Some js fixes and improvements

Better handling of Torrents.StopRefresh()
Keep the order of torrents
Encode html entities from torrent name (prevent execution of unwanted
html tags)

public/js/template.js

@@ -9,7 +9,7 @@ var Templates = {
 	},
 	ApplyItemListRenderer: function(params) {
 		return function(models) {
-			for (var i=0; i < models.length; i++) {
+			for (var i=models.length-1; i >= 0; i--) {
 				var object = Templates.Render(params.templateName, models[i]);
 				if (params.method == "append") {
 					params.element.innerHTML = params.element.innerHTML + object
@@ -18,5 +18,19 @@ var Templates = {
 				}
 			}
 		};
+	},
+	EncodeEntities: function(value) {
+		return value.
+		replace(/&/g, '&amp;').
+		replace(/[\uD800-\uDBFF][\uDC00-\uDFFF]/g, function(value) {
+		var hi = value.charCodeAt(0);
+		var low = value.charCodeAt(1);
+		return '&#' + (((hi - 0xD800) * 0x400) + (low - 0xDC00) + 0x10000) + ';';
+		}).
+		replace(/([^\#-~| |!])/g, function(value) {
+		return '&#' + value.charCodeAt(0) + ';';
+		}).
+		replace(/</g, '&lt;').
+		replace(/>/g, '&gt;');
 	}
 };

public/js/torrents.js

@@ -1,32 +1,39 @@
 var Torrents = {
     CanRefresh: false,
     timeout: undefined,
-    Seconds: 300,
+    Seconds: 300, // Every five minutes, can be overridden directly in home.html (not here is better)
     SearchURL: "/api/search",
     Method: "prepend",
     LastID: 0,
     StopRefresh: function() {
         clearTimeout(this.timeout)
         this.timeout = undefined
+        this.CanRefresh = false
+    },
+    Refresh: function() {
+        if (this.CanRefresh) {
+            console.log("Start Refresh...")
+            this.timeout = setTimeout(function() {
+                var searchArgs = (window.location.search != "") ? window.location.search.substr(1) : ""
+                searchArgs = (Torrents.LastID > 0) ? "?fromID="+Torrents.LastID+"&"+searchArgs : "?"+searchArgs
+                Query.Get(Torrents.SearchURL+searchArgs, 
+                    Templates.ApplyItemListRenderer({
+                        templateName: "torrents.item", method: "prepend", element: document.getElementById("torrentListResults")
+                    }), function(torrents) {
+                        for (var i =0; i < torrents.length; i++) { if (Torrents.LastID < torrents[i].id) Torrents.LastID = torrents[i].id; }
+                        parseAllDates();
+                        Torrents.Refresh()
+                    });
+            }, this.Seconds*1000);
+        }
     },
     StartRefresh: function() {
-        console.log("Start Refresh...")
-        this.timeout = setTimeout(function() {
-            var searchArgs = (window.location.search != "") ? window.location.search.substr(1) : ""
-            searchArgs = (Torrents.LastID > 0) ? "?fromID="+Torrents.LastID+"&"+searchArgs : "?"+searchArgs
-            Query.Get(Torrents.SearchURL+searchArgs, 
-                Templates.ApplyItemListRenderer({
-                    templateName: "torrents.item", method: "prepend", element: document.getElementById("torrentListResults")
-                }), function(torrents) {
-                    for (var i =0; i < torrents.length; i++) { if (Torrents.LastID < torrents[i].id) Torrents.LastID = torrents[i].id; }
-                    parseAllDates();
-                    Torrents.StartRefresh()
-                });
-        }, this.Seconds*1000);
+        this.CanRefresh = true;
+        this.Refresh()
     }
 }
 
-document.addEventListener("DOMContentLoaded", function() {
+document.addEventListener("DOMContentLoaded", function() { // if Torrents.CanRefresh is enabled, refresh is automatically done (no need to start it anually)
     if (Torrents.CanRefresh) {
         Torrents.StartRefresh()
     }

templates/home.html

@@ -106,11 +106,11 @@ Your browser does not support the audio element.
                       {{ end }}
                   "</a>"+
               "</td>"+
-              "<td class=\"tr-name home-td\"><a href=\"/view/"+torrent.id+"\">"+ torrent.name +"</a></td>"+
+              "<td class=\"tr-name home-td\"><a href=\"/view/"+torrent.id+"\">"+Templates.EncodeEntities(torrent.name) +"</a></td>"+
               "<td class=\"tr-links home-td\">"+
                   "<a href=\""+torrent.magnet +"\" title=\"{{ call $.T "magnet_link" }}\">"+
                       "<div class=\"magnet-icon\"></div>"+
-                  "</a>"+(torrent.torrent != "" ? "<a href=\""+torrent.torrent+"\" title=\"{{ call $.T "torrent_file" }}\"><div class=\"download-icon\"></div></a>" : "") +
+                  "</a>"+(torrent.torrent != "" ? " <a href=\""+torrent.torrent+"\" title=\"{{ call $.T "torrent_file" }}\"><div class=\"download-icon\"></div></a>" : "") +
               "</td>"+
               "<td class=\"tr-size home-td hide-xs\">"+humanFileSize(torrent.filesize)+"</td>"+
               "<td class=\"tr-se home-td hide-xs\">"+torrent.seeders+"</td>"+
@@ -120,6 +120,6 @@ Your browser does not support the audio element.
           "</tr>";
         });
        Torrents.LastID = {{ lastID .URL .Models }};
-       if (Torrents.LastID > 0) Torrents.StartRefresh()
+       if (Torrents.LastID > 0) Torrents.CanRefresh = true;
     </script>
 {{end}}