1 files changed, 1 insertions, 1 deletions

diff --git a/frontend/beta/js/Clipperz/PM/BookmarkletProcessor.js b/frontend/beta/js/Clipperz/PM/BookmarkletProcessor.js
index 2295d3f..369b9ce 100644
--- a/frontend/beta/js/Clipperz/PM/BookmarkletProcessor.js
+++ b/frontend/beta/js/Clipperz/PM/BookmarkletProcessor.js
@@ -45,193 +45,193 @@ Clipperz.PM.BookmarkletProcessor.versions['abstract'].prototype = MochiKit.Base.
                 return "BookmarkletProcessor - " + this.user();
         },
 
         //-------------------------------------------------------------------------
 
         'user': function() {
                 return this._user;
         },
         
         //-------------------------------------------------------------------------
 
         'configuration': function() {
                 return this._configuration;
         },
 
         //-------------------------------------------------------------------------
         
         'record': function() {
                 throw Clipperz.Base.exception.AbstractMethod;
         },
 
         //-------------------------------------------------------------------------
         __syntaxFix__: "syntax fix"
 });
 */
 
 Clipperz.PM.BookmarkletProcessor = function(anUser, aConfiguration) {
         this._user = anUser;
         this._configuration = aConfiguration;
         
         this._recordTitle = null;
         this._record = null;
         this._editableFields = null;
         this._favicon = null;
         
         return this;
 }
 
 Clipperz.PM.BookmarkletProcessor.prototype = MochiKit.Base.update(null, {
 
         'toString': function() {
                 return "BookmarkletProcessor - " + this.user();
         },
 
         //-------------------------------------------------------------------------
 
         'user': function() {
                 return this._user;
         },
         
         //-------------------------------------------------------------------------
 
         'configuration': function() {
                 return this._configuration;
         },
 
         //-------------------------------------------------------------------------
 
         'recordTitle': function() {
                 if (this._recordTitle == null) {
                         this._recordTitle = this.configuration().page.title;
                 }
                 
                 return this._recordTitle;
         },
 
         //-------------------------------------------------------------------------
 
         'fields': function() {
                 return this.configuration().form.inputs;
         },
 
         //-------------------------------------------------------------------------
 
         'editableFields': function() {
                 if (this._editableFields == null) {
                         this._editableFields = MochiKit.Base.filter(function(aField) {
                                 var result;
                                 var type;
                 
                                 type = aField['type'].toLowerCase();
                                 result = ((type != 'hidden') && (type != 'submit') && (type != 'checkbox') && (type != 'radio') && (type != 'select'));
                 
                                 return result;
                         }, this.fields())
                 }
                 
                 return this._editableFields;
         },
 
         //-------------------------------------------------------------------------
 
         'hostname': function() {
                 if (this._hostname == null) {
                         var actionUrl;
                         
-                        actionUrl = this.configuration()['form']['attributes']['action'];
+                        actionUrl = Clipperz.Base.sanitizeUrl(this.configuration()['form']['attributes']['action']);
 //MochiKit.Logging.logDebug("+++ actionUrl: " + actionUrl);
                         this._hostname = actionUrl.replace(/^https?:\/\/([^\/]*)\/.*/, '$1');
                 }
                 
                 return this._hostname;
         },
         
         'favicon': function() {
                 if (this._favicon == null) {
                         this._favicon = "http://" + this.hostname() + "/favicon.ico";
 //MochiKit.Logging.logDebug("+++ favicon: " + this._favicon);
                 }
                 
                 return this._favicon;
         },
         
         //-------------------------------------------------------------------------
         
         'record': function() {
                 if (this._record == null) {
                         var record;
                         var recordVersion;
                         var directLogin;
                         var bindings;
                         var i,c;
                         
                         record = new Clipperz.PM.DataModel.Record({
                                                                 label:this.recordTitle(),
                                                                 notes:"",
                                                                 user:this.user()
                         });
                         recordVersion = new Clipperz.PM.DataModel.RecordVersion(record, {})
                         record.setCurrentVersion(recordVersion);
                         
                         bindings = {};
                         
                         c = this.editableFields().length;
                         for (i=0; i<c; i++) {
                                 var formField;
                                 var recordField;
 
 //MochiKit.Logging.logDebug(">>> adding a field");
                                 formField = this.editableFields()[i];
                                 recordField = new Clipperz.PM.DataModel.RecordField({
                                                                         recordVersion:recordVersion,
                                                                         label:formField['name'],
                                                                         value:formField['value'],
                                                                         type:Clipperz.PM.Strings.inputTypeToRecordFieldType[formField['type']],
                                                                         hidden:false
                                 });
                                 recordVersion.addField(recordField);
                                 
                                 bindings[formField['name']] = recordField.key();
 //MochiKit.Logging.logDebug("<<< adding a field");
                         }
 
                         directLogin = new Clipperz.PM.DataModel.DirectLogin({
                                                                 record:record,
                                                                 label:this.recordTitle() + Clipperz.PM.Strings['newDirectLoginLabelSuffix'],
         //                                                      bookmarkletVersion:this.version(),
                                                                 bookmarkletVersion:'0.2',
                                                                 favicon:this.favicon(),
                                                                 formData:this.configuration()['form'],
                                                                 bindingData:bindings
                         });
                         record.addDirectLogin(directLogin);
 
                         this.user().addRecord(record);
                         
                         this._record = record;
                 }
                 
                 return this._record;
         },
 
         //-------------------------------------------------------------------------
         __syntaxFix__: "syntax fix"
 });
 
 //#############################################################################
 
 Clipperz.PM.BookmarkletProcessor.createRecordFromBookmarkletConfiguration = function(anUser, aConfiguration) {
         var processor;
 
         processor = new Clipperz.PM.BookmarkletProcessor(anUser, aConfiguration);
         
         return processor.record();
 };
 
 //-----------------------------------------------------------------------------
 
 Clipperz.PM.BookmarkletProcessor.sanitizeBookmarkletConfiguration = function(aConfiguration) {
         var result;
         
         //throw "XSS Bookmarklet attempt";