concerto_simple_rss 0.2 → 0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 0862961c2fc33975aaadb48733a8106c1574fdda
-  data.tar.gz: 48532a8bb9c91fe600a0d14b7bd6a0c1ee021295
+  metadata.gz: 49f9ee281528a7cd9f9dc486e016c0c8fc18d1f1
+  data.tar.gz: 9029aa1ba7de5a5bd50d298d4da9bfce1d02a058
 SHA512:
-  metadata.gz: aa9938a88821f71008b08b9e5c1ec8dc731775c81773ec7ec4e935ad980b9815640425dbc5a050a0b295f433e45cfdad41c2ba3e6ea8c8276f8b1669ccf85b87
-  data.tar.gz: 887b422a63307522e274a9f513d87e750639bedefd94f1815849e89da83e551cc8c205e4d089eccab5ce523fcd3afe7b1d72078b7539c6e6fd2aaaa92f2ed86d
+  metadata.gz: 33e24a4b172fbbe03c6447c35b9f92f6dc886952269a2a41bb47decc27299cb4e7af9a542fbcede282ae170c0599439362e7940fa50dd1ebdbe4b5f0075f18c0
+  data.tar.gz: 8eb1e6a38caa1c4b1aa9a32bd173b79061059f5ac3597fb52814d7fcbc642f445deb3e652e7f9ae68566ef98fc83a9c051e06cb2ffe73a02a1b3bc28d21076e9

data/app/assets/javascripts/concerto_simple_rss/simple_rss.js

@@ -16,6 +16,7 @@ function previewSimpleRss() {
     max_items = $('input#simple_rss_config_max_items').val();
     reverse_order = $('select#simple_rss_config_reverse_order').val();
     xsl = $('textarea#simple_rss_config_xsl').val();
+    sanitize_tags = $('input#simple_rss_config_sanitize_tags').val();
     if (max_items == '') {
       max_items = '0';
     }
@@ -24,7 +25,8 @@ function previewSimpleRss() {
       output_format: output_format, 
       max_items: max_items,
       reverse_order: reverse_order,
-      xsl: xsl
+      xsl: xsl,
+      sanitize_tags: sanitize_tags
     }, type: 'SimpleRss' });
   }
 }
@@ -42,6 +44,7 @@ function initializeSimpleRssHandlers() {
     $('input#simple_rss_config_max_items').on('blur', previewSimpleRss);
     $('select#simple_rss_config_reverse_order').on('change', previewSimpleRss);
     $('textarea#simple_rss_config_xsl').on('blur', previewSimpleRss);
+    $('input#simple_rss_config_sanitize_tags').on('blur', previewSimpleRss);
 
     initializedSimpleRssHandlers = true;
   }

data/app/models/simple_rss.rb

@@ -24,14 +24,14 @@ class SimpleRss < DynamicContent
         feed_items.each_slice(5).with_index do |items, index|
           htmltext = HtmlText.new()
           htmltext.name = "#{feed_title} (#{index+1})"
-          htmltext.data = "<h1>#{feed_title}</h1> #{items_to_html(items, type)}"
+          htmltext.data = sanitize("<h1>#{feed_title}</h1> #{items_to_html(items, type)}")
           contents << htmltext
         end
       when 'detailed'
         feed_items.each_with_index do |item, index|
           htmltext = HtmlText.new()
           htmltext.name = "#{feed_title} (#{index+1})"
-          htmltext.data = item_to_html(item, type)
+          htmltext.data = sanitize(item_to_html(item, type))
           contents << htmltext
         end
       when 'xslt'
@@ -66,28 +66,12 @@ class SimpleRss < DynamicContent
         # by adding the bogus namespace http://concerto.functions
         # A nodeset comes in as an array of REXML::Elements 
         XML::XSLT.registerExtFunc("http://concerto.functions", "replace") do |nodes, pattern, replacement|
-Rails.logger.debug("pattern = #{pattern}")
-Rails.logger.debug("replacement = #{replacement}")
-          result = []
-          begin
-            # this will only work with nodesets for now
-            re_pattern = Regexp.new(pattern)
-            if nodes.is_a?(Array) && nodes.count > 0 && nodes.first.is_a?(REXML::Element)
-              nodes.each do |node|
-                s = node.to_s
-                r = s.gsub(re_pattern, replacement)
-                result << REXML::Document.new(r)
-              end
-            elsif nodes.is_a?(String)
-              result = nodes.gsub(re_pattern, replacement)
-            else
-              # dont know how to handle this
-              Rails.logger.info "I'm sorry, but the xsl external function replace does not know how to handle this type #{nodes.class}"
-            end
-          rescue => e
-            Rails.logger.error "there was a problem replacing #{pattern} with #{replacement} - #{e.message}"
-          end
+          result = xslt_replace(nodes, pattern, replacement)
+          result
+        end
 
+        XML::XSLT.registerExtFunc("http://schemas.concerto-signage.org/functions", "replace") do |nodes, pattern, replacement|
+          result = xslt_replace(nodes, pattern, replacement)
           result
         end
 
@@ -102,14 +86,15 @@ Rails.logger.debug("replacement = #{replacement}")
           if nodes.count == 0
             htmltext = HtmlText.new()
             htmltext.name = "#{feed_title}"
-            htmltext.data = data
+            htmltext.data = sanitize(data)
             contents << htmltext
           else
             # if there are any content-items then add each one as a separate content
+            # and strip off the content-item wrapper
             nodes.each do |n|
               htmltext = HtmlText.new()
               htmltext.name = "#{feed_title}"
-              htmltext.data = n.to_s
+              htmltext.data = sanitize(n.to_s.gsub(/^\s*\<content-item\>/, '').gsub(/\<\/content-item\>\s*$/,''))
               contents << htmltext
             end
           end
@@ -119,7 +104,7 @@ Rails.logger.debug("replacement = #{replacement}")
           # add the whole result as one content
           htmltext = HtmlText.new()
           htmltext.name = "#{feed_title}"
-          htmltext.data = data
+          htmltext.data = sanitize(data)
           contents << htmltext
         end
       else
@@ -133,6 +118,32 @@ Rails.logger.debug("replacement = #{replacement}")
     return contents
   end
 
+  def xslt_replace(nodes, pattern, replacement)
+    #Rails.logger.debug("pattern = #{pattern}")
+    #Rails.logger.debug("replacement = #{replacement}")
+    result = []
+    begin
+      # this will only work with nodesets for now
+      re_pattern = Regexp.new(pattern)
+      if nodes.is_a?(Array) && nodes.count > 0 && nodes.first.is_a?(REXML::Element)
+        nodes.each do |node|
+          s = node.to_s
+          r = s.gsub(re_pattern, replacement)
+          result << REXML::Document.new(r)
+        end
+      elsif nodes.is_a?(String)
+        result = nodes.gsub(re_pattern, replacement)
+      else
+        # dont know how to handle this
+        Rails.logger.info "I'm sorry, but the xsl external function replace does not know how to handle this type #{nodes.class}"
+      end
+    rescue => e
+      Rails.logger.error "there was a problem replacing #{pattern} with #{replacement} - #{e.message}"
+    end
+
+    result
+  end    
+
   # fetch the feed, return the type, title, and contents (parsed) and raw feed (unparsed)
   def fetch_feed(url)
     require 'rss'
@@ -211,7 +222,7 @@ Rails.logger.debug("replacement = #{replacement}")
   # Simple RSS processing needs a feed URL and the format of the output content.
   def self.form_attributes
     attributes = super()
-    attributes.concat([:config => [:url, :output_format, :reverse_order, :max_items, :xsl]])
+    attributes.concat([:config => [:url, :output_format, :reverse_order, :max_items, :xsl, :sanitize_tags]])
   end
 
   # if the feed is valid we store the title in config
@@ -272,6 +283,7 @@ Rails.logger.debug("replacement = #{replacement}")
       o.config['max_items'] = data[:max_items]
       o.config['reverse_order'] = data[:reverse_order]
       o.config['xsl'] = data[:xsl]
+      o.config['sanitize_tags'] = data[:sanitize_tags]
       results = o.build_content.first.data
     rescue => e
       results = "Unable to preview.  #{e.message}"
@@ -280,4 +292,14 @@ Rails.logger.debug("replacement = #{replacement}")
     return results
   end
 
+  def sanitize(html)
+    if self.config.include?('sanitize_tags') and !self.config['sanitize_tags'].empty?
+      whitelist = ActionView::Base.sanitized_allowed_tags 
+      blacklist = self.config['sanitize_tags'].split(" ")
+
+      html = ActionController::Base.helpers.sanitize(html, :tags => (whitelist - blacklist))
+    end
+    html
+  end
+
 end

data/app/views/contents/simple_rss/_form_top.html.erb

@@ -33,5 +33,11 @@
         <%= config.text_area :xsl, :class => "span12", :rows =>4, :value => @content.config['xsl'] %>
       </div>
     </div>
+    <div class="clearfix" id="simple_rss_sanitize_tags">
+      <%= label_tooltip "simple_rss", :sanitize_tags, 'Blacklisted HTML Tags for Sanitization', :tip => "Whitelist includes #{[*ActionView::Base.sanitized_allowed_tags].join ' '}" %>
+      <div class="input">
+        <%= config.text_field :sanitize_tags, :class => "input-xxlarge", :placeholder => 'img a', :value => @content.config['sanitize_tags'] %>
+      </div>
+    </div>
   <% end %>
 </fieldset>

data/lib/concerto_simple_rss/version.rb

@@ -1,3 +1,3 @@
 module ConcertoSimpleRss
-  VERSION = "0.2"
+  VERSION = "0.3"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: concerto_simple_rss
 version: !ruby/object:Gem::Version
-  version: '0.2'
+  version: '0.3'
 platform: ruby
 authors:
 - Brian Michalski
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-05-12 00:00:00.000000000 Z
+date: 2014-06-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails