Index: openacs-4/packages/xowiki/tcl/includelet-procs.tcl =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/xowiki/tcl/includelet-procs.tcl,v diff -u -N -r1.200 -r1.201 --- openacs-4/packages/xowiki/tcl/includelet-procs.tcl 20 Jul 2015 10:07:57 -0000 1.200 +++ openacs-4/packages/xowiki/tcl/includelet-procs.tcl 7 Aug 2017 23:48:30 -0000 1.201 @@ -38,15 +38,17 @@ if {$ajaxhelper} { ::xo::Page requireCSS "/resources/ajaxhelper/yui/$path" } else { - ::xo::Page requireCSS "http://yui.yahooapis.com/$version/build/$path" + ::xo::Page requireCSS "//yui.yahooapis.com/$version/build/$path" + security::csp::require style-src yui.yahooapis.com } } ::xowiki::Includelet proc require_YUI_JS {{-version 2.7.0} {-ajaxhelper true} path} { if {$ajaxhelper} { ::xo::Page requireJS "/resources/ajaxhelper/yui/$path" } else { - ::xo::Page requireJS "http://yui.yahooapis.com/$version/build/$path" + ::xo::Page requireJS "//yui.yahooapis.com/$version/build/$path" + security::csp::require script-src yui.yahooapis.com } } @@ -194,21 +196,20 @@ set and_names [list] foreach cid_and [split $cid_or ,] { if {![string is integer -strict $cid_and]} { - return -code error "invalid category id '$cid_and'" - ns_log warning "ignore invalid category id '$cid_and'" - continue + ad_return_complaint 1 "invalid category id '[ns_quotehtml $cid_and]'" + ad_script_abort } lappend and_names [::category::get_name $cid_and] lappend ands "exists (select 1 from category_object_map \ where object_id = $item_ref and category_id = $cid_and)" } - lappend or_names "[join $and_names { and }]" + lappend or_names [join $and_names { and }] lappend ors "([join $ands { and }])" } if {$ors eq "()"} { set cnames "" } else { - set cnames "[join $or_names { or }]" + set cnames [join $or_names { or }] set extra_where_clause "and ([join $ors { or }])" } #my log "--cnames $category_spec -> $cnames // <$extra_where_clause>" @@ -441,7 +442,7 @@ set html [next] set localized_title [::xo::localize $title] set link [expr {[string match "*:*" $name] ? - "[ns_quotehtml $localized_title]" : + "[ns_quotehtml $localized_title]" : $localized_title}] ::xo::render_localizer return [subst [[self class] set template]] @@ -461,7 +462,7 @@ set localized_title [::xo::localize $title] set edit_button [my include [list edit-item-button -book_mode true]] set link [expr {[string match "*:*" $name] ? - "[ns_quotehtml $localized_title]" : + "[ns_quotehtml $localized_title]" : $localized_title}] return [subst [[self class] set template]] } -set template {
[join $entries {, }]\n" : + "
[join $entries {, }]\n" : ""}] } @@ -1398,8 +1409,8 @@ set save_tag_link [$package_id make_link -link $p_link $__including_page \ save-tags return_url] set popular_tags_link [$package_id make_link -link $p_link $__including_page \ - popular-tags return_url weblog_page] - + popular-tags] + set tags [lsort [::xowiki::Page get_tags -user_id [::xo::cc user_id] \ -item_id [$__including_page item_id] -package_id $package_id]] set entries [list] @@ -1410,16 +1421,27 @@ } set tags_with_links [join [lsort $entries] {, }] - if {![my exists id]} {my set id [::xowiki::Includelet html_id [self]]} - set content [subst -nobackslashes { + if {![my exists id]} { + my set id [::xowiki::Includelet html_id [self]] + } + set content [subst { #xowiki.your_tags_label#: $tags_with_links - (#xowiki.edit_link#, - #xowiki.popular_tags_link#) + (#xowiki.edit_link#, + #xowiki.popular_tags_link#)
- Create Form from Content + Create Form from Content
}] + template::add_event_listener \ + -id $id-control \ + -script [subst {document.getElementById("$id").style.display="inline";}] + return $inner_html$save_form } } @@ -2457,9 +2491,10 @@ #