From a9be0691d9efd84cbf5a9f05236caf4df23bcfdb Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 19 May 2012 11:28:46 -0700
Subject: Create an ajax response framework that inserts <meta> tags to guard
 against UTF-7, and create a $.gallery_autocomplete variant of jQuery's
 autocomplete that expects the first line to be a <meta> tag and discards it. 
 More complete fix for #1871.

---
 lib/gallery.common.js | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

(limited to 'lib')

diff --git a/lib/gallery.common.js b/lib/gallery.common.js
index b499a2cd..755218f5 100644
--- a/lib/gallery.common.js
+++ b/lib/gallery.common.js
@@ -222,4 +222,32 @@
     });
   };
 
+  // Augment jQuery autocomplete to expect the first response line to
+  // be a <meta> tag that protects against UTF-7 attacks.
+  $.fn.gallery_autocomplete = function(url, options) {
+    // Drop the first response - it should be a meta tag
+    options.parse = function(data) {
+      var parsed = [];
+      var rows = data.split("\n");
+      if (rows[0].indexOf("<meta") == -1) {
+        throw 'Missing <meta> tag in first line of autocomplete response';
+      }
+      rows.shift();  // drop <META> tag
+      for (var i=0; i < rows.length; i++) {
+        var row = $.trim(rows[i]);
+        if (row) {
+          row = row.split("|");
+          parsed[parsed.length] = {
+            data: row,
+            value: row[0],
+            result: row[0]
+          };
+        }
+      }
+      return parsed;
+    };
+
+    $(this).autocomplete(url, options);
+  };
+
 })(jQuery);
-- 
cgit v1.2.3