webcit: sanitize instant messages against XSS type stuff
[citadel.git] / webcit / static / instant_messenger.html
1 <html>
2 <head>
3         <title>Citadel Instant Messenger</title>
4         <script type="text/javascript" src="prototype.js"></script>
5         <script type="text/javascript" src="wclib.js"></script>
6         <script type="text/javascript" src="authmethods.js"></script>
7 </head>
8 <body onLoad='FetchNewMsgs();'>
9
10 <div id="thetop" style="position:fixed;width:100%;height:15%;top:0%;left:0%">
11 <div id="spacer1" style="background:#aaaaaa"><br></div>
12 <div id="tab_bar" style="background:#aaaaaa">&nbsp;&nbsp;</div>
13 <div id="spacer2" style="background:#aaaaaa"><br></div>
14 </div>
15
16 <div id="main" style="position:fixed;width:100%;height:85%;top:15%;left:0%;overflow:auto;background:#ffffff"></div>
17
18 <script type="text/javascript">
19 /*
20  * Copyright 2000 - 2010 The Citadel Team
21  * Licensed under the GPL V3
22  *
23  * Chat window for Person 2 Person Chat
24  *
25  */
26
27 var gexp_divs = new Array();
28 var num_gexp_divs = 0;
29 var shown_div = '';
30 var my_name = '';
31
32 function SendSomething(which_div, sendform, recipient) {
33         thetext = document.forms[sendform].elements['sendthis'].value;
34
35         // If the user didn't type anything, don't do anything.
36         if (thetext == '') {
37                 return false;
38         }
39
40         // Clear the box
41         document.forms[sendform].elements['sendthis'].value = '';
42
43         // Write it to the tab
44         $(which_div).innerHTML = $(which_div).innerHTML
45                                 + '<b>'
46                                 + '<font color=\"#FF0000\">'
47                                 + my_name
48                                 + '</font>'
49                                 + ':</b> '
50                                 + thetext
51                                 + '<br>\n';
52
53         // Scroll to the bottom of the tab
54         $('main').scrollTop = 999999;
55
56         // Send the text to the server
57         parms = 'r=' + Math.random()
58                 + '&recp=' + encodeURIComponent(recipient)
59                 + '&msg=' + encodeURIComponent(thetext);
60         new Ajax.Request('../ajax_send_instant_message',
61                 {
62                         method: 'post',
63                         parameters: parms
64                 }
65         );
66
67         // Refocus to the text box
68         document.forms[sendform].elements['sendthis'].focus();
69
70         // Don't submit the form
71         return false;
72 }
73
74 function TabSelect(which_div) {
75         if (shown_div != '') {
76                 $(shown_div).style.display = 'none' ;
77                 if ($('select_'+shown_div)) {
78                         $('select_'+shown_div).style.fontWeight = 'normal';
79                         $('select_'+shown_div).style.backgroundColor = '#cccccc';
80                 }
81         }
82         shown_div = 'tab_' + which_div;
83         $(shown_div).style.display = 'block' ;
84         if ($('select_'+shown_div)) {
85                 $('select_'+shown_div).style.fontWeight='bold';
86                 $('select_'+shown_div).style.backgroundColor = '#ffffff';
87         }
88 }
89
90
91 function ShowNewMsg(gexp_xmlresponse) {
92
93         // It isn't really XML.  It's a Citadel server response.
94         gexp_response = gexp_xmlresponse.responseText;
95
96         if (gexp_response.substring(0, 1) != '1') {
97                 return;
98         }
99
100         // Extract fields...
101         breakpos = gexp_response.indexOf('\n');
102         result = gexp_response.substring(0, breakpos-1);
103         the_message = gexp_response.substring(breakpos+1);
104         the_message = the_message.substring(0, the_message.indexOf('\n000'));
105         the_message = the_message.replaceAll("<", "&lt;");
106         the_message = the_message.replaceAll(">", "&gt;");
107         the_message = the_message.replaceAll("&", "&amp;");
108         sender = extract_token(result.substring(4), 3, '|');
109
110         // Figure out which div to write it to...
111         which_div = '';
112         if (num_gexp_divs > 0) {
113                 for (i=0; i<num_gexp_divs; ++i) {
114                         if (gexp_divs[i] == sender) {
115                                 which_div = 'gexp' + i ;
116                         }
117                 }
118         }
119
120         // Not found?  Create it.
121         if (which_div == '') {
122                 gexp_divs[num_gexp_divs] = sender;
123                 which_div = 'gexp' + num_gexp_divs;
124                 ++num_gexp_divs;
125                 $('main').innerHTML =
126                           $('main').innerHTML
127                         + '<div id=\"tab_' + which_div + '\" style=\"display:none;cursor:pointer\">'
128                         + '<div id=\"' + which_div + '\">'
129                         + '<br><br><br><br><br><br><br><br><br><br>'
130                         + '<br><br><br><br><br><br><br><br><br><br>'
131                         + '</div>'
132                         + '<div align=\"center\" id=\"response_'
133                         + which_div + '\" style=\"background:#ddddee\">'
134                         + '<br><form method=\"post\" action=\"null\" name=\"sendform_' + which_div + '\" '
135                         + 'onSubmit=\"return SendSomething(\'' + which_div + '\', \'sendform_'
136                         + which_div + '\', \'' + sender + '\');\">'
137                         + '<img src=\"webcit_icons/essen/16x16/chat.png\">&nbsp;'
138                         + '<input type=\"text\" size=\"72\" maxlength=\"600\" name=\"sendthis\">'
139                         + '</form>'
140                         + '<br></div>'
141                         + '</div>\n';
142                 $('tab_bar').innerHTML =
143                           $('tab_bar').innerHTML
144                         + '<span id=\"select_tab_' + which_div + '\" onClick=\"TabSelect(\'' + which_div + '\');\">'
145                         + '&nbsp;' + sender + '&nbsp;'
146                         + '</span>&nbsp;&nbsp;&nbsp;';
147
148                 // Raise the window in case it was buried
149                 window.focus();
150         }
151
152         // Switch tabs
153         TabSelect(which_div);
154
155         // Write it to the tab
156         $(which_div).innerHTML = $(which_div).innerHTML
157                                 + '<b>'
158                                 + '<font color=\"#0000FF\">'
159                                 + sender
160                                 + '</font>'
161                                 + ':</b> '
162                                 + the_message
163                                 + '<br>\n';
164
165         // Scroll to the bottom of the tab
166         $('main').scrollTop = 999999;
167
168         // Refocus to the send box
169         document.forms['sendform_'+which_div].elements['sendthis'].focus();
170
171         // Keep trying for new messages until the server tells us to stop.
172         FetchNewMsgs();
173 }
174
175 // This is called periodically to check for new incoming messages
176 function FetchNewMsgs() {
177         parms = encodeURI('g_cmd=GEXP&r=' + Math.random());
178         new Ajax.Request('../ajax_servcmd',
179                 {
180                         method: 'get',
181                         parameters: parms,
182                         onSuccess: ShowNewMsg
183                 }
184         );
185 }
186
187 // Perform some initialization.
188 parms = encodeURI('g_cmd=GREG _SELF_&r=' + Math.random());
189 new Ajax.Request('../ajax_servcmd',
190         {
191                 method: 'get',
192                 parameters: parms,
193                 onSuccess: GrabMyName
194         }
195 );
196
197 // Learn my name.
198 function GrabMyName(greg_xmlresponse) {
199
200         // It isn't really XML.  It's a Citadel server response.
201         greg_response = greg_xmlresponse.responseText;
202
203         if (greg_response.substring(0, 1) != '1') {
204                 return;
205         }
206
207         // Extract fields...
208         breakpos = greg_response.indexOf('\n');
209         result = greg_response.substring(0, breakpos);
210         my_name = result.substring(4);
211 }
212
213
214 // Cause FetchNewMsgs() to be called periodically.
215 new PeriodicalExecuter(FetchNewMsgs, 10);
216
217 </script>
218
219
220 </body>
221 </html>