Fix some XSS issues

[rails.git] / app / views / site / index.html.erb

diff --git a/app/views/site/index.html.erb b/app/views/site/index.html.erb
index 84ffcbe59a52bc7885ceab7c0a4add179c80cdd9..242890e28df73c769f658c068db52abb98280b3e 100644 (file)
--- a/app/views/site/index.html.erb
+++ b/app/views/site/index.html.erb
@@ -18,7 +18,7 @@
 
 <div id="map">
   <div id="permalink">
-    <a href="/" id="permalinkanchor"><%= t 'site.index.permalink' %></a><br/>
+    <a href="/" id="permalinkanchor" class="geolink llz layers object"><%= t 'site.index.permalink' %></a><br/>
     <a href="/" id="shortlinkanchor"><%= t 'site.index.shortlink' %></a>
   </div>
 </div>
@@ -43,56 +43,62 @@
 </div>
 
 <%
-if params['mlon'] and params['mlat']
+if params[:mlon] and params[:mlat]
     marker = true
-    mlon = h(params['mlon'])
-    mlat = h(params['mlat'])
+    mlon = params[:mlon].to_f
+    mlat = params[:mlat].to_f
 end
 
-if params['node'] or params['way'] or params['relation']
+if params[:node] or params[:way] or params[:relation]
     object = true
     object_zoom = true
 
-    if params['node']
+    if params[:node]
         object_type = 'node'
-        object_id = h(params['node'])
-    elsif params['way']
+        object_id = params[:node].to_i
+    elsif params[:way]
         object_type = 'way'
-        object_id = h(params['way'])
-    elsif params['relation']
+        object_id = params[:way].to_i
+    elsif params[:relation]
         object_type = 'relation'
-        object_id = h(params['relation'])
+        object_id = params[:relation].to_i
     end
 end
 
 # Decide on a lat lon to initialise the map with. Various ways of doing this
-if params['minlon'] and params['minlat'] and params['maxlon'] and params['maxlat']
+if params[:bbox]
     bbox = true
-    minlon = h(params['minlon'])
-    minlat = h(params['minlat'])
-    maxlon = h(params['maxlon'])
-    maxlat = h(params['maxlat'])
-    layers = h(params['layers'])
-    box = true if params['box']=="yes"
+    minlon, minlat, maxlon, maxlat = params[:bbox].split(",").collect { |c| c.to_i }
+    layers = params[:layers]
+    box = true if params[:box] == "yes"
     object_zoom = false
-elsif params['lon'] and params['lat']
-    lon =  h(params['lon'])
-    lat =  h(params['lat'])
-    zoom =  h(params['zoom'] || '5')
-    layers = h(params['layers'])
+elsif params[:minlon] and params[:minlat] and params[:maxlon] and params[:maxlat]
+    bbox = true
+    minlon = params[:minlon].to_f
+    minlat = params[:minlat].to_f
+    maxlon = params[:maxlon].to_f
+    maxlat = params[:maxlat].to_f
+    layers = params[:layers]
+    box = true if params[:box]=="yes"
+    object_zoom = false
+elsif params[:lon] and params[:lat]
+    lon =  params[:lon].to_f
+    lat =  params[:lat].to_f
+    zoom =  params.fetch(:zoom, 5).to_i
+    layers = params[:layers]
     object_zoom = false
-elsif params['mlon'] and params['mlat']
-    lon = h(params['mlon'])
-    lat = h(params['mlat'])
-    zoom =  h(params['zoom'] || '12')
-    layers = h(params['layers'])
+elsif params[:mlon] and params[:mlat]
+    lon = params[:mlon].to_f
+    lat = params[:mlat].to_f
+    zoom =  params.fetch(:zoom, 12).to_i
+    layers = params[:layers]
     object_zoom = false
 elsif cookies.key?("_osm_location")
     lon,lat,zoom,layers = cookies["_osm_location"].split("|")
 elsif @user and !@user.home_lon.nil? and !@user.home_lat.nil?
     lon =  @user.home_lon
     lat =  @user.home_lat
-    zoom = '10'
+    zoom = 10
 else
     unless STATUS == :database_readonly or STATUS == :database_offline
       session[:location] = OSM::IPLocation(request.env['REMOTE_ADDR']) unless session[:location]
@@ -105,12 +111,12 @@ else
         maxlon = session[:location][:maxlon]
         maxlat = session[:location][:maxlat]
     else
-        lon =  '-0.1'
-        lat =  '51.5'
-        zoom =  h(params['zoom'] || '5')
+        lon =  -0.1
+        lat =  51.5
+        zoom =  params.fetch(:zoom, 5).to_i
     end
 
-    layers = h(params['layers'])
+    layers = params[:layers]
 end
 %>
 
@@ -120,7 +126,7 @@ end
 
 <%= render :partial => 'resize' %>
 
-<script type="text/javascript" defer="defer">
+<script type="text/javascript">
   var marker;
   var map;
 
@@ -142,15 +148,14 @@ end
         setMapExtent(bbox);
 
         <% if box %>
-          // IE requires Vector layers be initialised on page load, and not under deferred script conditions
-          Event.observe(window, 'load', function() { addBoxToMap(bbox) });
+          Event.observe(window, "load", function() { addBoxToMap(bbox) });
         <% end %>
       <% else %>
         var centre = new OpenLayers.LonLat(<%= lon %>, <%= lat %>);
         var zoom = <%= zoom %>;
 
-        <% if params['scale'] and params['scale'].length > 0 then %>
-          zoom = scaleToZoom(<%= params['scale'].to_f() %>);
+        <% if params[:scale] and params[:scale].length > 0 then %>
+          zoom = scaleToZoom(<%= params[:scale].to_f %>);
         <% end %>
 
         setMapCenter(centre, zoom);
@@ -174,8 +179,7 @@ end
         url += "/full";
       <% end %>
 
-      // IE requires Vector layers be initialised on page load, and not under deferred script conditions
-      Event.observe(window, 'load', function() { addObjectToMap(url, <%= object_zoom %>) });
+      Event.observe(window, "load", function() { addObjectToMap(url, <%= object_zoom %>) });
     <% end %>
 
     map.events.register("moveend", map, updateLocation);
@@ -263,10 +267,9 @@ end
     <% end %>
   }
 
-  mapInit();
-
-  Event.observe(window, "load", installEditHandler);
-  Event.observe(window, "load", handleResize);
+  document.observe("dom:loaded", mapInit);
+  document.observe("dom:loaded", installEditHandler);
+  document.observe("dom:loaded", handleResize);
 
   Event.observe(window, "resize", function() {
     var centre = map.getCenter();
@@ -277,7 +280,7 @@ end
     map.setCenter(centre, zoom);
   });
 
-  <% if params['action'] == 'export' %>
+  <% if params[:action] == 'export' %>
   <%= remote_function :url => { :controller => 'export', :action => 'start' } %>
   <% end %>
 </script>