Prevent XSS attacks with wmd using the google-caja html sanitizer.

[osqa.git] / forum / skins / default / templates / answer_edit.html

diff --git a/forum/skins/default/templates/answer_edit.html b/forum/skins/default/templates/answer_edit.html
index 64142005ce85dc2f7ace484b2bd2259d0c67bc1b..3201dd26de651966b3c59b537a3f3a33f5ab650f 100644 (file)
--- a/forum/skins/default/templates/answer_edit.html
+++ b/forum/skins/default/templates/answer_edit.html
@@ -6,13 +6,15 @@
 {% block forejs %}
         <script type='text/javascript' src='{% media  "/media/js/wmd/showdown.js" %}'></script>
         <script type='text/javascript' src='{% media  "/media/js/wmd/wmd.js" %}'></script>
+        <script type='text/javascript' src='{% media  "/media/js/html_sanitizer.js" %}'></script>
         <link rel="stylesheet" type="text/css" href="{% media  "/media/js/wmd/wmd.css" %}" />
         <script type="text/javascript">
         
         $().ready(function(){
             $("#nav_questions").attr('className',"on");
             $('#editor').TextAreaResizer();
-                             
+
+
             //toggle preview of editor
             var display = true;
             var txt = "{% trans "hide preview" %}";
@@ -24,13 +26,35 @@
                 $('#pre-collapse').text(txt);
             });
 
-            
+
             $('#id_revision').unbind().change(function(){
                 $("#select_revision").click();
             });
-            
-            
+
+
+            answer = $("textarea#editor")[0].value;
         });
+
+
+        function submitClicked(e, f) {
+            if(!(browserTester('chrome') || browserTester('safari'))) {
+                $("input.submit")[0].disabled=true;
+                $("input.submit")[1].disabled=true;
+            }
+            window.removeEventListener('beforeunload', beforeUnload, true);
+            if (f) {
+                f.submit();
+            }
+        }
+
+        function beforeUnload(e) {
+            if($("textarea#editor")[0].value != answer) {
+                 return yourWorkWillBeLost(e);
+            }
+        }
+        window.addEventListener('beforeunload', beforeUnload, true);
+
+        var answer = "";
         </script>
 {% endblock %}
         
@@ -40,7 +64,8 @@
 </div>
 <div id="main-body" class="ask-body">
     <div id="askform">
-        <form id="fmedit" action="{% url edit_answer answer.id %}" method="post" >
+        <form id="fmedit" action="{% url edit_answer answer.id %}" method="post">
+            {% csrf_token %}
             <label for="id_revision" ><strong>{% trans "revision" %}:</strong></label> <br/> 
             {% if revision_form.revision.errors %}{{ revision_form.revision.errors.as_ul }}{% endif %}
             <div>
@@ -51,7 +76,14 @@
                 {{ form.text }}
                 <span class="form-error"></span>
                 <div class="preview-toggle"><span id="pre-collapse" 
-                                       title="{% trans "Toggle the real time Markdown editor preview" %}">{% trans "toggle preview" %}</span></div>
+                                       title="{% trans "Toggle the real time Markdown editor preview" %}">{% trans "toggle preview" %}</span>
+                           <span style="text-align: right; margin-left: 200px;" id="editor-metrics"></span>
+                               {% if settings.WIKI_ON %}
+                    <div style="float:right;">
+                        {{ form.wiki }} <span style="color:#000;cursor:help" title="{{form.wiki.help_text}}">{{ form.wiki.label_tag }} </span>
+                    </div>
+                    {% endif %}
+                </div>
                 <div id="previewer" class="wmd-preview"></div>
             </div>
             
@@ -60,8 +92,16 @@
             <div class="title-desc">
                 {{ form.summary.help_text }}
             </div>
-            <input type="submit" value="{% trans "Save edit" %}" class="submit" />
-            <input type="button" value="{% trans "Cancel" %}" class="submit" onclick="history.back(-1);" />
+            
+            {% if form.recaptcha %}
+            <div class="question-captcha">
+               {{ form.recaptcha.errors }}
+               {{ form.recaptcha }}
+            </div>
+            {% endif %}
+            
+            <input type="button" value="{% trans "Save edit" %}" class="submit" onclick="submitClicked(event, this.form)" />
+            <input type="button" value="{% trans "Cancel" %}" class="submit" onclick="submitClicked(event, this.form);history.back(-1);" />
         </form>
     </div>
 </div>