Project

General

Profile

« Previous | Next » 

Revision 7678

Added by ben leinfelder almost 11 years ago

escape reserved XML characters when constructing a pathquery from user input (&). https://projects.ecoinformatics.org/ecoinfo/issues/3017

View differences:

index.jsp
49 49 
          src="<%=STYLE_COMMON_URL%>/branding.js"></script>
50 50 
  <script language="Javascript">
51 51 

  		




  
  52
  
    
  function encodeXML(theString) {


  		




  
  53
  
    
		return theString.replace(/&/g, '&amp;')


  		




  
  54
  
    
			.replace(/</g, '&lt;')


  		




  
  55
  
    
			.replace(/>/g, '&gt;')


  		




  
  56
  
    
			.replace(/"/g, '&quot;');


  		




  
  57
  
    
	}


  		




  52
  58
  
    
	function trim(stringToTrim) {


  		




  53
  59
  
    
                return stringToTrim.replace(/^\s*/, '').replace(/\s*$/,'');


  		




  54
  60
  
    
        }


  		




  ......




  57
  63
  
    
                var checkBox = document.getElementById("searchCheckBox");


  		




  58
  64
  
    
                var searchBox = document.getElementById("searchBox");


  		




  59
  65
  
    
                var searchString = trim(searchBox.value);


  		




  60
  
  
    

  		




  
  66
  
    
                searchString = encodeXML(searchString);


  		




  
  67
  
    
                


  		




  61
  68
  
    
                if (searchString=="") {


  		




  62
  69
  
    
                        searchString="%";


  		




  63
  70
  
    
                }


  		












Also available in:  Unified diff