From 939d9b95a0e722c671b557611e5e0b275c41ac8f Mon Sep 17 00:00:00 2001 From: bamboo3250 Date: Wed, 20 Apr 2016 23:10:55 +0800 Subject: [PATCH 1/6] clear sanitization in session name when publishing and unpublishing session --- .../java/teammates/common/util/StringHelper.java | 15 +++++++++++++++ .../InstructorFeedbackPublishAction.java | 3 +++ .../InstructorFeedbackUnpublishAction.java | 3 +++ .../test/cases/common/StringHelperTest.java | 12 ++++++++++++ 4 files changed, 33 insertions(+) diff --git a/src/main/java/teammates/common/util/StringHelper.java b/src/main/java/teammates/common/util/StringHelper.java index 897f9dd325d..55aede9e189 100644 --- a/src/main/java/teammates/common/util/StringHelper.java +++ b/src/main/java/teammates/common/util/StringHelper.java @@ -350,6 +350,21 @@ public static String recoverFromSanitizedText(String str) { .replaceAll("&", "&"); } + /** + * Recovers text that has been sanitized for javascript under Sanitizer.sanitizeForJs() + */ + public static String recoverFromSanitizedForJsText(String str) { + if (str == null) { + return null; + } + + return recoverFromSanitizedText(str) + .replace("\\\\", "\\") + .replace("\\\"", "\"") + .replace("\\\'", "\'") + .replace("\\#", "#"); + } + /** * This recovers a set of html-sanitized string to original encoding for appropriate display in files such as csv file
* It restores encoding for < > \ / ' &
diff --git a/src/main/java/teammates/ui/controller/InstructorFeedbackPublishAction.java b/src/main/java/teammates/ui/controller/InstructorFeedbackPublishAction.java index 5f743de9046..704df81a180 100644 --- a/src/main/java/teammates/ui/controller/InstructorFeedbackPublishAction.java +++ b/src/main/java/teammates/ui/controller/InstructorFeedbackPublishAction.java @@ -8,6 +8,7 @@ import teammates.common.util.Const; import teammates.common.util.StatusMessage; import teammates.common.util.Const.StatusMessageColor; +import teammates.common.util.StringHelper; import teammates.logic.api.GateKeeper; public class InstructorFeedbackPublishAction extends InstructorFeedbacksPageAction { @@ -20,6 +21,8 @@ protected ActionResult execute() throws EntityDoesNotExistException { Assumption.assertNotNull(Const.StatusCodes.NULL_PARAMETER, courseId); Assumption.assertNotNull(Const.StatusCodes.NULL_PARAMETER, feedbackSessionName); + feedbackSessionName = StringHelper.recoverFromSanitizedForJsText(feedbackSessionName); + InstructorAttributes instructor = logic.getInstructorForGoogleId(courseId, account.googleId); FeedbackSessionAttributes session = logic.getFeedbackSession(feedbackSessionName, courseId); boolean isCreatorOnly = false; diff --git a/src/main/java/teammates/ui/controller/InstructorFeedbackUnpublishAction.java b/src/main/java/teammates/ui/controller/InstructorFeedbackUnpublishAction.java index 381a9e52d4b..661cfa2f664 100644 --- a/src/main/java/teammates/ui/controller/InstructorFeedbackUnpublishAction.java +++ b/src/main/java/teammates/ui/controller/InstructorFeedbackUnpublishAction.java @@ -7,6 +7,7 @@ import teammates.common.util.Assumption; import teammates.common.util.Const; import teammates.common.util.StatusMessage; +import teammates.common.util.StringHelper; import teammates.common.util.Const.StatusMessageColor; import teammates.logic.api.GateKeeper; @@ -20,6 +21,8 @@ protected ActionResult execute() throws EntityDoesNotExistException { Assumption.assertNotNull(Const.StatusCodes.NULL_PARAMETER, courseId); Assumption.assertNotNull(Const.StatusCodes.NULL_PARAMETER, feedbackSessionName); + feedbackSessionName = StringHelper.recoverFromSanitizedForJsText(feedbackSessionName); + InstructorAttributes instructor = logic.getInstructorForGoogleId(courseId, account.googleId); FeedbackSessionAttributes session = logic.getFeedbackSession(feedbackSessionName, courseId); boolean isCreatorOnly = false; diff --git a/src/test/java/teammates/test/cases/common/StringHelperTest.java b/src/test/java/teammates/test/cases/common/StringHelperTest.java index c5a78542428..4188a04179b 100644 --- a/src/test/java/teammates/test/cases/common/StringHelperTest.java +++ b/src/test/java/teammates/test/cases/common/StringHelperTest.java @@ -208,6 +208,18 @@ public void testRecoverFromSanitizedText(){ str = Sanitizer.sanitizeForHtml("
'param' &&& \\//\\"); assertEquals("
'param' &&& \\//\\",StringHelper.recoverFromSanitizedText(str)); } + + @Test + public void testRecoverFromSanitizedForJsText(){ + String str = null; + assertEquals(null,StringHelper.recoverFromSanitizedForJsText(str)); + + str = ""; + assertEquals("",StringHelper.recoverFromSanitizedForJsText(str)); + + str = Sanitizer.sanitizeForJs("\\ \" ' #"); + assertEquals("\\ \" ' #",StringHelper.recoverFromSanitizedForJsText(str)); + } @Test public void testCountEmptyStrings() { From 4ffccd6adcf997253f06c867314f1ecb7cfc654a Mon Sep 17 00:00:00 2001 From: bamboo3250 Date: Wed, 20 Apr 2016 23:11:13 +0800 Subject: [PATCH 2/6] modify test and run godmode --- .../InstructorFeedbackPageUiTest.java | 4 ++-- .../data/InstructorFeedbackPageUiTest.json | 2 +- .../instructorFeedbackAllSessionTypes.html | 24 +++++++++---------- ...FeedbackAllSessionTypesWithHelperView.html | 24 +++++++++---------- .../instructorFeedbackDeleteSuccessful.html | 24 +++++++++---------- .../instructorFeedbackPublishSuccessful.html | 24 +++++++++---------- ...instructorFeedbackUnpublishSuccessful.html | 24 +++++++++---------- 7 files changed, 63 insertions(+), 63 deletions(-) diff --git a/src/test/java/teammates/test/cases/ui/browsertests/InstructorFeedbackPageUiTest.java b/src/test/java/teammates/test/cases/ui/browsertests/InstructorFeedbackPageUiTest.java index 90fdde068f4..5bd6c12c360 100644 --- a/src/test/java/teammates/test/cases/ui/browsertests/InstructorFeedbackPageUiTest.java +++ b/src/test/java/teammates/test/cases/ui/browsertests/InstructorFeedbackPageUiTest.java @@ -157,9 +157,9 @@ public void testContent() throws Exception { feedbackPage.verifyHtmlMainContent("/instructorFeedbackAllSessionTypes.html"); feedbackPage.sortByName().verifyTablePattern( - 0, 1,"Awaiting Session{*}First Session{*}Manual Session{*}Open Session{*}Private Session"); + 0, 1,"Awaiting Session{*}First Session{*}Manual Session #1{*}Open Session{*}Private Session"); feedbackPage.sortByName().verifyTablePattern( - 0, 1,"Private Session{*}Open Session{*}Manual Session{*}First Session{*}Awaiting Session"); + 0, 1,"Private Session{*}Open Session{*}Manual Session #1{*}First Session{*}Awaiting Session"); ______TS("sort by course id"); diff --git a/src/test/resources/data/InstructorFeedbackPageUiTest.json b/src/test/resources/data/InstructorFeedbackPageUiTest.json index 0171b5ecfd2..c3c1b0fac84 100644 --- a/src/test/resources/data/InstructorFeedbackPageUiTest.json +++ b/src/test/resources/data/InstructorFeedbackPageUiTest.json @@ -310,7 +310,7 @@ "sentPublishedEmail" : false }, "manualSession": { - "feedbackSessionName" : "Manual Session", + "feedbackSessionName" : "Manual Session #1", "courseId" : "CFeedbackUiT.CS1101", "creatorEmail" : "teammates.test1@gmail.tmt", "instructions": {"value" : "Please please fill in the third feedback session"}, diff --git a/src/test/resources/pages/instructorFeedbackAllSessionTypes.html b/src/test/resources/pages/instructorFeedbackAllSessionTypes.html index 7437ef022b2..d758e276ae5 100644 --- a/src/test/resources/pages/instructorFeedbackAllSessionTypes.html +++ b/src/test/resources/pages/instructorFeedbackAllSessionTypes.html @@ -1016,7 +1016,7 @@
@@ -1024,31 +1024,31 @@
- + Show - + View Results - + Edit - + Delete - + Copy - + Publish Results @@ -1220,7 +1220,7 @@
@@ -984,31 +984,31 @@
- + Show - + View Results - + Edit - + Delete - + Copy - + Publish Results @@ -1144,7 +1144,7 @@
@@ -1245,31 +1245,31 @@
- + Show - + View Results - + Edit - + Delete - + Copy - + Publish Results @@ -1485,7 +1485,7 @@
The responses for this session are visible." data-placement="top" data-toggle="tooltip" title=""> @@ -1027,31 +1027,31 @@
- + Show - + View Results - + Edit - + Delete - + Copy - + Unpublish Results @@ -1223,7 +1223,7 @@
@@ -1027,31 +1027,31 @@
- + Show - + View Results - + Edit - + Delete - + Copy - + Publish Results @@ -1223,7 +1223,7 @@
- + @@ -1643,7 +1643,7 @@
+ @@ -840,7 +840,7 @@
+ @@ -840,7 +840,7 @@