diff options
| author | Andrew Dolgov <[email protected]> | 2008-04-18 06:13:00 +0100 |
|---|---|---|
| committer | Andrew Dolgov <[email protected]> | 2008-04-18 06:13:00 +0100 |
| commit | 06925d9e8502e544a98b7b2dacf618be9e34f25f (patch) | |
| tree | 08fb7deaec41b3adb0b60f9186d691be7792e248 | |
| parent | ae56f762746c1854acd326802cea7cc5f36244e7 (diff) | |
getArticleLink: add escaping; open_article_in_new_window: add error notifications (closes #202)
| -rw-r--r-- | functions.js | 9 | ||||
| -rw-r--r-- | modules/backend-rpc.php | 2 |
2 files changed, 10 insertions, 1 deletions
diff --git a/functions.js b/functions.js index 9e38e45b0..d30e6bee8 100644 --- a/functions.js +++ b/functions.js @@ -68,10 +68,15 @@ function open_article_callback(transport) { try { if (transport.responseXML) { + var link = transport.responseXML.getElementsByTagName("link")[0]; var id = transport.responseXML.getElementsByTagName("id")[0]; + debug("open_article_callback, received link: " + link); + if (link) { + debug("link url: " + link.firstChild.nodeValue); + window.open(link.firstChild.nodeValue, "_blank"); if (id) { @@ -80,7 +85,11 @@ function open_article_callback(transport) { window.setTimeout("toggleUnread(" + id + ", 0)", 100); } } + } else { + notify_error("Can't open article: received invalid article link"); } + } else { + notify_error("Can't open article: received invalid XML"); } } catch (e) { diff --git a/modules/backend-rpc.php b/modules/backend-rpc.php index 5a8452ea4..d7ebb5940 100644 --- a/modules/backend-rpc.php +++ b/modules/backend-rpc.php @@ -279,7 +279,7 @@ WHERE id = '$id' AND id = ref_id AND owner_uid = '".$_SESSION['uid']."'"); if (db_num_rows($result) == 1) { - $link = strip_tags(db_fetch_result($result, 0, "link")); + $link = htmlspecialchars(strip_tags(db_fetch_result($result, 0, "link"))); print "<rpc-reply><link>$link</link><id>$id</id></rpc-reply>"; } else { print "<rpc-reply><error>Article not found</error></rpc-reply>"; |