Knah-Tsaeb/MyShaarli
Knah-Tsaeb/MyShaarli
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity
MyShaarli/tpl/linklist.html

125 lines
5.7 KiB
HTML
Raw Normal View History

Initial commit (version 0.0.40 beta)
2013-02-26 10:09:41 +01:00
<!DOCTYPE html>
<html>
<head>{include="includes"}</head>
<body>
<div id="pageheader">
New QR-Code generation code * QR-Code generation now uses a client-side javascript library instead of an external service. This is better for user privacy. * Library used is http://neocotic.com/qr.js/ (11 kb). * jQuery is no longer used to display QR-Code (this is a first step in removing jQuery entirely). * This library is loaded *only* if the QR-Code icon is clicked. * If javascript is disabled, it will fallback to the external service. * External service was changed from "invx.com" to "qrfree.kaywa.com" because invx has become bloated. By loading the javascript library *only* if the icon is clicked, it will prevent the 11 kb lib to be loaded in every page.
2013-09-25 15:17:09 +02:00
{include="page.header"}
CSS: remove hardcoded style from templates Fixes shaarli/Shaarli#29 Style elements refactored as follows: - use existing ids and classes if possible, - else, define new ones and stick with the existing naming convention, - remove hardcoded style attributes from RainTPL templates. Exception: In tpl/tagcloud.html, the display size of each tag is computed at page generation. Signed-off-by: VirtualTam <virtualtam@flibidi.org>
2014-12-02 21:00:52 +01:00
<div id="headerform" class="search">
<form method="GET" class="searchform" name="searchform"><input type="text" id="searchform_value" name="searchterm" value=""> <input type="submit" value="Search" class="bigbutton"></form>
<form method="GET" class="tagfilter" name="tagfilter"><input type="text" name="searchtags" id="tagfilter_value" value=""> <input type="submit" value="Filter by tag" class="bigbutton"></form>
New QR-Code generation code * QR-Code generation now uses a client-side javascript library instead of an external service. This is better for user privacy. * Library used is http://neocotic.com/qr.js/ (11 kb). * jQuery is no longer used to display QR-Code (this is a first step in removing jQuery entirely). * This library is loaded *only* if the QR-Code icon is clicked. * If javascript is disabled, it will fallback to the external service. * External service was changed from "invx.com" to "qrfree.kaywa.com" because invx has become bloated. By loading the javascript library *only* if the icon is clicked, it will prevent the 11 kb lib to be loaded in every page.
2013-09-25 15:17:09 +02:00
</div>
Initial commit (version 0.0.40 beta)
2013-02-26 10:09:41 +01:00
</div>
<div id="linklist">
{include="linklist.paging"}
{if="count($links)==0"}
<div id="searchcriteria">Nothing found.</i></div>
{else}
{if="$search_type=='fulltext'"}
<div id="searchcriteria">{$result_count} results for <i>{$search_crits}</i></div>
{/if}
{if="$search_type=='tags'"}
<div id="searchcriteria">{$result_count} results for tags <i>
{loop="search_crits"}
CSS: remove hardcoded style from templates Fixes shaarli/Shaarli#29 Style elements refactored as follows: - use existing ids and classes if possible, - else, define new ones and stick with the existing naming convention, - remove hardcoded style attributes from RainTPL templates. Exception: In tpl/tagcloud.html, the display size of each tag is computed at page generation. Signed-off-by: VirtualTam <virtualtam@flibidi.org>
2014-12-02 21:00:52 +01:00
<span class="linktag" title="Remove tag"><a href="?removetag={$value|htmlspecialchars}">{$value|htmlspecialchars} <span class="remove">x</span></a></span>
Initial commit (version 0.0.40 beta)
2013-02-26 10:09:41 +01:00
{/loop}</i></div>
{/if}
{/if}
<ul>
{loop="links"}
<li{if="$value.class"} class="{$value.class}"{/if}>
After clicking save/cancel on a link, scroll to the link itself.
2013-02-27 18:24:07 +01:00
<a name="{$value.linkdate|smallHash}" id="{$value.linkdate|smallHash}"></a>
Initial commit (version 0.0.40 beta)
2013-02-26 10:09:41 +01:00
<div class="thumbnail">{$value.url|thumbnail}</div>
<div class="linkcontainer">
{if="isLoggedIn()"}
Edit/delete button on the left-side of links. https://github.com/sebsauvage/Shaarli/issues/5
2013-02-27 17:46:45 +01:00
<div class="linkeditbuttons">
<form method="GET" class="buttoneditform"><input type="hidden" name="edit_link" value="{$value.linkdate}"><input type="image" alt="Edit" src="images/edit_icon.png#" title="Edit" class="button_edit"></form><br>
<form method="POST" class="buttoneditform"><input type="hidden" name="lf_linkdate" value="{$value.linkdate}">
<input type="hidden" name="token" value="{$token}"><input type="hidden" name="delete_link"><input type="image" alt="Delete" src="images/delete_icon.png#" title="Delete" class="button_delete" onClick="return confirmDeleteLink();"></form>
</div>
Initial commit (version 0.0.40 beta)
2013-02-26 10:09:41 +01:00
{/if}
Corrected vulnerabilities (see report below) Title : Shaarli Vulnerabilities Author : @erwan_lr | @_WPScan_ Vendor : http://sebsauvage.net/wiki/doku.php?id=php:shaarli Download : https://github.com/sebsauvage/Shaarli/archive/master.zip | http://sebsauvage.net/files/shaarli_0.0.40beta.zip Affected versions : master-705F835, 0.0.40-beta (versions below may also be vulnerable) Vulnerabilities : Persistent XSS & Unvalidated Redirects and Forwards Persistent XSS : - During the instalation or configuration modification, the title field is vulnerable. e.g <script>alert(1)</script> Quotes can not be used because of var_export(), but String.fromCharCode works - The url field of a link is vulnerable : When there is no redirector : javascript:alert(1) Then, the code is triggered when a user click the url of a link Or with a classic XSS : "><script>alert(1)</script> Unvalidated Redirects and Forwards : A request with the param linksperpage or privateonly can be used to redirect a user to an arbitrary referer e.g GET /Audit/Shaarli/master-705f835/?linksperpage=10 HTTP/1.1 Host: 127.0.0.1 Referer: https://duckduckgo.com History : March 2, 2013 - Vendor contacted
2013-03-03 22:15:38 +01:00
<span class="linktitle"><a href="{$redirector}{$value.url|htmlspecialchars}">{$value.title|htmlspecialchars}</a></span>
Initial commit (version 0.0.40 beta)
2013-02-26 10:09:41 +01:00
<br>
CSS: remove hardcoded style from templates Fixes shaarli/Shaarli#29 Style elements refactored as follows: - use existing ids and classes if possible, - else, define new ones and stick with the existing naming convention, - remove hardcoded style attributes from RainTPL templates. Exception: In tpl/tagcloud.html, the display size of each tag is computed at page generation. Signed-off-by: VirtualTam <virtualtam@flibidi.org>
2014-12-02 21:00:52 +01:00
{if="$value.description"}<div class="linkdescription">{$value.description}</div>{/if}
Initial commit (version 0.0.40 beta)
2013-02-26 10:09:41 +01:00
{if="!$GLOBALS['config']['HIDE_TIMESTAMPS'] || isLoggedIn()"}
<span class="linkdate" title="Permalink"><a href="?{$value.linkdate|smallHash}">{$value.localdate|htmlspecialchars} - permalink</a> - </span>
{else}
<span class="linkdate" title="Short link here"><a href="?{$value.linkdate|smallHash}">permalink</a> - </span>
{/if}
make archive.org integration optional (ARCHIVE_ORG option, defaults to false)
2014-11-08 18:19:52 +01:00
{if="$GLOBALS['config']['ARCHIVE_ORG']"}
Add Archive.org integration * adds an "archive" link next to permalinks, linking to the last version of the page on archive.org
2014-11-02 15:29:39 +01:00
<span class="linkarchive"><a href="https://web.archive.org/web/{$value.url|htmlspecialchars}">archive</a> - </span>
make archive.org integration optional (ARCHIVE_ORG option, defaults to false)
2014-11-08 18:19:52 +01:00
{/if}
CSS: remove hardcoded style from templates Fixes shaarli/Shaarli#29 Style elements refactored as follows: - use existing ids and classes if possible, - else, define new ones and stick with the existing naming convention, - remove hardcoded style attributes from RainTPL templates. Exception: In tpl/tagcloud.html, the display size of each tag is computed at page generation. Signed-off-by: VirtualTam <virtualtam@flibidi.org>
2014-12-02 21:00:52 +01:00
<div class="linkqrcode"><a href="http://qrfree.kaywa.com/?l=1&s=8&d={$scripturl|urlencode}%3F{$value.linkdate|smallHash}"
onclick="showQrCode(this); return false;" class="qrcode" data-permalink="{$scripturl}?{$value.linkdate|smallHash}"><img src="images/qrcode.png#" title="QR-Code"></a></div> -
Added a link to the visible URL in the link list Corrected CSS to prevent a line from showing underneath Fixes https://github.com/shaarli/Shaarli/issues/53
2014-11-21 19:43:53 +01:00
<a href={$value.url|htmlspecialchars}><span class="linkurl" title="Short link">{$value.url|htmlspecialchars}</span></a><br>
Initial commit (version 0.0.40 beta)
2013-02-26 10:09:41 +01:00
{if="$value.tags"}
<div class="linktaglist">
{loop="value.taglist"}<span class="linktag" title="Add tag"><a href="?addtag={$value|urlencode}">{$value|htmlspecialchars}</a></span> {/loop}
</div>
{/if}
</div>
</li>
{/loop}
</ul>
{include="linklist.paging"}
</div>
Added a link to the visible URL in the link list Corrected CSS to prevent a line from showing underneath Fixes https://github.com/shaarli/Shaarli/issues/53
2014-11-21 19:43:53 +01:00
{include="page.footer"}
New QR-Code generation code * QR-Code generation now uses a client-side javascript library instead of an external service. This is better for user privacy. * Library used is http://neocotic.com/qr.js/ (11 kb). * jQuery is no longer used to display QR-Code (this is a first step in removing jQuery entirely). * This library is loaded *only* if the QR-Code icon is clicked. * If javascript is disabled, it will fallback to the external service. * External service was changed from "invx.com" to "qrfree.kaywa.com" because invx has become bloated. By loading the javascript library *only* if the icon is clicked, it will prevent the 11 kb lib to be loaded in every page.
2013-09-25 15:17:09 +02:00
<script language="JavaScript">
// Remove any displayed QR-Code
function remove_qrcode()
Added a link to the visible URL in the link list Corrected CSS to prevent a line from showing underneath Fixes https://github.com/shaarli/Shaarli/issues/53
2014-11-21 19:43:53 +01:00
{
New QR-Code generation code * QR-Code generation now uses a client-side javascript library instead of an external service. This is better for user privacy. * Library used is http://neocotic.com/qr.js/ (11 kb). * jQuery is no longer used to display QR-Code (this is a first step in removing jQuery entirely). * This library is loaded *only* if the QR-Code icon is clicked. * If javascript is disabled, it will fallback to the external service. * External service was changed from "invx.com" to "qrfree.kaywa.com" because invx has become bloated. By loading the javascript library *only* if the icon is clicked, it will prevent the 11 kb lib to be loaded in every page.
2013-09-25 15:17:09 +02:00
var elem = document.getElementById("permalinkQrcode");
if (elem) elem.parentNode.removeChild(elem);
return false;
}
// Show the QR-Code of a permalink (when the QR-Code icon is clicked).
function showQrCode(caller,loading=false)
Added a link to the visible URL in the link list Corrected CSS to prevent a line from showing underneath Fixes https://github.com/shaarli/Shaarli/issues/53
2014-11-21 19:43:53 +01:00
{
New QR-Code generation code * QR-Code generation now uses a client-side javascript library instead of an external service. This is better for user privacy. * Library used is http://neocotic.com/qr.js/ (11 kb). * jQuery is no longer used to display QR-Code (this is a first step in removing jQuery entirely). * This library is loaded *only* if the QR-Code icon is clicked. * If javascript is disabled, it will fallback to the external service. * External service was changed from "invx.com" to "qrfree.kaywa.com" because invx has become bloated. By loading the javascript library *only* if the icon is clicked, it will prevent the 11 kb lib to be loaded in every page.
2013-09-25 15:17:09 +02:00
// Dynamic javascript lib loading: We only load qr.js if the QR code icon is clicked:
if (typeof(qr)=='undefined') // Load qr.js only if not present.
{
if (!loading) // If javascript lib is still loading, do not append script to body.
{
var element = document.createElement("script");
element.src = "inc/qr.min.js";
document.body.appendChild(element);
}
setTimeout(function() { showQrCode(caller,true);}, 200); // Retry in 200 milliseconds.
return false;
}
// Remove previous qrcode if present.
remove_qrcode();
Added a link to the visible URL in the link list Corrected CSS to prevent a line from showing underneath Fixes https://github.com/shaarli/Shaarli/issues/53
2014-11-21 19:43:53 +01:00
New QR-Code generation code * QR-Code generation now uses a client-side javascript library instead of an external service. This is better for user privacy. * Library used is http://neocotic.com/qr.js/ (11 kb). * jQuery is no longer used to display QR-Code (this is a first step in removing jQuery entirely). * This library is loaded *only* if the QR-Code icon is clicked. * If javascript is disabled, it will fallback to the external service. * External service was changed from "invx.com" to "qrfree.kaywa.com" because invx has become bloated. By loading the javascript library *only* if the icon is clicked, it will prevent the 11 kb lib to be loaded in every page.
2013-09-25 15:17:09 +02:00
// Build the div which contains the QR-Code:
var element = document.createElement('div');
element.id="permalinkQrcode";
// Make QR-Code div commit sepuku when clicked:
if ( element.attachEvent ){ element.attachEvent('onclick', 'this.parentNode.removeChild(this);' ); } // Damn IE
else { element.setAttribute('onclick', 'this.parentNode.removeChild(this);' ); }
Added a link to the visible URL in the link list Corrected CSS to prevent a line from showing underneath Fixes https://github.com/shaarli/Shaarli/issues/53
2014-11-21 19:43:53 +01:00
New QR-Code generation code * QR-Code generation now uses a client-side javascript library instead of an external service. This is better for user privacy. * Library used is http://neocotic.com/qr.js/ (11 kb). * jQuery is no longer used to display QR-Code (this is a first step in removing jQuery entirely). * This library is loaded *only* if the QR-Code icon is clicked. * If javascript is disabled, it will fallback to the external service. * External service was changed from "invx.com" to "qrfree.kaywa.com" because invx has become bloated. By loading the javascript library *only* if the icon is clicked, it will prevent the 11 kb lib to be loaded in every page.
2013-09-25 15:17:09 +02:00
// Build the QR-Code:
var image = qr.image({size: 8,value: caller.dataset.permalink});
if (image)
Added a link to the visible URL in the link list Corrected CSS to prevent a line from showing underneath Fixes https://github.com/shaarli/Shaarli/issues/53
2014-11-21 19:43:53 +01:00
{
New QR-Code generation code * QR-Code generation now uses a client-side javascript library instead of an external service. This is better for user privacy. * Library used is http://neocotic.com/qr.js/ (11 kb). * jQuery is no longer used to display QR-Code (this is a first step in removing jQuery entirely). * This library is loaded *only* if the QR-Code icon is clicked. * If javascript is disabled, it will fallback to the external service. * External service was changed from "invx.com" to "qrfree.kaywa.com" because invx has become bloated. By loading the javascript library *only* if the icon is clicked, it will prevent the 11 kb lib to be loaded in every page.
2013-09-25 15:17:09 +02:00
element.appendChild(image);
element.innerHTML+= "<br>Click to close";
caller.parentNode.appendChild(element);
}
else
{
element.innerHTML="Your browser does not seem to be HTML5 compatible.";
}
return false;
}
Initial commit (version 0.0.40 beta)
2013-02-26 10:09:41 +01:00
</script>
</body>
New QR-Code generation code * QR-Code generation now uses a client-side javascript library instead of an external service. This is better for user privacy. * Library used is http://neocotic.com/qr.js/ (11 kb). * jQuery is no longer used to display QR-Code (this is a first step in removing jQuery entirely). * This library is loaded *only* if the QR-Code icon is clicked. * If javascript is disabled, it will fallback to the external service. * External service was changed from "invx.com" to "qrfree.kaywa.com" because invx has become bloated. By loading the javascript library *only* if the icon is clicked, it will prevent the 11 kb lib to be loaded in every page.
2013-09-25 15:17:09 +02:00
</html>
Reference in a new issue Copy permalink