HTML escape substituted parameter values to avoid injection attacks.

[rails.git] / app / views / diary_entry / new.rhtml

diff --git a/app/views/diary_entry/new.rhtml b/app/views/diary_entry/new.rhtml
index c0ddaef2387268f7067e7aff96f664c4bff6c781..d93e3e0235170b9f8d7313c11c5febc526180cba 100644 (file)
--- a/app/views/diary_entry/new.rhtml
+++ b/app/views/diary_entry/new.rhtml
@@ -1,6 +1,6 @@
 <%= error_messages_for 'diary_entry' %>
 
-<% form_for :controller => 'diary_entry', :action => 'new' do |f| %>
+<% form_for :diary_entry do |f| %>
   <table>
     <tr valign="top">
       <th>Subject</th>
@@ -10,9 +10,62 @@
       <th>Body</th>
       <td><%= f.text_area :body, :cols => 80 %></td>
     </tr>
+    <tr valign="top">
+           <th>Location</th>
+           <td><a name="map"></a><div id="map" style="border: 1px solid black; position: relative; width : 90%; height : 300px; display: none;"></div>
+                 <span class="location">Latitude: <%= f.text_field :latitude, :size => 20, :id => "latitude" %> Longitude: <%= f.text_field :longitude, :size => 20, :id => "longitude" %></span> <a href="#map" id="usemap" onclick="document.getElementById('map').style.display = 'block'; document.getElementById('usemap').style.display = 'none';">use map</a> </td>
+         </tr>
     <tr>
       <th></th>
       <td><%= submit_tag 'Save' %></td>
     </tr>
   </table>
 <% end %>
+
+<% if @user.home_lat.nil? or @user.home_lon.nil? %>
+  <% lon = h(params['lon']) || '-0.1' %>
+  <% lat = h(params['lat']) || '51.5' %>
+  <% zoom = h(params['zoom']) || '4' %> 
+<% else %>
+  <% lon = @user.home_lon %>
+  <% lat = @user.home_lat %>
+  <% zoom = '12' %>
+<% end %>
+
+<script type="text/javascript" src="/openlayers/OpenLayers.js"></script>
+<%= javascript_include_tag 'map.js' %>
+
+<script type="text/javascript">
+  <!--
+  var marker;
+
+  function init(){
+    var centre = lonLatToMercator(new OpenLayers.LonLat(<%= lon %>, <%= lat %>));
+    var zoom = <%= zoom %>;
+
+    var map = createMap("map");
+
+    map.setCenter(centre, zoom);
+
+    map.events.register("click", map, setLocation);
+  }        
+
+  function setLocation( e ) { 
+    closeMapPopup();
+
+    var merc = map.getLonLatFromViewPortPx(e.xy);
+    var lonlat = mercatorToLonLat(merc);
+
+    document.getElementById('latitude').value = lonlat.lat;
+    document.getElementById('longitude').value = lonlat.lon;
+
+    if (marker) {
+      removeMarkerFromMap(marker);
+    }
+
+    marker = addMarkerToMap(merc, null, "Diary entry location");
+  }
+
+  window.onload = init;
+// -->
+</script>