HTML escape substituted parameter values to avoid injection attacks.

[rails.git] / app / views / site / _key.rhtml

diff --git a/app/views/site/_key.rhtml b/app/views/site/_key.rhtml
index 2d8f1bc762b7f7053c6ad14245be82a55424c6f7..3208900788dbe37421be3865245132d309137c89 100644 (file)
--- a/app/views/site/_key.rhtml
+++ b/app/views/site/_key.rhtml
@@ -5,8 +5,21 @@
 <script type="text/javascript">
 <!--
   function showKey() {
-    updateSidebar("Map key", "<p><img src='images/keymapnik11.png' /></p>");
-    openSidebar();
+    var zoomlevel = map.getZoom();
+
+    if (zoomlevel<7 )      { var imgname = 'keymapnik6.png'; }
+    else if (zoomlevel<12) { var imgname = 'keymapnik'+zoomlevel+'.png'; }
+    else                   { var imgname = 'keymapnik12.png'; }
+
+    updateSidebar("Map key", "<p><img src='images/"+imgname+"' /></p>");
+    openSidebar("210px");
+  }
+
+  function updateKey() {
+    if (sidebarOpen("Map key")) 
+    {
+      showKey();
+    }
   }
 // -->
 </script>