Skip to content

Commit 5d751e2

Browse files
thatarchguythatarchguy
committed
Merge pull request #108 from StackFocus/Fixes
Filter Output and Misc Fixes
2 parents 470ada0 + 4bb0841 commit 5d751e2

File tree

11 files changed

+82
-96
lines changed

11 files changed

+82
-96
lines changed

‎config.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,10 @@ class BaseConfiguration(object):
1313
WTF_CSRF_ENABLED = False
1414
# Make this random (used to generate session keys)
1515
SECRET_KEY = 'e9987dce48df3ce98542529fd074d9e9f9cd40e66fc6c4c2'
16-
basedir = path.abspath(path.dirname(__file__))
1716
SQLALCHEMY_TRACK_MODIFICATIONS = True
1817
SQLALCHEMY_DATABASE_URI = 'mysql://root:vagrant@localhost:3306/servermail'
19-
SQLALCHEMY_MIGRATE_REPO = path.join(basedir, 'db_repository')
18+
basedir = path.abspath(path.dirname(__file__))
19+
SQLALCHEMY_MIGRATE_REPO = path.join(basedir, 'db/migrations')
2020

2121

2222
class TestConfiguration(BaseConfiguration):

‎manage.py‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,9 +30,9 @@ def createdb():
3030
"""Runs the db init, db migrate, db upgrade commands automatically,
3131
and adds the default configuration settings if they are missing"""
3232
if not os.path.isdir('db/migrations'):
33-
flask_migrate.init(directory='db/migrations')
34-
flask_migrate.migrate(directory='db/migrations')
35-
flask_migrate.upgrade(directory='db/migrations')
33+
flask_migrate.init(directory=app.config['SQLALCHEMY_MIGRATE_REPO'])
34+
flask_migrate.migrate(directory=app.config['SQLALCHEMY_MIGRATE_REPO'])
35+
flask_migrate.upgrade(directory=app.config['SQLALCHEMY_MIGRATE_REPO'])
3636
add_default_configuration_settings()
3737

3838

‎postmaster/static/js/admins.js‎

Lines changed: 16 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -12,14 +12,13 @@ function newAdmin(username, password, name) {
1212
'name': name
1313
}),
1414

15-
success: function (data) {
15+
success: function (response) {
1616
addStatusMessage('success', 'The administrator was added successfully');
1717
fillInTable();
1818
},
1919

20-
error: function (data) {
21-
// The jQuery('div />') is a work around to encode all html characters
22-
addStatusMessage('error', jQuery('<div />').text(jQuery.parseJSON(data.responseText).message).html());
20+
error: function (response) {
21+
addStatusMessage('error', filterText(jQuery.parseJSON(response.responseText).message));
2322
}
2423
});
2524
}
@@ -32,14 +31,13 @@ function deleteAdmin (id) {
3231
url: '/api/v1/admins/' + id,
3332
type: 'delete',
3433

35-
success: function (data) {
34+
success: function (response) {
3635
addStatusMessage('success', 'The administrator was successfully removed');
3736
fillInTable();
3837
},
3938

40-
error: function (data) {
41-
// The jQuery('div />') is a work around to encode all html characters
42-
addStatusMessage('error', jQuery('<div />').text(jQuery.parseJSON(data.responseText).message).html());
39+
error: function (response) {
40+
addStatusMessage('error', filterText(jQuery.parseJSON(response.responseText).message));
4341
}
4442
});
4543
}
@@ -61,35 +59,6 @@ function adminEventListeners () {
6159
adminPassword.tooltip();
6260
adminName.tooltip();
6361

64-
adminPassword.editable({
65-
type: 'password',
66-
mode: 'inline',
67-
anim: 100,
68-
69-
ajaxOptions: {
70-
type: 'PUT',
71-
dataType: 'JSON',
72-
contentType: 'application/json'
73-
},
74-
75-
params: function (params) {
76-
return JSON.stringify({'password': params.value})
77-
},
78-
79-
display: function () {
80-
$(this).html('●●●●●●●●');
81-
},
82-
83-
error: function (response) {
84-
// The jQuery('div />') is a work around to encode all html characters
85-
addStatusMessage('error', jQuery('<div />').text(jQuery.parseJSON(response.responseText).message).html());
86-
},
87-
88-
success: function () {
89-
addStatusMessage('success', 'The administrator\'s password was changed successfully');
90-
}
91-
});
92-
9362
adminUsername.editable({
9463
type: 'text',
9564
mode: 'inline',
@@ -106,12 +75,11 @@ function adminEventListeners () {
10675
},
10776

10877
display: function (value) {
109-
$(this).html(value.toLowerCase());
78+
$(this).html(filterText(value.toLowerCase()));
11079
},
11180

11281
error: function (response) {
113-
// The jQuery('div />') is a work around to encode all html characters
114-
addStatusMessage('error', jQuery('<div />').text(jQuery.parseJSON(response.responseText).message).html());
82+
addStatusMessage('error', filterText(jQuery.parseJSON(response.responseText).message));
11583
},
11684

11785
success: function () {
@@ -139,8 +107,7 @@ function adminEventListeners () {
139107
},
140108

141109
error: function (response) {
142-
// The jQuery('div />') is a work around to encode all html characters
143-
addStatusMessage('error', jQuery('<div />').text(jQuery.parseJSON(response.responseText).message).html());
110+
addStatusMessage('error', filterText(jQuery.parseJSON(response.responseText).message));
144111
},
145112

146113
success: function () {
@@ -163,9 +130,12 @@ function adminEventListeners () {
163130
return JSON.stringify({ 'name': params.value })
164131
},
165132

133+
display: function (value) {
134+
$(this).html(filterText(value));
135+
},
136+
166137
error: function (response) {
167-
// The jQuery('div />') is a work around to encode all html characters
168-
addStatusMessage('error', jQuery('<div />').text(jQuery.parseJSON(response.responseText).message).html());
138+
addStatusMessage('error', filterText(jQuery.parseJSON(response.responseText).message));
169139
},
170140

171141
success: function () {
@@ -263,9 +233,9 @@ function fillInTable () {
263233
var html = '';
264234

265235
tableRow.length == 0 ? html += '<tr id="dynamicTableRow' + String(i) + '">' : null;
266-
html += '<td data-title="Username: "><a href="#" class="adminUsername" data-pk="' + item.id + '" data-url="/api/v1/admins/' + item.id + '" title="Click to change the username">' + item.username + '</a></td>\
236+
html += '<td data-title="Username: "><a href="#" class="adminUsername" data-pk="' + item.id + '" data-url="/api/v1/admins/' + item.id + '" title="Click to change the username">' + filterText(item.username) + '</a></td>\
267237
<td data-title="Password: "><a href="#" class="adminPassword" data-pk="' + item.id + '" data-url="/api/v1/admins/' + item.id + '" title="Click to change the password">●●●●●●●●</a></td>\
268-
<td data-title="Name: "><a href="#" class="adminName" data-pk="' + item.id + '" data-url="/api/v1/admins/' + item.id + '" title="Click to change the name">' + item.name + '</a></td>\
238+
<td data-title="Name: "><a href="#" class="adminName" data-pk="' + item.id + '" data-url="/api/v1/admins/' + item.id + '" title="Click to change the name">' + filterText(item.name) + '</a></td>\
269239
<td data-title="Action: "><a href="#" class="deleteAnchor" data-pk="' + item.id + '" data-toggle="modal" data-target="#deleteModal">Delete</a></td>';
270240
tableRow.length == 0 ? html += '</tr>' : null;
271241
tableRow.length == 0 ? insertTableRow(html) : tableRow.html(html);

‎postmaster/static/js/aliases.js‎

Lines changed: 9 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -12,14 +12,13 @@ function newAlias(source, destination) {
1212
'destination': destination
1313
}),
1414

15-
success: function (data) {
15+
success: function (response) {
1616
addStatusMessage('success', 'The alias was added successfully');
1717
fillInTable();
1818
},
1919

20-
error: function (data) {
21-
// The jQuery('div />') is a work around to encode all html characters
22-
addStatusMessage('error', jQuery('<div />').text(jQuery.parseJSON(data.responseText).message).html());
20+
error: function (response) {
21+
addStatusMessage('error', filterText(jQuery.parseJSON(response.responseText).message));
2322
}
2423
});
2524
}
@@ -37,9 +36,8 @@ function deleteAlias (id) {
3736
fillInTable();
3837
},
3938

40-
error: function (data) {
41-
// The jQuery('div />') is a work around to encode all html characters
42-
addStatusMessage('error', jQuery('<div />').text(jQuery.parseJSON(data.responseText).message).html());
39+
error: function (response) {
40+
addStatusMessage('error', filterText(jQuery.parseJSON(response.responseText).message));
4341
}
4442
});
4543
}
@@ -156,8 +154,8 @@ function fillInTable () {
156154
var html = '';
157155

158156
tableRow.length == 0 ? html += '<tr id="dynamicTableRow' + String(i) + '">' : null;
159-
html += '<td data-title="Source: "><a href="#" class="sourceAlias" data-pk="' + item.id + '" data-url="/api/v1/aliases/' + item.id + '" title="Click to change the source of the alias">' + item.source + '</td>\
160-
<td data-title="Destination: "><a href="#" class="destinationAlias" data-pk="' + item.id + '" data-url="/api/v1/aliases/' + item.id + '" title="Click to change the destination of the alias">' + item.destination + '</td>\
157+
html += '<td data-title="Source: "><a href="#" class="sourceAlias" data-pk="' + item.id + '" data-url="/api/v1/aliases/' + item.id + '" title="Click to change the source of the alias">' + filterText(item.source) + '</td>\
158+
<td data-title="Destination: "><a href="#" class="destinationAlias" data-pk="' + item.id + '" data-url="/api/v1/aliases/' + item.id + '" title="Click to change the destination of the alias">' + filterText(item.destination) + '</td>\
161159
<td data-title="Action: "><a href="#" class="deleteAnchor" data-pk="' + item.id + '">Delete</a></td>';
162160
tableRow.length == 0 ? html += '</tr>' : null;
163161
tableRow.length == 0 ? insertTableRow(html) : tableRow.html(html);
@@ -206,11 +204,10 @@ $(document).ready(function () {
206204
return JSON.stringify({ 'value': params.value })
207205
};
208206
$.fn.editable.defaults.error = function (response) {
209-
// The jQuery('div />') is a work around to encode all html characters
210-
addStatusMessage('error', jQuery('<div />').text(jQuery.parseJSON(response.responseText).message).html());
207+
addStatusMessage('error', filterText(jQuery.parseJSON(response.responseText).message));
211208
};
212209
$.fn.editable.defaults.display = function (value) {
213-
$(this).html(value.toLowerCase());
210+
$(this).html(filterText(value.toLowerCase()));
214211
};
215212

216213
// When hitting the back/forward buttons, reload the table

‎postmaster/static/js/configs.js‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,11 @@ function configEventListeners () {
1717

1818
configTextItems.unbind();
1919
configTextItems.tooltip();
20-
configTextItems.editable();
20+
configTextItems.editable({
21+
display: function (value) {
22+
$(this).html(filterText(value));
23+
}
24+
});
2125

2226
configLogFile.unbind();
2327
configLogFile.tooltip();
@@ -26,6 +30,9 @@ function configEventListeners () {
2630
// Sets the Mail Database Auditing to True in the UI
2731
$('td:contains("Mail Database Auditing")').next('td').children('a').text('True');
2832
addStatusMessage('success', 'The setting was changed successfully');
33+
},
34+
display: function (value) {
35+
$(this).html(filterText(value));
2936
}
3037
});
3138
}
@@ -65,8 +72,8 @@ function fillInTable () {
6572
}
6673

6774
tableRow.length == 0 ? html += '<tr id="dynamicTableRow' + String(i) + '">' : null;
68-
html += '<td data-title="Setting: ">' + item.setting + '</td>\
69-
<td data-title="Value: "><a href="#" class="' + cssClass + '" data-pk="' + item.id + '" data-url="/api/v1/configs/' + item.id + '" title="Click to change the setting value">' + (item.value != null ? item.value : '') + '</a></td>';
75+
html += '<td data-title="Setting: ">' + filterText(item.setting) + '</td>\
76+
<td data-title="Value: "><a href="#" class="' + cssClass + '" data-pk="' + item.id + '" data-url="/api/v1/configs/' + item.id + '" title="Click to change the setting value">' + (item.value != null ? filterText(item.value) : '') + '</a></td>';
7077
tableRow.length == 0 ? html += '</tr>' : null;
7178
tableRow.length == 0 ? appendTableRow(html) : tableRow.html(html);
7279

@@ -112,8 +119,7 @@ $(document).ready(function () {
112119
return JSON.stringify({ 'value': params.value })
113120
};
114121
$.fn.editable.defaults.error = function (response) {
115-
// The jQuery('div />') is a work around to encode all html characters
116-
addStatusMessage('error', jQuery('<div />').text(jQuery.parseJSON(response.responseText).message).html());
122+
addStatusMessage('error', filterText(jQuery.parseJSON(response.responseText).message));
117123
};
118124
$.fn.editable.defaults.success = function () {
119125
addStatusMessage('success', 'The setting was changed successfully');

‎postmaster/static/js/domains.js‎

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,13 @@ function newDomain(name) {
88
contentType: 'application/json',
99
data: JSON.stringify({ 'name': name }),
1010

11-
success: function (data) {
11+
success: function (response) {
1212
addStatusMessage('success', 'The domain was added successfully.');
1313
fillInTable();
1414
},
1515

16-
error: function (data) {
17-
// The jQuery('div />') is a work around to encode all html characters
18-
addStatusMessage('error', jQuery('<div />').text(jQuery.parseJSON(data.responseText).message).html());
16+
error: function (response) {
17+
addStatusMessage('error', filterText(jQuery.parseJSON(response.responseText).message));
1918
}
2019
});
2120
}
@@ -33,14 +32,13 @@ function deleteDomain (id) {
3332
type: 'delete',
3433
contentType: 'application/json',
3534

36-
success: function (data) {
35+
success: function (response) {
3736
addStatusMessage('success', 'The domain was successfully removed.');
3837
fillInTable();
3938
},
4039

41-
error: function (data) {
42-
// The jQuery('div />') is a work around to encode all html characters
43-
addStatusMessage('error', jQuery('<div />').text(jQuery.parseJSON(data.responseText).message).html());
40+
error: function (response) {
41+
addStatusMessage('error', filterText(jQuery.parseJSON(response.responseText).message));
4442
}
4543
});
4644
}
@@ -130,7 +128,7 @@ function fillInTable(filter) {
130128
var html = '';
131129

132130
tableRow.length == 0 ? html += '<tr id="dynamicTableRow' + String(i) + '">' : null;
133-
html += '<td data-pk="' + item.id + '" data-title="Domain: ">' + item.name + '</td>\
131+
html += '<td data-pk="' + item.id + '" data-title="Domain: ">' + filterText(item.name) + '</td>\
134132
<td data-title="Action: "><a href="#" class="deleteAnchor" data-pk="' + item.id + '" data-toggle="modal" data-target="#deleteModal">Delete</a></td>';
135133
tableRow.length == 0 ? html += '</tr>' : null;
136134
tableRow.length == 0 ? insertTableRow(html) : tableRow.html(html);

‎postmaster/static/js/logs.js‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -30,9 +30,9 @@ function fillInTable() {
3030
var html = '';
3131

3232
tableRow.length == 0 ? html += '<tr id="dynamicTableRow' + String(i) + '">' : null;
33-
html += '<td data-title="Time: ">' + dateFormatFromISO(item.timestamp) + '</td>\
34-
<td data-title="Admin: ">' + item.admin + '</td>\
35-
<td data-title="Message: ">' + item.message + '</td>';
33+
html += '<td data-title="Time: ">' + filterText(dateFormatFromISO(item.timestamp)) + '</td>\
34+
<td data-title="Admin: ">' + filterText(item.admin) + '</td>\
35+
<td data-title="Message: ">' + filterText(item.message) + '</td>';
3636
tableRow.length == 0 ? html += '</tr>' : null;
3737
tableRow.length == 0 ? appendTableRow(html) : tableRow.html(html);
3838

@@ -47,7 +47,7 @@ function fillInTable() {
4747
.fail(function (jqxhr, textStatus, error) {
4848
// Remove the loading spinner
4949
manageSpinner(false);
50-
addStatusMessage('error', JSON.parse(jqxhr.responseText)['message']);
50+
addStatusMessage('error', filterText(JSON.parse(jqxhr.responseText)['message']));
5151
});
5252
}
5353

‎postmaster/static/js/users.js‎

Lines changed: 8 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -11,14 +11,13 @@ function newUser(email, password) {
1111
'password': password
1212
}),
1313

14-
success: function (data) {
14+
success: function (response) {
1515
addStatusMessage('success', 'The user was added successfully');
1616
fillInTable();
1717
},
1818

19-
error: function (data) {
20-
// The jQuery('div />') is a work around to encode all html characters
21-
addStatusMessage('error', jQuery('<div />').text(jQuery.parseJSON(data.responseText).message).html());
19+
error: function (response) {
20+
addStatusMessage('error', filterText(jQuery.parseJSON(response.responseText).message));
2221
}
2322
});
2423
}
@@ -31,14 +30,13 @@ function deleteUser (id) {
3130
url: '/api/v1/users/' + id,
3231
type: 'delete',
3332

34-
success: function (data) {
33+
success: function (response) {
3534
addStatusMessage('success', 'The user was successfully removed');
3635
fillInTable();
3736
},
3837

39-
error: function (data) {
40-
// The jQuery('div />') is a work around to encode all html characters
41-
addStatusMessage('error', jQuery('<div />').text(jQuery.parseJSON(data.responseText).message).html());
38+
error: function (response) {
39+
addStatusMessage('error', filterText(jQuery.parseJSON(response.responseText).message));
4240
}
4341
});
4442
}
@@ -74,8 +72,7 @@ function userEventListeners () {
7472
},
7573

7674
error: function (response) {
77-
// The jQuery('div />') is a work around to encode all html characters
78-
addStatusMessage('error', jQuery('<div />').text(jQuery.parseJSON(response.responseText).message).html());
75+
addStatusMessage('error', filterText(jQuery.parseJSON(response.responseText).message));
7976
},
8077

8178
success: function () {
@@ -164,7 +161,7 @@ function fillInTable () {
164161
var html = '';
165162

166163
tableRow.length == 0 ? html += '<tr id="dynamicTableRow' + String(i) + '">' : null;
167-
html += '<td data-title="Email: ">' + item.email + '</td>\
164+
html += '<td data-title="Email: ">' + filterText(item.email) + '</td>\
168165
<td data-title="Password: "><a href="#" class="userPassword" data-pk="' + item.id + '" data-url="/api/v1/users/' + item.id + '" title="Click to change the password">●●●●●●●●</a></td>\
169166
<td data-title="Action: "><a href="#" class="deleteAnchor" data-pk="' + item.id + '" data-toggle="modal" data-target="#deleteModal">Delete</a></td>';
170167
tableRow.length == 0 ? html += '</tr>' : null;

‎postmaster/static/js/utils.js‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,25 @@ function getUrlVars() {
1616
}
1717

1818

19+
// Inspired from https://github.com/janl/mustache.js/blob/master/mustache.js
20+
function filterText(text) {
21+
var entityMap = {
22+
'&': '&amp;',
23+
'<': '&lt;',
24+
'>': '&gt;',
25+
'"': '&quot;',
26+
"'": '&#39;',
27+
'/': '&#x2F;',
28+
'`': '&#x60;',
29+
'=': '&#x3D;'
30+
};
31+
32+
return String(text).replace(/[&<>"'`=\/]/g, function fromEntityMap (s) {
33+
return entityMap[s];
34+
});
35+
}
36+
37+
1938
function changePage(obj, e) {
2039

2140
if (history.pushState) {

0 commit comments

Comments
 (0)