From 7fcf703041ab8b70765f9cc8097c2c151dffbea7 Mon Sep 17 00:00:00 2001
From: Victor Dubiniuk <victor.dubiniuk@gmail.com>
Date: Mon, 7 Apr 2014 17:18:14 +0300
Subject: [PATCH 1/2] Cleanup some variables

---
 ajax/sessionController.php |  6 +++---
 ajax/userController.php    |  4 ++--
 js/documents.js            | 14 ++++++--------
 lib/helper.php             |  7 +++++++
 4 files changed, 18 insertions(+), 13 deletions(-)

diff --git a/ajax/sessionController.php b/ajax/sessionController.php
index 0ddd5063..b3db8bb8 100644
--- a/ajax/sessionController.php
+++ b/ajax/sessionController.php
@@ -52,9 +52,9 @@ class SessionController extends Controller{
 	}
 	
 	protected static function join($uid, $file){
-			$session = Db_Session::start($uid, $file);
-			\OCP\JSON::success($session);
-			exit();
+		$session = Db_Session::start($uid, $file);
+		\OCP\JSON::success($session);
+		exit();
 	}
 
 	/**
diff --git a/ajax/userController.php b/ajax/userController.php
index 8ad1d74d..94111c9b 100644
--- a/ajax/userController.php
+++ b/ajax/userController.php
@@ -40,8 +40,8 @@ class UserController extends Controller{
 	}
 	
 	public static function rename($args){
-		$memberId = @$args['member_id'];
-		$name = @$_POST['name'];
+		$memberId = Helper::getArrayValueByKey($args, 'member_id');
+		$name = Helper::getArrayValueByKey($_POST, 'name');
 		$member = new Db_Member();
 		$member->load($memberId);
 		$memberData = $member->getData();
diff --git a/js/documents.js b/js/documents.js
index 1a401116..66619f89 100644
--- a/js/documents.js
+++ b/js/documents.js
@@ -19,9 +19,8 @@ var documentsMain = {
 		toolbar : '<div id="odf-toolbar" class="dijitToolbar">' +
 					'  <div id="document-title" class="icon-noise">' +
 					'<div class="logo-wide"></div>' +
-					'<div>' +
-					'%title%' +
-			        '  </div></div>' +
+					'<div id="document-title-container"></div>' +
+			        '</div>' +
 					'  <span id="toolbar" class="claro">' +
 					'  <button id="odf-invite" class="drop">' +
 						  t('documents', 'Share') +
@@ -69,7 +68,8 @@ var documentsMain = {
 		},
 		
 		showEditor : function(title, canShare){
-			$(document.body).prepend(documentsMain.UI.toolbar.replace(/%title%/g, title));
+			$(document.body).prepend(documentsMain.UI.toolbar);
+			$('#document-title-container').text(title);
 			if (!canShare){
 				$('#odf-invite').remove();
 			} else {
@@ -132,9 +132,7 @@ var documentsMain = {
 		
 		notify : function(message){
 			OC.Notification.show(message);
-			setTimeout(function() {
-				OC.Notification.hide();
-			}, 10000);
+			setTimeout(OC.Notification.hide, 10000);
 		}
 	},
 	
@@ -420,7 +418,7 @@ var documentsMain = {
 				}
 				documentsMain.fileName = name;
 				$('title').text(documentsMain.UI.mainTitle + '| ' + name);
-				$('#document-title>div').text(name);
+				$('#document-title-container').text(name);
 			}
 		);
 	},
diff --git a/lib/helper.php b/lib/helper.php
index dbda481c..dc2ae3a5 100644
--- a/lib/helper.php
+++ b/lib/helper.php
@@ -26,6 +26,13 @@ class Helper {
 
 		return $path;
 	}
+	
+	public static function getArrayValueByKey($array, $key, $default=''){
+		if (array_key_exists($key, $array)){
+			return $array[$key];
+		}
+		return $default;
+	}
 
 	public static function isVersionsEnabled(){
 		return \OCP\App::isEnabled('files_versions');

From a54feb9c5828cd940df7115fbfba433d06defc99 Mon Sep 17 00:00:00 2001
From: Victor Dubiniuk <victor.dubiniuk@gmail.com>
Date: Mon, 7 Apr 2014 20:33:50 +0300
Subject: [PATCH 2/2] Add CSRF check

---
 ajax/documentController.php | 5 +++--
 js/ServerFactory.js         | 3 +--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/ajax/documentController.php b/ajax/documentController.php
index 6a704a34..2413532e 100644
--- a/ajax/documentController.php
+++ b/ajax/documentController.php
@@ -53,14 +53,15 @@ class DocumentController extends Controller{
 	 * @param array $args - array containing session id as an element with a key es_id 
 	 */
 	public static function serve($args){
+		
 		$session = new Db_Session();
 		$sessionData = $session->load(@$args['es_id'])->getData();
 			
 		$file = new File(@$sessionData['file_id']);
 		if (!$file->isPublicShare()){
-			self::preDispatch(false);
+			self::preDispatch();
 		} else {
-			self::preDispatchGuest(false);
+			self::preDispatchGuest();
 		}
 		
 		$filename = isset($sessionData['genesis_url']) ? $sessionData['genesis_url'] : '';
diff --git a/js/ServerFactory.js b/js/ServerFactory.js
index 7c37949b..82740001 100644
--- a/js/ServerFactory.js
+++ b/js/ServerFactory.js
@@ -45,8 +45,7 @@ define("owncloud/ServerFactory", [
 
                 server = new PullBoxServer(args);
                 server.getGenesisUrl = function(sid) {
-                    // what a dirty hack :)
-                    return OC.generateUrl('apps/documents/ajax/genesis/{es_id}', {es_id: sid});
+                    return OC.generateUrl('apps/documents/ajax/genesis/{es_id}', {es_id: sid}) + '?requesttoken=' + oc_requesttoken;
                 };
                 return server;
             };