[virtualcommons-svn] commit/vcweb: alllee: patches from this morning's pretest:

[Bitbucket <com...@bi...>]

1 new changeset in vcweb:

http://bitbucket.org/virtualcommons/vcweb/changeset/00024d63ebf0/
changeset:   00024d63ebf0
user:        alllee
date:        2011-06-22 18:22:27
summary:     patches from this morning's pretest:

fixing issue 21 - using tornado.xhtml_escape to untaint incoming chat messages

when max_harvest_decision is 0, display the deforested picture.
affected #:  3 files (371 bytes)

--- a/vcweb/forestry/templates/forestry/participate.html	Wed Jun 22 01:50:58 2011 -0700
+++ b/vcweb/forestry/templates/forestry/participate.html	Wed Jun 22 09:22:27 2011 -0700
@@ -62,6 +62,7 @@
 {% endblock %}
 {% block content %}
 <h3>Forestry round number {{ experiment.current_round.round_number }}</h3>
+{% if max_harvest_decision > 0 %}
 <div style="background: url('{{STATIC_URL}}images/forestry/{{tree.name}}.png'); width:{{max_width}}px; height: {{max_height}}px;">
     &nbsp;
 </div>
@@ -71,11 +72,12 @@
 </div>
 {% endif %}
 
-{% if resource_level.value == 0 %}
+{% else %}
 <div style='padding: 8px; margin: auto; border: solid 1px; background: #E8E8E8 url({{STATIC_URL}}images/forestry/deforestation.jpg) no-repeat center; height: 282px; width:425px;'>
     &nbsp;
 </div>
 {% endif %}
+
 <div style='padding: 5px; margin: 8px 0px;' class='ui-state-highlight'><span class='icon-left ui-icon ui-icon-info'>&nbsp;</span>
     There are <b>{{ resource_level.value }}</b> trees left.


--- a/vcweb/forestry/views.py	Wed Jun 22 01:50:58 2011 -0700
+++ b/vcweb/forestry/views.py	Wed Jun 22 09:22:27 2011 -0700
@@ -70,7 +70,8 @@
     experiment = group.experiment
     participant_history = deque()
     for round_data in experiment.playable_round_data:
-        logger.debug("generating participant history for %s", round_data)
+        logger.debug("generating participant history for %s, current round %s",
+                participant_group_relationship.participant, round_data)
         data = ParticipantRoundData()
 # FIXME: this kind of binding is a bit laborious and error-prone, refactor if possible
         data.round_configuration = round_data.round_configuration


--- a/vcweb/vcwebio.py	Wed Jun 22 01:50:58 2011 -0700
+++ b/vcweb/vcwebio.py	Wed Jun 22 09:22:27 2011 -0700
@@ -1,6 +1,7 @@
 #!/usr/bin/env python
 import tornado.web
 from tornadio import SocketConnection, get_router, server
+from tornado.escape import xhtml_escape
 import os
 import sys
 import logging
@@ -18,17 +19,6 @@
 def info_json(message):
     return simplejson.dumps({'message_type': 'info', 'message': message})
 
-def goto_json(url):
-    return simplejson.dumps({'message_type': 'goto', 'url': url})
-
-def chat_json(chat_message):
-    return simplejson.dumps({
-        "pk": chat_message.pk,
-        "date_created": chat_message.date_created.strftime("%H:%M:%S"),
-        "message" : unicode(chat_message),
-        "message_type": 'chat',
-        })
-
 class ConnectionManager:
     '''
     Manages socket.io connections to tornadio.
@@ -259,7 +249,7 @@
                 participant_group_relationship = connection_manager.get_participant_group_relationship(self)
                 current_round_data = participant_group_relationship.group.experiment.current_round_data
                 chat_message = ChatMessage.objects.create(participant_group_relationship=participant_group_relationship,
-                        message=event.message,
+                        message=xhtml_escape(event.message),
                         round_data=current_round_data
                         )
                 chat_json = simplejson.dumps({

Repository URL: https://bitbucket.org/virtualcommons/vcweb/

--

This is a commit notification from bitbucket.org. You are receiving
this because you have the service enabled, addressing the recipient of
this email.