From bcc57b677a64d530948eac7f4dbc3c3d1d8e312b Mon Sep 17 00:00:00 2001
From: Xie JinBin <xiexiecn@hotmail.com>
Date: Sun, 2 Feb 2014 00:41:39 +0800
Subject: [PATCH] Tag needs escaping. Wrongly call showSuggestions.

close #2087, fix #2089
- escape tag.
- do not call showSuggestions when key is UP/DOWN. or the selected tag will
  always be clear.
---
 core/client/views/editor-tag-widget.js | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/core/client/views/editor-tag-widget.js b/core/client/views/editor-tag-widget.js
index 45daac0c1b..33d3b7226a 100644
--- a/core/client/views/editor-tag-widget.js
+++ b/core/client/views/editor-tag-widget.js
@@ -125,7 +125,7 @@
                 /*jslint regexp: true */ // - would like to remove this
                 highlightedName = highlightedName.replace(/(<mark>[^<>]*)((<[^>]+>)+)([^<>]*<\/mark>)/, "$1</mark>$2<mark>$4");
 
-                suggestionHTML = "<li data-tag-id='" + matchingTag.id + "' data-tag-name='" + matchingTag.name + "'><a href='#'>" + highlightedName + "</a></li>";
+                suggestionHTML = "<li data-tag-id='" + matchingTag.id + "' data-tag-name='" + _.escape(matchingTag.name) + "'><a href='#'>" + highlightedName + "</a></li>";
                 this.$suggestions.append(suggestionHTML);
             }, this);
         },
@@ -134,12 +134,6 @@
             var $target = $(e.currentTarget),
                 searchTerm = $.trim($target.val());
 
-            if (searchTerm) {
-                this.showSuggestions($target, searchTerm);
-            } else {
-                this.$suggestions.hide();
-            }
-
             if (e.keyCode === this.keys.UP) {
                 e.preventDefault();
                 if (this.$suggestions.is(":visible")) {
@@ -160,6 +154,12 @@
                 }
             } else if (e.keyCode === this.keys.ESC) {
                 this.$suggestions.hide();
+            } else {
+                if (searchTerm) {
+                    this.showSuggestions($target, searchTerm);
+                } else {
+                    this.$suggestions.hide();
+                }
             }
 
             if (e.keyCode === this.keys.UP || e.keyCode === this.keys.DOWN) {
@@ -195,8 +195,8 @@
                 $selectedSuggestion = this.$suggestions.children(".selected");
                 if (this.$suggestions.is(":visible") && $selectedSuggestion.length !== 0) {
 
-                    if ($('.tag:containsExact("' + $selectedSuggestion.data('tag-name') + '")').length === 0) {
-                        tag = {id: $selectedSuggestion.data('tag-id'), name: $selectedSuggestion.data('tag-name')};
+                    if ($('.tag:containsExact("' + _.unescape($selectedSuggestion.data('tag-name')) + '")').length === 0) {
+                        tag = {id: $selectedSuggestion.data('tag-id'), name: _.unescape($selectedSuggestion.data('tag-name'))};
                         this.addTag(tag);
                     }
                 } else {
@@ -232,7 +232,7 @@
         handleSuggestionClick: function (e) {
             var $target = $(e.currentTarget);
             if (e) { e.preventDefault(); }
-            this.addTag({id: $target.data('tag-id'), name: $target.data('tag-name')});
+            this.addTag({id: $target.data('tag-id'), name: _.unescape($target.data('tag-name'))});
         },
 
         handleTagClick: function (e) {