[galaxy-commits] commit/galaxy-central: 34 new changesets

23 Oct 2012

34 new commits in galaxy-central:


https://bitbucket.org/galaxy/galaxy-central/changeset/b22b643e77b9/
changeset:   b22b643e77b9
user:        dan
date:        2012-10-23 17:05:59
summary:     Add helper method to allow html escaping and replacing newlines with breaks and use it for rendering readme and long description.
affected #:  1 file

diff -r 06b3b644188a29b78e8400298c67472b5b6bd790 -r b22b643e77b98544ac65becb16626be403578792 templates/webapps/community/common/common.mako

--- a/templates/webapps/community/common/common.mako
+++ b/templates/webapps/community/common/common.mako
@@ -1,3 +1,11 @@
+<%def name="escape_html_add_breaks( value )">
+    <%
+        import markupsafe
+        value = str( markupsafe.escape( value ) ).replace( '\n', '<br/>' )
+    %>
+    ${value}
+</%def>
+
 <%def name="render_star_rating( name, rating, disabled=False )"><%
         if disabled:
@@ -15,7 +23,6 @@
 </%def><%def name="render_readme( readme_text )">
-    <% readme_text = readme_text.replace( '\n', '<br/>' ) %><style type="text/css">
         #readme_table{ table-layout:fixed;
                        width:100%;
@@ -31,7 +38,7 @@
         <div class="toolFormBody"><div class="form-row"><table id="readme_table">
-                    <tr><td>${readme_text}</td></tr>
+                    <tr><td>${ escape_html_add_breaks( readme_text ) }</td></tr></table></div></div>
@@ -39,7 +46,6 @@
 </%def><%def name="render_long_description( description_text )">
-    <% description_text = description_text.replace( '\n', '<br/>' ) %><style type="text/css">
         #description_table{ table-layout:fixed;
                             width:100%;
@@ -53,7 +59,7 @@
     <div class="form-row"><label>Detailed description:</label><table id="description_table">
-            <tr><td>${description_text}</td></tr>
+            <tr><td>${ escape_html_add_breaks( description_text ) }</td></tr></table><div style="clear: both"></div></div>



https://bitbucket.org/galaxy/galaxy-central/changeset/dc8b436cba17/
changeset:   dc8b436cba17
user:        dan
date:        2012-10-23 17:05:59
summary:     HTML escape values that could be set by the user in templates/webapps/community/admin/statistics.mako.
affected #:  1 file

diff -r b22b643e77b98544ac65becb16626be403578792 -r dc8b436cba17a907d9b5b3b2a79514f52f67256e templates/webapps/community/admin/statistics.mako
--- a/templates/webapps/community/admin/statistics.mako
+++ b/templates/webapps/community/admin/statistics.mako
@@ -16,35 +16,35 @@
                     </tr><tr><td>Total repositories</td>
-                        <td>${trans.app.shed_counter.repositories}</td>
+                        <td>${trans.app.shed_counter.repositories | h}</td></tr><tr><td>Empty repositories</td>
-                        <td>${trans.app.shed_counter.new_repositories}</td>
+                        <td>${trans.app.shed_counter.new_repositories | h}</td></tr><tr><td>Deleted repositories</td>
-                        <td>${trans.app.shed_counter.deleted_repositories}</td>
+                        <td>${trans.app.shed_counter.deleted_repositories | h}</td></tr><tr><td>Valid tools</td>
-                        <td>${trans.app.shed_counter.valid_tools}</td>
+                        <td>${trans.app.shed_counter.valid_tools | h}</td></tr><tr><td>Invalid tools</td>
-                        <td>${trans.app.shed_counter.invalid_tools}</td>
+                        <td>${trans.app.shed_counter.invalid_tools | h}</td></tr><tr><td>Workflows</td>
-                        <td>${trans.app.shed_counter.workflows}</td>
+                        <td>${trans.app.shed_counter.workflows | h}</td></tr><tr><td>Proprietary datatypes</td>
-                        <td>${trans.app.shed_counter.proprietary_datatypes}</td>
+                        <td>${trans.app.shed_counter.proprietary_datatypes | h}</td></tr><tr><td>Total clones</td>
-                        <td>${trans.app.shed_counter.total_clones}</td>
+                        <td>${trans.app.shed_counter.total_clones | h}</td></tr></table></div>



https://bitbucket.org/galaxy/galaxy-central/changeset/5a9c7d2c9914/
changeset:   5a9c7d2c9914
user:        dan
date:        2012-10-23 17:05:59
summary:     HTML escape values that could be set by the user in templates/webapps/community/base_panels.mako.
affected #:  1 file

diff -r dc8b436cba17a907d9b5b3b2a79514f52f67256e -r 5a9c7d2c9914bb7b4c2b9626b8722138dab1ac10 templates/webapps/community/base_panels.mako
--- a/templates/webapps/community/base_panels.mako
+++ b/templates/webapps/community/base_panels.mako
@@ -50,10 +50,10 @@
                                             ${menu_item[0]}
                                         %elif len ( menu_item ) == 2:
                                             <% name, link = menu_item %>
-                                            <a href="${link}">${name}</a>
+                                            <a href="${link}">${name | h}</a>
                                         %else:
                                             <% name, link, target = menu_item %>
-                                            <a target="${target}" href="${link}">${name}</a>
+                                            <a target="${target}" href="${link}">${name | h}</a>
                                         %endif
                                         </li>
                                     %endif



https://bitbucket.org/galaxy/galaxy-central/changeset/30ba3eb8752d/
changeset:   30ba3eb8752d
user:        dan
date:        2012-10-23 17:06:00
summary:     HTML escape values that could be set by the user in templates/webapps/community/category/create_category.mako.
affected #:  1 file

diff -r 5a9c7d2c9914bb7b4c2b9626b8722138dab1ac10 -r 30ba3eb8752d2d81076bb262dfcdebc0c072cf32 templates/webapps/community/category/create_category.mako
--- a/templates/webapps/community/category/create_category.mako
+++ b/templates/webapps/community/category/create_category.mako
@@ -20,11 +20,11 @@
         <form name="create_category_form" id="create_category_form" action="${h.url_for( action='create_category' )}" method="post" ><div class="form-row"><label>Name:</label>
-                <input  name="name" type="textfield" value="${name}" size=40"/>
+                <input  name="name" type="textfield" value="${name | h}" size=40"/></div><div class="form-row"><label>Description:</label>
-                <input  name="description" type="textfield" value="${description}" size=40"/>
+                <input  name="description" type="textfield" value="${description | h}" size=40"/></div><div class="form-row"><input type="submit" name="create_category_button" value="Save"/>



https://bitbucket.org/galaxy/galaxy-central/changeset/1763560b7737/
changeset:   1763560b7737
user:        dan
date:        2012-10-23 17:06:00
summary:     HTML escape values that could be set by the user in templates/webapps/community/category/edit_category.mako.
affected #:  1 file

diff -r 30ba3eb8752d2d81076bb262dfcdebc0c072cf32 -r 1763560b7737d656bdf2aa091b1c3979580c48a3 templates/webapps/community/category/edit_category.mako
--- a/templates/webapps/community/category/edit_category.mako
+++ b/templates/webapps/community/category/edit_category.mako
@@ -12,14 +12,14 @@
             <div class="form-row"><label>Name:</label><div style="float: left; width: 250px; margin-right: 10px;">
-                    <input type="text" name="name" value="${category.name}" size="40"/>
+                    <input type="text" name="name" value="${category.name | h}" size="40"/></div><div style="clear: both"></div></div><div class="form-row"><label>Description:</label><div style="float: left; width: 250px; margin-right: 10px;">
-                    <input  name="description" type="textfield" value="${category.description}" size=40"/>
+                    <input  name="description" type="textfield" value="${category.description | h}" size=40"/></div><div style="clear: both"></div></div>



https://bitbucket.org/galaxy/galaxy-central/changeset/185c6185de86/
changeset:   185c6185de86
user:        dan
date:        2012-10-23 17:06:00
summary:     HTML escape values that could be set by the user in templates/webapps/community/category/grid.mako.
affected #:  1 file

diff -r 1763560b7737d656bdf2aa091b1c3979580c48a3 -r 185c6185de86b9aa282bdd80ab3f75adca6e4991 templates/webapps/community/category/grid.mako
--- a/templates/webapps/community/category/grid.mako
+++ b/templates/webapps/community/category/grid.mako
@@ -14,13 +14,13 @@
             <ul class="manage-table-actions">
                 %if len( grid.global_actions ) < 4:
                     %for action in grid.global_actions:
-                        <li><a class="action-button" href="${h.url_for( **action.url_args )}">${action.label}</a></li>
+                        <li><a class="action-button" href="${h.url_for( **action.url_args )}">${action.label | h}</a></li>
                     %endfor
                 %else:
                     <li><a class="action-button" id="action-8675309-popup" class="menubutton">Actions</a></li><div popupmenu="action-8675309-popup">
                         %for action in grid.global_actions:
-                            <a class="action-button" href="${h.url_for( **action.url_args )}">${action.label}</a>
+                            <a class="action-button" href="${h.url_for( **action.url_args )}">${action.label | h}</a>
                         %endfor
                     </div>
                 %endif



https://bitbucket.org/galaxy/galaxy-central/changeset/a850f48f7ae6/
changeset:   a850f48f7ae6
user:        dan
date:        2012-10-23 17:06:00
summary:     HTML escape values that could be set by the user in templates/webapps/community/category/valid_grid.mako.
affected #:  1 file

diff -r 185c6185de86b9aa282bdd80ab3f75adca6e4991 -r a850f48f7ae62221a3858f1445e4b1d11206598f templates/webapps/community/category/valid_grid.mako
--- a/templates/webapps/community/category/valid_grid.mako
+++ b/templates/webapps/community/category/valid_grid.mako
@@ -13,13 +13,13 @@
             <ul class="manage-table-actions">
                 %if len( grid.global_actions ) < 4:
                     %for action in grid.global_actions:
-                        <li><a class="action-button" href="${h.url_for( **action.url_args )}">${action.label}</a></li>
+                        <li><a class="action-button" href="${h.url_for( **action.url_args )}">${action.label | h}</a></li>
                     %endfor
                 %else:
                     <li><a class="action-button" id="action-8675309-popup" class="menubutton">Actions</a></li><div popupmenu="action-8675309-popup">
                         %for action in grid.global_actions:
-                            <a class="action-button" href="${h.url_for( **action.url_args )}">${action.label}</a>
+                            <a class="action-button" href="${h.url_for( **action.url_args )}">${action.label | h}</a>
                         %endfor
                     </div>
                 %endif



https://bitbucket.org/galaxy/galaxy-central/changeset/92646b4f0ef6/
changeset:   92646b4f0ef6
user:        dan
date:        2012-10-23 17:06:00
summary:     HTML escape hg ces that could be set by the user in templates/webapps/community/common/view_readme.mako.
affected #:  1 file

diff -r a850f48f7ae62221a3858f1445e4b1d11206598f -r 92646b4f0ef669cdb74fa131c00084ad55a6ead2 templates/webapps/community/common/view_readme.mako
--- a/templates/webapps/community/common/view_readme.mako
+++ b/templates/webapps/community/common/view_readme.mako
@@ -40,7 +40,7 @@
                 <a class="action-button" href="${h.url_for( controller='repository', action='rate_repository', id=trans.app.security.encode_id( repository.id ) )}">Rate repository</a>
             %endif
             %if can_browse_contents:
-                <a class="action-button" href="${h.url_for( controller='repository', action='browse_repository', id=trans.app.security.encode_id( repository.id ) )}">${browse_label}</a>
+                <a class="action-button" href="${h.url_for( controller='repository', action='browse_repository', id=trans.app.security.encode_id( repository.id ) )}">${browse_label | h}</a>
             %endif
             %if can_contact_owner:
                 <a class="action-button" href="${h.url_for( controller='repository', action='contact_owner', id=trans.security.encode_id( repository.id ) )}">Contact repository owner</a>



https://bitbucket.org/galaxy/galaxy-central/changeset/dc24ef2a00fb/
changeset:   dc24ef2a00fb
user:        dan
date:        2012-10-23 17:06:01
summary:     HTML escape values that could be set by the user in templates/webapps/community/index.mako.
affected #:  1 file

diff -r 92646b4f0ef669cdb74fa131c00084ad55a6ead2 -r dc24ef2a00fb078959e7fdadc961663bcd280e7f templates/webapps/community/index.mako
--- a/templates/webapps/community/index.mako
+++ b/templates/webapps/community/index.mako
@@ -39,7 +39,7 @@
 <%def name="left_panel()"><% can_review_repositories = trans.app.security_agent.user_can_review_repositories( trans.user ) %><div class="unified-panel-header" unselectable="on">
-        <div class='unified-panel-header-inner'>${trans.app.shed_counter.valid_tools} valid tools on ${trans.app.shed_counter.generation_time}</div>
+        <div class='unified-panel-header-inner'>${trans.app.shed_counter.valid_tools | h} valid tools on ${trans.app.shed_counter.generation_time | h}</div></div><div class="page-container" style="padding: 10px;"><div class="toolMenu">



https://bitbucket.org/galaxy/galaxy-central/changeset/47f0fcbe6d64/
changeset:   47f0fcbe6d64
user:        dan
date:        2012-10-23 17:06:05
summary:     HTML escape values that could be set by the user in templates/webapps/community/repository/browse_invalid_tools.mako.
affected #:  1 file

diff -r dc24ef2a00fb078959e7fdadc961663bcd280e7f -r 47f0fcbe6d6442c19170327c944266093b7445a6 templates/webapps/community/repository/browse_invalid_tools.mako
--- a/templates/webapps/community/repository/browse_invalid_tools.mako
+++ b/templates/webapps/community/repository/browse_invalid_tools.mako
@@ -24,9 +24,9 @@
                                     ${invalid_tool_config}
                                 </a></td>
-                            <td>${repository_name}</td>
-                            <td>${repository_owner}</td>
-                            <td>${changeset_revision}</td>
+                            <td>${repository_name | h}</td>
+                            <td>${repository_owner | h}</td>
+                            <td>${changeset_revision | h}</td></tr>
                     %endfor
                 </table>



https://bitbucket.org/galaxy/galaxy-central/changeset/4ede4449df8e/
changeset:   4ede4449df8e
user:        dan
date:        2012-10-23 17:06:06
summary:     HTML escape values that could be set by the user in templates/webapps/community/repository/browse_repository.mako.
affected #:  1 file

diff -r 47f0fcbe6d6442c19170327c944266093b7445a6 -r 4ede4449df8e43cade2a9a5c395be9eeae586d38 templates/webapps/community/repository/browse_repository.mako
--- a/templates/webapps/community/repository/browse_repository.mako
+++ b/templates/webapps/community/repository/browse_repository.mako
@@ -101,7 +101,7 @@
 
 %if can_browse_contents:
     <div class="toolForm">
-        <div class="toolFormTitle">Browse ${repository.name} revision ${repository.tip} (repository tip)</div>
+        <div class="toolFormTitle">Browse ${repository.name | h} revision ${repository.tip | h} (repository tip)</div>
         %if can_download:
             <div class="form-row"><label>Clone this repository:</label>
@@ -124,7 +124,7 @@
                     <label>Message:</label><div class="form-row-input">
                         %if commit_message:
-                            <textarea name="commit_message" rows="3" cols="35">${commit_message}</textarea>
+                            <textarea name="commit_message" rows="3" cols="35">${commit_message | h}</textarea>
                         %else:
                             <textarea name="commit_message" rows="3" cols="35"></textarea>
                         %endif



https://bitbucket.org/galaxy/galaxy-central/changeset/d2b0c5110534/
changeset:   d2b0c5110534
user:        dan
date:        2012-10-23 17:06:06
summary:     HTML escape values that could be set by the user in templates/webapps/community/repository/common.mako.
affected #:  1 file

diff -r 4ede4449df8e43cade2a9a5c395be9eeae586d38 -r d2b0c51105347748ce6863ab0a217c86daa295c8 templates/webapps/community/repository/common.mako
--- a/templates/webapps/community/repository/common.mako
+++ b/templates/webapps/community/repository/common.mako
@@ -126,9 +126,9 @@
                                                 type = requirements_dict[ 'type' ]
                                             %><tr>
-                                                <td>${name}</td>
-                                                <td>${version}</td>
-                                                <td>${type}</td>
+                                                <td>${name | h}</td>
+                                                <td>${version | h}</td>
+                                                <td>${type | h}</td></tr>
                                         %endif
                                     %endfor
@@ -154,8 +154,8 @@
                                     <% environment_settings = tool_dependencies[ 'set_environment' ] %>
                                     %for requirements_dict in environment_settings:
                                         <tr>
-                                            <td>${requirements_dict[ 'name' ]}</td>
-                                            <td>${requirements_dict[ 'type' ]}</td>
+                                            <td>${requirements_dict[ 'name' ] | h}</td>
+                                            <td>${requirements_dict[ 'type' ] | h}</td></tr>
                                     %endfor
                                 </table>
@@ -190,8 +190,8 @@
                                                 <a class="action-button" href="${h.url_for( controller='repository', action='view_tool_metadata', repository_id=trans.security.encode_id( repository.id ), changeset_revision=changeset_revision, tool_id=tool_dict[ 'id' ] )}">View tool metadata</a></div></td>
-                                        <td>${tool_dict[ 'description' ]}</td>
-                                        <td>${tool_dict[ 'version' ]}</td>
+                                        <td>${tool_dict[ 'description' ] | h}</td>
+                                        <td>${tool_dict[ 'version' ] | h}</td><td><%
                                                 if 'requirements' in tool_dict:
@@ -206,7 +206,7 @@
                                                         requirements_str += '%s (%s), ' % ( requirement_dict[ 'name' ], requirement_dict[ 'type' ] )
                                                     requirements_str = requirements_str.rstrip( ', ' )
                                                 %>
-                                                ${requirements_str}
+                                                ${requirements_str | h}
                                             %else:
                                                 none
                                             %endif
@@ -233,7 +233,7 @@
                                     <tr><td><a class="view-info" href="${h.url_for( controller='repository', action='load_invalid_tool', repository_id=trans.security.encode_id( repository.id ), tool_config=invalid_tool_config, changeset_revision=changeset_revision )}">
-                                                ${invalid_tool_config}
+                                                ${invalid_tool_config | h}
                                             </a></td></tr>
@@ -274,7 +274,7 @@
                                     %><tr><td>
-                                            <a href="${h.url_for( controller='workflow', action='view_workflow', repository_metadata_id=repository_metadata_id, workflow_name=tool_shed_encode( workflow_name ) )}">${workflow_name}</a>
+                                            <a href="${h.url_for( controller='workflow', action='view_workflow', repository_metadata_id=repository_metadata_id, workflow_name=tool_shed_encode( workflow_name ) )}">${workflow_name | h}</a></td><td>
                                             %if steps:
@@ -283,8 +283,8 @@
                                                 unknown
                                             %endif
                                         </td>
-                                        <td>${format_version}</td>
-                                        <td>${annotation}</td>
+                                        <td>${format_version | h}</td>
+                                        <td>${annotation | h}</td></tr>
                                 %endfor
                             </table>
@@ -317,10 +317,10 @@
                                         subclass = datatypes_dict.get( 'subclass', ' ' )
                                     %><tr>
-                                        <td>${extension}</td>
-                                        <td>${dtype}</td>
-                                        <td>${mimetype}</td>
-                                        <td>${subclass}</td>
+                                        <td>${extension | h}</td>
+                                        <td>${dtype | h}</td>
+                                        <td>${mimetype | h}</td>
+                                        <td>${subclass | h}</td></tr>
                                 %endfor
                             </table>



https://bitbucket.org/galaxy/galaxy-central/changeset/a8ac1dbc787a/
changeset:   a8ac1dbc787a
user:        dan
date:        2012-10-23 17:06:06
summary:     HTML escape values that could be set by the user in templates/webapps/community/repository/contact_owner.mako.
affected #:  1 file

diff -r d2b0c51105347748ce6863ab0a217c86daa295c8 -r a8ac1dbc787aed0e81050a0ced93b6d97335f427 templates/webapps/community/repository/contact_owner.mako
--- a/templates/webapps/community/repository/contact_owner.mako
+++ b/templates/webapps/community/repository/contact_owner.mako
@@ -50,7 +50,7 @@
                 <a class="action-button" href="${h.url_for( controller='repository', action='view_changelog', id=trans.app.security.encode_id( repository.id ) )}">View change log</a>
             %endif
             %if can_browse_contents:
-                <a class="action-button" href="${h.url_for( controller='repository', action='browse_repository', id=trans.app.security.encode_id( repository.id ) )}">${browse_label}</a>
+                <a class="action-button" href="${h.url_for( controller='repository', action='browse_repository', id=trans.app.security.encode_id( repository.id ) )}">${browse_label | h}</a>
             %endif
             %if can_download:
                 <a class="action-button" href="${h.url_for( controller='repository', action='download', repository_id=trans.app.security.encode_id( repository.id ), changeset_revision=repository.tip, file_type='gz' )}">Download as a .tar.gz file</a>
@@ -66,7 +66,7 @@
 %endif
 
 <div class="toolForm">
-    <div class="toolFormTitle">Contact the owner of the repository named '${repository.name}'</div>
+    <div class="toolFormTitle">Contact the owner of the repository named '${repository.name | h}'</div><div class="toolFormBody"><div class="form-row">
             This feature is intended to streamline appropriate communication between



https://bitbucket.org/galaxy/galaxy-central/changeset/80d3c1980287/
changeset:   80d3c1980287
user:        dan
date:        2012-10-23 17:06:06
summary:     HTML escape values that could be set by the user in templates/webapps/community/repository/create_repository.mako.
affected #:  1 file

diff -r a8ac1dbc787aed0e81050a0ced93b6d97335f427 -r 80d3c198028702dbc06e6a3c965d9f98101c8632 templates/webapps/community/repository/create_repository.mako
--- a/templates/webapps/community/repository/create_repository.mako
+++ b/templates/webapps/community/repository/create_repository.mako
@@ -20,18 +20,18 @@
         <form name="create_repository_form" id="create_repository_form" action="${h.url_for( controller='repository', action='create_repository' )}" method="post" ><div class="form-row"><label>Name:</label>
-                <input  name="name" type="textfield" value="${name}" size="40"/>
+                <input  name="name" type="textfield" value="${name | h}" size="40"/><div style="clear: both"></div></div><div class="form-row"><label>Synopsis:</label>
-                <input  name="description" type="textfield" value="${description}" size="80"/>
+                <input  name="description" type="textfield" value="${description | h}" size="80"/><div style="clear: both"></div></div><div class="form-row"><label>Detailed description:</label>
                 %if long_description:
-                    <pre><textarea name="long_description" rows="3" cols="80">${long_description}</textarea></pre>
+                    <pre><textarea name="long_description" rows="3" cols="80">${long_description | h}</textarea></pre>
                 %else:
                     <textarea name="long_description" rows="3" cols="80"></textarea>
                 %endif
@@ -43,9 +43,9 @@
                     <select name="category_id" multiple>
                         %for category in categories:
                             %if category.id in selected_categories:
-                                <option value="${trans.security.encode_id( category.id )}" selected>${category.name}</option>
+                                <option value="${trans.security.encode_id( category.id )}" selected>${category.name | h}</option>
                             %else:
-                                <option value="${trans.security.encode_id( category.id )}">${category.name}</option>
+                                <option value="${trans.security.encode_id( category.id )}">${category.name | h}</option>
                             %endif
                         %endfor
                     </select>



https://bitbucket.org/galaxy/galaxy-central/changeset/4163748b0a93/
changeset:   4163748b0a93
user:        dan
date:        2012-10-23 17:06:06
summary:     HTML escape values that could be set by the user in templates/webapps/community/repository/find_tools.mako.
affected #:  1 file

diff -r 80d3c198028702dbc06e6a3c965d9f98101c8632 -r 4163748b0a93004b390e1e53952e2ebce30ec750 templates/webapps/community/repository/find_tools.mako
--- a/templates/webapps/community/repository/find_tools.mako
+++ b/templates/webapps/community/repository/find_tools.mako
@@ -35,17 +35,17 @@
         <form name="find_tools" id="find_tools" action="${h.url_for( controller='repository', action='find_tools' )}" method="post" ><div class="form-row"><label>Tool id:</label>
-                <input name="tool_id" type="textfield" value="${tool_id}" size="40"/>
+                <input name="tool_id" type="textfield" value="${tool_id | h}" size="40"/></div><div style="clear: both"></div><div class="form-row"><label>Tool name:</label>
-                <input name="tool_name" type="textfield" value="${tool_name}" size="40"/>
+                <input name="tool_name" type="textfield" value="${tool_name | h}" size="40"/></div><div style="clear: both"></div><div class="form-row"><label>Tool version:</label>
-                <input name="tool_version" type="textfield" value="${tool_version}" size="40"/>
+                <input name="tool_version" type="textfield" value="${tool_version | h}" size="40"/></div><div style="clear: both"></div><div class="form-row">



https://bitbucket.org/galaxy/galaxy-central/changeset/119b61fcc0f2/
changeset:   119b61fcc0f2
user:        dan
date:        2012-10-23 17:06:11
summary:     HTML escape values that could be set by the user in templates/webapps/community/repository/find_workflows.mako.
affected #:  1 file

diff -r 4163748b0a93004b390e1e53952e2ebce30ec750 -r 119b61fcc0f27eda4460a0a4debea1944bac1ba6 templates/webapps/community/repository/find_workflows.mako
--- a/templates/webapps/community/repository/find_workflows.mako
+++ b/templates/webapps/community/repository/find_workflows.mako
@@ -34,7 +34,7 @@
             <div style="clear: both"></div><div class="form-row"><label>Workflow name:</label>
-                <input name="workflow_name" type="textfield" value="${workflow_name}" size="40"/>
+                <input name="workflow_name" type="textfield" value="${workflow_name | h}" size="40"/></div><div style="clear: both"></div><div class="form-row">



https://bitbucket.org/galaxy/galaxy-central/changeset/c5c5b77e7beb/
changeset:   c5c5b77e7beb
user:        dan
date:        2012-10-23 17:06:11
summary:     HTML escape values that could be set by the user in templates/webapps/community/repository/manage_repository.mako.
affected #:  1 file

diff -r 119b61fcc0f27eda4460a0a4debea1944bac1ba6 -r c5c5b77e7bebb2587f1567385d58338fec604513 templates/webapps/community/repository/manage_repository.mako
--- a/templates/webapps/community/repository/manage_repository.mako
+++ b/templates/webapps/community/repository/manage_repository.mako
@@ -82,7 +82,7 @@
                     <a class="action-button" href="${h.url_for( controller='repository', action='rate_repository', id=trans.app.security.encode_id( repository.id ) )}">Rate repository</a>
                 %endif
                 %if can_browse_contents:
-                    <a class="action-button" href="${h.url_for( controller='repository', action='browse_repository', id=trans.app.security.encode_id( repository.id ) )}">${browse_label}</a>
+                    <a class="action-button" href="${h.url_for( controller='repository', action='browse_repository', id=trans.app.security.encode_id( repository.id ) )}">${browse_label | h}</a>
                 %endif
                 %if can_contact_owner:
                     <a class="action-button" href="${h.url_for( controller='repository', action='contact_owner', id=trans.security.encode_id( repository.id ) )}">Contact repository owner</a>
@@ -137,7 +137,7 @@
     <p/>
 %endif
 <div class="toolForm">
-    <div class="toolFormTitle">Repository '${repository.name}'</div>
+    <div class="toolFormTitle">Repository '${repository.name | h}'</div><div class="toolFormBody"><form name="edit_repository" id="edit_repository" action="${h.url_for( controller='repository', action='manage_repository', id=trans.security.encode_id( repository.id ) )}" method="post" >
             %if can_download:
@@ -151,7 +151,7 @@
                 %if repository.times_downloaded > 0:
                     ${repository.name}
                 %else:
-                    <input name="repo_name" type="textfield" value="${repository.name}" size="40"/>
+                    <input name="repo_name" type="textfield" value="${repository.name | h}" size="40"/>
                 %endif
                 <div class="toolParamHelp" style="clear: both;">
                     Repository names cannot be changed if the repository has been cloned.
@@ -160,13 +160,13 @@
             </div><div class="form-row"><label>Synopsis:</label>
-                <input name="description" type="textfield" value="${description}" size="80"/>
+                <input name="description" type="textfield" value="${description | h}" size="80"/><div style="clear: both"></div></div><div class="form-row"><label>Detailed description:</label>
                 %if long_description:
-                    <pre><textarea name="long_description" rows="3" cols="80">${long_description}</textarea></pre>
+                    <pre><textarea name="long_description" rows="3" cols="80">${long_description | h}</textarea></pre>
                 %else:
                     <textarea name="long_description" rows="3" cols="80"></textarea>
                 %endif
@@ -175,27 +175,27 @@
             <div class="form-row"><label>Revision:</label>
                 %if can_view_change_log:
-                    <a href="${h.url_for( controller='repository', action='view_changelog', id=trans.app.security.encode_id( repository.id ) )}">${revision_label}</a>
+                    <a href="${h.url_for( controller='repository', action='view_changelog', id=trans.app.security.encode_id( repository.id ) )}">${revision_label | h}</a>
                 %else:
-                    ${revision_label}
+                    ${revision_label | h}
                 %endif
             </div><div class="form-row"><label>Owner:</label>
-                ${repository.user.username}
+                ${repository.user.username | h}
             </div><div class="form-row"><label>Times downloaded:</label>
-                ${repository.times_downloaded}
+                ${repository.times_downloaded | h}
             </div>
             %if is_admin:
                 <div class="form-row"><label>Location:</label>
-                    ${repository.repo_path}
+                    ${repository.repo_path | h}
                 </div><div class="form-row"><label>Deleted:</label>
-                    ${repository.deleted}
+                    ${repository.deleted | h}
                 </div>
             %endif
             <div class="form-row">
@@ -215,9 +215,9 @@
                 <select name="category_id" multiple>
                     %for category in categories:
                         %if category.id in selected_categories:
-                            <option value="${trans.security.encode_id( category.id )}" selected>${category.name}</option>
+                            <option value="${trans.security.encode_id( category.id )}" selected>${category.name | h}</option>
                         %else:
-                            <option value="${trans.security.encode_id( category.id )}">${category.name}</option>
+                            <option value="${trans.security.encode_id( category.id )}">${category.name | h}</option>
                         %endif
                     %endfor
                 </select>
@@ -258,14 +258,14 @@
     <div class="toolFormBody"><table class="grid"><tr>
-                <td>${repository.user.username}</td>
+                <td>${repository.user.username | h}</td><td>owner</td><td> </td></tr>
             %for username in current_allow_push_list:
                 %if username != repository.user.username:
                     <tr>
-                        <td>${username}</td>
+                        <td>${username | h}</td><td>write</td><td><a class="action-button" href="${h.url_for( controller='repository', action='manage_repository', id=trans.security.encode_id( repository.id ), user_access_button='Remove', remove_auth=username )}">remove</a></tr>
@@ -295,7 +295,7 @@
         <div class="toolFormBody"><div class="form-row"><label>Times Rated:</label>
-                ${num_ratings}
+                ${num_ratings | h}
                 <div style="clear: both"></div></div><div class="form-row">
@@ -329,9 +329,9 @@
                         %><tr><td>${render_star_rating( name, review.rating, disabled=True )}</td>
-                            <td><pre>${review.comment}</pre></td>
+                            <td><pre>${review.comment | h}</pre></td><td>${time_ago( review.update_time )}</td>
-                            <td>${review.user.username}</td>
+                            <td>${review.user.username | h}</td></tr>
                     %endfor
                 </table>



https://bitbucket.org/galaxy/galaxy-central/changeset/645953b633e2/
changeset:   645953b633e2
user:        dan
date:        2012-10-23 17:06:12
summary:     HTML escape values that could be set by the user in templates/webapps/community/repository/preview_tools_in_changeset.mako.
affected #:  1 file

diff -r c5c5b77e7bebb2587f1567385d58338fec604513 -r 645953b633e220d76128b4c68172549cd07d6dc8 templates/webapps/community/repository/preview_tools_in_changeset.mako
--- a/templates/webapps/community/repository/preview_tools_in_changeset.mako
+++ b/templates/webapps/community/repository/preview_tools_in_changeset.mako
@@ -53,7 +53,7 @@
 %endif
 
 <div class="toolForm">
-    <div class="toolFormTitle">Repository ${repository.name}</div>
+    <div class="toolFormTitle">Repository ${repository.name | h}</div><div class="toolFormBody">
         %if len( changeset_revision_select_field.options ) > 1:
             <form name="change_revision" id="change_revision" action="${h.url_for( controller='repository', action='preview_tools_in_changeset', repository_id=trans.security.encode_id( repository.id ) )}" method="post" >
@@ -64,7 +64,7 @@
                         else:
                             tip_str = ''
                     %>
-                    ${changeset_revision_select_field.get_html()} <i>${tip_str}</i>
+                    ${changeset_revision_select_field.get_html()} <i>${tip_str | h}</i><div class="toolParamHelp" style="clear: both;">
                         Select a revision to inspect and download versions of tools from this repository.
                     </div>
@@ -73,7 +73,7 @@
         %else:
             <div class="form-row"><label>Revision:</label>
-                ${revision_label}
+                ${revision_label | h}
             </div>
         %endif
     </div>



https://bitbucket.org/galaxy/galaxy-central/changeset/967d90f0fd7f/
changeset:   967d90f0fd7f
user:        dan
date:        2012-10-23 17:06:12
summary:     HTML escape values that could be set by the user in templates/webapps/community/repository/rate_repository.mako.
affected #:  1 file

diff -r 645953b633e220d76128b4c68172549cd07d6dc8 -r 967d90f0fd7fe97acd0e636f1df99a0851e29527 templates/webapps/community/repository/rate_repository.mako
--- a/templates/webapps/community/repository/rate_repository.mako
+++ b/templates/webapps/community/repository/rate_repository.mako
@@ -91,7 +91,7 @@
                 <a class="action-button" href="${h.url_for( controller='repository', action='view_changelog', id=trans.app.security.encode_id( repository.id ) )}">View change log</a>
             %endif
             %if can_browse_contents:
-                <a class="action-button" href="${h.url_for( controller='repository', action='browse_repository', id=trans.app.security.encode_id( repository.id ) )}">${browse_label}</a>
+                <a class="action-button" href="${h.url_for( controller='repository', action='browse_repository', id=trans.app.security.encode_id( repository.id ) )}">${browse_label | h}</a>
             %endif
             %if can_contact_owner:
                 <a class="action-button" href="${h.url_for( controller='repository', action='contact_owner', id=trans.security.encode_id( repository.id ) )}">Contact repository owner</a>
@@ -107,7 +107,7 @@
 
 %if repository.user != trans.user:
     <div class="toolForm">
-        <div class="toolFormTitle">${repository.name}</div>
+        <div class="toolFormTitle">${repository.name | h}</div>
         %if can_download:
             <div class="form-row"><label>Clone this repository:</label>
@@ -117,17 +117,17 @@
         <div class="toolFormBody"><div class="form-row"><label>Description:</label>
-                ${repository.description}
+                ${repository.description | h}
                 <div style="clear: both"></div></div><div class="form-row"><label>Version:</label>
-                ${repository.revision}
+                ${repository.revision | h}
                 <div style="clear: both"></div></div><div class="form-row"><label>Owner:</label>
-                ${repository.user.username}
+                ${repository.user.username | h}
                 <div style="clear: both"></div></div></div>
@@ -139,7 +139,7 @@
             <form id="rate_repository" name="rate_repository" action="${h.url_for( controller='repository', action='rate_repository', id=trans.security.encode_id( repository.id ) )}" method="post"><div class="form-row"><label>Times Rated:</label>
-                    ${num_ratings}
+                    ${num_ratings | h}
                     <div style="clear: both"></div></div><div class="form-row">
@@ -162,7 +162,7 @@
                     <label>Review:</label>
                     %if rra and rra.comment:
                         <div class="form-row-input">
-                            <pre><textarea name="comment" rows="5" cols="80">${rra.comment}</textarea></pre>
+                            <pre><textarea name="comment" rows="5" cols="80">${rra.comment | h}</textarea></pre></div>
                     %else:
                         <div class="form-row-input">
@@ -202,9 +202,9 @@
                             %><tr><td>${render_star_rating( name, review.rating, disabled=True )}</td>
-                                <td><pre>${review.comment}</pre></td>
+                                <td><pre>${review.comment | h}</pre></td><td>${time_ago( review.update_time )}</td>
-                                <td>${review.user.username}</td>
+                                <td>${review.user.username | h}</td></tr>
                         %endfor
                     </table>



https://bitbucket.org/galaxy/galaxy-central/changeset/fdab5aaf2c7b/
changeset:   fdab5aaf2c7b
user:        dan
date:        2012-10-23 17:06:12
summary:     HTML escape values that could be set by the user in templates/webapps/community/repository/tool_form.mako.
affected #:  1 file

diff -r 967d90f0fd7fe97acd0e636f1df99a0851e29527 -r fdab5aaf2c7be522c8dbabcea2d9d8e89710c925 templates/webapps/community/repository/tool_form.mako
--- a/templates/webapps/community/repository/tool_form.mako
+++ b/templates/webapps/community/repository/tool_form.mako
@@ -177,8 +177,8 @@
         %endif
 
         %if tool:
-            <div class="toolForm" id="${tool.id}">
-                <div class="toolFormTitle">${tool.name} (version ${tool.version})</div>
+            <div class="toolForm" id="${tool.id | h}">
+                <div class="toolFormTitle">${tool.name | h} (version ${tool.version | h})</div><div class="toolFormBody"><form id="tool_form" name="tool_form" action="" method="get"><input type="hidden" name="tool_state" value="${util.object_to_string( tool_state.encode( tool, app ) )}">



https://bitbucket.org/galaxy/galaxy-central/changeset/364d8ba060c0/
changeset:   364d8ba060c0
user:        dan
date:        2012-10-23 17:06:12
summary:     HTML escape values that could be set by the user in templates/webapps/community/repository/upload.mako.
affected #:  1 file

diff -r fdab5aaf2c7be522c8dbabcea2d9d8e89710c925 -r 364d8ba060c0cd039071842b7b4a1a78db6389ff templates/webapps/community/repository/upload.mako
--- a/templates/webapps/community/repository/upload.mako
+++ b/templates/webapps/community/repository/upload.mako
@@ -82,7 +82,7 @@
             <div class="form-row"><label>Url:</label><div class="form-row-input">
-                    <input name="url" type="textfield" value="${url}" size="40"/>
+                    <input name="url" type="textfield" value="${url | h}" size="40"/></div><div class="toolParamHelp" style="clear: both;">
                      Enter a URL to upload your files via http.
@@ -141,7 +141,7 @@
                 <label>Change set commit message:</label><div class="form-row-input">
                     %if commit_message:
-                        <pre><textarea name="commit_message" rows="3" cols="35">${commit_message}</textarea></pre>
+                        <pre><textarea name="commit_message" rows="3" cols="35">${commit_message | h}</textarea></pre>
                     %else:
                         <textarea name="commit_message" rows="3" cols="35"></textarea>
                     %endif



https://bitbucket.org/galaxy/galaxy-central/changeset/7a9b86fd9eaf/
changeset:   7a9b86fd9eaf
user:        dan
date:        2012-10-23 17:06:17
summary:     HTML escape values that could be set by the user in templates/webapps/community/repository/view_changelog.mako.
affected #:  1 file

diff -r 364d8ba060c0cd039071842b7b4a1a78db6389ff -r 7a9b86fd9eaf16ed57b75d771f86bc26e775945e templates/webapps/community/repository/view_changelog.mako
--- a/templates/webapps/community/repository/view_changelog.mako
+++ b/templates/webapps/community/repository/view_changelog.mako
@@ -78,7 +78,7 @@
 
 %if can_download:
     <div class="toolForm">
-        <div class="toolFormTitle">${repository.name}</div>
+        <div class="toolFormTitle">${repository.name | h}</div><div class="toolFormBody"><div class="form-row"><label>Clone this repository:</label>
@@ -95,7 +95,7 @@
         else:
             title_str = '%s changesets' % repository.name
     %>
-    <div class="toolFormTitle">${title_str}</div>
+    <div class="toolFormTitle">${title_str | h}</div><% test_date = None %><div class="toolFormBody"><table class="grid">
@@ -128,23 +128,23 @@
                         %endif
                         <div class="form-row"><label>Description:</label>
-                            <a href="${h.url_for( controller='repository', action='view_changeset', id=trans.security.encode_id( repository.id ), ctx_str=ctx_str )}">${changeset[ 'description' ]}</a>
+                            <a href="${h.url_for( controller='repository', action='view_changeset', id=trans.security.encode_id( repository.id ), ctx_str=ctx_str )}">${changeset[ 'description' ] | h}</a></div><div class="form-row"><label>Commit:</label>
-                            <a href="${h.url_for( controller='repository', action='view_changeset', id=trans.security.encode_id( repository.id ), ctx_str=ctx_str )}">${changeset_str}</a>
+                            <a href="${h.url_for( controller='repository', action='view_changeset', id=trans.security.encode_id( repository.id ), ctx_str=ctx_str )}">${changeset_str | h}</a></div><div class="form-row"><label>Parent:</label>
                             %if ctx_parent_str == 'None':
                                 ${ctx_parent_str}
                             %else:
-                                <a href="${h.url_for( controller='repository', action='view_changeset', id=trans.security.encode_id( repository.id ), ctx_str=ctx_parent )}">${ctx_parent_str}</a>
+                                <a href="${h.url_for( controller='repository', action='view_changeset', id=trans.security.encode_id( repository.id ), ctx_str=ctx_parent )}">${ctx_parent_str | h}</a>
                             %endif
                         </div><div class="form-row"><label>Commited by:</label>
-                            ${changeset[ 'user' ].split()[0]}
+                            ${changeset[ 'user' ].split()[0] | h}
                         </div><div class="form-row"><label>Pushed:</label>



https://bitbucket.org/galaxy/galaxy-central/changeset/3740010dbe9e/
changeset:   3740010dbe9e
user:        dan
date:        2012-10-23 17:06:17
summary:     HTML escape values that could be set by the user in templates/webapps/community/repository/view_changeset.mako.
affected #:  1 file

diff -r 7a9b86fd9eaf16ed57b75d771f86bc26e775945e -r 3740010dbe9eb5ae14cbee1ea0458b35e887eef2 templates/webapps/community/repository/view_changeset.mako
--- a/templates/webapps/community/repository/view_changeset.mako
+++ b/templates/webapps/community/repository/view_changeset.mako
@@ -82,7 +82,7 @@
 
 %if can_download:
     <div class="toolForm">
-        <div class="toolFormTitle">${repository.name}</div>
+        <div class="toolFormTitle">${repository.name | h}</div><div class="toolFormBody"><div class="form-row"><label>Clone this repository:</label>
@@ -99,7 +99,7 @@
         else:
             title_str = '%s changeset %s' % ( repository.name, ctx )
     %>
-    <div class="toolFormTitle">${title_str}</div>
+    <div class="toolFormTitle">${title_str | h}</div><div class="toolFormBody"><table class="grid">
             %if modified:
@@ -107,7 +107,7 @@
                     <td><b>modified:</b>
                         %for item in modified:
-                            <br/><a href="#${item}">${item}</a>
+                            <br/><a href="#${item}">${item | h}</a>
                         %endfor
                     </td></tr>
@@ -117,7 +117,7 @@
                     <td><b>added:</b>
                         %for item in added:
-                            <br/><a href="#${item}">${item}</a>
+                            <br/><a href="#${item}">${item | h}</a>
                         %endfor
                     </td></tr>
@@ -127,7 +127,7 @@
                     <td><b>removed:</b>
                         %for item in removed:
-                            <br/><a href="#${item}">${item}</a>
+                            <br/><a href="#${item}">${item | h}</a>
                         %endfor
                     </td></tr>
@@ -137,7 +137,7 @@
                     <td><b>deleted:</b>
                         %for item in deleted:
-                            <br/><a href="#${item}">${item}</a>
+                            <br/><a href="#${item}">${item | h}</a>
                         %endfor
                     </td></tr>
@@ -147,7 +147,7 @@
                     <td><b>unknown:</b>
                         %for item in unknown:
-                            <br/><a href="#${item}">${item}</a>
+                            <br/><a href="#${item}">${item | h}</a>
                         %endfor
                     }</td></tr>
@@ -157,7 +157,7 @@
                     <td><b>ignored:</b>
                         %for item in ignored:
-                            <br/><a href="#${item}">${item}</a>
+                            <br/><a href="#${item}">${item | h}</a>
                         %endfor
                     </td></tr>
@@ -167,7 +167,7 @@
                     <td>
                         clean:
                         %for item in clean:
-                            <br/><a href="#${item}">${item}</a>
+                            <br/><a href="#${item}">${item | h}</a>
                         %endfor
                     </td></tr>
@@ -177,7 +177,6 @@
                     # Read at most the first 10 lines of diff to determine the anchor
                     ctr = 0
                     lines = diff.split( '\n' )
-                    diff = diff.replace( '\n', '<br/>' )
                     anchor_str = ''
                     for line in lines:
                         if ctr > 9:
@@ -189,7 +188,7 @@
                         ctr += 1
                 %><tr><td bgcolor="#E0E0E0">${anchor_str}</td></tr>
-                <tr><td>${diff}</td></tr>
+                <tr><td>${ escape_html_add_breaks( diff ) }</td></tr>
             %endfor
         </table></div>



https://bitbucket.org/galaxy/galaxy-central/changeset/2acad55c0d8b/
changeset:   2acad55c0d8b
user:        dan
date:        2012-10-23 17:06:17
summary:     HTML escape values that could be set by the user in templates/webapps/community/repository/view_repository.mako.
affected #:  1 file

diff -r 3740010dbe9eb5ae14cbee1ea0458b35e887eef2 -r 2acad55c0d8bb6d7c682298b591266be1cee27d0 templates/webapps/community/repository/view_repository.mako
--- a/templates/webapps/community/repository/view_repository.mako
+++ b/templates/webapps/community/repository/view_repository.mako
@@ -143,12 +143,12 @@
             %if can_browse_contents:
                 <a href="${h.url_for( controller='repository', action='browse_repository', id=trans.app.security.encode_id( repository.id ) )}">${repository.name}</a>
             %else:
-                ${repository.name}
+                ${repository.name | h}
             %endif
         </div><div class="form-row"><label>Synopsis:</label>
-            ${repository.description}
+            ${repository.description | h}
         </div>
         %if repository.long_description:
             ${render_long_description( repository.long_description )}
@@ -158,12 +158,12 @@
             %if can_view_change_log:
                 <a href="${h.url_for( controller='repository', action='view_changelog', id=trans.app.security.encode_id( repository.id ) )}">${revision_label}</a>
             %else:
-                ${revision_label}
+                ${revision_label | h}
             %endif
         </div><div class="form-row"><label>Owner:</label>
-            ${repository.user.username}
+            ${repository.user.username | h}
         </div><div class="form-row"><label>Times downloaded:</label>
@@ -172,7 +172,7 @@
         %if trans.user_is_admin():
             <div class="form-row"><label>Location:</label>
-                ${repository.repo_path}
+                ${repository.repo_path | h}
             </div><div class="form-row"><label>Deleted:</label>
@@ -189,7 +189,7 @@
         <div class="toolFormBody">
             %for rca in repository.categories:
                 <div class="form-row">
-                    ${rca.category.name}
+                    ${rca.category.name | h}
                 </div>
             %endfor
             <div style="clear: both"></div>



https://bitbucket.org/galaxy/galaxy-central/changeset/97ab217e3aac/
changeset:   97ab217e3aac
user:        dan
date:        2012-10-23 17:06:17
summary:     HTML escape values that could be set by the user in templates/webapps/community/repository/view_tool_metadata.mako.
affected #:  1 file

diff -r 2acad55c0d8bb6d7c682298b591266be1cee27d0 -r 97ab217e3aace89120d9f34d171790c371b73f1b templates/webapps/community/repository/view_tool_metadata.mako
--- a/templates/webapps/community/repository/view_tool_metadata.mako
+++ b/templates/webapps/community/repository/view_tool_metadata.mako
@@ -140,35 +140,35 @@
             %if 'description' in tool_metadata_dict:
                 <div class="form-row"><label>Description:</label>
-                    ${tool_metadata_dict[ 'description' ]}
+                    ${tool_metadata_dict[ 'description' ] | h}
                     <div style="clear: both"></div></div>
             %endif
             %if 'id' in tool_metadata_dict:
                 <div class="form-row"><label>Id:</label>
-                    ${tool_metadata_dict[ 'id' ]}
+                    ${tool_metadata_dict[ 'id' ] | h}
                     <div style="clear: both"></div></div>
             %endif
             %if 'guid' in tool_metadata_dict:
                 <div class="form-row"><label>Guid:</label>
-                    ${tool_metadata_dict[ 'guid' ]}
+                    ${tool_metadata_dict[ 'guid' ] | h}
                     <div style="clear: both"></div></div>
             %endif
             %if 'version' in tool_metadata_dict:
                 <div class="form-row"><label>Version:</label>
-                    ${tool_metadata_dict[ 'version' ]}
+                    ${tool_metadata_dict[ 'version' ] | h}
                     <div style="clear: both"></div></div>
             %endif
             %if 'version_string_cmd' in tool_metadata_dict:
                 <div class="form-row"><label>Version command string:</label>
-                    ${tool_metadata_dict[ 'version_string_cmd' ]}
+                    ${tool_metadata_dict[ 'version_string_cmd' ] | h}
                     <div style="clear: both"></div></div>
             %endif
@@ -184,9 +184,9 @@
                             <tr><td>
                                     %if guid == tool_metadata_dict[ 'guid' ]:
-                                        ${guid} <b>(this tool)</b>
+                                        ${guid | h} <b>(this tool)</b>
                                     %else:
-                                        ${guid}
+                                        ${guid | h}
                                     %endif
                                 </td></tr>
@@ -224,9 +224,9 @@
                                 requirement_type = requirement_dict[ 'type' ] or 'not provided'
                             %><tr>
-                                <td>${requirement_name}</td>
-                                <td>${requirement_version}</td>
-                                <td>${requirement_type}</td>
+                                <td>${requirement_name | h}</td>
+                                <td>${requirement_version | h}</td>
+                                <td>${requirement_type | h}</td></tr>
                         %endfor
                     </table>
@@ -245,27 +245,27 @@
                 </div><div class="form-row"><label>Command:</label>
-                    <pre>${tool.command}</pre>
+                    <pre>${tool.command | h}</pre><div style="clear: both"></div></div><div class="form-row"><label>Interpreter:</label>
-                    ${tool.interpreter}
+                    ${tool.interpreter | h}
                     <div style="clear: both"></div></div><div class="form-row"><label>Is multi-byte:</label>
-                    ${tool.is_multi_byte}
+                    ${tool.is_multi_byte | h}
                     <div style="clear: both"></div></div><div class="form-row"><label>Forces a history refresh:</label>
-                    ${tool.force_history_refresh}
+                    ${tool.force_history_refresh | h}
                     <div style="clear: both"></div></div><div class="form-row"><label>Parallelism:</label>
-                    ${tool.parallelism}
+                    ${tool.parallelism | h}
                     <div style="clear: both"></div></div>
             %endif
@@ -299,17 +299,17 @@
                                 <td>${test_dict[ 'name' ]}</td><td>
                                     %for input in inputs:
-                                        <b>${input[0]}:</b> ${input[1]}<br/>
+                                        <b>${input[0]}:</b> ${input[1] | h}<br/>
                                     %endfor
                                 </td><td>
                                     %for output in outputs:
-                                        <b>${output[0]}:</b> ${output[1]}<br/>
+                                        <b>${output[0]}:</b> ${output[1] | h}<br/>
                                     %endfor
                                 </td><td>
                                     %for required_file in required_files:
-                                        ${required_file}<br/>
+                                        ${required_file | h}<br/>
                                     %endfor
                                 </td></tr>



https://bitbucket.org/galaxy/galaxy-central/changeset/44ccf4eb910c/
changeset:   44ccf4eb910c
user:        dan
date:        2012-10-23 17:06:17
summary:     HTML escape values that could be set by the user in templates/webapps/community/repository/view_workflow.mako.
affected #:  1 file

diff -r 97ab217e3aace89120d9f34d171790c371b73f1b -r 44ccf4eb910ce9e9ac8638675f403a80930a38fc templates/webapps/community/repository/view_workflow.mako
--- a/templates/webapps/community/repository/view_workflow.mako
+++ b/templates/webapps/community/repository/view_workflow.mako
@@ -96,7 +96,7 @@
     ${render_msg( message, status )}
 %endif
 
-<div class="toolFormTitle">${workflow_name}</div>
+<div class="toolFormTitle">${workflow_name | h}</div><div class="form-row"><b>Boxes are red when tools are not available in this repository</b><div class="toolParamHelp" style="clear: both;">



https://bitbucket.org/galaxy/galaxy-central/changeset/3d7e5bbeaf8d/
changeset:   3d7e5bbeaf8d
user:        dan
date:        2012-10-23 17:06:23
summary:     HTML escape values that could be set by the user in templates/webapps/community/repository_review/browse_review.mako.
affected #:  1 file

diff -r 44ccf4eb910ce9e9ac8638675f403a80930a38fc -r 3d7e5bbeaf8d3e76a7857ce67e5540109fcf29ce templates/webapps/community/repository_review/browse_review.mako
--- a/templates/webapps/community/repository_review/browse_review.mako
+++ b/templates/webapps/community/repository_review/browse_review.mako
@@ -34,7 +34,7 @@
 %endif
 
 <div class="toolForm">
-    <div class="toolFormTitle">Review of repository '${repository.name}'</div>
+    <div class="toolFormTitle">Review of repository '${repository.name | h}'</div><div class="toolFormBody"><div class="form-row"><label>Reviewer:</label>
@@ -43,17 +43,17 @@
         </div><div class="form-row"><label>Repository revision:</label>
-            <a class="action-button" href="${h.url_for( controller='repository_review', action='view_or_manage_repository', id=trans.security.encode_id( repository.id ), changeset_revision=review.changeset_revision )}">${changeset_revision_label}</a>
+            <a class="action-button" href="${h.url_for( controller='repository_review', action='view_or_manage_repository', id=trans.security.encode_id( repository.id ), changeset_revision=review.changeset_revision )}">${changeset_revision_label | h}</a><div style="clear: both"></div></div><div class="form-row"><label>Repository owner:</label>
-            ${repository.user.username}
+            ${repository.user.username | h}
             <div style="clear: both"></div></div><div class="form-row"><label>Repository synopsis:</label>
-            ${repository.description}
+            ${repository.description | h}
             <div style="clear: both"></div></div><div class="form-row">
@@ -70,11 +70,10 @@
                             # Initialize star rating.
                             rating_name = '%s%srating' % ( component.name, STRSEP )
                             
-                            review_comment = component_review.comment.replace( '\n', '<br/>' )
                         %><tr>
-                            <td bgcolor="#D8D8D8"><b>${component.name}</b></td>
-                            <td bgcolor="#D8D8D8">${component.description}</td>
+                            <td bgcolor="#D8D8D8"><b>${component.name | h}</b></td>
+                            <td bgcolor="#D8D8D8">${component.description | h}</td></tr><tr><td colspan="2">
@@ -93,7 +92,7 @@
                                         <tr><td><div overflow-wrap:normal;overflow:hidden;word-break:keep-all;word-wrap:break-word;line-break:strict;>
-                                                    ${review_comment}
+                                                    ${ escape_html_add_breaks( component_review.comment ) }
                                                 </div></td></tr>
@@ -101,7 +100,7 @@
                                     <tr><td><label>Approved:</label>
-                                            ${component_review.approved}
+                                            ${component_review.approved | h}
                                             <div style="clear: both"></div></td></tr>



https://bitbucket.org/galaxy/galaxy-central/changeset/2d86b224395e/
changeset:   2d86b224395e
user:        dan
date:        2012-10-23 17:06:23
summary:     HTML escape values that could be set by the user in templates/webapps/community/repository_review/create_component.mako.
affected #:  1 file

diff -r 3d7e5bbeaf8d3e76a7857ce67e5540109fcf29ce -r 2d86b224395ea5a3efb847bb67b4bb8a893c70cb templates/webapps/community/repository_review/create_component.mako
--- a/templates/webapps/community/repository_review/create_component.mako
+++ b/templates/webapps/community/repository_review/create_component.mako
@@ -20,11 +20,11 @@
         <form name="create_component" id="create_component" action="${h.url_for( controller='repository_review', action='create_component' )}" method="post" ><div class="form-row"><label>Name:</label>
-                <input name="name" type="textfield" value="${name}" size=40"/>
+                <input name="name" type="textfield" value="${name | h}" size=40"/></div><div class="form-row"><label>Description:</label>
-                <input name="description" type="textfield" value="${description}" size=40"/>
+                <input name="description" type="textfield" value="${description | h}" size=40"/></div><div class="form-row"><input type="submit" name="create_component_button" value="Save"/>



https://bitbucket.org/galaxy/galaxy-central/changeset/afea7bdcd557/
changeset:   afea7bdcd557
user:        dan
date:        2012-10-23 17:06:23
summary:     HTML escape values that could be set by the user in templates/webapps/community/repository_review/edit_component.mako.
affected #:  1 file

diff -r 2d86b224395ea5a3efb847bb67b4bb8a893c70cb -r afea7bdcd55755c780f9226e4b12a55dbbbd8591 templates/webapps/community/repository_review/edit_component.mako
--- a/templates/webapps/community/repository_review/edit_component.mako
+++ b/templates/webapps/community/repository_review/edit_component.mako
@@ -12,14 +12,14 @@
             <div class="form-row"><label>Name:</label><div style="float: left; width: 250px; margin-right: 10px;">
-                    ${component.name}
+                    ${component.name | h}
                 </div><div style="clear: both"></div></div><div class="form-row"><label>Description:</label><div style="float: left; width: 250px; margin-right: 10px;">
-                    <input  name="description" type="textfield" value="${component.description}" size=40"/>
+                    <input  name="description" type="textfield" value="${component.description | h}" size=40"/></div><div style="clear: both"></div></div>



https://bitbucket.org/galaxy/galaxy-central/changeset/87ce7c44d11c/
changeset:   87ce7c44d11c
user:        dan
date:        2012-10-23 17:06:23
summary:     HTML escape values that could be set by the user in templates/webapps/community/repository_review/edit_review.mako.
affected #:  1 file

diff -r afea7bdcd55755c780f9226e4b12a55dbbbd8591 -r 87ce7c44d11c1d1c874c4564f0acfd32304dd3a4 templates/webapps/community/repository_review/edit_review.mako
--- a/templates/webapps/community/repository_review/edit_review.mako
+++ b/templates/webapps/community/repository_review/edit_review.mako
@@ -35,7 +35,7 @@
 %endif
 
 <div class="toolForm">
-    <div class="toolFormTitle">My review of repository '${repository.name}'</div>
+    <div class="toolFormTitle">My review of repository '${repository.name | h}'</div><div class="toolFormBody"><form name="edit_review" action="${h.url_for( controller='repository_review', action='edit_review', id=trans.security.encode_id( review.id ) )}" method="post" ><div class="form-row">
@@ -45,12 +45,12 @@
             </div><div class="form-row"><label>Repository owner:</label>
-                ${repository.user.username}
+                ${repository.user.username | h}
                 <div style="clear: both"></div></div><div class="form-row"><label>Repository synopsis:</label>
-                ${repository.description}
+                ${repository.description | h}
                 <div style="clear: both"></div></div><div class="form-row">
@@ -108,8 +108,8 @@
                             review_button_name = '%s%sreview_button' % ( component_name, STRSEP )
                         %><tr>
-                            <td bgcolor="#D8D8D8"><b>${component.name}</b></td>
-                            <td bgcolor="#D8D8D8">${component.description}</td>
+                            <td bgcolor="#D8D8D8"><b>${component.name | h}</b></td>
+                            <td bgcolor="#D8D8D8">${component.description | h}</td></tr><tr><td colspan="2">
@@ -128,7 +128,7 @@
                                         <td><label>Comments:</label>
                                             %if component_review:
-                                                <pre><textarea name="${comment_name}" rows="3" cols="80">${comment}</textarea></pre>
+                                                <pre><textarea name="${comment_name}" rows="3" cols="80">${comment | h}</textarea></pre>
                                             %else:
                                                 <textarea name="${comment_name}" rows="3" cols="80"></textarea>
                                             %endif



https://bitbucket.org/galaxy/galaxy-central/changeset/a3b6a7ad9687/
changeset:   a3b6a7ad9687
user:        dan
date:        2012-10-23 17:06:23
summary:     HTML escape values that could be set by the user in templates/webapps/community/repository_review/reviews_of_changeset_revision.mako.
affected #:  1 file

diff -r 87ce7c44d11c1d1c874c4564f0acfd32304dd3a4 -r a3b6a7ad9687d84f950078ebd9a4e797aa5f337e templates/webapps/community/repository_review/reviews_of_changeset_revision.mako
--- a/templates/webapps/community/repository_review/reviews_of_changeset_revision.mako
+++ b/templates/webapps/community/repository_review/reviews_of_changeset_revision.mako
@@ -73,16 +73,16 @@
 %endif
 
 <div class="toolForm">
-    <div class="toolFormTitle">Revision reviews of repository '${repository.name}'</div>
+    <div class="toolFormTitle">Revision reviews of repository '${repository.name | h}'</div><div class="toolFormBody"><div class="form-row"><label>Revision:</label>
-            <a class="action-button" href="${h.url_for( controller='repository_review', action='view_or_manage_repository', id=trans.security.encode_id( repository.id ), changeset_revision=changeset_revision )}">${changeset_revision_label}</a>
+            <a class="action-button" href="${h.url_for( controller='repository_review', action='view_or_manage_repository', id=trans.security.encode_id( repository.id ), changeset_revision=changeset_revision )}">${changeset_revision_label | h}</a><div style="clear: both"></div></div><div class="form-row"><label>Revision is installable:</label>
-            ${installable_str}
+            ${installable_str | h}
             <div style="clear: both"></div></div><div class="form-row">
@@ -109,7 +109,7 @@
                         <tr><td><div style="float:left;" class="menubutton split popup" id="${encoded_review_id}-popup">
-                                    <a class="view-info" href="${h.url_for( controller='repository_review', action='repository_reviews_by_user', id=trans.security.encode_id( review.user.id ) )}">${review.user.username}</a>
+                                    <a class="view-info" href="${h.url_for( controller='repository_review', action='repository_reviews_by_user', id=trans.security.encode_id( review.user.id ) )}">${review.user.username | h}</a></div><div popupmenu="${encoded_review_id}-popup">
                                     %if review.user == trans.user:
@@ -126,7 +126,7 @@
                                     <td><input type="submit" name="approve_repository_review_button" value="Save"/></td></form>
                             %else:
-                                <td>${approved_str}</td>
+                                <td>${approved_str | h}</td><td></td>
                             %endif
                         </tr>



https://bitbucket.org/galaxy/galaxy-central/changeset/887af9525287/
changeset:   887af9525287
user:        dan
date:        2012-10-23 17:06:27
summary:     HTML escape values that could be set by the user in templates/webapps/community/repository_review/reviews_of_repository.mako.
affected #:  1 file

diff -r a3b6a7ad9687d84f950078ebd9a4e797aa5f337e -r 887af9525287ea51e2286c9b00ce694cb68dd817 templates/webapps/community/repository_review/reviews_of_repository.mako
--- a/templates/webapps/community/repository_review/reviews_of_repository.mako
+++ b/templates/webapps/community/repository_review/reviews_of_repository.mako
@@ -55,7 +55,7 @@
             <a class="action-button" href="${h.url_for( controller='repository', action='rate_repository', id=trans.security.encode_id( repository.id ) )}">Rate repository</a>
         %endif
         %if can_browse_contents:
-            <a class="action-button" href="${h.url_for( controller='repository', action='browse_repository', id=trans.security.encode_id( repository.id ) )}">${browse_label}</a>
+            <a class="action-button" href="${h.url_for( controller='repository', action='browse_repository', id=trans.security.encode_id( repository.id ) )}">${browse_label | h}</a>
         %endif
         %if can_contact_owner:
             <a class="action-button" href="${h.url_for( controller='repository', action='contact_owner', id=trans.security.encode_id( repository.id ) )}">Contact repository owner</a>
@@ -68,7 +68,7 @@
 %endif
 
 <div class="toolForm">
-    <div class="toolFormTitle">${title}</div>
+    <div class="toolFormTitle">${title | h}</div><div class="toolFormBody"><div class="form-row"><table class="grid">
@@ -102,7 +102,7 @@
                     <tr><td><div style="float:left;" class="menubutton split popup" id="${changeset_revision}-popup">
-                                <a class="view-info" href="${h.url_for( controller='repository_review', action='view_or_manage_repository', id=trans.security.encode_id( repository.id ), changeset_revision=changeset_revision )}">${changeset_revision_label}</a>
+                                <a class="view-info" href="${h.url_for( controller='repository_review', action='view_or_manage_repository', id=trans.security.encode_id( repository.id ), changeset_revision=changeset_revision )}">${changeset_revision_label | h}</a></div><div popupmenu="${changeset_revision}-popup">
                                 %if repository_reviews:
@@ -113,7 +113,7 @@
                             </div></td><td>${reviewers_str}</td>
-                        <td>${installable_str}</td>
+                        <td>${installable_str | h}</td></tr>
                 %endfor
             </table>



https://bitbucket.org/galaxy/galaxy-central/changeset/92237db0cd58/
changeset:   92237db0cd58
user:        dan
date:        2012-10-23 17:06:27
summary:     HTML escape values that could be set by the user in templates/webapps/community/repository_review/select_previous_review.mako.
affected #:  1 file

diff -r 887af9525287ea51e2286c9b00ce694cb68dd817 -r 92237db0cd58f97a24787d451ab5a4d9738452bd templates/webapps/community/repository_review/select_previous_review.mako
--- a/templates/webapps/community/repository_review/select_previous_review.mako
+++ b/templates/webapps/community/repository_review/select_previous_review.mako
@@ -67,23 +67,23 @@
 %endif
 
 <div class="warningmessage">
-    You have elected to create a new review for revision <b>${changeset_revision_label}</b>of this repository.  Since previous revisions have been reviewed, 
+    You have elected to create a new review for revision <b>${changeset_revision_label | h}</b>of this repository.  Since previous revisions have been reviewed, 
     you can select a previous review to copy to your new review, or click the <b>Create a review without copying</b> button.
 </div><div class="toolForm">
-    <div class="toolFormTitle">Select previous revision review of repository '${repository.name}'</div>
+    <div class="toolFormTitle">Select previous revision review of repository '${repository.name | h}'</div><div class="toolFormBody"><div class="form-row"><label>Revision for new review:</label>
-            <a class="action-button" href="${h.url_for( controller='repository_review', action='view_or_manage_repository', id=trans.security.encode_id( repository.id ), changeset_revision=changeset_revision )}">${changeset_revision_label}</a>
+            <a class="action-button" href="${h.url_for( controller='repository_review', action='view_or_manage_repository', id=trans.security.encode_id( repository.id ), changeset_revision=changeset_revision )}">${changeset_revision_label | h}</a><div style="clear: both"></div></div><div class="form-row"><table class="grid"><tr></tr>
-                    <td bgcolor="#D8D8D8" colspan="4"><b>Previous revision reviews of repository '${repository.name}' that can be copied to your new review</b></td>
+                    <td bgcolor="#D8D8D8" colspan="4"><b>Previous revision reviews of repository '${repository.name | h}' that can be copied to your new review</b></td><tr><th>Reviewer</th><th>Revision reviewed</th>
@@ -107,15 +107,15 @@
                         <tr><td><div style="float:left;" class="menubutton split popup" id="${encoded_review_id}-popup">
-                                    <a class="view-info" href="${h.url_for( controller='repository_review', action='browse_review', id=encoded_review_id )}">${review.user.username}</a>
+                                    <a class="view-info" href="${h.url_for( controller='repository_review', action='browse_review', id=encoded_review_id )}">${review.user.username | h}</a></div><div popupmenu="${encoded_review_id}-popup"><a class="action-button" href="${h.url_for( controller='repository_review', action='create_review', id=trans.security.encode_id( repository.id ), changeset_revision=changeset_revision, previous_review_id=encoded_review_id )}">Copy this review</a></div></td>
-                            <td>${previous_changeset_revision_label}</td>
+                            <td>${previous_changeset_revision_label | h}</td><td>${render_star_rating( repository_rating_name, review.rating, disabled=True )}</td>
-                            <td>${approved_str}</td>
+                            <td>${approved_str | h}</td></tr>
                     %endfor
                 %endfor



https://bitbucket.org/galaxy/galaxy-central/changeset/fba4cbb570ae/
changeset:   fba4cbb570ae
user:        dan
date:        2012-10-23 17:06:28
summary:     HTML escape values that could be set by the user in templates/webapps/community/user/manage_email_alerts.mako.
affected #:  1 file

diff -r 92237db0cd58f97a24787d451ab5a4d9738452bd -r fba4cbb570ae95874383509edeaa6b5e955f8782 templates/webapps/community/user/manage_email_alerts.mako
--- a/templates/webapps/community/user/manage_email_alerts.mako
+++ b/templates/webapps/community/user/manage_email_alerts.mako
@@ -42,8 +42,8 @@
                 </tr>
                 %for repository in email_alert_repositories:
                     <tr>
-                        <td>${repository.name}</td>
-                        <td>${repository.description}</td>
+                        <td>${repository.name | h}</td>
+                        <td>${repository.description | h}</td></tr>
                 %endfor
             </table>

Repository URL: https://bitbucket.org/galaxy/galaxy-central/

--

This is a commit notification from bitbucket.org. You are receiving
this because you have the service enabled, addressing the recipient of
this email.

    

[galaxy-commits] commit/galaxy-central: 34 new changesets

Bitbucket