Note._toHtmlEntity move to common.js

public/js/app/note.js

@@ -775,10 +775,6 @@ Note.renderNotes = function(notes, forNewNote, isShared) {
 	}
 }
 
-Note._toHtmlEntity = function(html){
-	return (html + '').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
-};
-
 Note._renderNotes = function(notes, forNewNote, isShared, tang) { // 第几趟
 	var baseClasses = "item-my";
 	if(isShared) {
@@ -794,9 +790,9 @@ Note._renderNotes = function(notes, forNewNote, isShared, tang) { // 第几趟
 		var note = notes[i];
 		var tmp;
 		if(note.ImgSrc) {
-			tmp = tt(Note.itemTpl, classes, note.NoteId, note.ImgSrc, Note._toHtmlEntity(note.Title), Notebook.getNotebookTitle(note.NotebookId), goNowToDatetime(note.UpdatedTime), note.Desc);
+			tmp = tt(Note.itemTpl, classes, note.NoteId, note.ImgSrc, toHtmlEntity(note.Title), Notebook.getNotebookTitle(note.NotebookId), goNowToDatetime(note.UpdatedTime), note.Desc);
 		} else {
-			tmp = tt(Note.itemTplNoImg, classes, note.NoteId, Note._toHtmlEntity(note.Title), Notebook.getNotebookTitle(note.NotebookId), goNowToDatetime(note.UpdatedTime), note.Desc);
+			tmp = tt(Note.itemTplNoImg, classes, note.NoteId, toHtmlEntity(note.Title), Notebook.getNotebookTitle(note.NotebookId), goNowToDatetime(note.UpdatedTime), note.Desc);
 		}
 		if(!note.IsBlog) {
 			tmp = $(tmp);
@@ -854,12 +850,12 @@ Note.newNote = function(notebookId, isShare, fromUserId, isMarkdown) {
 	}
 
 	var notebook = Notebook.getNotebook(notebookId);
-	var notebookTitle = notebook ? Note._toHtmlEntity(notebook.Title) : "";
+	var notebookTitle = notebook ? toHtmlEntity(notebook.Title) : "";
 	var curDate = getCurDate();
 	if(isShare) {
-		newItem = tt(Note.newItemTpl, baseClasses, fromUserId, note.NoteId, Note._toHtmlEntity(note.Title), notebookTitle, curDate, "");
+		newItem = tt(Note.newItemTpl, baseClasses, fromUserId, note.NoteId, toHtmlEntity(note.Title), notebookTitle, curDate, "");
 	} else {
-		newItem = tt(Note.newItemTpl, baseClasses, "", note.NoteId, Note._toHtmlEntity(note.Title), notebookTitle, curDate, "");
+		newItem = tt(Note.newItemTpl, baseClasses, "", note.NoteId, toHtmlEntity(note.Title), notebookTitle, curDate, "");
 	}
 
 	// notebook是否是Blog
@@ -1595,7 +1591,7 @@ var Attach = {
 		for(var i = 0; i < attachNum; ++i) {
 			var each = attachs[i];
 			html += '<li class="clearfix" data-id="' + each.AttachId + '">' +
-						'<div class="attach-title">' + Note._toHtmlEntity(each.Title) + '</div>' +
+						'<div class="attach-title">' + toHtmlEntity(each.Title) + '</div>' +
 						'<div class="attach-process"> ' +
 						'	  <button class="btn btn-sm btn-warning delete-attach" data-loading-text="..."><i class="fa fa-trash-o"></i></button> ' +
 						'	  <button type="button" class="btn btn-sm btn-primary download-attach"><i class="fa fa-download"></i></button> ' +

public/js/app/notebook.js

@@ -58,7 +58,7 @@ Notebook.getNotebook = function(notebookId) {
 Notebook.getNotebookTitle = function(notebookId) {
 	var notebook = Notebook.cache[notebookId];
 	if(notebook) {
-		return Note._toHtmlEntity(notebook.Title);
+		return toHtmlEntity(notebook.Title);
 	} else {
 		return "未知";
 	}
@@ -409,7 +409,7 @@ Notebook.getChangedNotebooks = function(notebooks) {
 		if(!isEmpty(notebook.Subs)) {
 			classes = "dropdown-submenu";
 		}
-		var eachForNew = tt('<li role="presentation" class="clearfix ?"><div class="new-note-left pull-left" title="为该笔记本新建笔记" href="#" notebookId="?">?</div><div title="为该笔记本新建markdown笔记" class="new-note-right pull-left" notebookId="?">M</div>', classes, notebook.NotebookId, Note._toHtmlEntity(notebook.Title), notebook.NotebookId);
+		var eachForNew = tt('<li role="presentation" class="clearfix ?"><div class="new-note-left pull-left" title="为该笔记本新建笔记" href="#" notebookId="?">?</div><div title="为该笔记本新建markdown笔记" class="new-note-right pull-left" notebookId="?">M</div>', classes, notebook.NotebookId, toHtmlEntity(notebook.Title), notebook.NotebookId);
 
 		if(!isEmpty(notebook.Subs)) {
 			eachForNew  += "<ul class='dropdown-menu'>";
@@ -487,12 +487,12 @@ Notebook.renderShareNotebooks = function(sharedUserInfos, shareNotebooks) {
 
 		userNotebooks.ShareNotebooks = [{NotebookId: "-2", Title: "默认共享"}].concat(userNotebooks.ShareNotebooks)
 
-		var username = Note._toHtmlEntity(userInfo.Username || userInfo.Email);
+		var username = toHtmlEntity(userInfo.Username || userInfo.Email);
 		var header = tt('<div class="folderNote closed"><div class="folderHeader"><a><h1 title="? 的共享"><i class="fa fa-angle-right"></i>?</h1></a></div>', username, username);
 		var body = '<ul class="folderBody">';
 		for(var j in userNotebooks.ShareNotebooks) {
 			var notebook = userNotebooks.ShareNotebooks[j];
-			body += tt('<li><a notebookId="?">?</a></li>', notebook.NotebookId, Note._toHtmlEntity(notebook.Title))
+			body += tt('<li><a notebookId="?">?</a></li>', notebook.NotebookId, toHtmlEntity(notebook.Title))
 		}
 		body += "</ul>";
 

public/js/app/tag.js

@@ -110,7 +110,7 @@ Tag.renderReadOnlyTags = function(tags) {
 		if(!classes) {
 			classes = getNextDefaultClasses();
 		}
-		tag = tt('<span class="?">?</span>', classes, Note._toHtmlEntity(text));
+		tag = tt('<span class="?">?</span>', classes, toHtmlEntity(text));
 		
 		$("#noteReadTags").append(tag);
 	}
@@ -149,7 +149,7 @@ Tag.appendTag = function(tag, save) {
 	}
 	text = text.replace(/[\r\n]/g, '');
 	
-	tag = tt('<span class="?" data-tag="?">?<i title="' + getMsg("delete") + '">X</i></span>', classes, text, Note._toHtmlEntity(text););
+	tag = tt('<span class="?" data-tag="?">?<i title="' + getMsg("delete") + '">X</i></span>', classes, text, toHtmlEntity(text));
 
 	// 避免重复
 	var isExists = false;
@@ -241,7 +241,7 @@ Tag.renderTagNav = function(tags) {
 		}
 		text = text.replace(/[\r\n]/g, '');
 		var classes = Tag.classes[tag] || "label label-default";
-		$("#tagNav").append(tt('<li data-tag="?"><a> <span class="?">?</span> <span class="tag-delete">X</span></li>', tag, classes, Note._toHtmlEntity(text)));
+		$("#tagNav").append(tt('<li data-tag="?"><a> <span class="?">?</span> <span class="tag-delete">X</span></li>', tag, classes, toHtmlEntity(text)));
 	}
 };
 

public/js/common.js

@@ -1278,6 +1278,10 @@ function setHash(key, value) {
 	location.href = "#" + str;
 }
 
-var trimTitle = function(title) {
+// 防止js注入
+function trimTitle(title) {
 	return title.replace(/<.*?script.*?>/g, '');
+};
+function toHtmlEntity(html) {
+	return (html + '').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
 };