foto: escape html (ampersands) in album links

[minimedit.git] / foto / index.php

diff --git a/foto/index.php b/foto/index.php
index 0acd44e7ab701aa6bfb091ed5c4a96ac08221521..49e5483d24d4d23ecaa8b0b3dbc078d8a49cd759 100644 (file)
--- a/foto/index.php
+++ b/foto/index.php
@@ -1,6 +1,25 @@
 <?php
 $rootdir = $Page->link;
 
+$nav = explode('/', $rootdir);
+$nav[0] = "Foto's"; # override of root 'foto'
+$title = array_pop($nav);
+$Page->title = ($nav ? implode(' ', $nav) . ': ' : '') . $title;
+
+if ($Page->api) {
+       $img = "$rootdir/index.jpg";
+       if (file_exists($img)) {
+               # cover image of current album
+               $Page->image = "/$img";
+       }
+       if (!$Page->path) {
+               return array_map(function ($dir) {
+                       return new ArchiveArticle($dir . '/index.html');
+               }, glob("$rootdir/*", GLOB_ONLYDIR)); #TODO: recurse
+       }
+       return;
+}
+
 if ($User->admin('foto')) {
        if ($Page->restricted) {
                $access = '<span class="icon icon-locked">&#x1F512;</span> Bewoners';
@@ -16,11 +35,6 @@ if ($User->admin('foto')) {
        print "<aside>$access</aside>\n\n";
 }
 
-$nav = explode('/', $rootdir);
-$nav[0] = "Foto's"; # override of root 'foto'
-$title = array_pop($nav);
-$Page->title = ($nav ? implode(' ', $nav) . ': ' : '') . $title;
-
 $link = '';
 print "<h2>";
 foreach ($nav as $i => $linktitle) {
@@ -34,6 +48,7 @@ if (isset($Page->raw)) {
        print $Page->raw;  # page intro
 }
 
+if (!function_exists('showthumb')) {
 function showthumb($path)
 {
        // assume all album entries are symlinks to archive originals
@@ -51,27 +66,28 @@ function showthumb($path)
 
        return sprintf('<a href="/%s"><%s /></a>'."\n", $target, $imgtag);
 }
+}
 
 if ($imgs = glob("$rootdir/*", GLOB_ONLYDIR)) {
        natsort($imgs);
        print '<ul class="gallery cat">'."\n";
        foreach ($imgs as $path) {
-               $parts = pathinfo($path);
-               $album = $parts['filename'];
+               $album = htmlspecialchars(pathinfo($path, PATHINFO_FILENAME));
                $cover = "$path/index.jpg";
                if (!file_exists($cover)) $cover = 'foto/index.jpg';
                if (is_link($cover)) {
                        $cover = preg_replace('{^(?:\.\./)*(?=data/)}', 'thumb/100/', readlink($cover));
                }
 
-               $html = '<img src="/'.$cover.'" />';
+               $html = sprintf('<img src="/%s" />', htmlspecialchars($cover));
                $html .= "<figcaption>$album</figcaption>";
                if (!$User->login and file_exists("$path/.private")) {
                        $html = '<s title="bewoners">'.$html.'</s>';
                }
                $html = "<figure>$html</figure>";
 
-               printf('<li id="%s"><a href="%s">%s</a>'."\n", $album, "/$path", $html);
+               printf('<li id="%s">', $album);
+               printf('<a href="/%s">%s</a>'."\n", htmlspecialchars($path), $html);
        }
        print "</ul>\n\n";
 }