1 files changed, 84 insertions, 50 deletions

diff --git a/src/ws/node.js b/src/ws/node.js
index 047c1e3..6e60b37 100644
--- a/src/ws/node.js
+++ b/src/ws/node.js
@@ -167,34 +167,16 @@ Node.prototype.create = function()
 	this.element.appendChild(this.children_element);
 
 
-	this.div_id = document.createElement("span");
-	this.div_id.setAttribute("class", "id");
-	this.data_element.appendChild(this.div_id);
-
-	this.div_title = document.createElement("span");
-	this.div_title.setAttribute("class", "title");
+	this.id_element = document.createElement("span");
+	this.id_element.setAttribute("class", "id");
 	var id_txt = document.createTextNode(this.id);
-	this.div_id.appendChild(id_txt);
-	this.data_element.appendChild(this.div_title);
-	this.setAttribute("title", "");
+	this.id_element.appendChild(id_txt);
+	this.data_element.appendChild(this.id_element);
 
-	var node = this.element;
-
-	node.name = "node";
-	node.setAttribute("class", "node");
-	node.setAttribute("ondblclick", "editTitle(event)");
-	node.setAttribute("ondrop", "drop(event)");
-	node.setAttribute("ondragenter", "dragenter(event)");
-	node.setAttribute("ondragover", "dragover(event)");
-	node.setAttribute("ondragleave", "dragleave(event)");
-	node.setAttribute("draggable", true);
-	node.setAttribute("ondragstart", "drag(event)");
-	node.setAttribute("ondragend", "dragEnd(event)");
-	node.setAttribute("nodeid", this.id);
-
-	// This is a hack to make it possible to identify the nodeid and
-	// oberveid from the node id alone.
-	node.id = createId(this.subscribeid, this.id);
+	this.title_element = document.createElement("span");
+	this.title_element.setAttribute("class", "title");
+	this.data_element.appendChild(this.title_element);
+//	this.setAttribute("title", "");
 
 	var add_child_button = document.createElement("div");
 	add_child_button.name = "add_button";
@@ -223,53 +205,105 @@ Node.prototype.create = function()
 	this.state_element.appendChild(txt_state);
 	this.data_element.appendChild(this.state_element);
 
-/*
-	var subscribe_button = document.createElement("div");
-	subscribe_button.name = "subscribe_button";
-	subscribe_button.setAttribute("onclick", "subscribeMe(this, event)");
-	subscribe_button.setAttribute("nodeid", this.id);
-	subscribe_button.setAttribute("style", "float: left; display: inline-box; width:14px; height: 14px; border: solid green 2px; cursor: pointer;");
-	var txt_plus = document.createTextNode("+");
-	subscribe_button.appendChild(txt_plus);
-	this.data_element.appendChild(subscribe_button);
-
-	var unsubscribe_button = document.createElement("div");
-	unsubscribe_button.name = "unsubscribe_button";
-	unsubscribe_button.setAttribute("onclick", "unsubscribeMe(this, event)");
-	unsubscribe_button.setAttribute("nodeid", this.id);
-	unsubscribe_button.setAttribute("style", "float: left; display: inline-box; width:14px; height: 14px; border: solid red 2px; cursor: pointer;");
-	var txt_minus = document.createTextNode("-");
-	unsubscribe_button.appendChild(txt_minus);
-	this.data_element.appendChild(unsubscribe_button);
-*/
+	this.description_element = document.createElement("div");
+	this.description_element.setAttribute("class", "description");
+	this.data_element.appendChild(this.description_element);
+
+	var node = this.element;
+
+	node.name = "node";
+	node.setAttribute("class", "node");
+	node.setAttribute("ondblclick", "editTitle(event)");
+	node.setAttribute("ondrop", "drop(event)");
+	node.setAttribute("ondragenter", "dragenter(event)");
+	node.setAttribute("ondragover", "dragover(event)");
+	node.setAttribute("ondragleave", "dragleave(event)");
+	node.setAttribute("draggable", true);
+	node.setAttribute("ondragstart", "drag(event)");
+	node.setAttribute("ondragend", "dragEnd(event)");
+
+	// This is a hack to make it possible to identify the nodeid and
+	// oberveid from the node id alone.
+	node.id = createId(this.subscribeid, this.id);
 
 	{
 		var collapsed = getCookie(node.id+"_collapsed") == "true";
 		if(collapsed)
 		{
 			//this.children_element.style.maxHeight = "16px";
-			this.children_element.classList.add('collapsed');
+			this.element.classList.add('collapsed');
 		}
 		else
 		{
 			//this.children_element.style.maxHeight = "inherit";
-			this.children_element.classList.remove('collapsed');
+			this.element.classList.remove('collapsed');
 		}
 	}
 };
 
+function checkHTML(html)
+{
+	var doc = document.createElement('p');
+	doc.innerHTML = html;
+
+	// Check for correct and balanced HTML
+	if(doc.innerHTML !== html)
+	{
+		return false;
+	}
+
+	// Check for valid tags
+	var elements = doc.getElementsByTagName("*");
+	for(let element of elements)
+	{
+		// Check for allowed tag-names
+		if(element.tagName != "P" &&
+		   element.tagName != "EM" &&
+		   element.tagName != "STRONG" &&
+		   element.tagName != "BR" &&
+		   element.tagName != "UL" &&
+		   element.tagName != "LI" &&
+		   // Allow no attributes
+		   element.attributes.length != 0)
+		{
+			return false;
+		}
+	}
+
+	return true;
+}
+
 Node.prototype.setAttribute = function(name, value)
 {
 	this.attributes[name] = value;
 
 	if(name == "title")
 	{
-		if(this.div_title.firstChild != null)
+		if(this.title_element.firstChild != null)
 		{
-			this.div_title.removeChild(this.div_title.firstChild);
+			this.title_element.removeChild(this.title_element.firstChild);
 		}
 		var title_txt = document.createTextNode(value);
-		this.div_title.appendChild(title_txt);
+		this.title_element.appendChild(title_txt);
+	}
+
+	if(name == "description")
+	{
+		if(this.description_element.firstChild != null)
+		{
+			this.description_element.removeChild(this.description_element.firstChild);
+		}
+		if(checkHTML(value))
+		{
+			// Insert as HTML
+			this.description_element.innerHTML = value;
+		}
+		else
+		{
+			// Not valid HTML, insert as plain text to avoid breaking things
+			var description_txt = document.createTextNode(value);
+			this.description_element.appendChild(description_txt);
+		}
 	}
 
 	if(name == "dragged")