client: clean up form data extraction

fossar · Sep 5, 2020 · 8ac6434 · 8ac6434
1 parent 1e593db
commit 8ac6434
Show file tree

Hide file tree

Showing 4 changed files with 33 additions and 44 deletions.
diff --git a/assets/js/selfoss-base.js b/assets/js/selfoss-base.js
@@ -179,32 +179,6 @@ var selfoss = {
     },
 
 
-    /**
-     * returns an array of name value pairs of all form elements in given element
-     *
-     * @return void
-     * @param element containing the form elements
-     */
-    getValues: function(element) {
-        var values = {};
-
-        $(element).find(':input').each(function(i, el) {
-            // get only input elements with name
-            if (el.hasAttribute('name')) {
-                let name = el.getAttribute('name').trim();
-                if (name.length != 0) {
-                    values[name] = $(el).val();
-                    if ($(el).attr('type') == 'checkbox') {
-                        values[name] = $(el).attr('checked') ? 1 : 0;
-                    }
-                }
-            }
-        });
-
-        return values;
-    },
-
-
     loggedin: false,
 
 

diff --git a/assets/js/selfoss-events-sources.js b/assets/js/selfoss-events-sources.js
@@ -6,7 +6,9 @@ import * as ajax from './helpers/ajax';
  */
 selfoss.events.sources = function() {
     // cancel source editing
-    $('.source-cancel').unbind('click').click(function() {
+    $('.source-cancel').unbind('click').click(function(event) {
+        event.preventDefault();
+
         var parent = $(this).parents('.source');
         if (parent.hasClass('source-new')) {
             parent.fadeOut('fast', function() {
@@ -18,7 +20,9 @@ selfoss.events.sources = function() {
     });
 
     // add new source
-    $('.source-add').unbind('click').click(function() {
+    $('.source-add').unbind('click').click(function(event) {
+        event.preventDefault();
+
         ajax.get('source').promise.then(response => response.text()).then((text) => {
             $('.source-opml').after(text);
             selfoss.events.sources();
@@ -29,8 +33,10 @@ selfoss.events.sources = function() {
     });
 
     // save source
-    $('.source-save').unbind('click').click(function() {
-        var parent = $(this).parents('.source');
+    $('.source-save').unbind('click').click(function(event) {
+        event.preventDefault();
+
+        var parent = $(this).parents('form.source');
 
         // remove old errors
         parent.find('span.error').remove();
@@ -42,15 +48,18 @@ selfoss.events.sources = function() {
         // get id
         let id = parent.attr('data-source-id');
 
-        // set url
-        const url = `source/${id}`;
-
         // get values and params
-        var values = selfoss.getValues(parent);
-        values['tags'] = values['tags'].split(',');
+        var values = new FormData(parent.get(0));
+
+        // make tags into a list
+        let oldTags = values.get('tags').split(',');
+        values.delete('tags');
+        oldTags.map(tag => tag.trim())
+            .filter(tag => tag !== '')
+            .forEach(tag => values.append('tags[]', tag));
 
-        ajax.post(url, {
-            body: ajax.makeSearchParams(values),
+        ajax.post(`source/${id}`, {
+            body: new URLSearchParams(values),
             failOnHttpErrors: false
         }).promise
             .then(ajax.rejectUnless(response => response.ok || response.status === 400))
@@ -95,7 +104,9 @@ selfoss.events.sources = function() {
     });
 
     // delete source
-    $('.source-delete').unbind('click').click(function() {
+    $('.source-delete').unbind('click').click(function(event) {
+        event.preventDefault();
+
         var answer = confirm(selfoss.ui._('source_warn'));
         if (answer == false) {
             return;
@@ -124,7 +135,8 @@ selfoss.events.sources = function() {
     });
 
     // show params
-    $('.source-showparams').unbind('click').click(function() {
+    $('.source-showparams').unbind('click').click(function(event) {
+        event.preventDefault();
         $(this).parent().parent().find('.source-edit-form').show();
     });
 

diff --git a/src/controllers/Sources/Write.php b/src/controllers/Sources/Write.php
@@ -78,6 +78,9 @@ public function write(Base $f3, array $params) {
 
         // clean up title and tag data to prevent XSS
         $title = htmlspecialchars($data['title']);
+        if (!isset($data['tags'])) {
+            $data['tags'] = [];
+        }
         $tags = array_map('htmlspecialchars', $data['tags']);
         $spout = $data['spout'];
         $filter = $data['filter'];

diff --git a/src/templates/source.phtml b/src/templates/source.phtml
@@ -1,5 +1,5 @@
 <?php $idAttr = isset($this->source) ? $this->source['id'] : 'new-' . rand(); ?>
-<div role="form" data-source-id="<?= $idAttr ?>"
+<form data-source-id="<?= $idAttr ?>"
         class="source <?= isset($this->source) === false ? 'source-new' : '' ?> <?= (isset($this->source) && isset($this->source['error']) && strlen($this->source['error']) > 0) ? 'error' : '' ?>">
     <div class="source-icon">
         <?php if (isset($this->source) && isset($this->source['icon']) && $this->source['icon'] != '0') : ?>
@@ -9,8 +9,8 @@
 
     <div class="source-title"><?= isset($this->source) ? $this->source['title'] : \F3::get('lang_source_new'); ?></div>
 
-    <div class="source-edit-delete"><button accesskey="e" class="source-showparams"><?= \F3::get('lang_source_edit')?>
-        </button> &bull; <button accesskey="d" class="source-delete"><?= \F3::get('lang_source_delete') ?></button>
+    <div class="source-edit-delete"><button type="button" accesskey="e" class="source-showparams"><?= \F3::get('lang_source_edit')?>
+        </button> &bull; <button type="button" accesskey="d" class="source-delete"><?= \F3::get('lang_source_delete') ?></button>
     </div>
 
     <div class="source-days">
@@ -88,9 +88,9 @@
 
         <!-- save/delete -->
         <li class="source-action">
-            <button class="source-save" accesskey="s"><?= \F3::get('lang_source_save')?></button> &bull; <button class="source-cancel" accesskey="c"><?= \F3::get('lang_source_cancel')?></button>
+            <button type="submit" class="source-save" accesskey="s"><?= \F3::get('lang_source_save')?></button> &bull; <button type="submit" class="source-cancel" accesskey="c"><?= \F3::get('lang_source_cancel')?></button>
         </li>
     </ul>
 
 
-</div>
+</form>