From 2396f550688bf4d6e28dc3badb2e73bc2979b524 Mon Sep 17 00:00:00 2001
From: nowrep <nowrep@gmail.com>
Date: Sat, 14 Jul 2012 16:19:33 +0200
Subject: [PATCH] Speed Dial: Fixed issues with ' and " characters in input
 fields

closes #455
---
 CHANGELOG                        |  1 +
 src/lib/data/html/speeddial.html | 37 ++++++++++++++++++++++++--------
 src/lib/plugins/speeddial.cpp    | 26 ++++++++++++++++------
 src/lib/plugins/speeddial.h      |  3 +++
 4 files changed, 52 insertions(+), 15 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 5857a22c9..f9c095fc0 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -2,6 +2,7 @@ Version 1.3.1
     * not yet released
     * Ctrl+= shortcut for + zoom in webview
     * Ctrl+Enter shortcut in PIM plugin now also works with enter on numpad
+    * fixed ' and " chars in speed dial's input fields
     * fixed zooming with Ctrl+Wheel for some users
     * fixed issues with cookies filtering
     * fixed $subdocument matching in AdBlock
diff --git a/src/lib/data/html/speeddial.html b/src/lib/data/html/speeddial.html
index ce141096f..f9bd3cd87 100644
--- a/src/lib/data/html/speeddial.html
+++ b/src/lib/data/html/speeddial.html
@@ -3,7 +3,7 @@
 <title>%SITE-TITLE%</title>
 <link rel="icon" href="%FAVICON%" type="image/x-icon" />
 <style type="text/css" media="screen">
-body {background: #eeeeee url('%IMG_BACKGROUND%') no-repeat center center;background-size: %B_SIZE%;font: 13px/22px "Helvetica Neue", Helvetica, Arial, sans-serif;color: #525c66;}
+body {background: #eeeeee url("%IMG_BACKGROUND%") no-repeat center center;background-size: %B_SIZE%;font: 13px/22px "Helvetica Neue", Helvetica, Arial, sans-serif;color: #525c66;}
 body * {-webkit-user-select: none;font-size: 100%;line-height: 1.6;margin: 0px;}
 .add {position: absolute;right:10px;top:10px;width: 24px;height: 24px;background: url(%IMG_PLUS%); cursor: pointer;}
 
@@ -35,7 +35,7 @@ span.reload:hover {border-color: grey; border-radius: 4px;}
 #settingsBox {margin-left:auto;margin-right: auto;margin-top: 100px;width: 350px;height: auto;padding:0 8px;-webkit-border-image: url(%BOX-BORDER%) 25;-webkit-box-shadow: 0px 5px 80px #505050;border-radius:10px;border-width: 20px;}
 #settingsBox .content {margin-left:auto;margin-right:auto;padding-bottom:2px;border-bottom: 1px solid #888;}
 #settingsBox .thumbhold {margin-left:auto;margin-right:auto;margin-bottom: 5px;padding: 1px;border-radius: 10px;text-align:center;width:180px;height:100px;background: #AAA;}
-#settingsBox .thumbhold p {padding: 0;background: #eeeeee url('%IMG_BACKGROUND%') no-repeat center center;background-size: %B_SIZE%;width: 178px;height:98px;border-radius: 10px;position: relative;left: 1px;top: 1px;line-height:98px;cursor:default;}
+#settingsBox .thumbhold p {padding: 0;background: #eeeeee url("%IMG_BACKGROUND%") no-repeat center center;background-size: %B_SIZE%;width: 178px;height:98px;border-radius: 10px;position: relative;left: 1px;top: 1px;line-height:98px;cursor:default;}
 #settingsBox p label {margin: 2px;padding: 1px;text-align: center;}
 #settingsBox p select {margin: 2px;padding: 1px;text-align: center;width: auto;}
 #settingsBox p select option {text-align: center;}
@@ -65,6 +65,24 @@ var DIAL_WIDTH = %SD-SIZE%;
 
 var editingId = -1;
 
+function escapeTitle(title) {
+    title = title.replace(/"/g, '&quot;');
+    title = title.replace(/'/g, '&apos;');
+    return title;
+}
+
+function unescapeTitle(title) {
+    title = title.replace(/&quot;/g, '"');
+    title = title.replace(/&apos;/g, '\'');
+    return title;
+}
+
+function escapeUrl(url) {
+    url = url.replace(/"/g, '');
+    url = url.replace(/'/g, '');
+    return url;
+}
+
 function onRemoveClick(box) {
     removeBox($(box).index());
 }
@@ -94,7 +112,7 @@ function hideEditBox() {
 function onEditClick(box) {
     editingId = $(box).index();
     var boxUrl = $(box).children('a').first().attr('href');
-    var boxTitle = $(box).children('span').first().text();
+    var boxTitle = escapeTitle($(box).children('span').first().text());
     if (boxUrl === '')
         boxUrl = 'http://';
 
@@ -160,9 +178,10 @@ function allPages() {
     var titles = $('span[class="boxTitle"]');
     var value = "";
     $('div.entry').each(function(i) {
-        var url = $(this).children('a').first().attr('href').replace('"', '').replace(';','');
-        var title = $(this).children('span[class="boxTitle"]').first().text().replace('"', '').replace(';','');
-        value += 'url:"' + url + '"|title:"' + title + '";';
+        var url = $(this).children('a').first().attr('href');
+        var title = $(this).children('span[class="boxTitle"]').first().text();
+
+        value += 'url:"' + escapeUrl(url) + '"|title:"' + escapeTitle(title) + '";';
     });
 
     return value;
@@ -178,7 +197,7 @@ function addBox(url, title, img_source) {
     a.setAttribute('class', 'boxUrl');
     var span1 = document.createElement('span');
     span1.setAttribute('class', 'boxTitle');
-    span1.appendChild( document.createTextNode(title) );
+    span1.innerText = unescapeTitle(title);
     var span2 = document.createElement('span');
     span2.setAttribute('class', 'edit');
     span2.setAttribute('onClick', 'onEditClick(parentNode)');
@@ -331,7 +350,7 @@ function bgImgToggle() {
     BgImgSel.disabled = (check.checked ? false : true);
     BgImgHold.disabled = (check.checked ? false : true);
     BgImgSz.disabled = (check.checked ? false : true);
-    BgImgHold.value = (check.checked ? '%IMG_BACKGROUND%' : '');
+    BgImgHold.value = (check.checked ? "%IMG_BACKGROUND%" : '');
 }
 
 function sdSizeToggle() {
@@ -359,7 +378,7 @@ function bgImgUpdate() {
 
 $(document).ready(function () {
   $('#BgImgSelSiz').val('%B_SIZE%').attr('selected','selected');
-  var bgImg = '%IMG_BACKGROUND%';
+  var bgImg = "%IMG_BACKGROUND%";
   var sdSize = 'DIAL_WIDTH';
   bgImg == '' ? $('#BgImgToggle').prop('checked', false) : $('#BgImgToggle').prop('checked', true)
   sdSize == '231' ? $('#SdSizeToggle').prop('checked', false) : $('#SdSizeToggle').prop('checked', true)
diff --git a/src/lib/plugins/speeddial.cpp b/src/lib/plugins/speeddial.cpp
index 4eb0f668a..10f7d80c3 100644
--- a/src/lib/plugins/speeddial.cpp
+++ b/src/lib/plugins/speeddial.cpp
@@ -129,8 +129,8 @@ void SpeedDial::addPage(const QUrl &url, const QString &title)
     }
 
     Page page;
-    page.title = title;
-    page.url = url.toString();
+    page.title = escapeTitle(title);
+    page.url = escapeUrl(url.toString());
 
     m_webPages.append(page);
     m_regenerateScript = true;
@@ -283,12 +283,12 @@ QString SpeedDial::getOpenFileName()
         return image;
     }
 
-    return QUrl::fromLocalFile(image).toString();
+    return QUrl::fromLocalFile(image).toEncoded();
 }
 
 QString SpeedDial::urlFromUserInput(const QString &url)
 {
-    return QUrl::fromUserInput(url).toString().remove('\'');
+    return QUrl::fromUserInput(url).toString();
 }
 
 void SpeedDial::setBackgroundImage(const QString &image)
@@ -340,15 +340,29 @@ void SpeedDial::thumbnailCreated(const QPixmap &pixmap)
 
     cleanFrames();
     foreach(QWebFrame * frame, cleanFrames()) {
-        frame->evaluateJavaScript(QString("setImageToUrl('%1', '%2');").arg(url, fileName));
+        frame->evaluateJavaScript(QString("setImageToUrl('%1', '%2');").arg(escapeUrl(url), escapeTitle(fileName)));
         if (loadTitle) {
-            frame->evaluateJavaScript(QString("setTitleToUrl('%1', '%2');").arg(url, title));
+            frame->evaluateJavaScript(QString("setTitleToUrl('%1', '%2');").arg(escapeUrl(url), escapeTitle(title)));
         }
     }
 
     thumbnailer->deleteLater();
 }
 
+QString SpeedDial::escapeTitle(QString title) const
+{
+    title.replace('"', "&quot;");
+    title.replace('\'', "&apos;");
+    return title;
+}
+
+QString SpeedDial::escapeUrl(QString url) const
+{
+    url.remove('"');
+    url.remove('\'');
+    return url;
+}
+
 QList<QWebFrame*> SpeedDial::cleanFrames()
 {
     QList<QWebFrame*> list;
diff --git a/src/lib/plugins/speeddial.h b/src/lib/plugins/speeddial.h
index 228495f71..d0dec06d8 100644
--- a/src/lib/plugins/speeddial.h
+++ b/src/lib/plugins/speeddial.h
@@ -80,6 +80,9 @@ private slots:
     void thumbnailCreated(const QPixmap &pixmap);
 
 private:
+    QString escapeTitle(QString string) const;
+    QString escapeUrl(QString url) const;
+
     QList<QWebFrame*> cleanFrames();
     QString generateAllPages();