fix bug

route/main_func_upload.py

@@ -113,7 +113,7 @@ def main_func_upload():
             return redirect('/w/file:' + name)
         else:
             license_list = '<option value="direct_input">' + load_lang('direct_input') + '</option>'
-            file_name = flask.request.args.get('name', '')
+            file_name = html.escape(flask.request.args.get('name', ''))
 
             curs.execute(db_change("select html from html_filter where kind = 'image_license'"))
             db_data = curs.fetchall()

version.json

@@ -1,6 +1,6 @@
 {
     "beta" : {
-        "r_ver" : "v3.4.4 (stable1) (beta1) (dev4)",
+        "r_ver" : "v3.4.4 (stable1) (beta1) (dev5)",
         "c_ver" : "3500101",
         "s_ver" : "3500110"
     }

views/main_css/js/render_onmark.js

@@ -116,6 +116,15 @@ function do_xss_change(data) {
     return data;
 }
 
+function do_html_escape(data) {
+    data = data.replace(/</g, '&lt;');
+    data = data.replace(/>/g, '&gt;');
+    data = data.replace(/&/g, '&amp;');
+    data = data.replace(/"/g, '&quot;');
+    
+    return data
+}
+
 function do_end_br_replace(data) {
     data = data.replace(/(\n| )+$/, '\n');
     
@@ -282,12 +291,12 @@ function do_onmark_link_render(data, data_js, name_doc, name_include, data_nowik
                     file_name = file_type.slice(0, file_type.length - 1).join('.');
                     file_type = file_type[file_type.length - 1];
 
-                    var file_src = do_url_change(file_name) + '.' + file_type;       
-                    var file_alt = file_name + '.' + file_type;
+                    var file_src = do_url_change(do_xss_change(file_name)) + '.' + do_html_escape(file_type);
+                    var file_alt = do_html_escape(file_name + '.' + file_type);
                     var file_exist = 1;
                 } else {
-                    var file_src = file_name;
-                    var file_alt = file_name;
+                    var file_src = do_html_escape(file_name);
+                    var file_alt = do_html_escape(file_name);
                     var file_exist = 0;
                 }
 
@@ -327,7 +336,7 @@ function do_onmark_link_render(data, data_js, name_doc, name_include, data_nowik
                                 'under_style="' + file_style + '" ' +
                                 'under_alt="' + file_alt + '" ' +
                                 'under_src="' + file_src + '" ' +
-                                'under_href="' + (file_exist === 0 ? "out_link" : '/upload?name=' + do_url_change(file_name)) + '">' +
+                                'under_href="' + (file_exist === 0 ? "out_link" : '/upload?name=' + file_src.replace(/\.[^.]+$/, '')) + '">' +
                         '</span>' + 
                     '</span>' +
                 ''

views/main_css/js/render_wiki.js

@@ -202,7 +202,7 @@ function get_file_state_intermal(data, data_inter) {
                                             'under_style="' + data_class[key_4].getAttribute('under_style') + '" ' +
                                             'under_alt="' + data_class[key_4].getAttribute('under_alt') + '" ' +
                                             'under_src="/image/' + data_dict[key_3]['file_sha224'] + '.' + data_dict[key_3]['file_type'] + '">' + 
-                                            '(' + data_class[key_4].getAttribute('under_alt') + ' load)' +
+                                            '(' + data_class[key_4].getAttribute('under_alt') + ' GET)' +
                                         '</a>' +
                                     '';
                                 }
@@ -210,11 +210,10 @@ function get_file_state_intermal(data, data_inter) {
                                 for(var key_4 in data_dict[key_3]['list']) {
                                     var key_4 = data_dict[key_3]['list'][key_4];
                                     document.getElementsByClassName(data + 'file_finder')[key_4].innerHTML = '' +
-                                        '<a href="/w/file:' + data_class[key_4].getAttribute('under_alt') + '">' + 
-                                            '<img   style="' + data_class[key_4].getAttribute('under_style') + '" ' + 
-                                                    'alt="' + data_class[key_4].getAttribute('under_alt') + '" ' + 
-                                                    'src="/image/' + data_dict[key_3]['file_sha224'] + '.' + data_dict[key_3]['file_type'] + '">' +
-                                        '</a>' +
+                                        '<img   style="' + data_class[key_4].getAttribute('under_style') + ';cursor: pointer;" ' + 
+                                                'onclick="window.location.href=\'/w/file:' + data_class[key_4].getAttribute('under_src') + '\';"' +
+                                                'alt="' + data_class[key_4].getAttribute('under_alt') + '" ' + 
+                                                'src="/image/' + data_dict[key_3]['file_sha224'] + '.' + data_dict[key_3]['file_type'] + '">' +
                                     '';
                                 }
                             }