Fixed possible JS injection via the title edition

[github/wallabag/wallabag.git] / src / Wallabag / CoreBundle / Resources / views / themes / baggy / Entry / entries.html.twig

{% extends "WallabagCoreBundle::layout.html.twig" %}

{% block title %}
    {% set currentTag = '' %}
    {% if tag is defined %}
        {% set currentTag = tag %}
    {% endif %}
    {% include "@WallabagCore/themes/common/Entry/_title.html.twig" with {'currentTag': currentTag} %}
{% endblock %}

{% block content %}

    <div class="results">
        <div class="nb-results">{{ 'entry.list.number_on_the_page'|transchoice(entries.count) }}</div>
        <div class="pagination">
            <i class="btn-clickable download-btn material-icons md-36">file_download</i>
            <i class="btn-clickable filter-btn material-icons md-36">filter_list</i>
            {% if entries.getNbPages > 1 %}
                {{ pagerfanta(entries, 'twitter_bootstrap_translated', {'proximity': 1}) }}
            {% endif %}
        </div>
    </div>

    {% for entry in entries %}
        <div id="entry-{{ entry.id|e }}" class="entry">
            <h2><a href="{{ path('view', { 'id': entry.id }) }}" title="{{ entry.title|e|raw }}">{{ entry.title|e|raw }}</a></h2>

            {% set readingTime = entry.readingTime / app.user.config.readingSpeed %}
            <div class="estimatedTime">
                    <span class="tool reading-time">
            {% if readingTime > 0 %}
                {{ 'entry.list.reading_time_minutes'|trans({'%readingTime%': readingTime|round}) }}
            {% else %}
                {{ 'entry.list.reading_time_less_one_minute'|trans|raw }}
            {% endif %}
                    </span>
                    <span class="tool created-at">
                        <i class="tool icon icon-calendar" title="{{ 'entry.view.created_at'|trans }}">
                            {{ entry.createdAt|date('Y-m-d') }}
                        </i>
                    </span>
            </div>

            <ul class="tools links">
                <li><a title="{{ 'entry.list.toogle_as_read'|trans }}" class="tool icon-check icon {% if entry.isArchived == 0 %}archive-off{% else %}archive{% endif %}" href="{{ path('archive_entry', { 'id': entry.id }) }}"><span>{{ 'entry.list.toogle_as_read'|trans }}</span></a></li>
                <li><a title="{{ 'entry.list.toogle_as_star'|trans }}" class="tool icon-star icon {% if entry.isStarred == 0 %}fav-off{% else %}fav{% endif %}" href="{{ path('star_entry', { 'id': entry.id }) }}"><span>{{ 'entry.list.toogle_as_star'|trans }}</span></a></li>
                <li><a title="{{ 'entry.list.delete'|trans }}" class="tool delete icon-trash icon" href="{{ path('delete_entry', { 'id': entry.id }) }}"><span>{{ 'entry.list.delete'|trans }}</span></a></li>
                <li><a href="{{ entry.url|e }}" target="_blank" title="{{ 'entry.list.original_article'|trans }} : {{ entry.title|e }}" class="tool link icon-link icon"><span>{{ entry.domainName|removeWww }}</span></a></li>
            </ul>
            {% if entry.previewPicture is null %}
                <ul class="card-entry-tags">
                    {% for tag in entry.tags %}
                        <li><a href="{{ path('tag_entries', {'slug': tag.slug}) }}">{{ tag.label }}</a></li>
                    {% endfor %}
                </ul>
                <p>{{ entry.content|striptags|slice(0, 300) }}&hellip;</p>
            {% else %}
                <ul class="card-entry-labels">
                {% for tag in entry.tags | slice(0, 3) %}
                    <li><a href="{{ path('tag_entries', {'slug': tag.slug}) }}">{{ tag.label }}</a></li>
                {% endfor %}
                </ul>
                <img class="preview" src="{{ entry.previewPicture }}" alt="{{ entry.title|e|raw }}" />
            {% endif %}
        </div>
    {% endfor %}

    {% if entries.getNbPages > 1 %}
        {{ pagerfanta(entries, 'twitter_bootstrap_translated', {'proximity': 1}) }}
    {% endif %}

    <!-- Export -->
    <aside id="download-form">
    {% set currentRoute = app.request.attributes.get('_route') %}
    {% set currentTag = '' %}
    {% if tag is defined %}
        {% set currentTag = tag %}
    {% endif %}
    {% if currentRoute == 'homepage' %}
        {% set currentRoute = 'unread' %}
    {% endif %}
        <h2>{{ 'entry.list.export_title'|trans }}</h2>
        <a href="javascript: void(null);" id="download-form-close" class="close-button--popup close-button">&times;</a>
        <ul>
            {% if craue_setting('export_epub') %}<li class="bold"><a class="waves-effect" href="{{ path('export_entries', { 'category': currentRoute, 'format': 'epub', 'tag' : currentTag }) }}">EPUB</a></li>{% endif %}
            {% if craue_setting('export_mobi') %}<li class="bold"><a class="waves-effect" href="{{ path('export_entries', { 'category': currentRoute, 'format': 'mobi', 'tag' : currentTag }) }}">MOBI</a></li>{% endif %}
            {% if craue_setting('export_pdf') %}<li class="bold"><a class="waves-effect" href="{{ path('export_entries', { 'category': currentRoute, 'format': 'pdf', 'tag' : currentTag }) }}">PDF</a></li>{% endif %}
            {% if craue_setting('export_csv') %}<li class="bold"><a class="waves-effect" href="{{ path('export_entries', { 'category': currentRoute, 'format': 'json', 'tag' : currentTag }) }}">JSON</a></li>{% endif %}
            {% if craue_setting('export_json') %}<li class="bold"><a class="waves-effect" href="{{ path('export_entries', { 'category': currentRoute, 'format': 'csv', 'tag' : currentTag }) }}">CSV</a></li>{% endif %}
            {% if craue_setting('export_txt') %}<li class="bold"><a class="waves-effect" href="{{ path('export_entries', { 'category': currentRoute, 'format': 'txt', 'tag' : currentTag }) }}">TXT</a></li>{% endif %}
            {% if craue_setting('export_xml') %}<li class="bold"><a class="waves-effect" href="{{ path('export_entries', { 'category': currentRoute, 'format': 'xml', 'tag' : currentTag }) }}">XML</a></li>{% endif %}
        </ul>
    </aside>

    <!-- Filter -->
    {% if form is not null %}
    <div id="filters">
        <form method="get" action="{{ path('all') }}">
            <h2>{{ 'entry.filters.title'|trans }}</h2>
            <a href="javascript: void(null);" id="filter-form-close" class="close-button--popup close-button">&times;</a>

            <div id="filter-status" class="filter-group">
                <div class="">
                    <label>{{ 'entry.filters.status_label'|trans }}</label>
                </div>
                <div class="input-field">
                    {{ form_widget(form.isArchived) }}
                    {{ form_label(form.isArchived) }}
                </div>

                <div class="input-field">
                    {{ form_widget(form.isStarred) }}
                    {{ form_label(form.isStarred) }}
                </div>

                <div class="input-field">
                    {{ form_widget(form.isUnread) }}
                    {{ form_label(form.isUnread) }}
                </div>

                <div class="input-field">
                    {{ form_widget(form.previewPicture) }}
                    {{ form_label(form.previewPicture) }}
                </div>
            </div>

            <div id="filter-language" class="filter-group">
                {{ form_label(form.language) }}
                <div class="input-field ">
                    {{ form_widget(form.language) }}
                </div>
            </div>

            <div id="filter-reading-time" class="filter-group">
                <div class="">
                    {{ form_label(form.readingTime) }}
                </div>
                <div class="input-field ">
                    <label for="entry_filter_readingTime_left_number">{{ 'entry.filters.reading_time.from'|trans }}</label>
                    {{ form_widget(form.readingTime.left_number, {'type': 'number'}) }}
                </div>
                <div class="input-field ">
                    <label for="entry_filter_readingTime_right_number">{{ 'entry.filters.reading_time.to'|trans }}</label>
                    {{ form_widget(form.readingTime.right_number, {'type': 'number'}) }}
                </div>
            </div>

            <div id="filter-domain-name" class="filter-group">
                {{ form_label(form.domainName) }}
                <div class="input-field ">
                    {{ form_widget(form.domainName, {'type': 'text', 'attr' : {'placeholder': 'website.com'} }) }}
                </div>
            </div>

            <div id="filter-creation-date" class="filter-group">
                <div class="">
                    {{ form_label(form.createdAt) }}
                </div>
                <div class="input-field ">
                    <label for="entry_filter_createdAt_left_date" class="active">{{ 'entry.filters.created_at.from'|trans }}</label>
                    {{ form_widget(form.createdAt.left_date, {'type': 'date', 'attr': {'class': 'datepicker', 'data-value': form.createdAt.left_date.vars.value} }) }}
                </div>
                <div class="input-field ">
                    <label for="entry_filter_createdAt_right_date" class="active">{{ 'entry.filters.created_at.to'|trans }}</label>
                    {{ form_widget(form.createdAt.right_date, {'type': 'date', 'attr': {'class': 'datepicker', 'data-value': form.createdAt.right_date.vars.value} }) }}
                </div>
            </div>

            <div id="filter-buttons" class="filter-group">
                <div class="">
                    <a href="#!" class="center waves-effect waves-green btn-flat" id="clear_form_filters">{{ 'entry.filters.action.clear'|trans }}</a>
                </div>

                <button class="btn waves-effect waves-light" type="submit" id="submit-filter" value="filter">{{ 'entry.filters.action.filter'|trans }}</button>
            </div>
        </form>
    </div>
    {% endif %}
{% endblock %}