Skip to content

Commit

Permalink
LUI-196 Escape Html for autocomplete and datatable
Browse files Browse the repository at this point in the history
  • Loading branch information
@rkorytkowski
rkorytkowski committed Jul 23, 2024
1 parent b6855fd commit fd7227c
Show file tree
Hide file tree
Showing 4 changed files with 59 additions and 19 deletions.
2 changes: 1 addition & 1 deletion omod/src/main/webapp/dictionary/index.jsp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@
//custom render, appends an arrow and preferredName it exists
function nameColumnRenderer(oObj){
if(oObj.aData[1] && $j.trim(oObj.aData[1]) != '')
return "<span>"+oObj.aData[0]+"</span><span class='otherHit'> &rArr; "+$j("<div>").text(oObj.aData[1]).html()+"</span>";
return "<span>"+oObj.aData[0]+"</span><span class='otherHit'> &rArr; "+oObj.aData[1]+"</span>";
return "<span>"+oObj.aData[0]+"</span>";
}
Expand Down
49 changes: 38 additions & 11 deletions omod/src/main/webapp/portlets/patientVisits.jsp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,10 @@ tr.bottom-encounter-in-visit td:last-child {
$j(document)
.ready(
function() {
function renderData(data) {
// Escape html for each cell
return $j('<div/>').text(data['aData'][data['iDataColumn']]).html();
}
$j('#patientVisitsTable')
.dataTable(
{
Expand All @@ -76,23 +80,46 @@ tr.bottom-encounter-in-visit td:last-child {
"sInfo": ""//hack to hide the text but keep the element to maintain the UI
},
"aoColumns" : [ {
"bVisible" : false
"bVisible" : false,
"fnRender": renderData
}, {
"bVisible" : false
}, null, {
"bVisible" : false
"bVisible" : false,
"fnRender": renderData
}, {
"bVisible" : false
"fnRender": renderData
}, {
"bVisible" : false
"bVisible" : false,
"fnRender": renderData
}, {
"bVisible" : false
"bVisible" : false,
"fnRender": renderData
}, {
"bVisible" : false
"bVisible" : false,
"fnRender": renderData
}, {
"bVisible" : false
}, null, null, null, null, null, null, {
"bVisible" : false
"bVisible" : false,
"fnRender": renderData
}, {
"bVisible" : false,
"fnRender": renderData
}, {
"bVisible" : false,
"fnRender": renderData
}, {
"fnRender": renderData
}, {
"fnRender": renderData
}, {
"fnRender": renderData
}, {
"fnRender": renderData
}, {
"fnRender": renderData
}, {
"fnRender": renderData
}, {
"bVisible" : false,
"fnRender": renderData
} ],
"fnRowCallback" : function(nRow,
aData, iDisplayIndex) {
Expand Down
6 changes: 4 additions & 2 deletions omod/src/main/webapp/resources/scripts/jquery-ui/js/openmrsSearch.js
View file
Original file line number Diff line number Diff line change
Expand Up @@ -841,7 +841,8 @@ function OpenmrsSearch(div, showIncludeVoided, searchHandler, selectionHandler,
var data = rowData[c.fieldName];
if(data == null)
data = " ";

//Escape html
data = $j('<div/>').text(data).html();
return data;
});

Expand All @@ -851,7 +852,8 @@ function OpenmrsSearch(div, showIncludeVoided, searchHandler, selectionHandler,
attributeValue = rowData.attributes[a.name];
if(attributeValue == null)
attributeValue = '';

//Escape html
attributeValue = $j('<div/>').text(attributeValue).html();
rRowData.push(attributeValue);
});
}
Expand Down
21 changes: 16 additions & 5 deletions omod/src/main/webapp/resources/scripts/jquery/autocomplete/OpenmrsAutoComplete.js
View file
Original file line number Diff line number Diff line change
Expand Up @@ -232,24 +232,25 @@ function CreateCallback(options) {
var textShown = " ";

if (person.identifier)
textShown += $j('<div/>').text(person.identifier).html();
textShown += person.identifier;

textShown += " ";

textShown += $j('<div/>').text(person.personName).html();
textShown += person.personName;

// highlight each search term in the results
textShown = highlightWords(textShown, origQuery);

var ageText = "";
if (person.age) {
ageText = " (" + person.age + " " + omsgs.yearsOld + ")";
ageText = $j('<div/>').text(ageText).html();
}

// append the gender image and age AFTER word highlighting so regex doesn't match it

textShown = imageText + textShown + ageText; // space was inserted into beginning of 'textShown' var

textShown = $j('<div/>').text(textShown).html()

// wrap each result in a span tag (needed?)
textShown = "<span class='autocompleteresult'>" + textShown + "</span>";
Expand All @@ -274,6 +275,8 @@ function CreateCallback(options) {
textShown += provider.identifier + " ";

textShown += provider.displayName;

textShown = $j('<div/>').text(textShown).html()

// wrap each result in a span tag (needed?)
textShown = "<span class='autocompleteresult'>" + textShown + "</span>";
Expand All @@ -291,13 +294,15 @@ function CreateCallback(options) {
// item is a ConceptListItem or LocationListItem object
// add a space so the term highlighter below thinks the first word is a word
var textShown = " " + item.name;

textShown = $j('<div/>').text(textShown).html()

// highlight each search term in the results
textShown = highlightWords(textShown, origQuery);

var value = item.name;
if (item.preferredName) {
textShown += "<span class='preferredname'> &rArr; " + item.preferredName + "</span>";
textShown += "<span class='preferredname'> &rArr; " + $j('<div/>').text(item.preferredName).html() + "</span>";
//value = item.preferredName;
}

Expand All @@ -315,6 +320,8 @@ function CreateCallback(options) {

// add a space so the term highlighter below thinks the first word is a word
var textShown = " " + item.fullName;

textShown = $j('<div/>').text(textShown).html()

// highlight each search term in the results
textShown = highlightWords(textShown, origQuery);
Expand Down Expand Up @@ -342,6 +349,8 @@ function CreateCallback(options) {
if (enc.location) {
textShown += " - " + enc.location;
}

textShown = $j('<div/>').text(textShown).html()

// highlight each search term in the results
textShown = highlightWords(textShown, origQuery);
Expand Down Expand Up @@ -384,7 +393,9 @@ function CreateCallback(options) {
return { label: item, value: "" };

var textShown = " " + item.code+((item.name != null && $j.trim(item.name) != '') ? " - "+item.name : "")+" ["+item.conceptSourceName+"]";


textShown = $j('<div/>').text(textShown).html()

// highlight each search term in the results
textShown = highlightWords(textShown, origQuery);

Expand Down

0 comments on commit fd7227c

Please sign in to comment.