From 7137787984af3bd8b71054bbb5c95deca576b31d Mon Sep 17 00:00:00 2001
From: Keegan McAllister <keegan@humbughq.com>
Date: Wed, 10 Oct 2012 17:53:00 -0400
Subject: [PATCH] Escape variables interpolated into <script> within index.html

Django's escapejs prevents breaking out with an embedded </script> tag.

It only works on bare string contents, not JSON-ish lists and such.  So we
generate stream_list and people_list with template loops now.

(imported from commit 07fe4bebaa3fa11bc479b4378b8989560ce77f6f)
---
 templates/zephyr/index.html | 22 ++++++++++++++++++----
 zephyr/views.py             |  4 ++--
 2 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/templates/zephyr/index.html b/templates/zephyr/index.html
index b0dbb098ab..91c0789fa5 100644
--- a/templates/zephyr/index.html
+++ b/templates/zephyr/index.html
@@ -43,11 +43,25 @@
 
 <script type="text/javascript">
 {% autoescape off %}
+
+{# Not escaped, because it's guaranteed by the model to be an integer. #}
 var initial_pointer = {{ user_profile.pointer }};
-var email = "{{ user_profile.user.email }}";
-var stream_list = {{ streams }};
-var people_list = {{ people }};
-var have_initial_messages = {{ have_initial_messages }};
+
+var email = "{{ user_profile.user.email|escapejs }}";
+var have_initial_messages = {{ have_initial_messages|escapejs }};
+
+var stream_list = [
+{% for stream in streams %}
+    "{{ stream|escapejs }}",
+{% endfor %}
+];
+
+var people_list = [
+{% for person in people %}
+    "{{ person|escapejs }}",
+{% endfor %}
+];
+
 {% endautoescape %}
 </script>
 {% endblock %}
diff --git a/zephyr/views.py b/zephyr/views.py
index fcfd0cec0f..9173fcd9d1 100644
--- a/zephyr/views.py
+++ b/zephyr/views.py
@@ -173,8 +173,8 @@ def home(request):
     return render_to_response('zephyr/index.html',
                               {'user_profile': user_profile,
                                'email_hash'  : hashlib.md5(user_profile.user.email).hexdigest(),
-                               'people'      : simplejson.dumps(people),
-                               'streams'     : simplejson.dumps(streams),
+                               'people'      : people,
+                               'streams'     : streams,
                                'have_initial_messages':
                                    'true' if messages else 'false',
                                'show_debug':