Merge branch 'feature/#36-security-cleanup' into 'develop'

closes #36
Feature/#36 security cleanup

See merge request !9

build.gradle

@@ -23,7 +23,7 @@ dependencies {
     implementation 'org.springframework.boot:spring-boot-starter-web'
     implementation 'org.apache.tomcat.embed:tomcat-embed-jasper'
     implementation 'javax.servlet:jstl'
-    implementation 'org.apache.cxf:cxf-rt-rs-client:3.3.4'
+    implementation 'org.apache.cxf:cxf-rt-rs-client:3.3.6'
     implementation 'io.jsonwebtoken:jjwt:0.9.1'
     implementation 'com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider'
     implementation 'com.atlassian.commonmark:commonmark:0.14.0'

package.json

@@ -2,8 +2,8 @@
   "name": "textgridrep-portal",
   "version": "3.0.0",
   "dependencies": {
-    "jquery": "^1.11.2",
-    "openseadragon": "^2.4.1",
-    "font-awesome": "4.3.0"
+    "font-awesome": "4.3.0",
+    "jquery": "^3.5.1",
+    "openseadragon": "^2.4.1"
   }
 }

src/main/java/info/textgrid/rep/basket/BasketAjaxController.java

@@ -5,6 +5,7 @@ import java.util.ArrayList;
 import java.util.List;
 import javax.servlet.http.HttpSession;
 import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RestController;
@@ -14,7 +15,7 @@ import org.springframework.web.bind.annotation.RestController;
 @RequestMapping("/service/shelf")
 public class BasketAjaxController {
 
-  @RequestMapping("/add")
+  @PostMapping("/add")
   public long addToBasket(
       HttpSession session,
       @RequestParam("uri") String textgridUri
@@ -33,7 +34,7 @@ public class BasketAjaxController {
   }
 
 
-  @RequestMapping("/remove")
+  @PostMapping("/remove")
   public long removeFromBasket(
       HttpSession session,
       @RequestParam("uri") String textgridUri
@@ -45,7 +46,7 @@ public class BasketAjaxController {
     return basket.size();
   }
 
-  @RequestMapping("/clear")
+  @PostMapping("/clear")
   public long clearBasket(
       HttpSession session
       ) throws IOException {

src/main/java/info/textgrid/rep/shared/Utils.java

 package info.textgrid.rep.shared;
 
-import info.textgrid.namespaces.metadata.core._2010.RelationType;
-import info.textgrid.namespaces.middleware.tgsearch.ResultType;
-//import info.textgrid.service.BasketLocalServiceUtil;
-import io.jsonwebtoken.Claims;
-import io.jsonwebtoken.Jws;
-import io.jsonwebtoken.Jwts;
-
 import java.io.UnsupportedEncodingException;
 import java.net.URLEncoder;
 import java.util.List;
-
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpSession;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.w3._1999._02._22_rdf_syntax_ns_.RdfType;
 import org.w3c.dom.Element;
+import info.textgrid.namespaces.metadata.core._2010.RelationType;
+import info.textgrid.namespaces.middleware.tgsearch.ResultType;
 
 
 
@@ -24,7 +18,6 @@ import org.w3c.dom.Element;
 public class Utils {
 
 	private final static int THUMBSIZE = 250;
-	//private final static String BROWSE_URL = "/web/textgrid/browse/-/tgrep/";
 	private final static String BROWSE_URL = "/browse/";
 	private final static String SEARCH_URL = "/search";
 
@@ -40,7 +33,6 @@ public class Utils {
 	}
 
 	public static String urlmod(String tgurl) {
-		//System.out.println("urmlod called with uri: " + tgurl);
 		if(tgurl.length() > 10) {
 			return tgurl.substring(9).replace('.', '_');
 		}
@@ -78,17 +70,10 @@ public class Utils {
         if (imageUri != null) {
         	return textgridHost + "/1.0/digilib/rest/IIIF/"+imageUri+"/full/,"+THUMBSIZE+"/0/native.jpg";
         } else {
-			return "https://upload.wikimedia.org/wikipedia/commons/1/1d/No_image.svg";
+			return "/images/no_image.svg";
 		}
 	}
 
-	public static String getParamWithDefault(HttpServletRequest sr, String param, String defaultString) {
-		if(sr.getParameter(param) == null) {
-			return defaultString;
-		}
-		return sr.getParameter(param);
-	}
-
 	public static String getFilterQueryString(List<String> filters) {
 
 		if(filters==null) {
@@ -128,52 +113,7 @@ public class Utils {
 		}
 		return string;
 	}
-/*
-	public static Boolean userWantsSandbox(long userId) {
-		boolean sandbox = false;
-		ExpandoValue expandoObject = null;
-		try {
-			expandoObject = ExpandoValueLocalServiceUtil.getValue(CompanyThreadLocal.getCompanyId(),
-					"com.liferay.portal.model.User", "CUSTOM_FIELDS", "textgrid-sandbox-results", userId);
-			if(expandoObject != null){
-				sandbox = expandoObject.getBoolean();
-			}
-		} catch (SystemException | PortalException e) {
-			log.error("error reading expandoValue (textgrid-sandbox-results)", e);
-		}
-		return sandbox;
-	}
 
-	public static Boolean userWantsAnnotation(long userId) {
-		boolean annotation = false;
-		ExpandoValue expandoObject = null;
-		try {
-			expandoObject = ExpandoValueLocalServiceUtil.getValue(CompanyThreadLocal.getCompanyId(),
-					"com.liferay.portal.model.User", "CUSTOM_FIELDS", "textgrid-annotation", userId);
-			if(expandoObject != null){
-				annotation = expandoObject.getBoolean();
-			}
-		} catch (SystemException | PortalException e) {
-			log.error("error reading expandoValue (textgrid-annotation)", e);
-		}
-		return annotation;
-	}
-
-	public static String getEppn(long userId) {
-		String eppn = "";
-		ExpandoValue expandoObject = null;
-		try {
-			expandoObject = ExpandoValueLocalServiceUtil.getValue(CompanyThreadLocal.getCompanyId(),
-					"com.liferay.portal.model.User", "CUSTOM_FIELDS", "eppn", userId);
-			if(expandoObject != null){
-				eppn = expandoObject.getString();
-			}
-		} catch (SystemException | PortalException e) {
-			log.error("error reading expandoValue (eppn)", e);
-		}
-		return eppn;
-	}
-*/
     public static String replaceAll(String string, String pattern, String replacement) {
         return string.replaceAll(pattern, replacement);
     }

src/main/resources/application.properties

@@ -2,6 +2,10 @@
 spring.mvc.view.prefix: /WEB-INF/jsp/
 spring.mvc.view.suffix: .jsp
 
+# secure cookies require https => set TGREP_SSL=TRUE env var in docker
+tgrep.ssl = false
+server.servlet.session.cookie.secure: ${tgrep.ssl}
+
 # textgrid defaults
 textgrid.host: https://textgridlab.org
 handle.host: https://hdl.handle.net

src/main/resources/static/css/more.css

+/* tgrep css additions to custom.css */
+
+/* from head.jsp */
+ul { padding: 0; }
+dd { margin-left: 0; }
+dt { font-weight: bold; }
+dd + dt { margin-top: 13px; }
+
+/* from browse.jsp */
+iframe {
+  width: 100%;
+}
+
+.clearboth {
+	clear: both;
+}
+
+.drunkenowl {
+  float:right; width: 30%;
+}

src/main/resources/static/images/no_image.svg

+<?xml version="1.0" encoding="UTF-8"?><svg xmlns="http://www.w3.org/2000/svg" width="1" height="1"/>
\ No newline at end of file

src/main/resources/static/js/basket.js

+document.addEventListener("DOMContentLoaded", function(event) {
+
+	// TODO: does this overload the binding from theme.js?
+	$(document).on('click', '.-remove-from-shelf', function(e) {
+		var $this = $(this);
+		var tgObjectUri = $this.attr('data-textgrid-targeturi');
+		$.ajax({
+				url: '/service/shelf/remove' ,
+				type: 'POST',
+				dataType:'json',
+				data: {
+					uri: tgObjectUri
+				},
+				success: function(data) {
+					$this.closest('li.tgrep.result').remove();
+					$this.closest('li.tgrep.gallery-item').remove();
+					$('.tgrep.header_count').html(data);
+					setBasketCount(data);
+					removeFromAggregatorItemString(tgObjectUri)
+				}
+		});
+	});
+
+	$(document).on('click', '.tgrep.header_button.-clear', function(e) {
+		$.ajax({
+				url: '/service/shelf/clear' ,
+				type: 'POST',
+				dataType:'json',
+				data: {
+					empty: 'empty'
+				},
+				success: function(data) {
+					$('.tgrep.results_list').empty();
+					$('.tgrep.results_gallery').empty();
+					$('.tgrep.header_count').html(0);
+					setBasketCount(data);
+					removeUselessActionsFromEmptyShelf();
+				}
+		});
+	});
+	
+	basketItemString = document.querySelector('#basketItemString').dataset.value;
+	
+});
+
+// set by jsp
+var basketItemString;
+
+// removes the tguri from aggregatorUrl
+function removeFromAggregatorItemString(tgObjectUri) {
+
+	var basketItemStringOld = basketItemString;
+	var itemArr = basketItemString.split(',');
+	itemArr.splice(itemArr.indexOf(tgObjectUri),1);
+
+	// are there any objects left on the shelf?
+	if(itemArr.length > 0) {
+		basketItemString = itemArr.join(',');
+	  document.querySelectorAll('.aggregator-items').forEach( elem => {
+	      elem.href = elem.href.replace(basketItemStringOld, basketItemString);
+	  });
+	} else {
+		removeUselessActionsFromEmptyShelf();
+	}
+}
+
+// disable download and voyant links if shelf is empty
+function removeUselessActionsFromEmptyShelf() {
+	document.querySelectorAll('.remove_on_shelf_empty').forEach( elem => {
+		elem.remove();
+	});
+}
\ No newline at end of file

src/main/resources/static/js/theme.js

-/*!
-* Using parts of Bootstrap 2:
-* Bootstrap.js by @fat & @mdo
-* Copyright 2013 Twitter, Inc.
-* http://www.apache.org/licenses/LICENSE-2.0.txt
-*/
-
-!function(t){"use strict";var e=function(e,i){this.$element=t(e),this.options=i,this.options.slide&&this.slide(this.options.slide),"hover"==this.options.pause&&this.$element.on("mouseenter",t.proxy(this.pause,this)).on("mouseleave",t.proxy(this.cycle,this))};e.prototype={cycle:function(e){return e||(this.paused=!1),this.options.interval&&!this.paused&&(this.interval=setInterval(t.proxy(this.next,this),this.options.interval)),this},to:function(e){var i=this.$element.find(".active"),s=i.parent().children(),n=s.index(i),a=this;if(!(e>s.length-1||e<0))return this.sliding?this.$element.one("slid",function(){a.to(e)}):n==e?this.pause().cycle():this.slide(e>n?"next":"prev",t(s[e]))},pause:function(t){return t||(this.paused=!0),clearInterval(this.interval),this.interval=null,this},next:function(){if(!this.sliding)return this.slide("next")},prev:function(){if(!this.sliding)return this.slide("prev")},slide:function(e,i){var s=this.$element.find(".active"),n=i||s[e](),a=this.interval,r="next"==e?"left":"right",l="next"==e?"first":"last",o=this,h=t.Event("slide");if(this.sliding=!0,a&&this.pause(),n=n.length?n:this.$element.find(".item")[l](),!n.hasClass("active")){if(t.support.transition&&this.$element.hasClass("slide")){if(this.$element.trigger(h),h.isDefaultPrevented())return;n.addClass(e),n[0].offsetWidth,s.addClass(r),n.addClass(r),this.$element.one(t.support.transition.end,function(){n.removeClass([e,r].join(" ")).addClass("active"),s.removeClass(["active",r].join(" ")),o.sliding=!1,setTimeout(function(){o.$element.trigger("slid")},0)})}else{if(this.$element.trigger(h),h.isDefaultPrevented())return;s.removeClass("active"),n.addClass("active"),this.sliding=!1,this.$element.trigger("slid")}return a&&this.cycle(),this}}},t.fn.carousel=function(i){return this.each(function(){var s=t(this),n=s.data("carousel"),a=t.extend({},t.fn.carousel.defaults,"object"==typeof i&&i);n||s.data("carousel",n=new e(this,a)),"number"==typeof i?n.to(i):"string"==typeof i||(i=a.slide)?n[i]():a.interval&&n.cycle()})},t.fn.carousel.defaults={interval:5e3,pause:"hover"},t.fn.carousel.Constructor=e,t(function(){t("body").on("click.carousel.data-api","[data-slide]",function(e){var i,s=t(this),n=t(s.attr("data-target")||(i=s.attr("href"))&&i.replace(/.*(?=#[^\s]+$)/,"")),a=!n.data("modal")&&t.extend({},n.data(),s.data());n.carousel(a),e.preventDefault()})})}(window.jQuery);
-!function(t){"use strict";function e(){var e=this,i=setTimeout(function(){e.$element.off(t.support.transition.end),s.call(e)},500);this.$element.one(t.support.transition.end,function(){clearTimeout(i),s.call(e)})}function s(t){this.$element.hide().trigger("hidden"),i.call(this)}function i(e){var s=this.$element.hasClass("fade")?"fade":"";if(this.isShown&&this.options.backdrop){var i=t.support.transition&&s;this.$backdrop=t('<div class="modal-backdrop '+s+'" />').appendTo(document.body),"static"!=this.options.backdrop&&this.$backdrop.click(t.proxy(this.hide,this)),i&&this.$backdrop[0].offsetWidth,this.$backdrop.addClass("in"),i?this.$backdrop.one(t.support.transition.end,e):e()}else!this.isShown&&this.$backdrop?(this.$backdrop.removeClass("in"),t.support.transition&&this.$element.hasClass("fade")?this.$backdrop.one(t.support.transition.end,t.proxy(o,this)):o.call(this)):e&&e()}function o(){this.$backdrop.remove(),this.$backdrop=null}function n(){var e=this;this.isShown&&this.options.keyboard?t(document).on("keyup.dismiss.modal",function(t){27==t.which&&e.hide()}):this.isShown||t(document).off("keyup.dismiss.modal")}var a=function(e,s){this.options=s,this.$element=t(e).delegate('[data-dismiss="modal"]',"click.dismiss.modal",t.proxy(this.hide,this))};a.prototype={constructor:a,toggle:function(){return this[this.isShown?"hide":"show"]()},show:function(){var e=this,s=t.Event("show");this.$element.trigger(s),this.isShown||s.isDefaultPrevented()||(t("body").addClass("modal-open"),this.isShown=!0,n.call(this),i.call(this,function(){var s=t.support.transition&&e.$element.hasClass("fade");e.$element.parent().length||e.$element.appendTo(document.body),e.$element.show(),s&&e.$element[0].offsetWidth,e.$element.addClass("in"),s?e.$element.one(t.support.transition.end,function(){e.$element.trigger("shown")}):e.$element.trigger("shown")}))},hide:function(i){i&&i.preventDefault();i=t.Event("hide"),this.$element.trigger(i),this.isShown&&!i.isDefaultPrevented()&&(this.isShown=!1,t("body").removeClass("modal-open"),n.call(this),this.$element.removeClass("in"),t.support.transition&&this.$element.hasClass("fade")?e.call(this):s.call(this))}},t.fn.modal=function(e){return this.each(function(){var s=t(this),i=s.data("modal"),o=t.extend({},t.fn.modal.defaults,s.data(),"object"==typeof e&&e);i||s.data("modal",i=new a(this,o)),"string"==typeof e?i[e]():o.show&&i.show()})},t.fn.modal.defaults={backdrop:!0,keyboard:!0,show:!0},t.fn.modal.Constructor=a,t(function(){t("body").on("click.modal.data-api",'[data-toggle="modal"]',function(e){var s,i=t(this),o=t(i.attr("data-target")||(s=i.attr("href"))&&s.replace(/.*(?=#[^\s]+$)/,"")),n=o.data("modal")?"toggle":t.extend({},o.data(),i.data());e.preventDefault(),o.modal(n)})})}(window.jQuery);
-!function(n){n(function(){"use strict";n.support.transition=function(){var n=function(){var n,i=document.createElement("bootstrap"),t={WebkitTransition:"webkitTransitionEnd",MozTransition:"transitionend",OTransition:"oTransitionEnd",msTransition:"MSTransitionEnd",transition:"transitionend"};for(n in t)if(void 0!==i.style[n])return t[n]}();return n&&{end:n}}()})}(window.jQuery);
-jQuery.fn.extend({renumberInputs:function(){return this.each(function(n){$(this).find(":input").each(function(){this.name=this.name.replace(/\[\d+\]/,"["+n+"]")})})}});
-$.fx.speeds._default=300,$(function(){$(".tg.dropdown_menu a").attr("tabindex",-1),$(".tg.dropdown_toggle").click(function(){var t=$(this).siblings(".tg.dropdown_menu");return $(".tg.dropdown_menu").not(t).removeClass("-open"),t.toggleClass("-open").find("input:eq(0)").focus(),t.find("a").attr("tabindex",t.hasClass("-open")?"":-1),!1}),$(".tg.nav, .tg.topbox, .tg.dropdown_menu").click(function(t){t.stopPropagation()}),$(".tg.topbox_toggle-nav").click(function(){$(".tg.site").toggleClass("-reveal-off-canvas")}),$("body").click(function(){$(".tg.dropdown_menu").removeClass("-open").find("a").attr("tabindex",-1),$(".tg.site").removeClass("-reveal-off-canvas")}),document.implementation.hasFeature("http://www.w3.org/TR/SVG11/feature#Image","1.1")||$('img[src$="svg"]').attr("src",function(){return $(this).attr("src").replace(".svg",".png")});var t=$(".tgrep.sidebar");$(".tgrep.sidebar-toggle_button").click(function(){$(this).siblings().addBack().toggle(),$(this).hasClass("-show")?t.slideDown():t.slideUp({done:function(){t.css("display","")}})}),$(".tgrep.sidebar_expand").click(function(){$(this).hide().siblings(".tgrep.sidebar_list").children(":hidden").show()});var e=$(".tgrep.header_button").filter(".-expand-all, .-collapse-all");e.click(function(){e.toggle(),$(this).hasClass("-expand-all")?$(".tgrep.metadata_button.-show:visible").click():$(".tgrep.metadata_button.-hide:visible").click()}),$(".tgrep.metadata_button").click(function(){$(this).siblings(".tgrep.metadata_button").addBack().toggle(),$(this).siblings(".tgrep.metadata_toggle").slideToggle()}),$(".tgrep.advanced-search_button.-toggle").click(function(){$(this).toggleClass("-open"),$("#"+$(this).data("target")).slideToggle()}),$(".tgrep.advanced-search_button.-select").click(function(){checked=$(this).hasClass("-all"),$("#"+$(this).data("target")).find(":checkbox").prop("checked",checked)}),$(".tgrep.advanced-search_button.-item").click(function(){var t=$(this).closest(".tgrep.advanced-search_grow-group");$(this).hasClass("-add")?($template=$(this).closest(".tgrep.advanced-search_grow-item"),$clone=$template.clone(!0),$clone.find(":input").val(""),$clone.find("select").each(function(){$(this).val($(this).find("option:first").val())}),$clone.insertAfter($template)):$(this).closest(".tgrep.advanced-search_grow-item").remove();var e=t.find(".tgrep.advanced-search_grow-item");t.find(".tgrep.advanced-search_button.-item.-remove").prop("disabled",e.length<2)});var a=$('<i class="eye -trigger">');$(".tg.header_logo a").append(a),a.click(function(){var t=$('<i class="eye -left">'),e=$('<i class="eye -right">');return $(this).after(t,e).remove(),$(window).mousemove(function(a){t.css("transform","rotate("+(Math.atan((a.pageY-t.offset().top-12)/(a.pageX-t.offset().left-12))+(a.pageX<=t.offset().left+12?4.19:1.05))+"rad)"),e.css("transform","rotate("+(Math.atan((a.pageY-e.offset().top-12)/(a.pageX-e.offset().left-12))+(a.pageX<=e.offset().left+12?4.19:1.05))+"rad)")}),!1})});
\ No newline at end of file
+// Set default animation duration to 300 ms
+$.fx.speeds._default = 300
+
+$( function() {
+
+	// Drowdown handlers
+	$('.tg.dropdown_menu a').attr('tabindex', -1)
+	$('.tg.dropdown_toggle').click( function() {
+		var $dropdown = $(this).siblings('.tg.dropdown_menu')
+		$('.tg.dropdown_menu').not($dropdown).removeClass('-open')
+		$dropdown.toggleClass('-open').find('input:eq(0)').focus()
+		$dropdown.find('a').attr('tabindex', ( $dropdown.hasClass('-open') ? '' : -1 ))
+		return false
+	})
+
+	$('.tg.nav, .tg.topbox, .tg.dropdown_menu').click( function(e) {
+		e.stopPropagation()
+	})
+
+	$('.tg.topbox_toggle-nav').click( function() {
+		$('.tg.site').toggleClass('-reveal-off-canvas')
+	})
+
+	$('body').click( function() {
+		$('.tg.dropdown_menu').removeClass('-open').find('a').attr('tabindex', -1)
+		$('.tg.site').removeClass('-reveal-off-canvas')
+	})
+
+	// SVG fallback for older browsers
+	if ( ! document.implementation.hasFeature('http://www.w3.org/TR/SVG11/feature#Image', '1.1') ) {
+		$('img[src$="svg"]').attr('src', function() {
+			return $(this).attr('src').replace('.svg', '.png')
+		})
+	}
+
+	// TextGridRep handlers
+	// TODO: Move to another file
+
+	var $sidebar = $('.tgrep.sidebar')
+	$('.tgrep.sidebar-toggle_button').click( function() {
+		$(this).siblings().addBack().toggle()
+		if ( $(this).hasClass('-show') ) {
+			$sidebar.slideDown()
+		} else {
+			$sidebar.slideUp({
+				done: function() {
+					// Remove inline style to prevent sidebar from
+					// being hidden when viewport width increases
+					$sidebar.css('display', '')
+				}
+			})
+		}
+	})
+
+	$('.tgrep.sidebar_expand').click( function() {
+		$(this)
+			.hide()
+			.siblings('.tgrep.sidebar_list').children(':hidden').show()
+	})
+
+	var $toggleAllButtons = $('.tgrep.header_button').filter('.-expand-all, .-collapse-all')
+	$toggleAllButtons.click( function() {
+		$toggleAllButtons.toggle()
+		if ( $(this).hasClass('-expand-all') ) {
+			$('.tgrep.metadata_button.-show:visible').click()
+		} else {
+			$('.tgrep.metadata_button.-hide:visible').click()
+		}
+	})
+
+	$('.tgrep.metadata_button').click( function() {
+		$(this).siblings('.tgrep.metadata_button').addBack().toggle()
+		$(this).siblings('.tgrep.metadata_toggle').slideToggle()
+	})
+
+	$('.tgrep.advanced-search_button.-toggle').click( function() {
+		$(this).toggleClass('-open')
+		$( '#' + $(this).data('target') ).slideToggle()
+	})
+
+	$('.tgrep.advanced-search_button.-select').click( function() {
+		checked = $(this).hasClass('-all')
+		$( '#' + $(this).data('target') ).find(':checkbox').prop('checked', checked)
+	})
+
+	// Add or remove metadata search fields
+	$('.tgrep.advanced-search_button.-item').click( function() {
+		var $container = $(this).closest('.tgrep.advanced-search_grow-group')
+		if ( $(this).hasClass('-add') ) {
+			$template = $(this).closest('.tgrep.advanced-search_grow-item')
+			$clone = $template.clone(true)
+			$clone.find(':input').val('')
+			$clone.find('select').each( function() {
+				$(this).val( $(this).find('option:first').val() )
+			})
+			$clone.insertAfter($template)
+		} else {
+			$(this).closest('.tgrep.advanced-search_grow-item').remove()
+		}
+		var $items = $container.find('.tgrep.advanced-search_grow-item')
+		$container.find('.tgrep.advanced-search_button.-item.-remove').prop('disabled', ($items.length < 2))
+	})
+
+	// :)
+	var $eyeTrigger = $('<i class="eye -trigger">')
+	$('.tg.header_logo a').append($eyeTrigger)
+	$eyeTrigger.click( function() {
+		var $eyeLeft = $('<i class="eye -left">'),
+			$eyeRight = $('<i class="eye -right">')
+		$(this).after($eyeLeft, $eyeRight).remove()
+		$(window).mousemove( function(e) {
+			$eyeLeft.css('transform', 'rotate(' + ( Math.atan((e.pageY - $eyeLeft.offset().top - 12) / (e.pageX - $eyeLeft.offset().left - 12)) + (e.pageX <= $eyeLeft.offset().left + 12 ? 4.19 : 1.05) ) + 'rad)')
+			$eyeRight.css('transform', 'rotate(' + ( Math.atan((e.pageY - $eyeRight.offset().top - 12) / (e.pageX - $eyeRight.offset().left - 12)) + (e.pageX <= $eyeRight.offset().left + 12 ? 4.19 : 1.05) ) + 'rad)')
+		})
+		return false
+	})
+
+})
+
+
+/* for the basket */
+
+/* retrieve number of basket items on page load to set number display */
+document.addEventListener("DOMContentLoaded", event => {
+ fetch("/service/shelf/count")
+   .then(response => response.text())
+   .then(cnt => setBasketCount(cnt));
+});
+/* show number of items in basket */
+function setBasketCount(num) {
+  document.querySelectorAll('.topbox_shelf-count').forEach( elem => {
+    elem.textContent = num;
+  })
+}
+
+/* the javascript for the shelf buttons, needed on browse and search-result and shelf pages */
+document.addEventListener("DOMContentLoaded", function(event) {
+
+	const removeLabel = document.querySelector('#i18n-remove-from-shelf-label').dataset.value;
+	const addLabel = document.querySelector('#i18n-add-to-shelf-label').dataset.value;
+
+	/* the buttons */
+	$(document).on('click', '.-add-to-shelf', function(e) {
+		var $this = $(this);
+		$.ajax({
+				url: "/service/shelf/add" ,
+				type: 'POST',
+				dataType:'json',
+				data: {
+					uri: $this.attr('data-textgrid-targeturi')
+				},
+				success: function(data) {
+					$this.removeClass('-add-to-shelf');
+					$this.addClass('-remove-from-shelf');
+					$this.html(removeLabel);
+					setBasketCount(data);
+				}
+			 });
+	});
+
+	$(document).on('click', '.-remove-from-shelf', function(e) {
+		var $this = $(this);
+		$.ajax({
+				url: "/service/shelf/remove" ,
+				type: 'POST',
+				dataType:'json',
+				data: {
+					uri: $this.attr('data-textgrid-targeturi')
+				},
+				success: function(data) {
+					$this.removeClass('-remove-from-shelf');
+					$this.addClass('-add-to-shelf');
+					$this.html(addLabel);
+					setBasketCount(data);
+				}
+		});
+	});
+ });
+
+
+/* the browse.jsp has an iframe when showing html directly loaded from tgcrud */
+document.addEventListener("DOMContentLoaded", function(event) {
+	$("#htmlIframe").contents().find("body").attr("style","margin-left: 0");
+});
+
+/* add/remove filters in search jsp */
+document.addEventListener("DOMContentLoaded", function(event) {
+
+  var filters = [];
+  // get the filters from the left sidebar to append them to the search form
+  document.querySelectorAll('.tgrep.sidebar_item.-filter').forEach( elem => {
+	  filters.push(elem.dataset.filter);
+  });
+
+  function addFiltersToSearchForm(filters) {
+    filters.forEach(function(filter) {
+      $('form.search').append($('<input type="hidden" class="hiddenFilterInput" name="filter" value="'+filter+'" />'));
+    });
+  }
+
+  function removeFiltersFromSearchForm() {
+    $('.hiddenFilterInput').remove();
+  }
+
+  addFiltersToSearchForm(filters);
+
+  //$('form.search').append($('<input type="hidden" name="order" value="${order}" />'));
+  //$('form.search').append($('<input type="hidden" name="limit" value="${limit}" />'));
+
+  $('#search-filters-active').change(function() {
+    if($('#search-filters-active').is(':checked')){
+      addFiltersToSearchForm(filters);
+    } else {
+      removeFiltersFromSearchForm();
+    }
+  });
+
+});
+
+

src/main/webapp/WEB-INF/jsp/base/foot.jsp

@@ -40,20 +40,6 @@
   <script src="/js/jquery.min.js"></script>
   <script src="/js/theme.js"></script>
 
-<script type="text/javascript">
-  /* show number of items in basket */
-  document.addEventListener("DOMContentLoaded", event => {
-   fetch("/service/shelf/count")
-     .then(response => response.text())
-     .then(cnt => setBasketCount(cnt));
-  });
-  function setBasketCount(num) {
-    document.querySelectorAll('.topbox_shelf-count').forEach( elem => {
-      elem.textContent = num;
-    })
-  }
-</script>
-
 </div>
 </body>
 </html>

src/main/webapp/WEB-INF/jsp/base/head.jsp

@@ -4,19 +4,15 @@
   <title>TextGrid Repository</title>
   <meta charset="utf-8">
   <link rel="stylesheet" href="/css/custom.css">
-  <style type="text/css">  
-  
-    ul { padding: 0; }
-    dd { margin-left: 0; }
-    dt { font-weight: bold; }
-    dd + dt { margin-top: 13px; }