From a7fea462b00bd18ec12de758f5648d4c19ea0840 Mon Sep 17 00:00:00 2001
From: Veloman Yunkan <veloman.yunkan@gmail.com>
Date: Wed, 3 Mar 2021 00:41:38 +0400
Subject: [PATCH 1/2] HTML decoding of suggestions in the frontend

Since the `value` field of the search suggestion results is HTML
escaped/encoded in the backend (see static/templates/suggestion.json) it
must be decoded in the frontend.
---
 static/templates/head_part.html | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/static/templates/head_part.html b/static/templates/head_part.html
index 47b7c7921..3f31d8451 100644
--- a/static/templates/head_part.html
+++ b/static/templates/head_part.html
@@ -4,6 +4,10 @@
 <script type="text/javascript" src="{{root}}/skin/jquery-ui/external/jquery/jquery.js"></script>
 <script type="text/javascript" src="{{root}}/skin/jquery-ui/jquery-ui.min.js"></script>
 <script>
+  function htmlDecode(input) {
+        var doc = new DOMParser().parseFromString(input, "text/html");
+        return doc.documentElement.textContent;
+  }
   var jk = jQuery.noConflict();
   jk(function() {
   jk( "#kiwixsearchbox" ).autocomplete({
@@ -12,6 +16,12 @@
   dataType: "json",
   cache: false,
 
+  response: function( event, ui ) {
+        for(const item of ui.content) {
+            item.value = htmlDecode(item.value);
+        }
+  },
+
   select: function(event, ui) {
   jk( "#kiwixsearchbox" ).val(ui.item.value);
   jk( "#kiwixsearchform" ).submit();

From c7d77395e76d6e6315c56a745394afd1d976fe0e Mon Sep 17 00:00:00 2001
From: Veloman Yunkan <veloman.yunkan@gmail.com>
Date: Wed, 3 Mar 2021 00:49:07 +0400
Subject: [PATCH 2/2] `label` field of suggestions is also HTML escaped

Without this if the suggestion text contains a double quote, the
response stops being a valid json.
---
 static/templates/head_part.html  | 1 +
 static/templates/suggestion.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/static/templates/head_part.html b/static/templates/head_part.html
index 3f31d8451..f4b78bfe1 100644
--- a/static/templates/head_part.html
+++ b/static/templates/head_part.html
@@ -18,6 +18,7 @@
 
   response: function( event, ui ) {
         for(const item of ui.content) {
+            item.label = htmlDecode(item.label);
             item.value = htmlDecode(item.value);
         }
   },
diff --git a/static/templates/suggestion.json b/static/templates/suggestion.json
index e35d28054..cedb609a3 100644
--- a/static/templates/suggestion.json
+++ b/static/templates/suggestion.json
@@ -2,6 +2,6 @@
   {{#suggestions}}{{^first}},{{/first}}
   {
     "value" : "{{value}}",
-    "label" : "{{& label}}"
+    "label" : "{{label}}"
   }{{/suggestions}}
 ]