X-Git-Url: https://git.mdrn.pl/redakcja.git/blobdiff_plain/3e85e1533d6109be1d5889fb98db7e3e07fedf72..3604839194c368450c7bd3b96d74277f84d524a6:/apps/catalogue/views.py

diff --git a/apps/catalogue/views.py b/apps/catalogue/views.py
index 1f3130a0..b2727747 100644
--- a/apps/catalogue/views.py
+++ b/apps/catalogue/views.py
@@ -8,6 +8,7 @@ import os
 import shutil
 import subprocess
 from tempfile import NamedTemporaryFile
+from xml.sax.saxutils import escape as escape_xml
 
 from django.conf import settings
 from django.contrib import auth
@@ -29,6 +30,11 @@ from catalogue.forms import TagMultipleForm, TagSingleForm
 from catalogue.helpers import active_tab
 from catalogue.models import Category
 from librarian import BuildError
+from librarian.utils import Context
+from librarian.document import Document as SST
+from librarian.formats.html import HtmlFormat
+from librarian.formats.pdf import PdfFormat
+from librarian.formats.epub import EpubFormat
 from redakcja.utlis import send_notify_email
 from .constants import STAGES
 from .models import Document, Plan
@@ -115,17 +121,24 @@ def create_missing(request):
             else:
                 cover_url = ''
 
-            doc.commit(
-                text='''<section xmlns="http://nowoczesnapolska.org.pl/sst#" xmlns:dc="http://purl.org/dc/elements/1.1/">
+            text = '''<section xmlns="http://nowoczesnapolska.org.pl/sst#" xmlns:dc="http://purl.org/dc/elements/1.1/">
                 <metadata>
-                    <dc:publisher>''' + form.cleaned_data['publisher'] + '''</dc:publisher>
-                    <dc:description>''' + form.cleaned_data['description'] + '''</dc:description>
-                    ''' + '\n'.join(tag_form.metadata_rows() for tag_form in tag_forms) + '''
-                    <dc:relation.coverImage.url>''' + cover_url + '''</dc:relation.coverImage.url>
+                    <dc:publisher>%s</dc:publisher>
+                    <dc:description>%s</dc:description>
+                    %s
+                    <dc:relation.coverImage.url>%s</dc:relation.coverImage.url>
                 </metadata>
-                <header>''' + title + '''</header>
+                <header>%s</header>
                 <div class="p"> </div>
-                </section>''',
+                </section>''' % (
+                    escape_xml(form.cleaned_data['publisher']),
+                    escape_xml(form.cleaned_data['description']),
+                    '\n'.join(tag_form.metadata_rows() for tag_form in tag_forms),
+                    escape_xml(cover_url),
+                    escape_xml(title))
+
+            doc.commit(
+                text=text,
                 author=creator
             )
             doc.assigned_to = request.user
@@ -164,9 +177,6 @@ def create_missing(request):
 
 @never_cache
 def book_html(request, pk, rev_pk=None, preview=False):
-    from librarian.document import Document as SST
-    from librarian.formats.html import HtmlFormat
-
     doc = get_object_or_404(Document, pk=pk, deleted=False)
 
     try:
@@ -220,10 +230,6 @@ def book_html(request, pk, rev_pk=None, preview=False):
 
 @never_cache
 def book_pdf(request, pk, rev_pk):
-    from librarian.utils import Context
-    from librarian.document import Document as SST
-    from librarian.formats.pdf import PdfFormat
-
     doc = get_object_or_404(Document, pk=pk)
     rev = get_object_or_404(Revision, pk=rev_pk)
     # Test
@@ -250,10 +256,6 @@ def book_pdf(request, pk, rev_pk):
 
 @never_cache
 def book_epub(request, pk, rev_pk):
-    from librarian.utils import Context
-    from librarian.document import Document as SST
-    from librarian.formats.epub import EpubFormat
-
     doc = get_object_or_404(Document, pk=pk)
     rev = get_object_or_404(Revision, pk=rev_pk)
     # Test
@@ -280,10 +282,6 @@ def book_epub(request, pk, rev_pk):
 
 @never_cache
 def book_mobi(request, pk, rev_pk):
-    from librarian.utils import Context
-    from librarian.document import Document as SST
-    from librarian.formats.epub import EpubFormat
-
     doc = get_object_or_404(Document, pk=pk)
     rev = get_object_or_404(Revision, pk=rev_pk)