Prevent XSS attacks with wmd using the google-caja html sanitizer.

[osqa.git] / forum / skins / default / templates / ask.html

diff --git a/forum/skins/default/templates/ask.html b/forum/skins/default/templates/ask.html
index 2f2b92e1463cf16dd56a835a3bdb6047d141cf64..ec5b1a8e80d6ac2fd5fb38cd541f9bdc9a1beff9 100644 (file)
--- a/forum/skins/default/templates/ask.html
+++ b/forum/skins/default/templates/ask.html
@@ -1,11 +1,11 @@
 {% extends "base.html" %}
 <!-- template ask.html -->
-{% load i18n %}
-{% load extra_tags %}
+{% load i18n extra_tags extra_filters %}
 {% block title %}{% spaceless %}{% trans "Ask a question" %}{% endspaceless %}{% endblock %}
 {% block forejs %}
         <script type='text/javascript' src='{% media  "/media/js/wmd/showdown.js" %}'></script>
         <script type='text/javascript' src='{% media  "/media/js/wmd/wmd.js" %}'></script>
+        <script type='text/javascript' src='{% media  "/media/js/html_sanitizer.js" %}'></script>
         <link rel="stylesheet" type="text/css" href="{% media  "/media/js/wmd/wmd.css" %}" />
         <script type="text/html" id="question-summary-template">
             <div class="answer-summary">
@@ -34,29 +34,55 @@
             });
 
             //Tags autocomplete action
-               $("#id_tags").autocomplete("/matching_tags/", {
+               $("#id_tags").autocomplete("{% url matching_tags %}", {
                 minChars: 1,
                        matchContains: true,
-                max: 20,
+                max: 10,
                 multiple: true,
                 multipleSeparator: " ",
-                       /*formatItem: function(row, i, max) {
+                highlightItem: true,
+                scroll: true,
+                scrollHeight: 300,
+
+
+                       /*
+                       formatItem: function(row, i, max) {
                                return row.n + " ("+ row.c +")";
                        },
                 formatResult: function(row, i, max){
                     return row.n;
-                }*/
+                }
+                */
+
                 formatItem: function(row, i, max, value) {
-                    return row[1].split(".")[0] + " (" + row[1].split(".")[1] + ")";
+                    return row[1] + " (" + row[2] + ")";
                 },
 
                 formatResult: function(row, i, max, value){
-                    return row[0];
+                    return row[1];
                 }
 
             });
+
         });
 
+        function submitClicked(e, f) {
+            if(!(browserTester('chrome') || browserTester('safari'))) {
+                $("input.submit")[0].disabled=true;
+            }
+            window.removeEventListener('beforeunload', beforeUnload, true);
+            if (f) {
+                f.submit();
+            }
+        }
+
+        function beforeUnload(e) {
+            if($("input#id_title")[0].value != "" || $("textarea#editor")[0].value != "" || $("input#id_tags")[0].value != "") {
+                return yourWorkWillBeLost(e);
+            }
+        }
+        window.addEventListener('beforeunload', beforeUnload, true);
+
         var related_questions_url = "{% url related_questions %}";
         </script>
         <script src="{% media "/media/js/osqa.ask.js" %}" type="text/javascript"></script>
@@ -69,13 +95,14 @@
 <div id="main-body" class="ask-body">
     <div id="askform">
         <form id="fmask" action="" method="post" accept-charset="utf-8">
+            {% csrf_token %}
                        {% if not request.user.is_authenticated %}
             <div class="message">
                 <span class="strong big">{% trans "You are welcome to start submitting your question anonymously." %}</span>
                 <p>{% blocktrans %}
                     After submiting your question, you will be redirected to the login/signup page.
                     Your question will be saved in the current session and will be published after you login with your existing account,
-                    or signup for a new account{% endblocktrans %}{% if "ask" in settings.REQUIRE_EMAIL_VALIDATION_TO %}
+                    or signup for a new account{% endblocktrans %}{% if "ask"|contained_in:settings.REQUIRE_EMAIL_VALIDATION_TO %}
                     {% trans "and validate your email." %}{% else %}.{% endif %}</p>
             </div>
             {% else %}
@@ -103,6 +130,7 @@
                             <td>
                                 <span id="pre-collapse" title="{% trans "Toggle the real time Markdown editor preview" %}">{% trans "toggle preview" %}</span>
                             </td>
+                            <td style="text-align: right;" id="editor-metrics"></td>
                             {% if settings.WIKI_ON %}
                             <td class="tright">
                                 {{ form.wiki }} <span class="help_text" title="{{form.wiki.help_text}}">{{ form.wiki.label_tag }} </span>
@@ -122,10 +150,19 @@
                        <p class="title-desc">
                                {{ form.tags.help_text }}
                        </p>
-            {% if not request.user.is_authenticated %}
-            <input name="ask" type="submit" value="{% trans "Login/signup to post your question" %}" class="submit" />
+                       
+            {% if form.recaptcha %}
+            <div class="question-captcha" style="float: left">
+               {{ form.recaptcha.errors }}
+               {{ form.recaptcha }}
+            </div>
+            <div class="clear"></div>
+            {% endif %}
+                       
+            {% if not request.user.is_authenticated %}                                                                        
+            <input name="ask" type="button" value="{% trans "Login/signup to post your question" %}" class="submit" onclick="submitClicked(event, this.form)"/>
                        {% else %}
-            <input name="ask" type="submit" value="{% trans "Ask your question" %}" class="submit" />
+            <input name="ask" type="button" value="{% trans "Ask your question" %}" class="submit" onclick="submitClicked(event, this.form)"/>
             {% endif %}
         </form>
     </div>