From f91f414f3ecac85c2b3a44193fadda3d79cd600c Mon Sep 17 00:00:00 2001
From: Marvin Borner
Date: Sat, 10 Oct 2020 11:14:10 +0200
Subject: Frontend improvements

---
 quotes/public/style.css | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'quotes')

diff --git a/quotes/public/style.css b/quotes/public/style.css
index 0336774..a4e85ea 100644
--- a/quotes/public/style.css
+++ b/quotes/public/style.css
@@ -15,7 +15,7 @@ div {
 main {
     position: absolute;
     max-height: 80%;
-    overflow-y: scroll;
+    overflow-y: auto;
     width: 30%;
     left: 50%;
     top: 50%;
-- 
cgit v1.2.3


From 54837fbd3614f97c06675ca416859dcbe96e1190 Mon Sep 17 00:00:00 2001
From: Marvin Borner
Date: Sat, 10 Oct 2020 11:27:18 +0200
Subject: Fixed teacher quotes

---
 overview/public/index.html | 3 +++
 quotes/public/script.js    | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

(limited to 'quotes')

diff --git a/overview/public/index.html b/overview/public/index.html
index ba3596f..27d5292 100644
--- a/overview/public/index.html
+++ b/overview/public/index.html
@@ -34,6 +34,9 @@
                 <li><a href="/quotes">Zitate</a></li>
                 <li><a href="/poll">Schüler-Ranking</a></li>
             </ul>
+	    <p>
+	    	Bitte benutzt diese Tools nur ernsthaft - es ist nun mal unsere gemeinsame Zeitung :)
+	    </p>
             <p>
                 Falls ihr uns bei der Entwicklung helfen wollt, Fehler gefunden habt oder Fragen an uns habt, könnt ihr
                 gerne mit dem Entwicklungs-Team Kontakt aufnehmen:
diff --git a/quotes/public/script.js b/quotes/public/script.js
index 55eeb5f..f8486f9 100644
--- a/quotes/public/script.js
+++ b/quotes/public/script.js
@@ -1,5 +1,5 @@
 const dropdown = document.getElementById("author");
-const classes = ["TGM13.1", "TGM13.2", "TGTM13.1", "TGI13.1", "TGI13.2", "Lehrer"];
+const classes = ["TGM13.1", "TGM13.2", "TGTM13.1", "TGI13.1", "TGI13.2", "teacher"];
 
 dropdown.insertAdjacentHTML("beforeend", '<option selected="true" disabled>Author auswählen...</option>');
 dropdown.insertAdjacentHTML("beforeend", `<option disabled>--${classes[0]}--</option>`);
-- 
cgit v1.2.3


From ad2d5dd284dc733a5fbd2a9f60c30fa1b7a0da73 Mon Sep 17 00:00:00 2001
From: Marvin Borner
Date: Sat, 10 Oct 2020 11:37:35 +0200
Subject: Fixed HTML injection and middlename spaces

---
 poll/public/script.js   | 15 +--------------
 quotes/index.js         |  2 +-
 quotes/public/script.js |  4 ++--
 3 files changed, 4 insertions(+), 17 deletions(-)

(limited to 'quotes')

diff --git a/poll/public/script.js b/poll/public/script.js
index bfb686d..a1911fa 100644
--- a/poll/public/script.js
+++ b/poll/public/script.js
@@ -8,26 +8,13 @@ function appendOption(response) {
     response.forEach((elem) => {
         dropdown.insertAdjacentHTML(
             "beforeend",
-            `<option value="${elem["id"]}">${elem["name"]} ${elem["middlename"] ? elem["middlename"] : " "}${
+            `<option value="${elem["id"]}">${elem["name"]} ${elem["middlename"] ? elem["middlename"] + " " : ""}${
                 elem["surname"]
             }</option>`,
         );
     });
 }
 
-function appendQuote(response) {
-    response.forEach((elem) => {
-        document
-            .getElementById(elem["class"])
-            .insertAdjacentHTML(
-                "beforeend",
-                `<li>${elem["name"]} ${elem["middlename"] ? elem["middlename"] : " "}${elem["surname"]}: ${
-                    elem["quote"]
-                }</li>`,
-            );
-    });
-}
-
 fetch("/auth/api/list")
     .then((response) => response.json())
     .then((response) => appendOption(response));
diff --git a/quotes/index.js b/quotes/index.js
index 5aa0646..0e0717b 100644
--- a/quotes/index.js
+++ b/quotes/index.js
@@ -11,7 +11,7 @@ app.post("/api/add", checkUser, async (req, res) => {
         await db.query("INSERT INTO quotes (user_id, author_id, quote) VALUE (?,?,?)", [
             req.session.uid,
             parseInt(req.body.author),
-            req.body.quote,
+            req.body.quote.replace(/</g, "&lt;").replace(/>/g, "&gt;"),
         ]);
         res.redirect("/quotes");
     } catch (e) {
diff --git a/quotes/public/script.js b/quotes/public/script.js
index f8486f9..d848814 100644
--- a/quotes/public/script.js
+++ b/quotes/public/script.js
@@ -11,7 +11,7 @@ function appendOption(response) {
             (response[i - 1 < 0 ? 0 : i - 1]["class_id"] !== elem["class_id"]
                 ? `<option disabled>--${classes[elem["class_id"] - 1]}--</option>`
                 : "") +
-                `<option value="${elem["id"]}">${elem["name"]} ${elem["middlename"] ? elem["middlename"] : " "}${
+                `<option value="${elem["id"]}">${elem["name"]} ${elem["middlename"] ? elem["middlename"] + " " : ""}${
                     elem["surname"]
                 }</option>`,
         );
@@ -24,7 +24,7 @@ function appendQuote(response) {
             .getElementById(elem["class"])
             .insertAdjacentHTML(
                 "beforeend",
-                `<li>${elem["name"]} ${elem["middlename"] ? elem["middlename"] : ""}${elem["surname"]}: ${
+                `<li>${elem["name"]} ${elem["middlename"] ? elem["middlename"] + " " : ""}${elem["surname"]}: ${
                     elem["quote"]
                 }${elem["owner"] ? ' <span data-id="' + elem["id"] + '">[x]</span></li>' : ""}`,
             );
-- 
cgit v1.2.3