HTML escape substituted parameter values to avoid injection attacks.

[rails.git] / app / views / site / _search.rhtml

diff --git a/app/views/site/_search.rhtml b/app/views/site/_search.rhtml
index c874e180ccaa08bb7a3d36bef53ec0c6e4957e51..bdfc2fb57a44df4382054f82d520ad7420d34f93 100644 (file)
--- a/app/views/site/_search.rhtml
+++ b/app/views/site/_search.rhtml
@@ -1,26 +1,8 @@
-<div id="search_results">
-  <table class="search_results_title" width="100%">
-    <tr>
-      <td align="left" id="search_title">Search Results</td>
-      <td align="right"><a href="javascript:closeSearchResults()">Close</a></td>
-    </tr>
-  </table>
-  <div id="search_results_content">
-  </div>
-</div>
-
 <script type="text/javascript">
 <!--
-  function showKey() {
-    $("search_results").style.display = "block";
-    $("search_results_content").innerHTML = "<p><img src='images/keymapnik11.png' /></p>";
-    $("search_title").innerHTML = "Map key";
-       resizeMap();
-  }
-
   function startSearch() {
-    $("search_results_content").innerHTML = "<p class='search_results_entry'>Searching...</p>";
-    $("search_title").innerHTML = "Search Results";
+    updateSidebar("Search Results", "<p class='search_results_entry'>Searching...</p>");
+
     $("search_field").style.display = "none";
     $("search_active").style.display = "inline";
   }
@@ -30,16 +12,6 @@
     $("search_active").style.display = "none";
   }
 
-  function openSearchResults() {
-    $("search_results").style.display = "block";
-    <%= onopen %>
-  }
-
-  function closeSearchResults() {
-    $("search_results").style.display = "none";
-    <%= onclose %>
-  }
-
   function describeLocation() {
     var position = getPosition();
 
@@ -52,7 +24,7 @@
   <% if params[:query] %>
   <%= remote_function(:loading => "startSearch()",
                       :complete => "endSearch()",
-                      :url => { :controller => :geocoder, :action => :search, :query => params[:query] }) %>
+                      :url => { :controller => :geocoder, :action => :search, :query => h(params[:query]) }) %>
   <% end %>
 // -->
 </script>
@@ -66,7 +38,7 @@
     <% form_remote_tag(:loading => "startSearch()",
                        :complete => "endSearch()",
                        :url => { :controller => :geocoder, :action => :search }) do %>
-      <%= text_field_tag :query, params[:query] %>
+      <%= text_field_tag :query, h(params[:query]) %>
     <% end %>
     </span>
     <p id="search_active">Searching...</p>