Some js fixes and improvements

Better handling of Torrents.StopRefresh()
Keep the order of torrents
Encode html entities from torrent name (prevent execution of unwanted
html tags)

public/js/template.js

@@ -9,7 +9,7 @@ var Templates = {
 	},
 	ApplyItemListRenderer: function(params) {
 		return function(models) {
-			for (var i=0; i < models.length; i++) {
+			for (var i=models.length-1; i >= 0; i--) {
 				var object = Templates.Render(params.templateName, models[i]);
 				if (params.method == "append") {
 					params.element.innerHTML = params.element.innerHTML + object
@@ -18,5 +18,19 @@ var Templates = {
 				}
 			}
 		};
+	},
+	EncodeEntities: function(value) {
+		return value.
+		replace(/&/g, '&amp;').
+		replace(/[\uD800-\uDBFF][\uDC00-\uDFFF]/g, function(value) {
+		var hi = value.charCodeAt(0);
+		var low = value.charCodeAt(1);
+		return '&#' + (((hi - 0xD800) * 0x400) + (low - 0xDC00) + 0x10000) + ';';
+		}).
+		replace(/([^\#-~| |!])/g, function(value) {
+		return '&#' + value.charCodeAt(0) + ';';
+		}).
+		replace(/</g, '&lt;').
+		replace(/>/g, '&gt;');
 	}
 };

public/js/torrents.js

@@ -1,15 +1,17 @@
 var Torrents = {
     CanRefresh: false,
     timeout: undefined,
-    Seconds: 300,
+    Seconds: 300, // Every five minutes, can be overridden directly in home.html (not here is better)
     SearchURL: "/api/search",
     Method: "prepend",
     LastID: 0,
     StopRefresh: function() {
         clearTimeout(this.timeout)
         this.timeout = undefined
+        this.CanRefresh = false
     },
-    StartRefresh: function() {
+    Refresh: function() {
+        if (this.CanRefresh) {
             console.log("Start Refresh...")
             this.timeout = setTimeout(function() {
                 var searchArgs = (window.location.search != "") ? window.location.search.substr(1) : ""
@@ -20,13 +22,18 @@ var Torrents = {
                     }), function(torrents) {
                         for (var i =0; i < torrents.length; i++) { if (Torrents.LastID < torrents[i].id) Torrents.LastID = torrents[i].id; }
                         parseAllDates();
-                    Torrents.StartRefresh()
+                        Torrents.Refresh()
                     });
             }, this.Seconds*1000);
         }
+    },
+    StartRefresh: function() {
+        this.CanRefresh = true;
+        this.Refresh()
+    }
 }
 
-document.addEventListener("DOMContentLoaded", function() {
+document.addEventListener("DOMContentLoaded", function() { // if Torrents.CanRefresh is enabled, refresh is automatically done (no need to start it anually)
     if (Torrents.CanRefresh) {
         Torrents.StartRefresh()
     }

templates/home.html

@@ -106,7 +106,7 @@ Your browser does not support the audio element.
                       {{ end }}
                   "</a>"+
               "</td>"+
-              "<td class=\"tr-name home-td\"><a href=\"/view/"+torrent.id+"\">"+ torrent.name +"</a></td>"+
+              "<td class=\"tr-name home-td\"><a href=\"/view/"+torrent.id+"\">"+Templates.EncodeEntities(torrent.name) +"</a></td>"+
               "<td class=\"tr-links home-td\">"+
                   "<a href=\""+torrent.magnet +"\" title=\"{{ call $.T "magnet_link" }}\">"+
                       "<div class=\"magnet-icon\"></div>"+
@@ -120,6 +120,6 @@ Your browser does not support the audio element.
           "</tr>";
         });
        Torrents.LastID = {{ lastID .URL .Models }};
-       if (Torrents.LastID > 0) Torrents.StartRefresh()
+       if (Torrents.LastID > 0) Torrents.CanRefresh = true;
     </script>
 {{end}}