Big overhaul patch and style changes

4 files changed, 53 insertions, 39 deletions

diff --git a/app/controllers/admin_controller.rb b/app/controllers/admin_controller.rb
index 1d1a1ca..cdfe564 100644
--- a/app/controllers/admin_controller.rb
+++ b/app/controllers/admin_controller.rb
@@ -20,13 +20,17 @@ class AdminController < ApplicationController
   end
   
   def search
-    @results = Node.search params[:search_term]
+    @results = Node.search params[:search_term], :per_page => 1000
     
     respond_to do |format|
-      format.html
+      format.html do
+        render :template => 'admin/search_results.html'
+      end
       format.js do 
         render( :json => @results.map do |node| 
-          {:id => node.id, :title => node.title, :edit_path => node_path(node)} 
+            if node
+              {:id => node.id, :title => node.title, :edit_path => node_path(node)}
+            end
           end
         )
         
@@ -46,7 +50,6 @@ class AdminController < ApplicationController
         render :partial => 'admin/menu_search_results'
       end
       
-      
       format.js do 
         render( :json => @results.map do |node| 
           {:node_id => node.id, :title => node.title, :unique_name => node.unique_name} 
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index bce0c71..89cd330 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -2,20 +2,20 @@
 # Likewise, all the methods added will be available for all controllers.
 
 class ApplicationController < ActionController::Base
-  
+
   include ExceptionNotifiable
   include AuthenticatedSystem
-    
+
   helper :all # include all helpers, all the time
   protect_from_forgery # See ActionController::RequestForgeryProtection for details
 
   # Scrub sensitive parameters from your log
   filter_parameter_logging :password, :password_confirmation
-  
+
   before_filter :set_locale
-  
+
   protected
-  
+
     def set_locale
       if params[:locale] && I18n.available_locales.include?(params[:locale].to_sym)
         I18n.locale = params[:locale].to_sym
diff --git a/app/controllers/content_controller.rb b/app/controllers/content_controller.rb
index 1b13456..c62b726 100644
--- a/app/controllers/content_controller.rb
+++ b/app/controllers/content_controller.rb
@@ -1,30 +1,30 @@
 class ContentController < ApplicationController
-  
+
   # Public
-  
+
   before_filter :find_page
-  
+
   # This is the method that renders most of the the public content. It recieves
-  # a :locale and a :page_path parameter through the params hash. It looks up 
+  # a :locale and a :page_path parameter through the params hash. It looks up
   # the node with the corresponding unique_name attribute. The method doesn't
-  # return a node though, the node is really a proxy object for pages. It 
+  # return a node though, the node is really a proxy object for pages. It
   # returns the most recent page associated to this node instead.
   def render_page
-    
+
     expires_in 20.minutes, :public => true
-    
+
     if @page and @page.public?
       render(
         :file => @page.valid_template,
         :layout => true
       )
     else
-      render( 
+      render(
         :file => File.join(RAILS_ROOT, 'public', '404.html'),
         :status => 404
       )
     end
-    
+
   end
 
   def render_gallery
@@ -35,10 +35,14 @@ class ContentController < ApplicationController
       render :nothing => true, :status => 404
     end
   end
-  
+
   private
     def find_page
       path = params[:page_path].join('/')
-      @page = Node.find_page(path)
+      if path =~ /^[a-zA-Z\:\/\/\.\-\d_]+$/
+        @page = Node.find_page(path)
+      else
+        @page = nil
+      end
     end
 end
diff --git a/app/controllers/tags_controller.rb b/app/controllers/tags_controller.rb
index 565cdd4..bf64b73 100644
--- a/app/controllers/tags_controller.rb
+++ b/app/controllers/tags_controller.rb
@@ -1,33 +1,40 @@
 class TagsController < ApplicationController
-  
+
   # Public
-  
+
   def index
     @page = Page.new :title => "Tags"
-    
+
     @tags = Tag.all(:limit => 500)
   end
 
   def show
-    @tag    = Tag.find_by_name(params[:id])
-    
-    @tag = @tag ? @tag.name : params[:id]
-    
-    @page   = Page.new
+    tag_name = params[:id]
+
+    if tag_name.match(/^[a-zA-Z0-9_\w\s\-\.\']+$/)
+      @tag  = Tag.find_by_name(tag_name)
+      @tag  = @tag ? @tag.name : tag_name
+      @page = Page.new
 
-    params[:page] = ( params[:page].is_a?(Fixnum) ? params[:page] : 1 )
-    
-    @pages  = Page.heads.paginate(
-      Page.find_options_for_find_tagged_with(@tag).merge(
-        :order => 'published_at DESC',
-        :page=>params[:page],
-        :per_page => 23
+      params[:page] = ( params[:page].is_a?(Fixnum) ? params[:page] : 1 )
+
+      @pages = Page.heads.paginate(
+        Page.find_options_for_find_tagged_with(@tag).merge(
+          :order => 'published_at DESC',
+          :page=>params[:page],
+          :per_page => 23
+        )
       )
-    )
-    
-    respond_to do |format|
-      format.html {}
+
+      respond_to do |format|
+        format.html {}
+      end
+    else
+      respond_to do |format|
+        format.html { render :nothing => true, :status => 400 }
+      end
     end
+
   end
 
 end