Index: openacs-4/packages/xowiki/tcl/weblog-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/xowiki/tcl/weblog-procs.tcl,v
diff -u -N -r1.70 -r1.71
--- openacs-4/packages/xowiki/tcl/weblog-procs.tcl	24 Jun 2015 15:38:41 -0000	1.70
+++ openacs-4/packages/xowiki/tcl/weblog-procs.tcl	7 Aug 2017 23:48:30 -0000	1.71
@@ -22,9 +22,9 @@
     {exclude_item_ids 0}
     {entry_renderer ::xowiki::Weblog::Entry}
     {entry_flag}
-    {summary false}
+    {summary:boolean false}
     {summary_chars 150}
-    {compute_summary false}
+    {compute_summary:boolean false}
   }
 
   ::xowiki::Weblog proc instantiate_forms {
@@ -33,7 +33,6 @@
      -forms:required 
      -package_id:required
      } {
-    set folder_id [::$package_id folder_id]
     set form_item_ids [list]
     foreach t [split $forms |] {
       #my log "trying to get $t // parent_id $parent_id"
@@ -67,10 +66,10 @@
     set extra_where_clause ""
 
     if {$date ne ""} {
-      if {[regexp {['\"<>]} $date]} {
-        ns_log Warning "ignoring invalid date '$date'"
-        set date ""
-        set query [::xo::update_query $query date ""]
+      if {![regexp {^\d\d\d\d[-]\d\d[-]\d\d$} $date]} {
+        ns_log Warning "invalid date '$date'"
+        ad_return_complaint 1 "invalid date"
+        ad_script_abort
       }
     }
     if {$date ne ""} {
@@ -87,8 +86,8 @@
       set category_ids {}
       foreach cid [split $category_id ,] {
         if {![string is integer -strict $cid]} {
-          ns_log warning "weblog: ignoring invalid category_id $cid"
-          continue
+          ad_return_complaint 1 "invalid category_id"
+          ad_script_abort
         }
         append extra_where_clause "and exists (select * from category_object_map \
            where object_id = ci.item_id and category_id = '$cid')"
@@ -103,6 +102,7 @@
     }
     #my msg "tag=$tag"
     if {$tag ne ""} {
+      $package_id validate_tag $tag
       set filter_msg "Filtered by your tag $tag"
       append extra_from_clause " join xowiki_tags tags on (tags.item_id = bt.item_id) "
       append extra_where_clause "and tags.tag = :tag and \
@@ -111,6 +111,7 @@
     }
     #my msg "ptag=$ptag"
     if {$ptag ne ""} {
+      $package_id validate_tag $ptag
       set filter_msg "Filtered by popular tag $ptag"
       append extra_from_clause " join xowiki_tags tags on (tags.item_id = bt.item_id) "
       append extra_where_clause "and tags.tag = :ptag " 
@@ -266,20 +267,19 @@
     }
     array set smsg {1 full 0 summary}
     
-    set query [::xo::update_query $query summary [expr {!$summary}]]
-    set weblog_href [::xo::cc url]?$query
-    #set weblog_href [$package_id package_url][$package_id get_parameter weblog_page]
-    #set flink "<a href='[ns_quotehtml $weblog_href?summary=[expr {!$summary}]$query_parm]'>[ns_quotehtml $smsg($summary)]</a>"
-    set flink "<a href='[ns_quotehtml $weblog_href]'>[ns_quotehtml $smsg($summary)]</a>"
+    set summary_href [::xo::cc url]?[::xo::update_query $query summary [expr {!$summary}]]
+    #set flink "<a href='[ns_quotehtml $summary_href$query_parm]'>[ns_quotehtml $smsg($summary)]</a>"
+    set flink "<a href='[ns_quotehtml $summary_href]'>[ns_quotehtml $smsg([string is true $summary])]</a>"
     
     if {$page_number ne ""} {
       set nr [llength [$items children]] 
-      set from [expr {($page_number-1)*$page_size+1}]
-      set to   [expr {($page_number-1)*$page_size+$nr}]
+      set from [expr {($page_number-1) * $page_size + 1}]
+      set to   [expr {($page_number-1) * $page_size + $nr}]
       set range [expr {$nr > 1 ? "$from - $to" : $from}]
       
       if {$filter_msg ne ""} {
-        append filter_msg ", $range of $nr_items $entry_label (<a href='[ns_quotehtml $weblog_href]'>all</a>, [ns_quotehtml $flink])"
+        set all_href  [$package_id package_url][$package_id get_parameter weblog_page weblog-portlet]
+        append filter_msg ", $range of $nr_items $entry_label (<a href='[ns_quotehtml $all_href]'>all</a>, $flink)"
       } else {
         append filter_msg "Showing $range of $nr_items $entry_label ($flink)"
       }
@@ -288,10 +288,9 @@
       set prev_p [expr {$page_number > 1}]
       
       if {$next_p} {
-        set query [::xo::update_query $query page_number [expr {$page_number+1}]]
+        set query [::xo::update_query $query page_number [expr {$page_number + 1}]]
         set next_page_link [::xo::cc url]?$query
-      }
-      if {$prev_p} {
+      } elseif {$prev_p} {
         set query [::xo::update_query $query page_number [expr {$page_number-1}]]
         set prev_page_link [::xo::cc url]?$query
       }