From 0b7d370286ba2d0a7d35c1b9180425b6212b10f8 Mon Sep 17 00:00:00 2001
From: Timotej Lazar <timotej.lazar@araneo.org>
Date: Fri, 18 Sep 2015 12:58:03 +0200
Subject: Escape HTML in hint template parameters

---
 js/codeq/hint.js | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

(limited to 'js')

diff --git a/js/codeq/hint.js b/js/codeq/hint.js
index a94f571..d090c4d 100644
--- a/js/codeq/hint.js
+++ b/js/codeq/hint.js
@@ -35,7 +35,9 @@
                 if (!args)
                     return template;
                 return template.replace(/\[%=(\w+)%\]/g, function(match, name) {
-                    return args[name];
+                    return args[name].replace(/&/g, '&amp')
+                                     .replace(/</g, '&lt;')
+                                     .replace(/>/g, '&gt;');
                 });
             },
 
@@ -181,4 +183,4 @@
             }
         };
     };
-})();
\ No newline at end of file
+})();
-- 
cgit v1.2.1


From 99bad1571ed306678d9b0416bf87f37f5f882058 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ale=C5=A1=20Smodi=C5=A1?= <aless@guru.si>
Date: Fri, 18 Sep 2015 13:25:57 +0200
Subject: Bugfix: join the array of removed character into a string, when the
 user makes a deletion, and it needs to be recorded in activity.

---
 js/prolog.js | 2 +-
 js/python.js | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

(limited to 'js')

diff --git a/js/prolog.js b/js/prolog.js
index 1c811ed..fad1dd4 100644
--- a/js/prolog.js
+++ b/js/prolog.js
@@ -160,7 +160,7 @@
                 pos = codeq.codePointCount(doc.getRange(firstCharacterPos, changeObj.from));
 
             if (changeObj.removed) {
-                activityHandler.queueTrace({'typ': 'rm', 'off': pos, 'len': codeq.codePointCount(changeObj.removed)});
+                activityHandler.queueTrace({'typ': 'rm', 'off': pos, 'len': codeq.codePointCount(changeObj.removed.join(''))});
             }
 
             if (changeObj.text) {
diff --git a/js/python.js b/js/python.js
index 9d051fe..1f2b5cb 100644
--- a/js/python.js
+++ b/js/python.js
@@ -108,7 +108,7 @@
                 pos = codeq.codePointCount(doc.getRange(firstCharacterPos, changeObj.from));
 
             if (changeObj.removed) {
-                activityHandler.queueTrace({'typ': 'rm', 'off': pos, 'len': codeq.codePointCount(changeObj.removed)});
+                activityHandler.queueTrace({'typ': 'rm', 'off': pos, 'len': codeq.codePointCount(changeObj.removed.join(''))});
             }
 
             if (changeObj.text) {
-- 
cgit v1.2.1


From 666a497696c80df08bdff7f8ce049565a46541b7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ale=C5=A1=20Smodi=C5=A1?= <aless@guru.si>
Date: Fri, 18 Sep 2015 13:29:32 +0200
Subject: Bugfix: off-by-one when displaying an array of hints.

---
 js/codeq/hint.js | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'js')

diff --git a/js/codeq/hint.js b/js/codeq/hint.js
index d090c4d..dc774ba 100644
--- a/js/codeq/hint.js
+++ b/js/codeq/hint.js
@@ -44,7 +44,7 @@
             typeHandlers = {
                 'static': function (type, template, serverHint) {
                     var args = serverHint.args,
-                        jqContainer, jqButton, i, lastIndex;
+                        jqContainer, jqButton, i, N;
                     if (template instanceof Array) { // unwrap the template if there's only one
                         if (template.length == 0) template = '';
                         else if (template.length == 1) template = template[0] + ''; // it must be a string
@@ -54,14 +54,14 @@
                         jqContainer = $('<div class="hint-static-group"></div>');
                         jqButton = $('<button type="button">More...</button>'); // TODO: translate "more"
                         jqHints.append(jqContainer);
-                        lastIndex = template.length - 1;
+                        N = template.length;
                         jqContainer.append('<div class="hint-static">' + processTemplate(template[0], args) + '</div>');
                         jqContainer.append(jqButton);
                         i = 1;
                         jqButton.on('click', function () {
                             var jqNext = $('<div class="hint-static">' + processTemplate(template[i], args) + '</div>');
                             i++;
-                            if (i < lastIndex) {
+                            if (i < N) {
                                 jqButton.before(jqNext);
                             }
                             else {
-- 
cgit v1.2.1


From 99edd51f53b03a49e8c61f95eef0cd6f94e87c2b Mon Sep 17 00:00:00 2001
From: Timotej Lazar <timotej.lazar@araneo.org>
Date: Fri, 18 Sep 2015 13:39:40 +0200
Subject: Bugfix: template parameter can be a number

---
 js/codeq/hint.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'js')

diff --git a/js/codeq/hint.js b/js/codeq/hint.js
index dc774ba..06eceb0 100644
--- a/js/codeq/hint.js
+++ b/js/codeq/hint.js
@@ -35,7 +35,8 @@
                 if (!args)
                     return template;
                 return template.replace(/\[%=(\w+)%\]/g, function(match, name) {
-                    return args[name].replace(/&/g, '&amp')
+                    return args[name].toString()
+                                     .replace(/&/g, '&amp')
                                      .replace(/</g, '&lt;')
                                      .replace(/>/g, '&gt;');
                 });
-- 
cgit v1.2.1