr>";
36 46
			queryString += "</queryterm>";
37 47
		}
......
39 49
	}
40 50
	else {
41 51
		queryString += "<queryterm casesensitive='false' searchmode='contains'>";
42
		queryString += "<value>" + anyValue + "</value>";
52
		queryString += "<value>" + searchTerm + "</value>";
43 53
		queryString += "</queryterm>";
44 54
	}
45 55
	
lib/style/skins/esa/index.jsp
49 49
          src="<%=STYLE_COMMON_URL%>/branding.js"></script>
50 50
  <script language="Javascript">
51 51

  
52
  function encodeXML(theString) {
53
		return theString.replace(/&/g, '&amp;')
54
			.replace(/</g, '&lt;')
55
			.replace(/>/g, '&gt;')
56
			.replace(/"/g, '&quot;');
57
	}
52 58
	function trim(stringToTrim) {
53 59
                return stringToTrim.replace(/^\s*/, '').replace(/\s*$/,'');
54 60
        }
......
57 63
                var checkBox = document.getElementById("searchCheckBox");
58 64
                var searchBox = document.getElementById("searchBox");
59 65
                var searchString = trim(searchBox.value);
60

  
66
                searchString = encodeXML(searchString);
67
                
61 68
                if (searchString=="") {
62 69
                        searchString="%";
63 70
                }

Also available in: Unified diff