Escape titles and dates on their way out of the HTML. It _shouldn't_ be

[pr0n] / perl / Sesse / pr0n / Index.pm

diff --git a/perl/Sesse/pr0n/Index.pm b/perl/Sesse/pr0n/Index.pm
index c0c89a7f5d94d7cb6bd3c23d76845c232fb2d26a..ca02b75003ed4bb54f04d801978ed1e7da8072f1 100644 (file)
--- a/perl/Sesse/pr0n/Index.pm
+++ b/perl/Sesse/pr0n/Index.pm
@@ -23,7 +23,7 @@ sub handler {
        }
 
        # Internal? (Ugly?) 
-       if ($r->get_server_name =~ /internal/) {
+       if ($r->get_server_name =~ /internal/ || $r->get_server_name =~ /skoyen\.bilder\.knatten\.com/) {
                my $user = Sesse::pr0n::Common::check_access($r);
                if (!defined($user)) {
                        return Apache2::Const::OK;
@@ -34,8 +34,8 @@ sub handler {
        my %defsettings = (
                thumbxres => 80,
                thumbyres => 64,
-               xres => undef,
-               yres => undef,
+               xres => -1,
+               yres => -1,
                start => 1,
                num => -1,
                all => 1,
@@ -45,6 +45,11 @@ sub handler {
                fullscreen => 0,
        );
        
+       # Any NEF files => default to processing
+       my $ref = $dbh->selectrow_hashref('SELECT * FROM images WHERE event=? AND LOWER(filename) LIKE \'%.nef\' LIMIT 1',
+               undef, $event)
+               and $defsettings{'xres'} = $defsettings{'yres'} = undef;
+       
        # Reduce the front page load when in overload mode.
        if (Sesse::pr0n::Overload::is_in_overload($r)) {
                $defsettings{'num'} = 100;
@@ -77,12 +82,18 @@ sub handler {
                $num = undef;
        }
 
-       my $ref = $dbh->selectrow_hashref('SELECT * FROM events WHERE id=? AND vhost=?',
+       $ref = $dbh->selectrow_hashref('SELECT name,date,EXTRACT(EPOCH FROM last_update) AS last_update FROM events WHERE id=? AND vhost=?',
                undef, $event, $r->get_server_name)
                or error($r, "Could not find event $event", 404, "File not found");
 
-       my $name = $ref->{'name'};
-       my $date = $ref->{'date'};
+       my $date = HTML::Entities::encode_entities(Encode::decode_utf8($ref->{'date'}));
+       my $name = HTML::Entities::encode_entities(Encode::decode_utf8($ref->{'name'}));
+       $r->set_last_modified($ref->{'last_update'});
+                               
+       # If the client can use cache, do so
+       if ((my $rc = $r->meets_conditions) != Apache2::Const::OK) {
+               return $rc;
+       }
        
        # Count the number of selected images.
        $ref = $dbh->selectrow_hashref("SELECT COUNT(*) AS num_selected FROM images WHERE event=? AND selected=\'t\'", undef, $event);
@@ -92,7 +103,7 @@ sub handler {
        my $q;
        my $where = ($all == 0) ? ' AND selected=\'t\'' : '';
 
-       if (defined($start) && defined($num)) {
+       if (defined($start) && defined($num) && !$settings{'fullscreen'}) {
                $q = $dbh->prepare("SELECT *, (date - INTERVAL '6 hours')::date AS day FROM images WHERE event=? $where ORDER BY (date - INTERVAL '6 hours')::date,takenby,date,filename LIMIT $num OFFSET " . ($start-1))
                        or dberror($r, "prepare()");
        } else {
@@ -107,7 +118,7 @@ sub handler {
                $r->content_type("text/html; charset=utf-8");
                Sesse::pr0n::Templates::print_template($r, "fullscreen-header", { title => "$name [$event]" });
                while (my $ref = $q->fetchrow_hashref()) {
-                       $r->print("        \"" . $ref->{'filename'} . "\",\n");
+                       $r->print("        \"" . $infobox . $ref->{'filename'} . "\",\n");
                }
 
                my %settings_no_fullscreen = %settings;
@@ -116,11 +127,15 @@ sub handler {
                my $returnurl = "http://" . $r->get_server_name . "/" . $event . "/" .
                        Sesse::pr0n::Common::get_query_string(\%settings_no_fullscreen, \%defsettings);
 
+               # *whistle*
+               $returnurl =~ s/&/&/g;
+
                Sesse::pr0n::Templates::print_template($r, "fullscreen-footer", {
                        vhost => $r->get_server_name,
                        event => $event,
                        start => $settings{'start'} - 1,
-                       returnurl => $returnurl
+                       returnurl => $returnurl,
+                       sel => $settings{'sel'},
                });
        } else {
                Sesse::pr0n::Common::header($r, "$name [$event]");
@@ -136,6 +151,7 @@ sub handler {
                print_infobox($r, $event, \%settings, \%defsettings);
                print_nextprev($r, $event, \%settings, \%defsettings);
                print_selected($r, $event, \%settings, \%defsettings) if ($num_selected > 0);
+               print_fullscreen($r, $event, \%settings, \%defsettings);
 
                my $toclose = 0;
                my $lastupl = "";
@@ -143,6 +159,7 @@ sub handler {
                # Print out all thumbnails
                if ($rot == 1) {
                        $r->print("    <form method=\"post\" action=\"/rotate\">\n");
+                       $r->print("      <input type=\"hidden\" name=\"event\" value=\"$event\" />\n");
                
                        while (my $ref = $q->fetchrow_hashref()) {
                                my $imgsz = "";
@@ -164,7 +181,7 @@ sub handler {
                                }
 
                                my $filename = $ref->{'filename'};
-                               my $uri = $filename;
+                               my $uri = $infobox . $filename;
                                if (defined($xres) && defined($yres) && $xres != -1) {
                                        $uri = "${xres}x$yres/$infobox$filename";
                                } elsif (defined($xres) && $xres == -1) {
@@ -207,7 +224,7 @@ sub handler {
                                }
 
                                my $filename = $ref->{'filename'};
-                               my $uri = $filename;
+                               my $uri = $infobox . $filename;
                                if (defined($xres) && defined($yres) && $xres != -1) {
                                        $uri = "${xres}x$yres/$infobox$filename";
                                } elsif (defined($xres) && $xres == -1) {
@@ -245,7 +262,7 @@ sub handler {
                                }
 
                                my $filename = $ref->{'filename'};
-                               my $uri = $filename;
+                               my $uri = $infobox . $filename;
                                if (defined($xres) && defined($yres) && $xres != -1) {
                                        $uri = "${xres}x$yres/$infobox$filename";
                                } elsif (defined($xres) && $xres == -1) {
@@ -432,7 +449,8 @@ sub print_nextprev {
                my %newsettings = %$settings;
                $newsettings{'start'} = $newstart;
                chomp (my $title = Sesse::pr0n::Templates::fetch_template($r, 'prevpage'));
-               Sesse::pr0n::Common::print_link($r, "$title ($newstart-$newend)\n", "/$event/", \%newsettings, $defsettings);
+               chomp (my $accesskey = Sesse::pr0n::Templates::fetch_template($r, 'prevaccesskey'));
+               Sesse::pr0n::Common::print_link($r, "$title ($newstart-$newend)\n", "/$event/", \%newsettings, $defsettings, $accesskey);
        }
 
        # This
@@ -450,7 +468,8 @@ sub print_nextprev {
                my %newsettings = %$settings;
                $newsettings{'start'} = $newstart;
                chomp (my $title = Sesse::pr0n::Templates::fetch_template($r, 'nextpage'));
-               Sesse::pr0n::Common::print_link($r, "$title ($newstart-$newend)", "/$event/", \%newsettings, $defsettings);
+               chomp (my $accesskey = Sesse::pr0n::Templates::fetch_template($r, 'nextaccesskey'));
+               Sesse::pr0n::Common::print_link($r, "$title ($newstart-$newend)", "/$event/", \%newsettings, $defsettings, $accesskey);
        }
 
        $r->print("    </p>\n");
@@ -485,6 +504,19 @@ sub print_selected {
        
        $r->print('</p>');
 }
+
+sub print_fullscreen {
+       my ($r, $event, $settings, $defsettings) = @_;
+
+       chomp (my $title = Sesse::pr0n::Templates::fetch_template($r, 'fullscreen'));
+
+       my %newsettings = %$settings;
+       $newsettings{'fullscreen'} = 1;
+
+        $r->print("    <p>");
+       Sesse::pr0n::Common::print_link($r, $title, "/$event/", \%newsettings, $defsettings);
+       $r->print("</p>\n");
+}
        
 1;