s around + // "paragraphs" that are wrapped in non-block-level tags, such as anchors, + // phrase emphasis, and spans. The list of tags we're looking for is + // hard-coded: + var block_tags_a = "p|div|h[1-6]|blockquote|pre|table|dl|ol|ul|script|noscript|form|fieldset|iframe|math|ins|del" + var block_tags_b = "p|div|h[1-6]|blockquote|pre|table|dl|ol|ul|script|noscript|form|fieldset|iframe|math" + + // First, look for nested blocks, e.g.: + //
tags around block-level tags.
+ text = _HashHTMLBlocks(text);
+ text = _FormParagraphs(text);
+
+ return text;
+}
+
+
+var _RunSpanGamut = function(text) {
+//
+// These are all the transformations that occur *within* block-level
+// tags like paragraphs, headers, and list items.
+//
+
+ text = _DoCodeSpans(text);
+ text = _EscapeSpecialCharsWithinTagAttributes(text);
+ text = _EncodeBackslashEscapes(text);
+
+ // Process anchor and image tags. Images must come first,
+ // because ![foo][f] looks like an anchor.
+ text = _DoImages(text);
+ text = _DoAnchors(text);
+
+ // Make links out of things like ` Just type tags
+//
+
+ // Strip leading and trailing lines:
+ text = text.replace(/^\n+/g,"");
+ text = text.replace(/\n+$/g,"");
+
+ var grafs = text.split(/\n{2,}/g);
+ var grafsOut = new Array();
+
+ //
+ // Wrap tags.
+ //
+ var end = grafs.length;
+ for (var i=0; i ");
+ str += " {{doc.kanso.description}}
\n");
+
+ return text;
+}
+
+var _EscapeSpecialCharsWithinTagAttributes = function(text) {
+//
+// Within tags -- meaning between < and > -- encode [\ ` * _] so they
+// don't conflict with their use in Markdown for code, italics and strong.
+//
+
+ // Build a regex to find HTML tags and comments. See Friedl's
+ // "Mastering Regular Expressions", 2nd Ed., pp. 200-201.
+ var regex = /(<[a-z\/!$]("[^"]*"|'[^']*'|[^'">])*>|)/gi;
+
+ text = text.replace(regex, function(wholeMatch) {
+ var tag = wholeMatch.replace(/(.)<\/?code>(?=.)/g,"$1`");
+ tag = escapeCharacters(tag,"\\`*_");
+ return tag;
+ });
+
+ return text;
+}
+
+var _DoAnchors = function(text) {
+//
+// Turn Markdown link shortcuts into XHTML tags.
+//
+ //
+ // First, handle reference-style links: [link text] [id]
+ //
+
+ /*
+ text = text.replace(/
+ ( // wrap whole match in $1
+ \[
+ (
+ (?:
+ \[[^\]]*\] // allow brackets nested one level
+ |
+ [^\[] // or anything else
+ )*
+ )
+ \]
+
+ [ ]? // one optional space
+ (?:\n[ ]*)? // one optional newline followed by spaces
+
+ \[
+ (.*?) // id = $3
+ \]
+ )()()()() // pad remaining backreferences
+ /g,_DoAnchors_callback);
+ */
+ text = text.replace(/(\[((?:\[[^\]]*\]|[^\[\]])*)\][ ]?(?:\n[ ]*)?\[(.*?)\])()()()()/g,writeAnchorTag);
+
+ //
+ // Next, inline-style links: [link text](url "optional title")
+ //
+
+ /*
+ text = text.replace(/
+ ( // wrap whole match in $1
+ \[
+ (
+ (?:
+ \[[^\]]*\] // allow brackets nested one level
+ |
+ [^\[\]] // or anything else
+ )
+ )
+ \]
+ \( // literal paren
+ [ \t]*
+ () // no id, so leave $3 empty
+ ? // href = $4
+ [ \t]*
+ ( // $5
+ (['"]) // quote char = $6
+ (.*?) // Title = $7
+ \6 // matching quote
+ [ \t]* // ignore any spaces/tabs between closing quote and )
+ )? // title is optional
+ \)
+ )
+ /g,writeAnchorTag);
+ */
+ text = text.replace(/(\[((?:\[[^\]]*\]|[^\[\]])*)\]\([ \t]*()?[ \t]*((['"])(.*?)\6[ \t]*)?\))/g,writeAnchorTag);
+
+ //
+ // Last, handle reference-style shortcuts: [link text]
+ // These must come last in case you've also got [link test][1]
+ // or [link test](/foo)
+ //
+
+ /*
+ text = text.replace(/
+ ( // wrap whole match in $1
+ \[
+ ([^\[\]]+) // link text = $2; can't contain '[' or ']'
+ \]
+ )()()()()() // pad rest of backreferences
+ /g, writeAnchorTag);
+ */
+ text = text.replace(/(\[([^\[\]]+)\])()()()()()/g, writeAnchorTag);
+
+ return text;
+}
+
+var writeAnchorTag = function(wholeMatch,m1,m2,m3,m4,m5,m6,m7) {
+ if (m7 == undefined) m7 = "";
+ var whole_match = m1;
+ var link_text = m2;
+ var link_id = m3.toLowerCase();
+ var url = m4;
+ var title = m7;
+
+ if (url == "") {
+ if (link_id == "") {
+ // lower-case and turn embedded newlines into spaces
+ link_id = link_text.toLowerCase().replace(/ ?\n/g," ");
+ }
+ url = "#"+link_id;
+
+ if (g_urls[link_id] != undefined) {
+ url = g_urls[link_id];
+ if (g_titles[link_id] != undefined) {
+ title = g_titles[link_id];
+ }
+ }
+ else {
+ if (whole_match.search(/\(\s*\)$/m)>-1) {
+ // Special case for explicit empty url
+ url = "";
+ } else {
+ return whole_match;
+ }
+ }
+ }
+
+ url = escapeCharacters(url,"*_");
+ var result = "";
+
+ return result;
+}
+
+
+var _DoImages = function(text) {
+//
+// Turn Markdown image shortcuts into tags.
+//
+
+ //
+ // First, handle reference-style labeled images: ![alt text][id]
+ //
+
+ /*
+ text = text.replace(/
+ ( // wrap whole match in $1
+ !\[
+ (.*?) // alt text = $2
+ \]
+
+ [ ]? // one optional space
+ (?:\n[ ]*)? // one optional newline followed by spaces
+
+ \[
+ (.*?) // id = $3
+ \]
+ )()()()() // pad rest of backreferences
+ /g,writeImageTag);
+ */
+ text = text.replace(/(!\[(.*?)\][ ]?(?:\n[ ]*)?\[(.*?)\])()()()()/g,writeImageTag);
+
+ //
+ // Next, handle inline images: 
+ // Don't forget: encode * and _
+
+ /*
+ text = text.replace(/
+ ( // wrap whole match in $1
+ !\[
+ (.*?) // alt text = $2
+ \]
+ \s? // One optional whitespace character
+ \( // literal paren
+ [ \t]*
+ () // no id, so leave $3 empty
+ ? // src url = $4
+ [ \t]*
+ ( // $5
+ (['"]) // quote char = $6
+ (.*?) // title = $7
+ \6 // matching quote
+ [ \t]*
+ )? // title is optional
+ \)
+ )
+ /g,writeImageTag);
+ */
+ text = text.replace(/(!\[(.*?)\]\s?\([ \t]*()?[ \t]*((['"])(.*?)\6[ \t]*)?\))/g,writeImageTag);
+
+ return text;
+}
+
+var writeImageTag = function(wholeMatch,m1,m2,m3,m4,m5,m6,m7) {
+ var whole_match = m1;
+ var alt_text = m2;
+ var link_id = m3.toLowerCase();
+ var url = m4;
+ var title = m7;
+
+ if (!title) title = "";
+
+ if (url == "") {
+ if (link_id == "") {
+ // lower-case and turn embedded newlines into spaces
+ link_id = alt_text.toLowerCase().replace(/ ?\n/g," ");
+ }
+ url = "#"+link_id;
+
+ if (g_urls[link_id] != undefined) {
+ url = g_urls[link_id];
+ if (g_titles[link_id] != undefined) {
+ title = g_titles[link_id];
+ }
+ }
+ else {
+ return whole_match;
+ }
+ }
+
+ alt_text = alt_text.replace(/"/g,""");
+ url = escapeCharacters(url,"*_");
+ var result = "
' + _RunSpanGamut(m1) + "");});
+
+ text = text.replace(/^(.+)[ \t]*\n-+[ \t]*\n+/gm,
+ function(matchFound,m1){return hashBlock('
' + _RunSpanGamut(m1) + "
");});
+
+ // atx-style headers:
+ // # Header 1
+ // ## Header 2
+ // ## Header 2 with closing hashes ##
+ // ...
+ // ###### Header 6
+ //
+
+ /*
+ text = text.replace(/
+ ^(\#{1,6}) // $1 = string of #'s
+ [ \t]*
+ (.+?) // $2 = Header text
+ [ \t]*
+ \#* // optional closing #'s (not counted)
+ \n+
+ /gm, function() {...});
+ */
+
+ text = text.replace(/^(\#{1,6})[ \t]*(.+?)[ \t]*\#*\n+/gm,
+ function(wholeMatch,m1,m2) {
+ var h_level = m1.length;
+ return hashBlock("` blocks.
+//
+
+ /*
+ text = text.replace(text,
+ /(?:\n\n|^)
+ ( // $1 = the code block -- one or more lines, starting with a space/tab
+ (?:
+ (?:[ ]{4}|\t) // Lines must start with a tab or a tab-width of spaces - attacklab: g_tab_width
+ .*\n+
+ )+
+ )
+ (\n*[ ]{0,3}[^ \t\n]|(?=~0)) // attacklab: g_tab_width
+ /g,function(){...});
+ */
+
+ // attacklab: sentinel workarounds for lack of \A and \Z, safari\khtml bug
+ text += "~0";
+
+ text = text.replace(/(?:\n\n|^)((?:(?:[ ]{4}|\t).*\n+)+)(\n*[ ]{0,3}[^ \t\n]|(?=~0))/g,
+ function(wholeMatch,m1,m2) {
+ var codeblock = m1;
+ var nextChar = m2;
+
+ codeblock = _EncodeCode( _Outdent(codeblock));
+ codeblock = _Detab(codeblock);
+ codeblock = codeblock.replace(/^\n+/g,""); // trim leading newlines
+ codeblock = codeblock.replace(/\n+$/g,""); // trim trailing whitespace
+
+ codeblock = "
";
+
+ return hashBlock(codeblock) + nextChar;
+ }
+ );
+
+ // attacklab: strip sentinel
+ text = text.replace(/~0/,"");
+
+ return text;
+}
+
+var hashBlock = function(text) {
+ text = text.replace(/(^\n+|\n+$)/g,"");
+ return "\n\n~K" + (g_html_blocks.push(text)-1) + "K\n\n";
+}
+
+
+var _DoCodeSpans = function(text) {
+//
+// * Backtick quotes are used for " + codeblock + "\n spans.
+//
+// * You can use multiple backticks as the delimiters if you want to
+// include literal backticks in the code span. So, this input:
+//
+// Just type ``foo `bar` baz`` at the prompt.
+//
+// Will translate to:
+//
+// foo `bar` baz at the prompt.`bar` ...
+//
+
+ /*
+ text = text.replace(/
+ (^|[^\\]) // Character before opening ` can't be a backslash
+ (`+) // $2 = Opening run of `
+ ( // $3 = The code block
+ [^\r]*?
+ [^`] // attacklab: work around lack of lookbehind
+ )
+ \2 // Matching closer
+ (?!`)
+ /gm, function(){...});
+ */
+
+ text = text.replace(/(^|[^\\])(`+)([^\r]*?[^`])\2(?!`)/gm,
+ function(wholeMatch,m1,m2,m3,m4) {
+ var c = m3;
+ c = c.replace(/^([ \t]*)/g,""); // leading whitespace
+ c = c.replace(/[ \t]*$/g,""); // trailing whitespace
+ c = _EncodeCode(c);
+ return m1+""+c+"";
+ });
+
+ return text;
+}
+
+
+// THIS HAS BEEN EDITED FOR THE WIKI
+var _EncodeCode = function(text) {
+//
+// Encode/escape certain characters inside Markdown code runs.
+// The point is that in code, these characters are literals,
+// and lose their special Markdown meanings.
+//
+ // Encode all ampersands; HTML entities are not
+ // entities within a Markdown code span.
+ //text = text.replace(/&/g,"&");
+
+ // Do the angle bracket song and dance:
+ //text = text.replace(//g,">");
+
+ // Now, escape characters that are magic in Markdown:
+ text = escapeCharacters(text,"\*_{}[]\\",false);
+
+// jj the line above breaks this:
+//---
+
+//* Item
+
+// 1. Subitem
+
+// special char: *
+//---
+
+ return text;
+}
+
+
+var _DoItalicsAndBold = function(text) {
+
+ // must go first:
+ text = text.replace(/(\*\*|__)(?=\S)([^\r]*?\S[*_]*)\1/g,
+ "$2");
+
+ text = text.replace(/(\*|_)(?=\S)([^\r]*?\S)\1/g,
+ "$2");
+
+ return text;
+}
+
+
+var _DoBlockQuotes = function(text) {
+
+ /*
+ text = text.replace(/
+ ( // Wrap whole match in $1
+ (
+ ^[ \t]*>[ \t]? // '>' at the start of a line
+ .+\n // rest of the first line
+ (.+\n)* // subsequent consecutive lines
+ \n* // blanks
+ )+
+ )
+ /gm, function(){...});
+ */
+
+ text = text.replace(/((^[ \t]*>[ \t]?.+\n(.+\n)*\n*)+)/gm,
+ function(wholeMatch,m1) {
+ var bq = m1;
+
+ // attacklab: hack around Konqueror 3.5.4 bug:
+ // "----------bug".replace(/^-/g,"") == "bug"
+
+ bq = bq.replace(/^[ \t]*>[ \t]?/gm,"~0"); // trim one level of quoting
+
+ // attacklab: clean up hack
+ bq = bq.replace(/~0/g,"");
+
+ bq = bq.replace(/^[ \t]+$/gm,""); // trim whitespace-only lines
+ bq = _RunBlockGamut(bq); // recurse
+
+ bq = bq.replace(/(^|\n)/g,"$1 ");
+ // These leading spaces screw with content, so we need to fix that:
+ bq = bq.replace(
+ /(\s*
[^\r]+?<\/pre>)/gm,
+ function(wholeMatch,m1) {
+ var pre = m1;
+ // attacklab: hack around Konqueror 3.5.4 bug:
+ pre = pre.replace(/^ /mg,"~0");
+ pre = pre.replace(/~0/g,"");
+ return pre;
+ });
+
+ return hashBlock("\n" + bq + "\n
");
+ });
+ return text;
+}
+
+
+var _FormParagraphs = function(text) {
+//
+// Params:
+// $text - string to process with html
';
+ }
+ else {
+ // no syntax highlighting, use basic pre tag
+ pre = '' +
+ block[2] + '
';
+ }
+ str = str.substr(0, block.index) +
+ pre +
+ str.substr(block.index + block[0].length);
+ }
+
+ var c = new Showdown.converter();
+ return c.makeHtml(str);
+};
diff --git a/lib/ui.js b/lib/ui.js
new file mode 100644
index 0000000..58aeeef
--- /dev/null
+++ b/lib/ui.js
@@ -0,0 +1,44 @@
+var duality = require('duality/core'),
+ sanitize = require('sanitize'),
+ showdown = require('./showdown-wiki'),
+ path = require('path');
+
+
+exports.fetchREADME = function (doc, att) {
+ var pre = $('');
+ if (att) {
+ var dbURL = duality.getDBURL();
+ $.get(dbURL + '/' + encodeURIComponent(doc._id) + '/' + att,
+ function (data) {
+ var ext = path.extname(att);
+ if (ext === '.md' || ext === '.markdown') {
+ var html = showdown.convert(data);
+ $('#readme').append('' + block[1] + '' + html + '');
+ exports.syntaxHighlight();
+ }
+ else {
+ $('#readme').append(pre.text(data));
+ }
+ }
+ );
+ }
+ else {
+ $('#readme').append(
+ pre.text('This package has no README')
+ );
+ }
+};
+
+
+/**
+ * Add syntax highlighting to the page using highlight.js (hljs)
+ */
+
+exports.syntaxHighlight = function () {
+ $('pre > code').each(function () {
+ if (this.className) {
+ // has a code class
+ $(this).html(hljs.highlight(this.className, $(this).text()).value);
+ }
+ });
+};
diff --git a/packages/sanitize/kanso.json b/packages/sanitize/kanso.json
new file mode 100644
index 0000000..d974d29
--- /dev/null
+++ b/packages/sanitize/kanso.json
@@ -0,0 +1,11 @@
+{
+ "name": "sanitize",
+ "version": "0.0.8",
+ "categories": ["utils"],
+ "description": "Functions for santizing user input or other untrusted data",
+ "modules": "sanitize.js",
+ "dependencies": {
+ "modules": null,
+ "underscore": null
+ }
+}
diff --git a/packages/sanitize/sanitize.js b/packages/sanitize/sanitize.js
new file mode 100644
index 0000000..e62331e
--- /dev/null
+++ b/packages/sanitize/sanitize.js
@@ -0,0 +1,199 @@
+/**
+ * Input sanitization, escaping, and construction functions
+ * covering security-sensitive areas.
+ *
+ * @module
+ */
+
+/**
+ * Module dependencies
+ */
+
+var _ = require('underscore')._;
+
+/**
+ *
+ * @name escapeUrlParams(s)
+ * @param {Object} obj An object containing url parameters, with
+ * parameter names stored as property names (or keys).
+ * @returns {String}
+ * @api public
+ */
+
+exports.escapeUrlParams = exports.url = function (obj)
+{
+ var rv = [ ];
+
+ for (var key in obj) {
+ rv.push(
+ encodeURIComponent(key) +
+ '=' + encodeURIComponent(obj[key])
+ );
+ }
+
+ return (rv.length > 0 ? ('?' + rv.join('&')) : '');
+};
+
+
+/**
+ * Encodes required characters as HTML entities so a string
+ * can be included in a page. This function must be used to
+ * avoid Cross-site Scripting attacks.
+ *
+ * @name escapeHtml(s)
+ * @param {String} s
+ * @returns {String}
+ * @api public
+ */
+
+exports.escapeHtml = exports.h = function (s)
+{
+ s = ('' + s); /* Coerce to string */
+ s = s.replace(/&/g, '&');
+ s = s.replace(//g, '>');
+ s = s.replace(/"/g, '"');
+ s = s.replace(/'/g, ''');
+ return s;
+};
+
+
+/**
+ * Encodes selected characters in a string, so that the string
+ * can be safely used within a Javascript string constant. This
+ * function must be used to avoid cross-site scripting attacks
+ * (or, in some cases, arbitrary server-side code execution).
+ *
+ * @name escapeJavascriptString(s)
+ * @param {String} s
+ * @returns {String}
+ * @api public
+ */
+
+exports.escapeJavascriptString = exports.js = function (s)
+{
+ s = ('' + s); /* Coerce to string */
+ s = s.replace(/'/g, "\\'");
+ s = s.replace(/"/g, '\\"');
+ return s;
+};
+
+
+/**
+ * Encodes selected characters in a string, so that the string
+ * can be safely used within an XML character data section.
+ * This function must be used to avoid cross-site scripting attacks.
+ *
+ * @name escapeXmlCharacterData(s)
+ * @param {String} s
+ * @returns {String}
+ * @api public
+ */
+
+exports.escapeXmlCharacterData = exports.cdata = function (s)
+{
+ s = ('' + s); /* Coerce to string */
+ s = s.replace(/\]\]>/g, '');
+ return s;
+};
+
+
+/**
+ * Encodes selected characters in a string, so that the string
+ * can be safely used on the right side of a CSS attribute selector's
+ * equal sign. This function should be used when using a user-modifiable
+ * string to match an element by attribute -- either in jQuery, or as part
+ * of a dynamically-generated CSS selector.
+ *
+ * @name escapeAttributeSelectorValue(s)
+ * @param {String} s
+ * @returns {String}
+ * @api public
+ */
+
+exports.escapeAttributeSelectorValue = exports.css = function (s)
+{
+ s = ('' + s); /* Coerce to string */
+ s = s.replace(/['"\\=\[\]]/, '\\$1');
+ return s;
+};
+
+
+/**
+ * Takes any number of arguments, and combines them together
+ * to safely form a string that's suitable for use as an
+ * identifier or name.
+ *
+ * @name generateAbstractIdentifier(rv, args, esc_fn, final_fn)
+ * @param {Array} rv An accumulator array, used to store results.
+ * @param {Array} args An array of arguments to the id-generating function.
+ * @param {Array} esc_fn An input-sanitizing function, to be applied to
+ * each component of the identifier before it's emitted.
+ * @param {Array} join_fn A function that accepts an array of sanitized
+ * identifier components, and produces a string.
+ * @returns {String}
+ */
+
+exports.generateAbstractIdentifier = function (rv, args, esc_fn, join_fn) {
+ if (args.length <= 0) {
+ return null;
+ }
+ for (var i = 0, len = args.length; i < len; ++i) {
+ var arg = args[i];
+ if (arg !== undefined && arg !== null) {
+ if (_.isArray(arg)) {
+ /* Avoid recursion; limit to one level deep */
+ for (var j = 0, lenj = arg.length; j < lenj; ++j) {
+ if (arg[j] !== undefined && arg[j] !== null) {
+ rv.push(esc_fn(arg[j]));
+ }
+ }
+ } else {
+ rv.push(esc_fn(arg));
+ }
+ }
+ }
+ return join_fn(rv);
+};
+
+
+/**
+ * Takes any number of arguments, and combines them together
+ * to safely form a string that's suitable for use as a DOM
+ * element identifier.
+ *
+ * @name generateDomIdentifier()
+ * @returns {String}
+ * @api public
+ */
+
+exports.generateDomIdentifier = exports.id = function (/* ... */) {
+ return exports.generateAbstractIdentifier(
+ [ 'id' ], arguments, function (x) {
+ return ('' + x).replace(/[^A-Za-z0-9_]+/, '_');
+ }, function (x) {
+ return x.join('_');
+ }
+ );
+};
+
+
+/**
+ * Takes any number of arguments, and combines them together
+ * to safely form a string that's suitable for use in a DOM
+ * element's name attribute.
+ *
+ * @name generateDomName()
+ * @returns {String}
+ * @api public
+ */
+
+exports.generateDomName = exports.name = function (/* ... */) {
+ return exports.generateAbstractIdentifier(
+ [ ], arguments, function (x) {
+ return ('' + x).replace(/[\'\"]+/, '_');
+ }, function (x) {
+ return x.join('.');
+ }
+ );
+};
diff --git a/static/css/garden.less b/static/css/garden.less
index 46d2700..e5894f2 100644
--- a/static/css/garden.less
+++ b/static/css/garden.less
@@ -16,3 +16,29 @@
font-weight: bold;
color: #31d055;
}
+
+#details_sidebar {
+ margin-top: 1em;
+ width: 200px;
+ margin-right: 20px;
+}
+
+.no_screenshot {
+ width: 200px;
+ height: 125px;
+ background: #ccc;
+ position: relative;
+}
+.no_screenshot div {
+ background: #999;
+ position: absolute;
+ bottom: 0;
+ left: 0;
+ color: white;
+ text-align: center;
+ width: 200px;
+}
+
+.install_actions {
+ margin: 2em 0 1em 0;
+}
diff --git a/templates/app_details.html b/templates/app_details.html
index 21190fa..2e7029f 100644
--- a/templates/app_details.html
+++ b/templates/app_details.html
@@ -1,11 +1,20 @@
@@ -15,13 +24,17 @@
+
+ {{#if screenshot}}
+
+ {{else}}
+
+ {{/if}}
+ No screenshot
-
{{doc.kanso.name}}
{{doc.kanso.name}}
+
+
-
-
diff --git a/templates/base.html b/templates/base.html
index 5be7450..f76f9b8 100644
--- a/templates/base.html
+++ b/templates/base.html
@@ -11,8 +11,9 @@
{{{include "duality-contrib-session/session.html"}}}