HTML escape substituted parameter values to avoid injection attacks.

[rails.git] / app / views / site / _search.rhtml

diff --git a/app/views/site/_search.rhtml b/app/views/site/_search.rhtml
index 2b2fc6e31b49b76ea76eb5bdbde8db0bf1ed3c7d..bdfc2fb57a44df4382054f82d520ad7420d34f93 100644 (file)
--- a/app/views/site/_search.rhtml
+++ b/app/views/site/_search.rhtml
@@ -1,35 +1,52 @@
+<script type="text/javascript">
+<!--
+  function startSearch() {
+    updateSidebar("Search Results", "<p class='search_results_entry'>Searching...</p>");
+
+    $("search_field").style.display = "none";
+    $("search_active").style.display = "inline";
+  }
+
+  function endSearch() {
+    $("search_field").style.display = "inline";
+    $("search_active").style.display = "none";
+  }
+
+  function describeLocation() {
+    var position = getPosition();
+
+    <%= remote_function(:loading => "startSearch()",
+                        :complete => "endSearch()",
+                        :url => { :controller => :geocoder, :action => :description },
+                        :with => "'lat=' + position.lat + '&lon=' + position.lon") %>
+  }
+
+  <% if params[:query] %>
+  <%= remote_function(:loading => "startSearch()",
+                      :complete => "endSearch()",
+                      :url => { :controller => :geocoder, :action => :search, :query => h(params[:query]) }) %>
+  <% end %>
+// -->
+</script>
+
 <% content_for "optionals" do %>
   <div class="optionalbox">
     <span class="oboxheader">Search</span>
-    <% form_remote_tag(:update => :search_results_content, 
-                       :loading => "openSearchResults()",
-                       :url => { :controller => :geocoder, :action => :search } ) do %>
-      <%= text_field_tag :query, nil, :size => 16 %>
+    <span class="whereami"><a href="javascript:describeLocation()">Where am I?</a></span>
+    <div class="search_form">
+    <span id="search_field">
+    <% form_remote_tag(:loading => "startSearch()",
+                       :complete => "endSearch()",
+                       :url => { :controller => :geocoder, :action => :search }) do %>
+      <%= text_field_tag :query, h(params[:query]) %>
     <% end %>
+    </span>
+    <p id="search_active">Searching...</p>
+    </div>
+    <p class="search_help">
+      examples: 'Alkmaar', 'Regent Street, Cambridge', 'CB2 5AQ',
+      or 'post offices near Lünen'
+      <a href="http://wiki.openstreetmap.org/index.php/Search">more examples...</a>
+    </p>
   </div>
-  <script type="text/javascript">
-  <!--
-    function openSearchResults() {
-      $("search_results").style.display = "block";
-      $("search_results_content").innerHTML = "<p class='search_results_entry'>Searching...</p>";
-      <%= onopen %>
-    }
-
-    function closeSearchResults() {
-      $("search_results").style.display = "none";
-      <%= onclose %>
-    }
-  // -->
-  </script>
 <% end %>
-
-<div id="search_results">
-  <table class="search_results_title" width="100%">
-    <tr>
-      <td align="left">Search Results</td>
-      <td align="right"><a href="javascript:closeSearchResults()">Close</a></td>
-    </tr>
-  </table>
-  <div id="search_results_content">
-  </div>
-</div>