From 98dc32d75393a3d2cf8dbd08d0573d5c68dee249 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=97=B6=E9=9B=A8?= <phithon@phithon.local>
Date: Sat, 9 May 2015 14:31:04 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E6=94=B9=E6=8E=92=E5=BA=8F=E6=96=B9?=
 =?UTF-8?q?=E5=BC=8F=EF=BC=8C=E6=96=B0=E5=9B=9E=E5=A4=8D=E6=8E=92=E5=89=8D?=
 =?UTF-8?q?=E9=9D=A2?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 README.md             | 1 +
 controller/main.py    | 2 +-
 controller/open.py    | 2 +-
 controller/post.py    | 5 ++++-
 controller/publish.py | 3 ++-
 util/pxfilter.py      | 6 +-----
 6 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/README.md b/README.md
index 98c1802..7bdce7d 100644
--- a/README.md
+++ b/README.md
@@ -216,6 +216,7 @@ location / {
  3. 编写测试脚本，在py2/3环境下进行测试。
  4. 增加多语言支持。
  5. 增加网站底部自定义，使之可以填写：备案信息、统计代码等。
+ 6. 增加CSS白名单过滤，防止出乱子。
 
 ### LICENSE
 开源协议：MPL  
diff --git a/controller/main.py b/controller/main.py
index f6f7519..24b6eb0 100644
--- a/controller/main.py
+++ b/controller/main.py
@@ -15,7 +15,7 @@ def get(self, *args, **kwargs):
 		page = intval(args[1])
 		if not page or page <= 0 : page = 1
 		cursor = self.db.article.find()
-		cursor.sort([('top', pymongo.DESCENDING), ('time', pymongo.DESCENDING)]).limit(limit).skip((page - 1) * limit)
+		cursor.sort([('top', pymongo.DESCENDING), ("lastcomment", pymongo.DESCENDING), ('time', pymongo.DESCENDING)]).limit(limit).skip((page - 1) * limit)
 		count = yield cursor.count()
 		posts = yield cursor.to_list(length = limit)
 		sorts = yield self.get_sort()
diff --git a/controller/open.py b/controller/open.py
index 61064ea..c8777b4 100644
--- a/controller/open.py
+++ b/controller/open.py
@@ -137,7 +137,7 @@ def get(self, *args, **kwargs):
 		cursor = self.db.article.find({
 			"open": True
 		})
-		cursor.sort([("top", pymongo.DESCENDING), ('time', pymongo.DESCENDING)]).limit(limit).skip((page - 1) * limit)
+		cursor.sort([("top", pymongo.DESCENDING), ("lastcomment", pymongo.DESCENDING), ('time', pymongo.DESCENDING)]).limit(limit).skip((page - 1) * limit)
 		count = yield cursor.count()
 		posts = yield cursor.to_list(length = limit)
 		self.render("open_list.htm", posts = posts, page = page,
diff --git a/controller/post.py b/controller/post.py
index d55bed2..8b636f5 100644
--- a/controller/post.py
+++ b/controller/post.py
@@ -94,7 +94,10 @@ def post(self, *args, **kwargs):
 					    },
 					    "time": time.time()
 					}
-				}
+				},
+		        "$set": {
+			        "lastcomment": time.time()
+		        }
 			})
 		if post:
 			if self.current_user["username"] != post["user"]:
diff --git a/controller/publish.py b/controller/publish.py
index 66ce3e3..6390a17 100644
--- a/controller/publish.py
+++ b/controller/publish.py
@@ -79,7 +79,8 @@ def post(self, *args, **kwargs):
 		    "rank": 0,
 		    "comment": [],
 		    "open": False,
-		    "top": False
+		    "top": False,
+		    "lastcomment": time.time()
 		}
 		model = ArticleModel()
 		if not model(article):
diff --git a/util/pxfilter.py b/util/pxfilter.py
index 7f9756d..787926e 100644
--- a/util/pxfilter.py
+++ b/util/pxfilter.py
@@ -194,10 +194,6 @@ def __htmlspecialchars(self, html, strict=False):
 
 if "__main__" == __name__:
 	parser = XssHtml()
-	parser.feed("""<p><img src=1 onerror=alert(/xss/)></p><div class="left">
-		<a href='javascript:prompt(1)'><br />hehe</a></div>
-		<p id="test" onmouseover="alert(1)">&gt;M<svg>
-		<a href="https://www.baidu.com" target="self">MM</a></p>
-		<embed src='javascript:alert(/hehe/)' allowscriptaccess=always />""")
+	parser.feed("""<div onmouseover=alert(1) >""")
 	parser.close()
 	print(parser.getHtml())
\ No newline at end of file