client: escape periods in tag names

Merges PR #390

client/html/post_readonly_sidebar.tpl

@@ -92,7 +92,7 @@
                             --></a><!--
                         --><% } %><!--
                         --><% if (ctx.canListPosts) { %><!--
-                            --><a href='<%- ctx.formatClientLink('posts', {query: ctx.escapeColons(tag.names[0])}) %>' class='<%= ctx.makeCssName(tag.category, 'tag') %>'><!--
+                            --><a href='<%- ctx.formatClientLink('posts', {query: ctx.escapeTagName(tag.names[0])}) %>' class='<%= ctx.makeCssName(tag.category, 'tag') %>'><!--
                         --><% } %><!--
                             --><%- ctx.getPrettyName(tag.names[0]) %>&#32;<!--
                         --><% if (ctx.canListPosts) { %><!--

client/html/tag_delete.tpl

@@ -1,6 +1,6 @@
 <div class='tag-delete'>
     <form>
-        <p>This tag has <a href='<%- ctx.formatClientLink('posts', {query: ctx.escapeColons(ctx.tag.names[0])}) %>'><%- ctx.tag.postCount %> usage(s)</a>.</p>
+        <p>This tag has <a href='<%- ctx.formatClientLink('posts', {query: ctx.escapeTagName(ctx.tag.names[0])}) %>'><%- ctx.tag.postCount %> usage(s)</a>.</p>
 
         <ul class='input'>
             <li>

client/html/tag_summary.tpl

@@ -36,6 +36,6 @@
     <section class='description'>
         <hr/>
         <%= ctx.makeMarkdown(ctx.tag.description || 'This tag has no description yet.') %>
-        <p>This tag has <a href='<%- ctx.formatClientLink('posts', {query: ctx.escapeColons(ctx.tag.names[0])}) %>'><%- ctx.tag.postCount %> usage(s)</a>.</p>
+        <p>This tag has <a href='<%- ctx.formatClientLink('posts', {query: ctx.escapeTagName(ctx.tag.names[0])}) %>'><%- ctx.tag.postCount %> usage(s)</a>.</p>
     </section>
 </div>

client/js/controllers/pool_controller.js

@@ -52,7 +52,7 @@ class PoolController {
                     canMerge: api.hasPrivilege("pools:merge"),
                     canDelete: api.hasPrivilege("pools:delete"),
                     categories: categories,
-                    escapeColons: uri.escapeColons,
+                    escapeTagName: uri.escapeTagName,
                 });
 
                 this._view.addEventListener("change", (e) =>

client/js/controllers/pool_create_controller.js

@@ -26,7 +26,7 @@ class PoolCreateController {
                 this._view = new PoolCreateView({
                     canCreate: api.hasPrivilege("pools:create"),
                     categories: categories,
-                    escapeColons: uri.escapeColons,
+                    escapeTagName: uri.escapeTagName,
                 });
 
                 this._view.addEventListener("submit", (e) =>

client/js/controllers/tag_controller.js

@@ -56,7 +56,7 @@ class TagController {
                     canMerge: api.hasPrivilege("tags:merge"),
                     canDelete: api.hasPrivilege("tags:delete"),
                     categories: categories,
-                    escapeColons: uri.escapeColons,
+                    escapeTagName: uri.escapeTagName,
                 });
 
                 this._view.addEventListener("change", (e) =>

client/js/controls/post_readonly_sidebar_control.js

@@ -28,7 +28,7 @@ class PostReadonlySidebarControl extends events.EventTarget {
                 canListPosts: api.hasPrivilege("posts:list"),
                 canEditPosts: api.hasPrivilege("posts:edit"),
                 canViewTags: api.hasPrivilege("tags:view"),
-                escapeColons: uri.escapeColons,
+                escapeTagName: uri.escapeTagName,
                 extractRootDomain: uri.extractRootDomain,
                 getPrettyName: misc.getPrettyName,
             })

client/js/controls/tag_input_control.js

@@ -163,7 +163,8 @@ class TagInputControl extends events.EventTarget {
 
     addTagByName(name, source) {
         name = name.trim();
-        if (!name) {
+        // Tags `.` and `..` are not allowed, see https://github.com/rr-/szurubooru/pull/390
+        if (!name || name == "." || name == "..") {
             return;
         }
         return Tag.get(name).then(
@@ -305,7 +306,7 @@ class TagInputControl extends events.EventTarget {
         searchLinkNode.setAttribute(
             "href",
             uri.formatClientLink("posts", {
-                query: uri.escapeColons(tag.names[0]),
+                query: uri.escapeTagName(tag.names[0]),
             })
         );
         searchLinkNode.textContent = tag.names[0] + " ";

client/js/util/misc.js

@@ -187,7 +187,7 @@ function arraysDiffer(source1, source2, orderImportant) {
 }
 
 function escapeSearchTerm(text) {
-    return text.replace(/([a-z_-]):/g, "$1\\:");
+    return text.replace(/([a-z_-]):/g, "$1\\:").replace(/\./g, "\\.");
 }
 
 function dataURItoBlob(dataURI) {

client/js/util/uri.js

@@ -85,14 +85,14 @@ function extractRootDomain(url) {
     return domain;
 }
 
-function escapeColons(text) {
-    return text.replace(new RegExp(":", "g"), "\\:");
+function escapeTagName(text) {
+    return text.replace(/:/g, "\\:").replace(/\./g, "\\.");
 }
 
 module.exports = {
     formatClientLink: formatClientLink,
     formatApiLink: formatApiLink,
-    escapeColons: escapeColons,
+    escapeTagName: escapeTagName,
     escapeParam: escapeParam,
     unescapeParam: unescapeParam,
     extractHostname: extractHostname,