Merge pull request #2231 from erasche/fix-2230

Fixes #2230

client/galaxy/scripts/mvc/form/form-input.js

@@ -77,7 +77,7 @@ define([], function() {
             this.field.collapsed ? this.$field.hide() : this.$field.fadeIn( 'fast' );
             // render preview view for collapsed fields
             this.$preview[ this.field.collapsed && this.model.get( 'collapsible_preview' ) ? 'show' : 'hide' ]()
-                         .html( this.model.get( 'text_value' ) );
+                         .html( _.escape( this.model.get( 'text_value' ) ) );
             // render error messages
             var error_text = this.model.get( 'error_text' );
             this.$error[ error_text ? 'show' : 'hide' ]();
@@ -123,4 +123,4 @@ define([], function() {
                                  .append( $( '<div/>' ).addClass( 'ui-form-preview' ) );
         }
     });
-});
+});

static/maps/mvc/form/form-input.js.map

@@ -1 +1 @@
-{"version":3,"file":"form-input.js","sources":["../../../src/mvc/form/form-input.js"],"names":["define","Backbone","View","extend","initialize","app","options","this","app_options","field","model","Model","text_enable","text_disable","cls_enable","cls_disable","set","setElement","_template","$field","$","$info","$preview","$collapsible","$collapsible_text","$collapsible_icon","$title","$title_text","$error_text","$error","$backdrop","prepend","$el","collapsible_value","get","collapsed","undefined","JSON","stringify","listenTo","render","self","on","trigger","disable","silent","error","text","reset","hide","help_text","help_argument","indexOf","html","fadeIn","error_text","removeClass","addClass","show","collapsible_state","attr","tooltip","placement","append"],"mappings":"AAGAA,UAAW,WACP,MAAOC,UAASC,KAAKC,QACjBC,WAAY,SAAUC,EAAKC,GACvBC,KAAKF,IAAMA,EACXE,KAAKC,YAAcH,EAAIC,YACvBC,KAAKE,MAAQH,GAAWA,EAAQG,OAAS,GAAIR,UAASC,KACtDK,KAAKG,MAAQJ,GAAWA,EAAQI,OAAS,GAAIT,UAASU,OAClDC,YAAkBL,KAAKC,YAAYI,aAAiB,SACpDC,aAAkBN,KAAKC,YAAYK,cAAiB,UACpDC,WAAkBP,KAAKC,YAAYM,YAAiB,4BACpDC,YAAkBR,KAAKC,YAAYO,aAAiB,4BACrDC,IAAKV,GAGRC,KAAKU,WAAYV,KAAKW,aACtBX,KAAKY,OAAqBZ,KAAKa,EAAG,kBAClCb,KAAKc,MAAqBd,KAAKa,EAAG,iBAClCb,KAAKe,SAAqBf,KAAKa,EAAG,oBAClCb,KAAKgB,aAAqBhB,KAAKa,EAAG,wBAClCb,KAAKiB,kBAAqBjB,KAAKa,EAAG,6BAClCb,KAAKkB,kBAAqBlB,KAAKa,EAAG,6BAClCb,KAAKmB,OAAqBnB,KAAKa,EAAG,kBAClCb,KAAKoB,YAAqBpB,KAAKa,EAAG,uBAClCb,KAAKqB,YAAqBrB,KAAKa,EAAG,uBAClCb,KAAKsB,OAAqBtB,KAAKa,EAAG,kBAClCb,KAAKuB,UAAqBvB,KAAKa,EAAG,qBAGlCb,KAAKY,OAAOY,QAASxB,KAAKE,MAAMuB,IAGhC,IAAIC,GAAoB1B,KAAKG,MAAMwB,IAAK,oBACxC3B,MAAKE,MAAM0B,UAAkCC,SAAtBH,GAAmCI,KAAKC,UAAW/B,KAAKG,MAAMwB,IAAK,WAAeG,KAAKC,UAAWL,GACzH1B,KAAKgC,SAAUhC,KAAKG,MAAO,SAAUH,KAAKiC,OAAQjC,MAClDA,KAAKiC,QAGL,IAAIC,GAAOlC,IACXA,MAAKgB,aAAamB,GAAI,QAAS,WAC3BD,EAAKhC,MAAM0B,WAAaM,EAAKhC,MAAM0B,UACnC9B,EAAIsC,SAAWtC,EAAIsC,QAAS,UAC5BF,EAAKD,YAMbI,QAAS,SAAUC,GACftC,KAAKG,MAAMM,IAAK,WAAY6B,EAAS,SAAW,YAKpDC,MAAO,SAAUC,GACbxC,KAAKG,MAAMM,IAAK,aAAc+B,IAKlCC,MAAO,WACHzC,KAAKG,MAAMM,IAAK,aAAc,OAGlCwB,OAAQ,WAEJpB,EAAG,YAAa6B,MAChB,IAAIC,GAAY3C,KAAKG,MAAMwB,IAAK,OAAQ,IACpCiB,EAAgB5C,KAAKG,MAAMwB,IAAK,WAC/BiB,IAAmE,IAAlDD,EAAUE,QAAS,IAAMD,EAAgB,OAC3DD,GAAa,KAAOC,EAAgB,KAExC5C,KAAKc,MAAMgC,KAAMH,GAEjB3C,KAAKE,MAAM0B,UAAY5B,KAAKY,OAAO8B,OAAS1C,KAAKY,OAAOmC,OAAQ,QAEhE/C,KAAKe,SAAUf,KAAKE,MAAM0B,WAAa5B,KAAKG,MAAMwB,IAAK,uBAA0B,OAAS,UAC5EmB,KAAM9C,KAAKG,MAAMwB,IAAK,cAEpC,IAAIqB,GAAahD,KAAKG,MAAMwB,IAAK,aASjC,IARA3B,KAAKsB,OAAQ0B,EAAa,OAAS,UACnChD,KAAKyB,IAAKuB,EAAa,WAAa,eAAiB,YACrDhD,KAAKqB,YAAYyB,KAAME,GAEvBhD,KAAKuB,UAAU0B,cACAC,SAAU,oBACVA,SAAU,oBAAsBlD,KAAKG,MAAMwB,IAAK,aAEzD3B,KAAKG,MAAMwB,IAAK,aAA0DE,SAA1C7B,KAAKG,MAAMwB,IAAK,qBAUlD3B,KAAKoB,YAAY+B,OAAOX,KAAMxC,KAAKG,MAAMwB,IAAK,UAC9C3B,KAAKgB,aAAa0B,WAXsE,CACxF,GAAIU,GAAoBpD,KAAKE,MAAM0B,UAAY,SAAW,SAC1D5B,MAAKoB,YAAYsB,OACjB1C,KAAKgB,aAAamC,OAClBnD,KAAKiB,kBAAkBuB,KAAMxC,KAAKG,MAAMwB,IAAK,UAC7C3B,KAAKkB,kBAAkB+B,cAAcC,SAAU,QACxBA,SAAUlD,KAAKG,MAAMwB,IAAK,OAAUyB,IACpCC,KAAM,sBAAuBrD,KAAKG,MAAMwB,IAAK,QAAUyB,IACvDE,SAAWC,UAAW,aAOrD5C,UAAW,WACP,MAAQE,GAAG,UAAWqC,SAAU,mBACVM,OAAQ3C,EAAG,UAAWqC,SAAU,0BAC7BM,OAAQ3C,EAAG,WAAYqC,SAAU,qBACjCM,OAAQ3C,EAAG,WAAYqC,SAAU,wBAEpCM,OAAQ3C,EAAG,UAAWqC,SAAU,iBAC7BM,OAAQ3C,EAAG,UAAWqC,SAAU,uBAC5BM,OAAQ3C,EAAG,QAASqC,SAAU,6BAC9BM,OAAQ3C,EAAG,WAAYqC,SAAU,8BAErCM,OAAQ3C,EAAG,WAAYqC,SAAU,wBAEpCM,OAAQ3C,EAAG,UAAWqC,SAAU,iBAC7BM,OAAQ3C,EAAG,WAAYqC,SAAU,iBACjCM,OAAQ3C,EAAG,WAAYqC,SAAU,sBAEpCM,OAAQ3C,EAAG,UAAWqC,SAAU"}
+{"version":3,"file":"form-input.js","sources":["../../../src/mvc/form/form-input.js"],"names":["define","Backbone","View","extend","initialize","app","options","this","app_options","field","model","Model","text_enable","text_disable","cls_enable","cls_disable","set","setElement","_template","$field","$","$info","$preview","$collapsible","$collapsible_text","$collapsible_icon","$title","$title_text","$error_text","$error","$backdrop","prepend","$el","collapsible_value","get","collapsed","undefined","JSON","stringify","listenTo","render","self","on","trigger","disable","silent","error","text","reset","hide","help_text","help_argument","indexOf","html","fadeIn","_","escape","error_text","removeClass","addClass","show","collapsible_state","attr","tooltip","placement","append"],"mappings":"AAGAA,UAAW,WACP,MAAOC,UAASC,KAAKC,QACjBC,WAAY,SAAUC,EAAKC,GACvBC,KAAKF,IAAMA,EACXE,KAAKC,YAAcH,EAAIC,YACvBC,KAAKE,MAAQH,GAAWA,EAAQG,OAAS,GAAIR,UAASC,KACtDK,KAAKG,MAAQJ,GAAWA,EAAQI,OAAS,GAAIT,UAASU,OAClDC,YAAkBL,KAAKC,YAAYI,aAAiB,SACpDC,aAAkBN,KAAKC,YAAYK,cAAiB,UACpDC,WAAkBP,KAAKC,YAAYM,YAAiB,4BACpDC,YAAkBR,KAAKC,YAAYO,aAAiB,4BACrDC,IAAKV,GAGRC,KAAKU,WAAYV,KAAKW,aACtBX,KAAKY,OAAqBZ,KAAKa,EAAG,kBAClCb,KAAKc,MAAqBd,KAAKa,EAAG,iBAClCb,KAAKe,SAAqBf,KAAKa,EAAG,oBAClCb,KAAKgB,aAAqBhB,KAAKa,EAAG,wBAClCb,KAAKiB,kBAAqBjB,KAAKa,EAAG,6BAClCb,KAAKkB,kBAAqBlB,KAAKa,EAAG,6BAClCb,KAAKmB,OAAqBnB,KAAKa,EAAG,kBAClCb,KAAKoB,YAAqBpB,KAAKa,EAAG,uBAClCb,KAAKqB,YAAqBrB,KAAKa,EAAG,uBAClCb,KAAKsB,OAAqBtB,KAAKa,EAAG,kBAClCb,KAAKuB,UAAqBvB,KAAKa,EAAG,qBAGlCb,KAAKY,OAAOY,QAASxB,KAAKE,MAAMuB,IAGhC,IAAIC,GAAoB1B,KAAKG,MAAMwB,IAAK,oBACxC3B,MAAKE,MAAM0B,UAAkCC,SAAtBH,GAAmCI,KAAKC,UAAW/B,KAAKG,MAAMwB,IAAK,WAAeG,KAAKC,UAAWL,GACzH1B,KAAKgC,SAAUhC,KAAKG,MAAO,SAAUH,KAAKiC,OAAQjC,MAClDA,KAAKiC,QAGL,IAAIC,GAAOlC,IACXA,MAAKgB,aAAamB,GAAI,QAAS,WAC3BD,EAAKhC,MAAM0B,WAAaM,EAAKhC,MAAM0B,UACnC9B,EAAIsC,SAAWtC,EAAIsC,QAAS,UAC5BF,EAAKD,YAMbI,QAAS,SAAUC,GACftC,KAAKG,MAAMM,IAAK,WAAY6B,EAAS,SAAW,YAKpDC,MAAO,SAAUC,GACbxC,KAAKG,MAAMM,IAAK,aAAc+B,IAKlCC,MAAO,WACHzC,KAAKG,MAAMM,IAAK,aAAc,OAGlCwB,OAAQ,WAEJpB,EAAG,YAAa6B,MAChB,IAAIC,GAAY3C,KAAKG,MAAMwB,IAAK,OAAQ,IACpCiB,EAAgB5C,KAAKG,MAAMwB,IAAK,WAC/BiB,IAAmE,IAAlDD,EAAUE,QAAS,IAAMD,EAAgB,OAC3DD,GAAa,KAAOC,EAAgB,KAExC5C,KAAKc,MAAMgC,KAAMH,GAEjB3C,KAAKE,MAAM0B,UAAY5B,KAAKY,OAAO8B,OAAS1C,KAAKY,OAAOmC,OAAQ,QAEhE/C,KAAKe,SAAUf,KAAKE,MAAM0B,WAAa5B,KAAKG,MAAMwB,IAAK,uBAA0B,OAAS,UAC5EmB,KAAME,EAAEC,OAAQjD,KAAKG,MAAMwB,IAAK,eAE9C,IAAIuB,GAAalD,KAAKG,MAAMwB,IAAK,aASjC,IARA3B,KAAKsB,OAAQ4B,EAAa,OAAS,UACnClD,KAAKyB,IAAKyB,EAAa,WAAa,eAAiB,YACrDlD,KAAKqB,YAAYyB,KAAMI,GAEvBlD,KAAKuB,UAAU4B,cACAC,SAAU,oBACVA,SAAU,oBAAsBpD,KAAKG,MAAMwB,IAAK,aAEzD3B,KAAKG,MAAMwB,IAAK,aAA0DE,SAA1C7B,KAAKG,MAAMwB,IAAK,qBAUlD3B,KAAKoB,YAAYiC,OAAOb,KAAMxC,KAAKG,MAAMwB,IAAK,UAC9C3B,KAAKgB,aAAa0B,WAXsE,CACxF,GAAIY,GAAoBtD,KAAKE,MAAM0B,UAAY,SAAW,SAC1D5B,MAAKoB,YAAYsB,OACjB1C,KAAKgB,aAAaqC,OAClBrD,KAAKiB,kBAAkBuB,KAAMxC,KAAKG,MAAMwB,IAAK,UAC7C3B,KAAKkB,kBAAkBiC,cAAcC,SAAU,QACxBA,SAAUpD,KAAKG,MAAMwB,IAAK,OAAU2B,IACpCC,KAAM,sBAAuBvD,KAAKG,MAAMwB,IAAK,QAAU2B,IACvDE,SAAWC,UAAW,aAOrD9C,UAAW,WACP,MAAQE,GAAG,UAAWuC,SAAU,mBACVM,OAAQ7C,EAAG,UAAWuC,SAAU,0BAC7BM,OAAQ7C,EAAG,WAAYuC,SAAU,qBACjCM,OAAQ7C,EAAG,WAAYuC,SAAU,wBAEpCM,OAAQ7C,EAAG,UAAWuC,SAAU,iBAC7BM,OAAQ7C,EAAG,UAAWuC,SAAU,uBAC5BM,OAAQ7C,EAAG,QAASuC,SAAU,6BAC9BM,OAAQ7C,EAAG,WAAYuC,SAAU,8BAErCM,OAAQ7C,EAAG,WAAYuC,SAAU,wBAEpCM,OAAQ7C,EAAG,UAAWuC,SAAU,iBAC7BM,OAAQ7C,EAAG,WAAYuC,SAAU,iBACjCM,OAAQ7C,EAAG,WAAYuC,SAAU,sBAEpCM,OAAQ7C,EAAG,UAAWuC,SAAU"}

static/scripts/mvc/form/form-input.js

@@ -1,2 +1,2 @@
-define([],function(){return Backbone.View.extend({initialize:function(a,b){this.app=a,this.app_options=a.options||{},this.field=b&&b.field||new Backbone.View,this.model=b&&b.model||new Backbone.Model({text_enable:this.app_options.text_enable||"Enable",text_disable:this.app_options.text_disable||"Disable",cls_enable:this.app_options.cls_enable||"fa fa-caret-square-o-down",cls_disable:this.app_options.cls_disable||"fa fa-caret-square-o-up"}).set(b),this.setElement(this._template()),this.$field=this.$(".ui-form-field"),this.$info=this.$(".ui-form-info"),this.$preview=this.$(".ui-form-preview"),this.$collapsible=this.$(".ui-form-collapsible"),this.$collapsible_text=this.$(".ui-form-collapsible-text"),this.$collapsible_icon=this.$(".ui-form-collapsible-icon"),this.$title=this.$(".ui-form-title"),this.$title_text=this.$(".ui-form-title-text"),this.$error_text=this.$(".ui-form-error-text"),this.$error=this.$(".ui-form-error"),this.$backdrop=this.$(".ui-form-backdrop"),this.$field.prepend(this.field.$el);var c=this.model.get("collapsible_value");this.field.collapsed=void 0!==c&&JSON.stringify(this.model.get("value"))==JSON.stringify(c),this.listenTo(this.model,"change",this.render,this),this.render();var d=this;this.$collapsible.on("click",function(){d.field.collapsed=!d.field.collapsed,a.trigger&&a.trigger("change"),d.render()})},disable:function(a){this.model.set("backdrop",a?"silent":"default")},error:function(a){this.model.set("error_text",a)},reset:function(){this.model.set("error_text",null)},render:function(){$(".tooltip").hide();var a=this.model.get("help",""),b=this.model.get("argument");b&&-1==a.indexOf("("+b+")")&&(a+=" ("+b+")"),this.$info.html(a),this.field.collapsed?this.$field.hide():this.$field.fadeIn("fast"),this.$preview[this.field.collapsed&&this.model.get("collapsible_preview")?"show":"hide"]().html(this.model.get("text_value"));var c=this.model.get("error_text");if(this.$error[c?"show":"hide"](),this.$el[c?"addClass":"removeClass"]("ui-error"),this.$error_text.html(c),this.$backdrop.removeClass().addClass("ui-form-backdrop").addClass("ui-form-backdrop-"+this.model.get("backdrop")),this.model.get("disabled")||void 0===this.model.get("collapsible_value"))this.$title_text.show().text(this.model.get("label")),this.$collapsible.hide();else{var d=this.field.collapsed?"enable":"disable";this.$title_text.hide(),this.$collapsible.show(),this.$collapsible_text.text(this.model.get("label")),this.$collapsible_icon.removeClass().addClass("icon").addClass(this.model.get("cls_"+d)).attr("data-original-title",this.model.get("text_"+d)).tooltip({placement:"bottom"})}},_template:function(){return $("<div/>").addClass("ui-form-element").append($("<div/>").addClass("ui-form-error ui-error").append($("<span/>").addClass("fa fa-arrow-down")).append($("<span/>").addClass("ui-form-error-text"))).append($("<div/>").addClass("ui-form-title").append($("<div/>").addClass("ui-form-collapsible").append($("<i/>").addClass("ui-form-collapsible-icon")).append($("<span/>").addClass("ui-form-collapsible-text"))).append($("<span/>").addClass("ui-form-title-text"))).append($("<div/>").addClass("ui-form-field").append($("<span/>").addClass("ui-form-info")).append($("<span/>").addClass("ui-form-backdrop"))).append($("<div/>").addClass("ui-form-preview"))}})});
+define([],function(){return Backbone.View.extend({initialize:function(a,b){this.app=a,this.app_options=a.options||{},this.field=b&&b.field||new Backbone.View,this.model=b&&b.model||new Backbone.Model({text_enable:this.app_options.text_enable||"Enable",text_disable:this.app_options.text_disable||"Disable",cls_enable:this.app_options.cls_enable||"fa fa-caret-square-o-down",cls_disable:this.app_options.cls_disable||"fa fa-caret-square-o-up"}).set(b),this.setElement(this._template()),this.$field=this.$(".ui-form-field"),this.$info=this.$(".ui-form-info"),this.$preview=this.$(".ui-form-preview"),this.$collapsible=this.$(".ui-form-collapsible"),this.$collapsible_text=this.$(".ui-form-collapsible-text"),this.$collapsible_icon=this.$(".ui-form-collapsible-icon"),this.$title=this.$(".ui-form-title"),this.$title_text=this.$(".ui-form-title-text"),this.$error_text=this.$(".ui-form-error-text"),this.$error=this.$(".ui-form-error"),this.$backdrop=this.$(".ui-form-backdrop"),this.$field.prepend(this.field.$el);var c=this.model.get("collapsible_value");this.field.collapsed=void 0!==c&&JSON.stringify(this.model.get("value"))==JSON.stringify(c),this.listenTo(this.model,"change",this.render,this),this.render();var d=this;this.$collapsible.on("click",function(){d.field.collapsed=!d.field.collapsed,a.trigger&&a.trigger("change"),d.render()})},disable:function(a){this.model.set("backdrop",a?"silent":"default")},error:function(a){this.model.set("error_text",a)},reset:function(){this.model.set("error_text",null)},render:function(){$(".tooltip").hide();var a=this.model.get("help",""),b=this.model.get("argument");b&&-1==a.indexOf("("+b+")")&&(a+=" ("+b+")"),this.$info.html(a),this.field.collapsed?this.$field.hide():this.$field.fadeIn("fast"),this.$preview[this.field.collapsed&&this.model.get("collapsible_preview")?"show":"hide"]().html(_.escape(this.model.get("text_value")));var c=this.model.get("error_text");if(this.$error[c?"show":"hide"](),this.$el[c?"addClass":"removeClass"]("ui-error"),this.$error_text.html(c),this.$backdrop.removeClass().addClass("ui-form-backdrop").addClass("ui-form-backdrop-"+this.model.get("backdrop")),this.model.get("disabled")||void 0===this.model.get("collapsible_value"))this.$title_text.show().text(this.model.get("label")),this.$collapsible.hide();else{var d=this.field.collapsed?"enable":"disable";this.$title_text.hide(),this.$collapsible.show(),this.$collapsible_text.text(this.model.get("label")),this.$collapsible_icon.removeClass().addClass("icon").addClass(this.model.get("cls_"+d)).attr("data-original-title",this.model.get("text_"+d)).tooltip({placement:"bottom"})}},_template:function(){return $("<div/>").addClass("ui-form-element").append($("<div/>").addClass("ui-form-error ui-error").append($("<span/>").addClass("fa fa-arrow-down")).append($("<span/>").addClass("ui-form-error-text"))).append($("<div/>").addClass("ui-form-title").append($("<div/>").addClass("ui-form-collapsible").append($("<i/>").addClass("ui-form-collapsible-icon")).append($("<span/>").addClass("ui-form-collapsible-text"))).append($("<span/>").addClass("ui-form-title-text"))).append($("<div/>").addClass("ui-form-field").append($("<span/>").addClass("ui-form-info")).append($("<span/>").addClass("ui-form-backdrop"))).append($("<div/>").addClass("ui-form-preview"))}})});
 //# sourceMappingURL=../../../maps/mvc/form/form-input.js.map

templates/webapps/galaxy/workflow/display.mako

@@ -4,6 +4,7 @@
 <%!
     from galaxy.tools.parameters.basic import DataCollectionToolParameter, DataToolParameter, RuntimeValue
     from galaxy.web import form_builder
+    import cgi
 %>
 
 <%def name="stylesheets()">
@@ -63,7 +64,7 @@
                     <i>select at runtime</i>
                 %endif
             %else:
-                ${param.value_to_display_text( value, app )}
+                ${cgi.escape( param.value_to_display_text( value, app ) )}
             %endif
         </div>
         %if hasattr( step, 'upgrade_messages' ) and step.upgrade_messages and param.name in step.upgrade_messages:

templates/webapps/galaxy/workflow/run.mako

@@ -648,12 +648,15 @@ if wf_parms:
     });
     </script>
 %endif
+<%
+import base64
+%>
 %for i, step in enumerate( steps ):
     <!-- Only way module would be missing is if tool is missing, but
          that would cause missing_tools.mako to render instead of this
          template. -->
     <% module = step.module %>
-    <input type="hidden" name="${step.id}|tool_state" value="${module.get_state( step.state )}">
+    <input type="hidden" name="${step.id}|tool_state" value="${base64.b64encode( module.get_state( step.state ))}">
     %if step.type == 'tool' or step.type is None:
       <%
         tool = trans.app.toolbox.get_tool( step.tool_id )