Prevent XSS attacks with wmd using the google-caja html sanitizer.

[osqa.git] / forum / skins / default / templates / question.html

diff --git a/forum/skins/default/templates/question.html b/forum/skins/default/templates/question.html
index 4873d145f87d66083b2b0c597f2da866f3f29546..228285730fd1946d0fbfe269fd765e4b6d94d203 100644 (file)
--- a/forum/skins/default/templates/question.html
+++ b/forum/skins/default/templates/question.html
@@ -11,16 +11,24 @@
 {% block metadescription %}{{ question.meta_description }}{% endblock %}\r
 {% block metakeywords %}{{question.tagname_meta_generator}}{% endblock %}\r
 {% block meta %}\r
 {% block metadescription %}{{ question.meta_description }}{% endblock %}\r
 {% block metakeywords %}{{question.tagname_meta_generator}}{% endblock %}\r
 {% block meta %}\r

-        <link rel="canonical" href="{{settings.APP_URL}}{{question.get_absolute_url}}" />\r
+        <link rel="canonical" href="{{settings.APP_BASE_URL}}{{question.get_absolute_url}}" />\r

         <link rel="alternate" type="application/rss+xml" title="RSS" href="{{ question.get_absolute_url }}?type=rss">\r
 {% endblock %}\r
 {% block title %}{% spaceless %}{{ question.headline }}{% endspaceless %}{% endblock %}\r
 {% block forejs %}\r
         {% if not question.nis.closed %}\r
         <script type='text/javascript' src='{% media  "/media/js/osqa.question.js" %}'></script>\r
         <link rel="alternate" type="application/rss+xml" title="RSS" href="{{ question.get_absolute_url }}?type=rss">\r
 {% endblock %}\r
 {% block title %}{% spaceless %}{{ question.headline }}{% endspaceless %}{% endblock %}\r
 {% block forejs %}\r
         {% if not question.nis.closed %}\r
         <script type='text/javascript' src='{% media  "/media/js/osqa.question.js" %}'></script>\r

+        <script type='text/javascript' src='{% media  "/media/js/jquery.caret.js" %}'></script>\r

         <script type='text/javascript' src='{% media  "/media/js/wmd/showdown.js" %}'></script>\r
         <script type='text/javascript' src='{% media  "/media/js/wmd/wmd.js" %}'></script>\r
         <script type='text/javascript' src='{% media  "/media/js/wmd/showdown.js" %}'></script>\r
         <script type='text/javascript' src='{% media  "/media/js/wmd/wmd.js" %}'></script>\r

+        <script type='text/javascript' src='{% media  "/media/js/html_sanitizer.js" %}'></script>\r

         <link rel="stylesheet" type="text/css" href="{% media  "/media/js/wmd/wmd.css" %}" />\r
         <link rel="stylesheet" type="text/css" href="{% media  "/media/js/wmd/wmd.css" %}" />\r

+\r
+        {% if embed_youtube_videos %}\r
+        <script type='text/javascript' src='{% media  "/media/js/viewbox_min.js" %}'></script>\r
+        <script type='text/javascript' src='{% media  "/media/js/youtube.js" %}'></script>\r
+        <link rel="stylesheet" type="text/css" href="{% media  "/media/js/viewbox.css" %}" />\r
+        {% endif %}\r

         {% endif %}\r
 \r
         <script type="text/javascript">\r
         {% endif %}\r
 \r
         <script type="text/javascript">\r


@@ -146,7 +154,7 @@
   \r
                 {% for answer in answers.paginator.page %}\r
                     <a name="{{ answer.id }}"></a>\r
   \r
                 {% for answer in answers.paginator.page %}\r
                     <a name="{{ answer.id }}"></a>\r

-                    <div id="answer-container-{{ answer.id }}" class="answer {% post_classes answer %}">\r
+                    <div id="answer-container-{{ answer.id }}" class="answer {% post_classes answer %}{% ifequal answer.id focused_answer_id %} focusedAnswer{% endifequal %}">\r

                         <table style="width:100%;">\r
                             <tr>\r
                                 <td style="width:30px;vertical-align:top">\r
                         <table style="width:100%;">\r
                             <tr>\r
                                 <td style="width:30px;vertical-align:top">\r


@@ -179,6 +187,7 @@
                 </div>\r
             {% endif %}\r
         <form id="fmanswer" action="{% url answer question.id %}" method="post">\r
                 </div>\r
             {% endif %}\r
         <form id="fmanswer" action="{% url answer question.id %}" method="post">\r

+            {% csrf_token %}\r

             <div style="clear:both">\r
             </div>\r
             \r
             <div style="clear:both">\r
             </div>\r
             \r


@@ -239,13 +248,13 @@
                         </table>  \r
                     </div>\r
                     {{ answer.text.errors }}\r
                         </table>  \r
                     </div>\r
                     {{ answer.text.errors }}\r

-                    <div id="previewer" class="wmd-preview"></div>                    \r
+                    <div id="previewer" class="wmd-preview"></div>\r

                 </div>\r
                 </div>\r

-                \r
-                   {% if answer.captcha %}\r
+\r
+                   {% if answer.recaptcha %}\r

                    <div class="question-captcha" style="float: left;">\r
                    <div class="question-captcha" style="float: left;">\r

-                       {{ answer.captcha.errors }}\r
-                       {{ answer.captcha }}\r
+                       {{ answer.recaptcha.errors }}\r
+                       {{ answer.recaptcha }}\r

                    </div>\r
                    <div class="clear"></div>\r
                    {% endif %}\r
                    </div>\r
                    <div class="clear"></div>\r
                    {% endif %}\r