def post(self):
     initial = "(.*%s.*)" % (self.get_argument('search_string'))
     for match in SEARCH.find({"search": { '$regex': initial}}):
         response = """
         <li class="list-group-item"><a onClick="a_onClick(\'%s\')">%s</a></li>
         """ % (esc.xhtml_escape(match["search"]), esc.xhtml_escape(match["search"]))
         self.write(response)

    def test_get_ag_details(self):
        self.mock_login_admin()

        # test if AGP data are rendered correctly
        barcode = '000029153'
        response = self.get('/barcode_util/', {'barcode': barcode})
        self.assertEqual(response.code, 200)
        self.assertIn('<h2>%s Details</h2>' % 'American Gut', response.body)
        ag_details = db.getAGBarcodeDetails(barcode)
        self.assertIn('<tr><td>Sample Date</td><td>%s</td></tr>'
                      % ag_details['sample_date'], response.body)
        self.assertIn('<tr><td>Sample Time</td><td>%s</td></tr>'
                      % ag_details['sample_time'], response.body)
        self.assertIn('<tr><td>Sample Site</td><td>%s</td></tr>'
                      % ag_details['site_sampled'], response.body)

        self.assertIn('<label for="moldy"> moldy (current: %s) </label> <br />'
                      % ag_details['moldy'], response.body)
        self.assertIn(('<label for="overloaded"> overloaded (current: %s) '
                       '</label> <br />') % ag_details['overloaded'],
                      response.body)
        self.assertIn(('<label for="other"> other (current: %s) '
                       '</label> <br />') % ag_details['other'], response.body)

        self.assertIn(('<textarea name="other_text" onclick="this.select()'
                       '">%s</textarea>') %
                      xhtml_escape(ag_details['other_text']),
                      response.body)
        self.assertIn(('<label for="send_mail" style="display:block;">send kit'
                       ' owner %s (%s) an email </label>')
                      % (xhtml_escape(ag_details['name']),
                         xhtml_escape(ag_details['email'])),
                      response.body)

	def post_argv(self, post= None):
		if post:			# title
			if 'title_seo' in post['post']:
				title_seo 		= escape.xhtml_escape(post['post']['title_seo'])
			else:
				title_seo 	= ''

			if 'title' in post['post']:
				title 		= escape.xhtml_escape("%s (%s)" % (post['post']['title'], post['post']['year']))
			else:
				title 		= ""

			# poster
			if 'poster' in post['post']:
				poster 		= escape.xhtml_escape(post['post']['poster'])
			else:
				poster 		= ""

			###
			argv 	= {
				"id" 				: str(post['_id']),
				"title"				: title,
				"subtitle"			: escape.xhtml_escape(post['post']['subtitle']),
				"poster" 			: poster,
				"link" 				: "%s/%s/%s/%s.html" % (self.site.domain_root, self.module['setting']['server']['page_view'], post['_id'], title_seo),
			}
		else:
			argv 	= {
				"id" 				: '{{ id }}',
				"title"				: '{{ title }}',
				"subtitle"			: '{{ subtitle }}',
				"poster" 			: '{{ poster }}',
				"link"				: '{{ link }}'
			}
		return argv

 def get(self, note_id):
     template_values = {}
     if len(note_id) < 8:
         raise tornado.web.HTTPError(404)
     note_id = decode(note_id)
     notes = self.db.query(
             "select title,note,rev_num,rev_user_name as name,rev_user_domain as domain"
             ", revdate from fd_NoteHistory where note_id = %s and rev_status = 0"
             " order by rev_num desc", note_id)
     if not notes:
         raise tornado.web.HTTPError(404)
     for i in range(len(notes)):
         next_note = {}
         if i == len(notes)-1:
             next_note['title'] = ''
             next_note['note'] = ''
         else:
             next_note['title'] = notes[i+1].title
             next_note['note'] = notes[i+1].note
         notes[i].title = textdiff(xhtml_escape(next_note['title']), xhtml_escape(notes[i].title))
         note1 = self.br(linkify(next_note['note'], extra_params="target='_blank' rel='nofollow'"))
         note2 = self.br(linkify(notes[i].note, extra_params="target='_blank' rel='nofollow'"))
         notes[i].note = self.at(textdiff(note1, note2))
         notes[i]['rev'] = 0
         if i == 0:
             notes[i]['rev'] = 1
     template_values['notes'] = notes
     self.render("notehistory.html", template_values=template_values)

 def post(self):
     """Post connection form and try to connect with these credentials
     """
     incorrect = self.get_secure_cookie('incorrect')
     if not incorrect or int(incorrect) < 0:
         incorrect = 0
     elif int(incorrect) >= max_attemps:
         logging.warning('an user is blocked')
         self.clear_cookie('user')
         self.render('blocked.html', blocked_duration=blocked_duration)
         return
     getusername = escape.xhtml_escape(self.get_argument('username'))
     getpassword = escape.xhtml_escape(self.get_argument('password'))
     if login == getusername and password == getpassword:
         logging.info('right credentials')
         self.set_secure_cookie('user', self.get_argument('username'), expires_days=1)
         self.clear_cookie('incorrect')
         self.redirect('/')
     else:
         logging.info('invalid credentials')
         incorrect = int(incorrect) + 1
         self.set_secure_cookie('incorrect', str(incorrect), expires_days=blocked_duration)
         if incorrect >= max_attemps:
             logging.warning('an user is now blocked')
             self.clear_cookie('user')
             self.render('blocked.html', blocked_duration=blocked_duration)
         else:
             self.render('login.html', failed=True)

    def post(self):
        id = self.get_argument("id", None)
        title = xhtml_escape(self.get_argument("title"))
        tep = self.get_argument("info")
        code = xhtml_escape(self.get_argument("code"))
        pswd = self.get_argument("password")

        check = self.get_argument("check", None)
        if check != "1984":
            self.redirect("/newcode")
            return

        info = md.convert(tep)
        password = hexuserpass(pswd)
        slug = "zzzzzzzz"
        self.db.execute(
            "INSERT INTO entries (password,title,slug,code,info,markdown," "published) VALUES (%s,%s,%s,%s,%s,%s,%s)",
            password,
            title,
            slug,
            code,
            info,
            tep,
            datetime.datetime.now(),
        )
        e = self.db.get("SELECT * FROM entries WHERE slug = %s", slug)
        eid = e.id
        slug = eid
        self.db.execute("UPDATE entries SET slug = %s WHERE id = %s", slug, int(eid))
        self.redirect("/" + str(slug))

    def post(self):
        """
        POST the required parameters to register a TestBox env

        * `hostname`
        """
        hostname = xhtml_escape(self.get_argument('hostname'))
        password = xhtml_escape(self.get_argument('password'))
        box_ip = self.request.remote_ip

        try:
            testbox = yield self.testbox_find(
                hostname=hostname,
                password=password
            )
            testbox.hostname = hostname
            testbox.password = password
            testbox.box_ip = box_ip
            testbox.pubkey = self.application.pubkey_content
            testbox.updated_at = datetime.now()
        except ValueError:
            testbox = TestBox(
                hostname=hostname,
                password=password,
                box_ip=box_ip,
                pubkey=self.application.pubkey_content,
                created_at=datetime.now()
            )
        res = yield testbox.save()
        print(res)
        self.set_status(201)
        self.success(res.to_son())

    def _on_auth(self, user):
        if not user:
            self.get_error('/', '10', u'Google auth failed', SITE_NAME)
            return

        author = User().select(['uid', 'username', 'flag']).find_by_email(user["email"])
        if not author:
            if CHECK_REG == 1:
                usermail = xhtml_escape(user["email"].strip())
                username = xhtml_escape(usermail.split('@')[0])
                userid = User().user_new_google(username, usermail, '1')
                self.session['gnauid'] = userid
                self.session['gnaname'] = username
                self.session['gnaflag'] = '1'
                self.session.save()
                self.logaw('reg', u'注册(第一次登录)', '0', '0', '0', '0')
                #记录日志(type,des,aid,cid,nid,puid)
                self.redirect('/settings')
            else:
                self.get_error('/', '10', u'系统禁止注册', SITE_NAME)
        else:
            self.session['gnauid'] = author.uid
            self.session['gnaname'] = author.username
            self.session['gnaflag'] = author.flag
            self.session.save()
            self.logaw('login', u'登录', '0', '0', '0', '0')
            #记录日志(type,des,aid,cid,nid,puid)
            self.redirect(self.get_argument('next', '/'))

    def test_get(self):
        ag_login_id = '0077c686-b0ad-11f8-e050-8a800c5d1877'
        self.mock_login_admin()
        email = db.get_login_info(ag_login_id)[0]['email']
        response = self.get('/ag_edit_participant/', {'email': email})
        self.assertEqual(response.code, 200)

        # check that all relevant user information is rendered on HTML side
        login = db.get_login_by_email(email)
        for key, value in login.items():
            if not isinstance(key, unicode):
                key = key.decode('utf-8')
            if key == 'zip':
                key = u'zipcode'
            elif key == 'ag_login_id':
                continue
            if not isinstance(value, unicode):
                value = value.decode('utf-8')
            key = xhtml_escape(key.encode('utf-8'))
            value = xhtml_escape(value.encode('utf-8'))
            self.assertIn(('</td><td><input type="text" name="%s" id="%s" '
                           'value="%s"></td></tr>') % (key, key, value),
                          response.body)

        # check what happens if user with email does not exist.
        # TODO: we should create a better error message in the handler to be
        # displayed, see issue: #115
        response = self.get('/ag_edit_participant/?email=notInDB')
        self.assertIn('AN ERROR HAS OCCURED!', response.body)
        self.assertEqual(response.code, 500)

        # TODO: similarly if no email, i.e. user, is given. Issue: #115
        response = self.get('/ag_edit_participant/?email=')
        self.assertIn('AN ERROR HAS OCCURED!', response.body)
        self.assertEqual(response.code, 500)

 def tags_link(self):
     tags = self.tags
     if not tags:
         return ''
     links = ['<a href="%s" title="%s" class="tag">%s</a>' % (
         tag.permalink, xhtml_escape(tag.title), xhtml_escape(tag.title)) for tag in tags]
     return ','.join(links)

	def post(self):

		email = xhtml_escape(self.get_argument("email"))
		password = xhtml_escape(self.get_argument("password"))

		pool = ThreadPool(processes=1)
		pool.apply_async(self.__checkLogin, args=(email, password), callback=self.__onfinish)
		pool.close()

 def get_netinfo(self):
     
     addr = xhtml_escape(common.shell('ip addr'))
     routing = xhtml_escape('\n'.join(common.shell('route -n').split("\n")[1:]))
     ifaces = OutputFormatter.highlight(xhtml_escape(common.shell('mii-tool 2> /dev/null')))
     lan = appconfig.get()['net']
     sangoma = common.shell("wanrouter status")
     
     return {'addr': addr, 'routing': routing, 'lan': lan, 'ifaces': ifaces, 'sangoma': sangoma}

 def block_code(self, code, language):
     # Don't forget about escaping
     code = ignore_trailing_newlines(xhtml_escape(code))
     if language:
         language = xhtml_escape(language)
         klass = ' class="language-{0}"'.format(language)
     else:
         klass = ""
     return "<pre><code{0}>{1}</code></pre>\n".format(klass, code)

	def post(self):

		username = xhtml_escape(self.get_argument("username"))
		email = xhtml_escape(self.get_argument("email"))
		password = xhtml_escape(self.get_argument("password"))
		conf_pass = xhtml_escape(self.get_argument("confirmPassword"))

		#Thread incaricato di gesitire la scrittura sul db
		pool = ThreadPool(processes=1)
		pool.apply_async(self.__checkDuplicates, args=(username, email, password), callback=self.__onfinish)
		pool.close()

 def get_scores(self):
   scores = {}
   for socket in self.sockets:
     name = socket.name
     if name in self.game.scores:
       scores[xhtml_escape(name)] = self.game.scores[name]
     else:
       scores[xhtml_escape(name)] = []
   for (name, score) in self.game.scores.items():
     if not xhtml_escape(name) in scores:
       scores[xhtml_escape(name) + " (ABSENT)"] = score
   return scores

    def show_flash(self):
        err = self.get_secure_cookie('e')
        info = self.get_secure_cookie('i')

        s = ''
        if err:
            s += '<div class="error">%s</div>' % (xhtml_escape(err),)
            self.clear_cookie('e')
        if info:
            s += '<div class="info">%s</div>' % (xhtml_escape(info),)
            self.clear_cookie('i')
        return s

    def write_error(self, status_code, **kwargs):
        if hasattr(self, "error_message"):
            if isinstance(self.error_message, BaseException):
                import traceback

                self.write("<html><body><pre>%s</pre></body></html>" %
                           xhtml_escape(''.join(traceback.format_exc())))
            else:
                self.write("<html><body>Error: %s</body></html>" %
                           xhtml_escape(self.error_message))
        else:
            super(HandlerBase, self).write_error(status_code, **kwargs)

    def post(self):
        result = {}
        try:
            tmp_file = self.get_argument("tmp_file")
            result["status"] = os.path.isfile(tmp_file)
            if result["status"]:
                result["message"] = "上传成功"
                self.write(json.dumps(result))
                self.finish()
                file_info = {
        			"nickname" : xhtml_escape(self.get_argument("nickname")),
                    "category" : self.get_argument("category"),
        			"intro"    : xhtml_escape(self.get_argument("intro")),
        			"uploader" : self.get_secure_cookie("username"),
                    "tmp_file" : tmp_file,
                }
                category = self.get_argument("category")
                sub_category = self.get_arguments("sub_category")
                file_info["cid"] = sub_category[-1]
                if category == "common":
                    # 常用分类，需要记录pid
                    file_info["pid"] = sub_category[0]
                if category == "book":
        			# 图书类，需要作者
                    file_info["author"] = self.get_argument("author", "anonymous")
                elif category == "magazine":
        			# 杂志类，需要出版社，刊号
                    file_info["publisher"] = xhtml_escape(
                                        self.get_argument("publisher", "unknown"))
                    file_info["issue"] = xhtml_escape(
                                        self.get_argument("issue", "unknown"))
                file_path = {
                    "static_path" : self.application.settings["static_path"],
                    "temp_path"   : self.application.settings["temp_path"]
                }
                pool = multiprocessing.Pool(processes=8)
                pool.apply_async(Upload, (file_info, file_path))
                pool.close()
                pool.join()
            else:
                result["message"] = "附件已丢失...请联系网站管理员或重新上传"
                self.write(json.dumps(result))
                self.finish()
                return

        except Exception as e:
            print e
            # result["status"] = False
            # result["message"] = e
            self.finish()

    def post(self):
        if self.session['gnaflag'] <> '675':
            raise tornado.web.HTTPError(404)
            return

        node_nName = unicode(xhtml_escape(self.get_argument('nName', '').strip()))
        node_nUrl = clear2nbsp(xhtml_escape(self.get_argument('nUrl', '').strip().lower()))
        node_nDes = unicode(xhtml_escape(self.get_argument('nDes', '').strip()))
        node_nType = xhtml_escape(self.get_argument('nType', 'N'))
        node_subhead = int(self.get_argument('subhead', '0'))
        nid = int(self.get_argument('nid','0'))
        if nid:
            if node_nName and node_nUrl:
                if node_nType == 'N':
                    if not node_subhead:
                        self.get_error('javascript:history.go(-1);','10',u'分类不能为空','toaza.com')
                        return

                Node().node_admin_update(node_nName,node_nUrl,node_nDes,node_nType,node_subhead,nid)
                self.logaw('admin',u'修改节点','0','0',nid,'0') #记录日志(type,des,aid,cid,nid,puid)
                self.get_error('javascript:history.go(-2);','10',u'修改成功','toaza.com')
            else:
                self.get_error('javascript:history.go(-1);','10',u'名字和url不能为空','toaza.com')
                return
        else:
            if node_nName and node_nUrl:
                if node_nType == 'N':
                    if not node_subhead:
                        self.get_error('javascript:history.go(-1);','10',u'分类不能为空','toaza.com')
                        return
                check_node_url = Node().find_by_nType_and_nUrl_and_nName('N',node_nUrl,node_nName)
                if not check_node_url:
                    nodeid = Node().node_admin_new(node_nName,node_nUrl,node_nDes,node_nType,node_subhead)
                    self.logaw('admin',u'添加节点','0','0',nodeid,'0') #记录日志(type,des,aid,cid,nid,puid)
                    if nodeid:
                        if node_nType == 'N':
                            self.get_error('/zzginoa/nodes?op=index&nType=N','10',u'节点添加成功','toaza.com')
                            return
                        else:
                            self.get_error('/zzginoa/nodes?op=index&nType=C','10',u'分类添加成功','toaza.com')
                            return
                    else:
                        self.get_error('javascript:history.go(-1);','10',u'添加出错','toaza.com')
                        return
                else:
                    self.get_error('javascript:history.go(-1);','10',u'节点名称、Url已经存在','toaza.com')
                    return
            else:
                self.get_error('javascript:history.go(-1);','10',u'名字、url不能为空','toaza.com')
                return

 def post(self,id):
     if self.check_login(id):
         id = int(id)
         url = '/detail/' + str(id)
         title = xhtml_escape(self.get_argument('title', ''))
         poster = xhtml_escape(self.get_argument('poster', ''))
         password = xhtml_escape(self.get_argument('password', ''))
         type = xhtml_escape(self.get_argument('syntax', 'other'))
         content = xhtml_escape(self.get_argument('content', ''))
         time = fmt_time()
         Post.modify(id, title, poster, type, content, time, password)
         self.redirect(url) 
     else:
         self.redirect('/detail/' + str(id))