escape strings passed as parameters to function call showPortalPosLinks

fix #259
This commit is contained in:
Jon Atkins 2013-05-10 03:45:40 +01:00
parent 65783ac0b1
commit 35397c0c35
2 changed files with 7 additions and 1 deletions

View File

@ -49,7 +49,7 @@ window.renderPortalDetails = function(guid) {
var lng = d.locationE6.lngE6/1E6;
var perma = '/intel?ll='+lat+','+lng+'&z=17&pll='+lat+','+lng;
var imgTitle = 'title="'+getPortalDescriptionFromDetails(d)+'\n\nClick to show full image."';
var poslinks = 'window.showPortalPosLinks('+lat+','+lng+',\'' + d.portalV2.descriptiveText.TITLE + '\')';
var poslinks = 'window.showPortalPosLinks('+lat+','+lng+',\''+escapeJavascriptString(d.portalV2.descriptiveText.TITLE)+'\')';
$('#portaldetails')
.attr('class', TEAM_TO_CSS[getTeam(d)])

View File

@ -289,6 +289,12 @@ if (typeof String.prototype.startsWith !== 'function') {
};
}
// escape a javascript string, so quotes and backslashes are escaped with a backslash
// (for strings passed as parameters to html onclick="..." for example)
window.escapeJavascriptString = function(str) {
return (str+'').replace(/[\\"']/g,'\\$&');
}
window.prettyEnergy = function(nrg) {
return nrg> 1000 ? Math.round(nrg/1000) + ' k': nrg;
}