escaping urls

handlers/content.go

@@ -5,6 +5,7 @@ import (
	"html/template"
	"log"
	"net/http"
	"net/url"
	"time"
	"code.revolvingcow.com/revolvingcow/loop/account"
@@ -69,12 +70,16 @@ func ContentCreateHandler(w http.ResponseWriter, r *http.Request) {
	vars := mux.Vars(r)
	title := vars["title"]
	if title != "" {
		title, err = url.QueryUnescape(title)
		if err != nil {
			http.Error(w, err.Error(), http.StatusInternalServerError)
		}
		account.Add(title, "document.md", []byte{})
	} else {
		http.Redirect(w, r, account.Username, http.StatusSeeOther)
	}
	http.Redirect(w, r, "/"+account.Username+"/edit/"+title, http.StatusSeeOther)
	http.Redirect(w, r, "/"+account.Username+"/edit/"+url.QueryEscape(title), http.StatusSeeOther)
}
// ContentReadHandler reads a document in the user context.
@@ -94,6 +99,10 @@ func ContentReadHandler(w http.ResponseWriter, r *http.Request) {
		http.Error(w, "No title given", http.StatusInternalServerError)
		return
	}
	title, err = url.QueryUnescape(title)
	if err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
	}
	contents, err := account.Read(title)
	if err != nil {
@@ -128,6 +137,11 @@ func ContentPreviewHandler(w http.ResponseWriter, r *http.Request) {
	vars := mux.Vars(r)
	title := vars["title"]
	title, err = url.QueryUnescape(title)
	if err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
	}
	contents := r.FormValue("contents")
	if contents == "" {
		contents, _ = account.Read(title)
@@ -162,6 +176,10 @@ func ContentUpdateHandler(w http.ResponseWriter, r *http.Request) {
		http.Error(w, "No title given", http.StatusInternalServerError)
		return
	}
	title, err = url.QueryUnescape(title)
	if err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
	}
	contents := r.FormValue("contents")
	if contents == "" {
@@ -194,6 +212,10 @@ func ContentDeleteHandler(w http.ResponseWriter, r *http.Request) {
		http.Error(w, "No title given", http.StatusInternalServerError)
		return
	}
	title, err = url.QueryUnescape(title)
	if err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
	}
	account.Remove(title)
	http.Redirect(w, r, "/"+account.Username, http.StatusSeeOther)

html/workspace.html

@@ -72,6 +72,7 @@
{{ end }}
{{ define "content" }}
    <div class="row">
        <div id="left-pane" class="col s4 m4 l2">
            <div class="row">
                <div class="col s12">
@@ -91,7 +92,7 @@
                        {{ range $d := .Directories }}
                            <li class="collection-item avatar dismissable">
                                <i class="mdi-file-folder circle"></i>
                                <span class="title"><a href="/{{ $.Username }}/edit/{{ $d }}">{{ $d }}</a></span>
                                <span class="title"><a href="/{{ $.Username }}/edit/{{ $d | urlquery }}">{{ $d }}</a></span>
                                <p><!--(3 files)--></p>
                                <a href="#" class="secondary-content"><i class="mdi-action-grade"></i></a>
                            </li>
@@ -100,6 +101,7 @@
                </div>
            </div>
        </div>
        <div id="workarea" class="col s8 m8 l10">
            <div class="fixed-action-btn" style="bottom: 45px; right: 24px;">
                <a id="create" class="btn-floating btn-large red" title="Edit">
@@ -128,7 +130,7 @@
                    </div>
                    <div class="col s12 m12 l12"><h4>{{ .Title }}</h4></div>
                    <pre id="editor" class="col s12 m12 l12">{{ .Content }}</pre>
                    <iframe id="view" class="col s12 m12 l12" style="display: none;" frameBorder="0" seamless="seamless" src="/{{ .Username }}/edit/{{ .Title }}/preview"></iframe>
                    <iframe id="view" class="col s12 m12 l12" style="display: none;" frameBorder="0" seamless="seamless" src="/{{ .Username }}/edit/{{ .Title | urlquery }}/preview"></iframe>
                </div>
            {{ else }}
                <div class="row">
@@ -139,6 +141,7 @@
            {{ end }}
        </div>
    </div>
    <div class="row">
        <div class="col s12">
            <div id="upload-area" class="modal bottom-sheet">
@@ -161,6 +164,7 @@
            </div>
        </div>
    </div>
    <div id="modal-new-directory" class="modal">
        <div class="modal-content">
            <h4>New Content</h4>
@@ -341,14 +345,15 @@
                });
            });
            $('form#new-directory').submit(function (event) {
                var title = $('input#title').val();
                var action = $(this).attr('action');
                $(this).attr('action', action + encodeURIComponent(title));
                return true;
            });
            $('a#new').click(function (event) {
                event.preventDefault();
                var title = $('input#title').val();
                var form = $('form#new-directory');
                form.attr('action', form.attr('action') + title);
                form.submit();
                $('form#new-directory').submit();
                return false;
            });