From: Tom Hughes <tom@compton.nu>
Date: Fri, 10 Sep 2010 16:36:55 +0000 (+0100)
Subject: Escape ampersands in URLs when exporting HTML for embedding
X-Git-Tag: live~6297^2~7
X-Git-Url: https://git.openstreetmap.org/rails.git/commitdiff_plain/58b63dbc3dceab5cb3a9ada20de8e4a3f2049fac?ds=inline

Escape ampersands in URLs when exporting HTML for embedding
---

diff --git a/app/views/export/start.rjs b/app/views/export/start.rjs
index b7687d11b..abf9e671d 100644
--- a/app/views/export/start.rjs
+++ b/app/views/export/start.rjs
@@ -228,12 +228,12 @@ page << <<EOJ
   function htmlUrlChanged() {
     var bounds = new OpenLayers.Bounds($("minlon").value, $("minlat").value, $("maxlon").value, $("maxlat").value);
     var layerName = map.baseLayer.keyid;
-    var url = "http://#{SERVER_URL}/export/embed.html?bbox=" + bounds.toBBOX() + "&layer=" + layerName;
+    var url = "http://#{SERVER_URL}/export/embed.html?bbox=" + bounds.toBBOX() + "&amp;layer=" + layerName;
     var markerUrl = "";
 
     if ($("marker_lat").value && $("marker_lon").value) {
-      markerUrl = "&mlat=" + $("marker_lat").value + "&mlon=" + $("marker_lon").value;
-      url += "&marker=" + $("marker_lat").value + "," + $("marker_lon").value;
+      markerUrl = "&amp;mlat=" + $("marker_lat").value + "&amp;mlon=" + $("marker_lon").value;
+      url += "&amp;marker=" + $("marker_lat").value + "," + $("marker_lon").value;
     } 
     
     var html = '<iframe width="425" height="350" frameborder="0" scrolling="no" marginheight="0" marginwidth="0" src="'+url+'" style="border: 1px solid black"></iframe>';
@@ -248,7 +248,7 @@ page << <<EOJ
     
     var layers = getMapLayers();
 
-    html += '<br /><small><a href="http://#{SERVER_URL}/?lat='+center.lat+'&lon='+center.lon+'&zoom='+zoom+'&layers='+layers+markerUrl+'">'+"#{html_escape_unicode(I18n.t('export.start_rjs.view_larger_map'))}"+'</a></small>';
+    html += '<br /><small><a href="http://#{SERVER_URL}/?lat='+center.lat+'&amp;lon='+center.lon+'&amp;zoom='+zoom+'&amp;layers='+layers+markerUrl+'">'+"#{html_escape_unicode(I18n.t('export.start_rjs.view_larger_map'))}"+'</a></small>';
 
     $("export_html_text").value = html;