From 1800397fcf0f1162a1297523d6f65449a4100605 Mon Sep 17 00:00:00 2001
From: Christian Mueller <chmllr@me.com>
Date: Sun, 26 Jan 2014 11:24:14 +0100
Subject: [PATCH] sanitizing added

---
 resources/public/js/main.js |  6 ++++--
 src/NoteHub/views/pages.clj | 10 ++++++++--
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/resources/public/js/main.js b/resources/public/js/main.js
index 3c32370..4e7c3ed 100644
--- a/resources/public/js/main.js
+++ b/resources/public/js/main.js
@@ -51,8 +51,10 @@ function onLoad() {
 
   if(window.innerHeight >= document.body.clientHeight) {
     var links = $("links");
-    links.style.position = "fixed";
-    links.style.bottom = 0;
+    if(links) {
+      links.style.position = "fixed";
+      links.style.bottom = 0;
+    }
   }
 
 }
diff --git a/src/NoteHub/views/pages.clj b/src/NoteHub/views/pages.clj
index 99ea4ec..fe4362a 100644
--- a/src/NoteHub/views/pages.clj
+++ b/src/NoteHub/views/pages.clj
@@ -40,6 +40,11 @@
     (if-not (get-setting :dev-mode) (include-js "/js/google-analytics.js"))]
    [:body {:onload "onLoad()"} content]))
 
+(defn sanitize
+  "Breakes all usages of <script> & <iframe>"
+  [input]
+  (sreplace input #"(</?(iframe|script).*?>|javascript:)" ""))
+
 ; Sets a custom message for each needed HTTP status.
 ; The message to be assigned is extracted with a dynamically generated key
 (doseq [code [400 403 404 500]]
@@ -102,9 +107,10 @@
 (defpage "/:year/:month/:day/:title" {:keys [year month day title] :as params}
   (let [noteID (api/build-key [year month day] title)]
     (when (storage/note-exists? noteID)
-      (let [note (api/get-note noteID)]
+      (let [note (api/get-note noteID)
+            sanitized-note (sanitize (:note note))]
         (layout (:title note)
-                (md-node :article.bottom-space (:note note))
+                (md-node :article.bottom-space sanitized-note)
                 (let [urls {:short-url (api/url (storage/create-short-url noteID params))
                             :notehub "/"}
                       links (map #(link-to