HTML escape substituted parameter values to avoid injection attacks.

[rails.git] / app / views / site / edit.rhtml

diff --git a/app/views/site/edit.rhtml b/app/views/site/edit.rhtml
index d21d1a0e856b2386f6462a98b9f806c37fbda6b0..16c2ef3f27ef835e6790df60d4df50857ed57b62 100644 (file)
--- a/app/views/site/edit.rhtml
+++ b/app/views/site/edit.rhtml
@@ -1,21 +1,102 @@
-note that this copy of potlatch is coming off of richards dev account and isn't speaking to your local API as it hasn't been integrated yet.<br>
-FIXME integrate potlatch properly.
+<% if API_STATUS == :offline %>
+<p>The OpenStreetMap database is currently offline while
+   essential database maintenance work is carried out.
+</p>
+<% elsif API_STATUS == :readonly %>
+<p>The OpenStreetMap database is currently in read-only mode while
+   essential database maintenance work is carried out.
+</p>
+<% elsif !@user.data_public? %>
+<p>You haven't set your edits to be public.</p>
+<p>You can't use the online editor unless you do so. You can set your edits as public from your 
+<%= link_to 'user page', {:controller => 'user', :action => 'account', :display_name => @user.display_name}%>.</p>
+<p>(<a href="http://wiki.openstreetmap.org/index.php/Disabling_anonymous_edits">Find out why this is the case.</a>)</p>
+<% else %>
+<% content_for :greeting do %>
+<% if @user and !@user.home_lon.nil? and !@user.home_lat.nil? %>
+<%= link_to_function 'home', "setPosition(#{@user.home_lat}, #{@user.home_lon}, 10)" %> |
+<% end %>
+<% end %>

 
 

-<div id="mapcontent">Sorry, you need a Flash player to use Potlatch, the
+<%= render :partial => 'sidebar', :locals => { :onopen => "resizeMap();", :onclose => "resizeMap();" } %>
+<%= render :partial => 'search' %>
+
+<% session[:token] = @user.tokens.create.token unless session[:token] %>
+
+<% if params['mlon'] and params['mlat'] %>
+<% lon =  h(params['mlon']) %>
+<% lat =  h(params['mlat'])  %>
+<% zoom =  h(params['zoom']) || '12' %>
+<% elsif @user and params['lon'].nil? and params['lat'].nil? %> 
+<% lon =  @user.home_lon %>
+<% lat =  @user.home_lat %>
+<% zoom = '12' %>
+<%else%>
+<% lon =  h(params['lon']) || '-0.1' %>
+<% lat =  h(params['lat']) || '51.5' %>
+<% zoom =  h(params['zoom']) || '12' %>
+<% end %>
+
+<div id="map">You need a Flash player to use Potlatch, the

     OpenStreetMap Flash editor. You can <a href="http://www.adobe.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash">download Flash Player from Adobe.com</a>.
 
     OpenStreetMap Flash editor. You can <a href="http://www.adobe.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash">download Flash Player from Adobe.com</a>.
 

-    <a href="http://wiki.openstreetmap.org/index.php/Editing">Several other options</a> are also available 
-    for editing OpenStreetMap.</div>
-  <script type="text/javascript" src="http://richard.dev.openstreetmap.org/potlatch/swfobject.js"></script>
-  <script type="text/javascript">
-    var fo = new SWFObject("http://richard.dev.openstreetmap.org/potlatch/potlatch.swf", "potlatch", "700", "600", "6", "#FFFFFF");
-    function doSWF(lat,lon,sc) {
-      fo.addVariable('lat',lat);
-      fo.addVariable('long',lon);
-      fo.addVariable('scale',sc);
-      fo.addVariable('token','tokenstring');
-      fo.write("mapcontent");
+    <a href="http://wiki.openstreetmap.org/index.php/Editing">Several other options</a> are also available
+    for editing OpenStreetMap.
+</div>
+<script type="text/javascript" src="/javascripts/swfobject.js"></script>
+<script type="text/javascript">
+  var brokenContentSize = $("content").offsetWidth == 0;
+  var fo = new SWFObject("/potlatch/potlatch.swf?d="+Math.round(Math.random()*1000), "potlatch", "700", "600", "6", "#FFFFFF");
+
+  function doSWF(lat,lon,sc) {
+    if (sc < 11) sc = 11;
+    fo.addVariable('lat',lat);
+    fo.addVariable('long',lon);
+    fo.addVariable('scale',sc);
+    fo.addVariable('token','<%= session[:token] %>');
+    <% if params['gpx'] %>
+    fo.addVariable('gpx','<%= h(params['gpx']) + "/data" %>');
+    <% end %>
+    fo.write("map");
+  }
+
+  doSWF(<%= lat %>,<%= lon %>,<%= zoom %>);
+
+  function setPosition(lat, lon, zoom) {
+    doSWF(lat, lon, zoom);
+  }
+
+  function resizeContent() {
+    var content = $("content");
+    var rightMargin = parseInt(getStyle(content, "right"));
+    var bottomMargin = parseInt(getStyle(content, "bottom"));
+
+    content.style.width = document.documentElement.clientWidth - content.offsetLeft - rightMargin;
+    content.style.height = document.documentElement.clientHeight - content.offsetTop - bottomMargin;
+  }
+  
+  function resizeMap() {
+    var sidebar_width = $("sidebar").offsetWidth;
+
+    if (sidebar_width > 0) {
+      sidebar_width = sidebar_width + 5

     }
     }

-    doSWF(52.2,-2.2,12);
+
+    $("map").style.left = (sidebar_width) + "px";
+    $("map").style.width = ($("content").offsetWidth - sidebar_width) + "px";
+    $("map").style.height = ($("content").offsetHeight - 2) + "px";
+  }
+
+  function handleResize() {
+    if (brokenContentSize) {
+      resizeContent();
+    }
+
+    resizeMap();
+  }
+
+  window.onresize = handleResize;
+  window.onload = handleResize;

 
 </script>
 
 </script>

+<% end %>