libre-service.eu/pad.libre-service.eu-etherpad
libre-service.eu/pad.libre-service.eu-etherpad
1
0
Fork 0
mirror of https://github.com/ether/etherpad-lite.git synced 2025-02-01 03:12:42 +01:00
Code Issues Projects Releases Wiki Activity

Merge pull request #2035 from lebrinkma/dont-die-on-bad-html

Browse source 
Add input validation for html param in setHTML()
This commit is contained in:
John McLear 2013-12-16 03:07:50 -08:00
commit 3d8edef926
2 changed files with 17 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
doc/api/http_api.md
View file

@ -285,16 +285,6 @@ sets the text of a pad
* `{code: 1, message:"padID does not exist", data: null}` * `{code: 1, message:"padID does not exist", data: null}`
* `{code: 1, message:"text too long", data: null}` * `{code: 1, message:"text too long", data: null}`
#### setHTML(padID, html)
* API >= 1
sets the text of a pad based on HTML, HTML must be well formed. Malformed HTML will send a warning to the API log
*Example returns:*
* `{code: 0, message:"ok", data: null}`
* `{code: 1, message:"padID does not exist", data: null}`
#### getHTML(padID, [rev]) #### getHTML(padID, [rev])
* API >= 1 * API >= 1
@ -304,15 +294,14 @@ returns the text of a pad formatted as HTML
* `{code: 0, message:"ok", data: {html:"Welcome Text<br>More Text"}}` * `{code: 0, message:"ok", data: {html:"Welcome Text<br>More Text"}}`
* `{code: 1, message:"padID does not exist", data: null}` * `{code: 1, message:"padID does not exist", data: null}`
#### setHTML(padID, text) #### setHTML(padID, html)
* API >= 1 * API >= 1
sets the html of a pad sets the text of a pad based on HTML, HTML must be well formed. Malformed HTML will send a warning to the API log.
*Example returns:* *Example returns:*
* `{code: 0, message:"ok", data: null}` * `{code: 0, message:"ok", data: null}`
* `{code: 1, message:"padID does not exist", data: null}` * `{code: 1, message:"padID does not exist", data: null}`
* `{code: 1, message:"text too long", data: null}`
#### getAttributePool(padID) #### getAttributePool(padID)
* API >= 1.2.8 * API >= 1.2.8

15
src/node/db/API.js
View file

@ -382,8 +382,23 @@ exports.getHTML = function(padID, rev, callback)
}); });
} }
/**
setHTML(padID, html) sets the text of a pad based on HTML
Example returns:
{code: 0, message:"ok", data: null}
{code: 1, message:"padID does not exist", data: null}
*/
exports.setHTML = function(padID, html, callback) exports.setHTML = function(padID, html, callback)
{ {
//html is required
if(typeof html != "string")
{
callback(new customError("html is no string","apierror"));
return;
}
//get the pad //get the pad
getPadSafe(padID, true, function(err, pad) getPadSafe(padID, true, function(err, pad)
{ {