From 6ae9485038c06c831ac3a80130c98de1463ebf4d Mon Sep 17 00:00:00 2001
From: Joseph Schorr <jschorr@gmail.com>
Date: Tue, 14 Jan 2014 15:19:47 -0500
Subject: [PATCH 1/6] Add the command view to the tooltips in the tree, the
 image side bar and the image view page

---
 static/css/quay.css             | 47 +++++++++++++++++++++++++++++++--
 static/js/app.js                |  2 +-
 static/js/controllers.js        | 25 ++++++++++++++++--
 static/js/graphing.js           | 15 ++++++++---
 static/partials/image-view.html |  5 ++++
 static/partials/view-repo.html  |  6 +++++
 templates/base.html             |  1 +
 7 files changed, 93 insertions(+), 8 deletions(-)

diff --git a/static/css/quay.css b/static/css/quay.css
index f9d233e57..bceafd57b 100644
--- a/static/css/quay.css
+++ b/static/css/quay.css
@@ -9,6 +9,16 @@
   }
 }
 
+.codetooltipcontainer .tooltip-inner {
+    white-space:pre;
+    max-width:none;
+}
+
+.codetooltip {
+  font-family: Consolas, "Lucida Console", Monaco, monospace;
+  display: block;
+}
+
 .resource-view-element {
   position: relative;
 }
@@ -1655,6 +1665,18 @@ p.editable:hover i {
   padding-top: 4px;
 }
 
+.repo .formatted-command {
+  margin-top: 4px;
+  padding: 4px;
+  font-size: 12px;
+}
+
+.repo .formatted-command.trimmed {
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
+
 .repo .changes-count-container {
   text-align: center;
 }
@@ -2499,16 +2521,37 @@ p.editable:hover i {
   display: block;
 }
 
-.d3-tip .created {
+.d3-tip .command {
   font-size: 12px;
   color: white;
   display: block;
-  margin-bottom: 6px;
+  font-family: Consolas, "Lucida Console", Monaco, monospace;
+}
+
+.d3-tip .info-line {
+  display: block;
+  margin-top: 6px;
+  padding-top: 6px;
+}
+
+.d3-tip .info-line i {
+  margin-right: 10px;
+  font-size: 14px;
+  color: #888;
 }
 
 .d3-tip .comment {
   display: block;
   font-size: 14px;
+  padding-bottom: 4px;
+  margin-bottom: 10px;
+  border-bottom: 1px dotted #ccc;
+}
+
+.d3-tip .created {
+  font-size: 12px;
+  color: white;
+  display: block;
   margin-bottom: 6px;
 }
 
diff --git a/static/js/app.js b/static/js/app.js
index 0b881200b..e1f6a235f 100644
--- a/static/js/app.js
+++ b/static/js/app.js
@@ -103,7 +103,7 @@ function getMarkedDown(string) {
 }
 
 // Start the application code itself.
-quayApp = angular.module('quay', ['ngRoute', 'chieffancypants.loadingBar', 'restangular', 'angularMoment', 'angulartics', /*'angulartics.google.analytics',*/ 'angulartics.mixpanel', '$strap.directives', 'ngCookies'], function($provide, cfpLoadingBarProvider) {
+quayApp = angular.module('quay', ['ngRoute', 'chieffancypants.loadingBar', 'restangular', 'angularMoment', 'angulartics', /*'angulartics.google.analytics',*/ 'angulartics.mixpanel', '$strap.directives', 'ngCookies', 'ngSanitize'], function($provide, cfpLoadingBarProvider) {
     cfpLoadingBarProvider.includeSpinner = false;
 
     $provide.factory('ApiService', ['Restangular', function(Restangular) {
diff --git a/static/js/controllers.js b/static/js/controllers.js
index 900a12cb8..e159a554b 100644
--- a/static/js/controllers.js
+++ b/static/js/controllers.js
@@ -1,3 +1,14 @@
+function getFormattedCommand(command) {
+  if (!command || !command.length) { return ''; }
+
+  // Handle /bin/sh commands specially.
+  if (command.length > 2 && command[0] == '/bin/sh' && command[1] == '-c') {
+    return command[2];
+  }
+
+  return command.join(' ');
+}
+
 $.fn.clipboardCopy = function() { 
   var clip = new ZeroClipboard($(this),  { 'moviePath': 'static/lib/ZeroClipboard.swf' });  
 
@@ -157,7 +168,7 @@ function LandingCtrl($scope, UserService, ApiService) {
   browserchrome.update();
 }
 
-function RepoCtrl($scope, Restangular, ApiService, $routeParams, $rootScope, $location, $timeout) {
+function RepoCtrl($scope, $sanitize, Restangular, ApiService, $routeParams, $rootScope, $location, $timeout) {
   var namespace = $routeParams.namespace;
   var name = $routeParams.name;
 
@@ -192,6 +203,14 @@ function RepoCtrl($scope, Restangular, ApiService, $routeParams, $rootScope, $lo
 
   // Start scope methods //////////////////////////////////////////
 
+  $scope.getFormattedCommand = getFormattedCommand;
+
+  $scope.getTooltipCommand = function(command) {
+    var formatted = getFormattedCommand(command);
+    var sanitized = $sanitize(formatted);
+    return '<span class=\'codetooltip\'>' + sanitized + '</span>';
+  };
+
   $scope.updateForDescription = function(content) {
     $scope.repo.description = content;
     $scope.repo.put();
@@ -563,7 +582,7 @@ function RepoCtrl($scope, Restangular, ApiService, $routeParams, $rootScope, $lo
 
       // Create the new tree.
       $scope.tree = new ImageHistoryTree(namespace, name, resp.images,
-          getFirstTextLine, $scope.getTimeSince);
+          getFirstTextLine, $scope.getTimeSince, $scope.getFormattedCommand);
 
       $scope.tree.draw('image-history-container');
 
@@ -979,6 +998,8 @@ function ImageViewCtrl($scope, $routeParams, $rootScope, $timeout, ApiService) {
   var name = $routeParams.name;
   var imageid = $routeParams.image;
 
+  $scope.getFormattedCommand = getFormattedCommand;
+
   $scope.parseDate = function(dateString) {
     return Date.parse(dateString);
   };
diff --git a/static/js/graphing.js b/static/js/graphing.js
index bfbb7a099..c9f3ef24b 100644
--- a/static/js/graphing.js
+++ b/static/js/graphing.js
@@ -31,7 +31,7 @@ var DEPTH_WIDTH = 132;
 /**
  * Based off of http://mbostock.github.io/d3/talk/20111018/tree.html by Mike Bostock (@mbostock)
  */
-function ImageHistoryTree(namespace, name, images, formatComment, formatTime) {
+function ImageHistoryTree(namespace, name, images, formatComment, formatTime, formatCommand) {
     /**
      * The namespace of the repo.
      */
@@ -57,6 +57,11 @@ function ImageHistoryTree(namespace, name, images, formatComment, formatTime) {
      */
     this.formatTime_ = formatTime;
 
+    /**
+     * Method to invoke to format the command for an image.
+     */
+    this.formatCommand_ = formatCommand;
+
     /**
      * The current tag (if any).
      */
@@ -187,6 +192,8 @@ ImageHistoryTree.prototype.draw = function(container) {
 
     var formatComment = this.formatComment_;
     var formatTime = this.formatTime_;
+    var formatCommand = this.formatCommand_;
+
     var tip = d3.tip()
         .attr('class', 'd3-tip')
         .offset([-1, 24])
@@ -212,8 +219,10 @@ ImageHistoryTree.prototype.draw = function(container) {
             if (d.image.comment) {
                 html += '<span class="comment">' + formatComment(d.image.comment) + '</span>';
             }
-            html += '<span class="created">' + formatTime(d.image.created) + '</span>';
-            html += '<span class="full-id">' + d.image.id + '</span>';
+            if (d.image.command && d.image.command.length) {
+                html += '<span class="command info-line"><i class="fa fa-terminal"></i>' + formatCommand(d.image.command) + '</span>';
+            }
+            html += '<span class="created info-line"><i class="fa fa-calendar"></i>' + formatTime(d.image.created) + '</span>';           
             return html;
         })
 
diff --git a/static/partials/image-view.html b/static/partials/image-view.html
index 30ecaf5a7..102ac9bb8 100644
--- a/static/partials/image-view.html
+++ b/static/partials/image-view.html
@@ -43,6 +43,11 @@
                 title="The amount of data sent between Docker and Quay.io when pushing/pulling"
                 bs-tooltip="tooltip.title" data-container="body">{{ image.value.size | bytes }}</span>
       </dd>
+
+      <dt ng-show="image.value.command && image.value.command.length">Command</dt>
+      <dd ng-show="image.value.command && image.value.command.length">
+        <pre class="formatted-command">{{ getFormattedCommand(image.value.command) }}</pre>
+      </dd>
     </dl>
 
     <!-- Changes tabs -->
diff --git a/static/partials/view-repo.html b/static/partials/view-repo.html
index 053bd2952..4ad6ec016 100644
--- a/static/partials/view-repo.html
+++ b/static/partials/view-repo.html
@@ -167,6 +167,12 @@ sudo docker push quay.io/{{repo.namespace}}/{{repo.name}}</pre>
                               title="The amount of data sent between Docker and Quay.io when pushing/pulling"
                               bs-tooltip="tooltip.title" data-container="body">{{ currentImage.size | bytes }}</span>
                     </dd>
+                    <dt ng-show="currentImage.command && currentImage.command.length">Command</dt>
+                    <dd ng-show="currentImage.command && currentImage.command.length" class="codetooltipcontainer">
+                      <pre class="formatted-command trimmed"
+                           bs-tooltip="getTooltipCommand(currentImage.command)"
+                           data-placement="top">{{ getFormattedCommand(currentImage.command) }}</pre>
+                    </dd>
                   </dl>
 
                   <!-- Image changes loading -->
diff --git a/templates/base.html b/templates/base.html
index 0f8851206..5729c40bd 100644
--- a/templates/base.html
+++ b/templates/base.html
@@ -42,6 +42,7 @@
 
     <script src="//ajax.googleapis.com/ajax/libs/angularjs/1.2.1/angular.min.js"></script>
     <script src="//ajax.googleapis.com/ajax/libs/angularjs/1.2.1/angular-route.min.js"></script>
+    <script src="//ajax.googleapis.com/ajax/libs/angularjs/1.2.1/angular-sanitize.min.js"></script>
 
     <script src="//cdn.jsdelivr.net/underscorejs/1.5.2/underscore-min.js"></script>
     <script src="//cdn.jsdelivr.net/restangular/1.2.0/restangular.min.js"></script>

From e7e39e6146c622603c482de3aea6c6cee5734ed5 Mon Sep 17 00:00:00 2001
From: Joseph Schorr <jschorr@gmail.com>
Date: Tue, 14 Jan 2014 15:26:31 -0500
Subject: [PATCH 2/6] Make sure we use the sanitized command everywhere we are
 injecting HTML

---
 static/js/controllers.js | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/static/js/controllers.js b/static/js/controllers.js
index e159a554b..caadff1fb 100644
--- a/static/js/controllers.js
+++ b/static/js/controllers.js
@@ -59,7 +59,7 @@ function GuideCtrl($scope) {
 function SecurityCtrl($scope) {
 }
 
-function RepoListCtrl($scope, Restangular, UserService, ApiService) {
+function RepoListCtrl($scope, $sanitize, Restangular, UserService, ApiService) {
   $scope.namespace = null;
   $scope.page = 1;
   $scope.publicPageCount = null;
@@ -562,6 +562,11 @@ function RepoCtrl($scope, $sanitize, Restangular, ApiService, $routeParams, $roo
     });
   };
 
+  var getSanitizedCommand = function(command) {
+    var formatted = getFormattedCommand(command);
+    return $sanitize(formatted);
+  };
+
   var listImages = function() {
     var params = {'repository': namespace + '/' + name};    
     $scope.imageHistory = ApiService.listRepositoryImagesAsResource(params).get(function(resp) {
@@ -582,7 +587,7 @@ function RepoCtrl($scope, $sanitize, Restangular, ApiService, $routeParams, $roo
 
       // Create the new tree.
       $scope.tree = new ImageHistoryTree(namespace, name, resp.images,
-          getFirstTextLine, $scope.getTimeSince, $scope.getFormattedCommand);
+          getFirstTextLine, $scope.getTimeSince, getSanitizedCommand);
 
       $scope.tree.draw('image-history-container');
 

From 63899b8efd63ec1432268c8e752ffeeae70d6e3b Mon Sep 17 00:00:00 2001
From: yackob03 <jacob.moshenko@gmail.com>
Date: Tue, 14 Jan 2014 15:28:24 -0500
Subject: [PATCH 3/6] Add a NOP command in the commands test db as would exist
 in a Dockerfile build.

---
 initdb.py         |   1 +
 test/data/test.db | Bin 116736 -> 116736 bytes
 2 files changed, 1 insertion(+)

diff --git a/initdb.py b/initdb.py
index 88468c022..0ce64c8b5 100644
--- a/initdb.py
+++ b/initdb.py
@@ -21,6 +21,7 @@ SAMPLE_CMDS = [['/bin/bash'],
                 "echo \"PasswordAuthentication no\" >> /etc/ssh/sshd_config"],
                ["/bin/sh", "-c",
                 "sed -i 's/#\\(force_color_prompt\\)/\\1/' /etc/skel/.bashrc"],
+               ["/bin/sh", "-c", "#(nop) EXPOSE [8080]"],
                None]
 
 REFERENCE_DATE = datetime(2013, 6, 23)
diff --git a/test/data/test.db b/test/data/test.db
index e8d38d652f9b2b309f450c91b2b63f519e1b6c82..677baedd3e9e0f5a2ac305abf7971e136fdd93bd 100644
GIT binary patch
delta 4697
zcmbtXdvH|c6~E`+yV<-pPm+*iNeD!iG$eQL?%utdKs5W#K9WtsvbzaF2!TM@yd@8U
z5br8h&=zP$zoAN@f!eAV9Vo01ltE^+RqLa6v|4N1sT$kr==2Y9Mlt>Nac@GC@Q37|
zWbXN$bAIRj<*p<0yN<}8RvT+|O;&@ivCi$#wOC9xwbgA<I~oH4lip=&s@tHo@_xIO
zcY9l!wd?K8ZfzB>H+sE}I!CkLX0G#Z&`k6jeOzC6Z+mZ}al6NEH*~vOdz(C-V14Bd
zYpbuNhi~oacKQQ7djfucpx-q-vc02cn}Ho1n)ueZn)B}R7={MMx;k5{v|fJ$v%@|x
zv~6fK7+l}V4Z74^SHrG7HjT-#txMDC-MYcp(K)bl`$WK0&gnZme7)0e@>n+X`PBY^
zqkXu2xN=Wt!}froy~`Qw4w@|<u5YJ{(*<3&zB}Ar7w?*Q#-!pp>sv<a#(b@Ar>4@Q
z>)O-J@2qbh8nW_(J#ODNKX=ETE`!PCsoP~5ZE1J94X&|zu4`h6nXA>B-0B8LU8C8o
zaTr;P-K+7qovg9NY&F}sCM{oO)>*vn);engXSG{gRjh|M*zC=ghC064+~V?095gFA
zpV8c*9UkZzak#bK!Ch5Do-uRhklxMe8v7g9H};Nfwd;7^F)+ZJn7ZBVo;^MF`mS>y
zn3Z`qUo8E`ftwEE-1Nr7)cDQzO&uf<0D^)fe^63W=4AEkmeG`(=0n<Km`&0TV`Fbl
zl4^Xm`}E$8ZfAgP4y<?b4Q{(e=e1h>?iPE!#?{JiFgSdAr^9D4dp)hJmaTXA4DR|m
zb)#9s25dIH&ED$tnG!T=R#%~BD_GrfmaEqA)ttVP*BMw&dv0d>GF5xC4$gkwxHNOF
zZO)+6u&A8|`vRXolEG@EmH~}Ep<(p`0IXMl3^Fh+Aj8UK=(jS+UszU~#j5ATDDfyj
z&IBmStePi_k~xzA<qOC@O8{@CVV(-6mxH#-fmuK{DTnI$pTl3s;q`*?c^OJ6qKvR$
zaiYYNZ!Au_u{iPn#p6=xqt@lu$>(J)VXjy`FLAOPi|Omcu^c*LeHV33Eg+vGCYMph
zBr!4Sc_p||3jdHN6cPl{mKUBbhhp`QN(f3vu7q@=1b@B$M+nlXgrE@0v?XmxbRl}Y
z8*0(9+aZWf?t|=tm8*OE`pcGE1C5^b*5w-wYJ+;yicJ-om*nBZO^^k&^7}8(hl@5t
zI?&0Jmkfw)gI9BkI{w|nD6k`%un|-(IRKjo+k}zUXM~m{D&p>h3c&te>B0UU+!FKG
zs3Z&MAq~SZdWL60nQ{qR4s;%3`Y`tPcG!=;+zK^0tL!7HC{%DKh%u;8<yJV4zIqlC
zmXL|nYX&etsF8_c0^QaDQ@Lc)u`NAuf}02`opiwnu?Z8bSA_CXXPqMBHkgVgBI>bl
zwJY@3s7F@Kuq-1qrHF=AD0O?>Z$7!=ndLGOCK!`N41r2JVJe^0w?BC`#=AF3l(hj}
zj4nmu8`}Yc=&fN$)i0cTl00UajH>gDAs#~)L4F1^u#V^=@NRen{Ha1?hG<%a8g|B_
zkVo@UNEQC+N-x9e7#8QIHeJLKK<6Ol6s8d9f?y7nb^eGif)YB@L`WMd+Xa`)7A8g|
z?>?BvgmM&8{wk0mh?5ct1|2>CH8Qf|xwWI=Z-S7Pn4CqB)9@<s7a|L-*$po&t5G-C
z#7VJLjL@AeIgPZ*_yFc*AA<dwMVx0}OT0a<9xBM1r2w=Fr4M4|&BM5FFpFD@mbmye
zq9;AW;zrBOloZO5ek8`(QKU5={d5)>>1T?#N>C~?4gU(@c5$KG9)L%}S4SZg=rvVa
zo(s#zB15t6z!Mp0*<Sc#iRO@ES~O9`Xw>n7SqLhPG(jg}!B%t`q2j_>0zhlgi3nqE
zU#!#D$tbzuYX-f20J2ksmI5&`DwMN7-gBi??u#?gYT=q{w2Vf_XmD{I`63n<SB1Xp
z$5w~OAy`CJobG}+uNYkDTPkAPQ1xiM?MoNQ_PUS$@OMc)JTne5x{xNa3GxGYpZFgC
zK@h^uV$q-qy>U;RsElGq+|EcS#i>G|NJJ3m+5wo7QMy58M?|Ph7xpg`g?Kh@L*u{1
z+;{yrJ{yIL@Jd?s#)*i2z9O_zDW$XmDesI0)I`hP|9Cor$jyk=^AJJ42|p(e5o>WJ
zDv|mKxKl%l6_Rg6AB4+`xq~-Tjz?ob8;?SgBBUvq<FoqEoZi2cPOI|FM6uagmeFdM
zP~~z7T#m}`k7qoxXmG)6-roCe%<{GSAu0Jog32Y8#D_!;W~q*Log!3o%NzsK55&8c
zu9z%1ERo7e7e-3OU{pYNp-Xq;M5=xoTez`}AfuLQ9=lJ{NlzDctQ2){<8+{r$X3WX
z3_%&Cd~5IB5;FCnBao1MiXbn-apDx=#pLW^oWew)<&Qq<l5om2rAjo2tGO5XC$Yho
zkHY@NGMnsO{(z*uR1q?+l47kuul@`!M@N}1k=^r?C@lP+33xh*<`U&}_{4F@#yex#
z<k6UgZ;wF<`uZ2}d%Eo8sn?`$MHfy&0-b#QC@Mn5ctm6OP$)-br?IC<MM|mE3x(p=
z&}kW+j?r<9PR|G}m11Nn<o=a3k0lR&zCAu65?pXph}h^nUgB{Uo_rL7CDhuCns=^)
z3w>)uEY4U7nvP`b-e1S>GQUXw7Z_jpde%(r0=E<7zu+oV676`^);<EBbit_=ZR3_m
zN6a~F`_OOjY(?&74xRbh%H51$(}*BUwgfSEV9>*lL9md@yL(Jr9y$Xf^syqa4fQ`B
zZ~DddG&6SPBaxwj2`y1e*{(pgC*o78UfVypHjat~kx!6cz<b0eM85QV5gfeemq5ld
zFjYhs?ml>i;aG;lPY5l;;oH@x7cp&U^OJB{w{YTU<)^QW&T59Txmj93q0uQgH+#mG
z(!JZp<KR$+PC}L=$5Y}I7f(SAou_3_hrfFYlIRpXx>PAiUN^xRp_SE=GJXtIq4cvj
z$NSF54poheUiA+5U)1<8<l?rhlAz^i^MzQJ>q=?u$$ws)C5}VpIEIU~r9li_g=)ev
zTJdS8Qwyv+&{tu|#m!I7kfq>{-J!7Z8A!p`>&{aORQ@cyPV<!`$I-XX!bQ63zTag=
znV=I7LjvB;Yen<X?R+V+AXLvUI?uGy^PVH7f9-j^&o;+;vYgnAS4Kms;53QmRLF8M
zK14b4f-^<m<11zqh0&=QiFE5jFW@UCTk+O`I~hI8=rxR9%jhHZt`)IuXw8f9YAmv3
zWMxf{apAwc2)U47ZF=um+*0f=d>m=GcZrWNzjxDwKC5IF|7X^AIo=N3!rde<Ikj(!
z(d!vK&*&pfZjoviee+Jgj3XF&NqqCl>9WE<$Kjz2vxLQOUi=_?1!LD;5nlrGTV_n(
KgulB2H2puB6#O3m

delta 4415
zcmbuBd2kcg9mn_Wt|S{vmT!E>7Z3}urPc0gcO@rIypoV?OUROZ$c6v`V;kFG8v`~t
z0ka|@7XzeDdDF?HNt-(jZih>0L*hELVMyqNcG5|kqgM_mX$~^eluW`jeJg9%PVC7a
zfqyjk_x=5TpZ7c7+x<s%`;Y2=WfN;%OnYlx(C1ne@raEscO)1QJTz<fw1izuTh!Gc
z@N`>?%gu=qdrONLWms1;vpUq^5rT9;2s+sDL9vx<+$siyu)oPx-?C$X7sA8!zG2$B
zBRt^P#Evv^Yr<=qyZ3}Rad;;)xP$9<Y}~V@of-dHT+Z$3?{4(+T|#sBkhn9l$LSUZ
zc+t8g9O>#DY4$hQ(QDkkJwt=G?M=fT&yLMI#MX^X{CJzIlJiq+lfaBpt)3Bav_9A{
zu(f^7=FTn74sK+tZL7bfiy0ILR@oebyRGiQA)&)L;1@c_pLLnJK4x>cw~1dp$O~N1
z@3RM~w)T$3x<I6}iQdEW9bw)()Y0zfvr;T;rFPbhct?BO<2i1wmS@>DJ}=$Eu+e6w
z)kAw)T`q4R8l{`Uwn)_L^!mNtdUrtdw|M;_mTzedvSCMKw6%?H4mCPjg5!6)O<XS(
z=G%nrJuQK*y469kr(@&lo&CEUeLX$2m$PlNIjmxruVIMq@9q@)xoDuXw@=_tzTq}4
zzV>GEYqwwXAx=)OJwl9K>)g}<Ee3#O!0{hc)U-KOJ#owKv}@+Uy&6Q5`om}%qp50-
zPi%ek*0psZyKhxA%!S)HpS{i}x@bNaTor2Y`h)E@G3apy+wH6Quoz-mMW5dlX>9N}
zdFn#JP=pCI2i)~q#zxyMHrhh7Wi(&S($y?yWdx^<r%!$}Jw?=BYl0IWhw?M$#&$S)
z-U&C7z_-Ak|E2-Up-lrw_#O$CFCajEh0vh^t_5t!c?CSB0R;=&YO`$4IcHQk3Som5
ztjKiCvn61j(SphaY#(SrbEYuQ1>xnwO*%j=VEefaRL}o&{1Y9xSU5JXLTM$02o`Kk
z0({Z;n^V8vobp}snA-Y8blqJ0{HkfcWu8|!&G(zhZ<%LmSU)p&iR8or_Bm#}m=IHy
z!r11u;LI}cPo36;Vc3TJ_;e*GwJmDE2s^$M7_o+Nk*wBBE>e$425ALbjzP=KV1hJ^
zcBRKt)`2WQrd9dU;w9^W5s)QczEc3{4dCV6+z(&gPZ>~167ymNi<bjE=0&l1qvTFe
zV*#=Vp5F#);jvplp9$Aq|Jnx>NAZ+E#j<pUWJbvX$i<KvK(gZ-!9Mu*I#9D1XPxJ#
z655zit12tu-c8^%yfg~xa`2)H|N0+NNDUe#pBV-^zyvJY2Ml?5^^dK&NkR@ID)GhG
zHyDQquQN(Mz2boZaw&YMUrxOl^p)Wi_~HCSR@z3<G!@HDQ*$HAVmKmGzSIeZ;H7S$
zPoNg!h1>jHic>6ek?K(iqg^vNx&(3oZatiSDWQ}isS1J_kfm@^j=R1a#VvgvXiM<Y
z-(9$p5DJtdc?cIqRN*F&g1OKk7*ysAB?3A`5ge0HglD&)G80VIyPs3EouWA^mT6RR
z&;fEG^$3#P+XMRKDj_WS6zd)YH|FNqzsQ!IVup0pqY|d|f+=|E47eeS&<4LgL`h+T
zlGO~q=taGdc{TWo3vX1!zw86)DT}Nau@X<mu3%QgSpu_mg6B#W?|QvINkluTSWdQ@
z0zo16?Fee+F4TJ&rRc_Ucm6}+FUV4*m4Gxu;}DV-4kM{dRYI(=WK1fNd5RV&sVQ@o
z@IS*z!cu}d8{Ic6oS9sNYMw>aOWu6N6@!IiV8TdLm}7rPdNC{&zp@+X0qHm&I3CxH
z%Da*A+grE7;#<L=Eclk)ol1Ns#n_Tv%aBu~VDDiWQp7YHefl7n&=6&h2EKw*2SJ`8
zR#v2*(*nb{p{mQJAX(v5v8>3>h?xpi1*(JvM&(MJ-YbvdD5x(pU;OlySyIMMF=#bf
z3zU>*7~D5Ai|HA(m-xk8Y5bcppds}HHiZ#I;4=DIa-WzBYY%}3^;M;6Rtqe>U0yzA
zWXMA1-!2)h0KWQDpv{OaFHyCKa25RQVMMt44t3TLCRu2hxRUV6Vw{w;saWL$<V|qw
zXUJjs!Q>Wbh^mV(zLOAV$o(SFOcABH75%iK(elp#+Lz2Gg~#qnj;n@9fBb+(g){1<
z{&F=HeBy3paEaozL+ezTUN5aLQ)C!?>mIpD=1;G@rYcg89Rk`#Z({iG!C$a9u^V9K
zA@GV`8of^OGQ$rKslkgbyg#M7<{PEnWr_@~Y!93~fR5XD81!j~C6n(SRF%0IF~?H%
zRA@sw;E24ook!GCsy)a*zT~Rvn04$ZqPq>lp9jO(ZI}gBsSMtD7YM*dj)JqK;gj8a
zRc*N;<}uGEfluA1%-l-7->k|?46)h@RaOZv{79`ZKHYMisw+BkKX@RO%sF#zUHqX3
zK{mS5-~Loo&6i1`@5x;Czst@%47B7@6GjO5dT<jazfJ1DSQ*-#na4;%yYOg|%bY{L
z-<TX*J4@N^l%1pOJQXupRe54DrW1?tn6em_Q>PyLuA9_qQ96MZ<MHHT6kDxDfBlwJ
z@>VH2bR#?gCQ6B=hPC(4YG&?{YK*AHHv>ObjViv<5KCuOA`9I1q_Q;f!<I*uY`ce{
zVtI@zLD1!p+JPFp_bIi(Xjh6g)qUMcDhImQXoUqm8RhV^{m8@nbaGjWh`c{@56n@!
zZHgL$|9u)vm<Te<TagsZVB0aG2JZ!7%#N^^WyA^vl?e@<89sCZW!UnJ%A~w_rDSQt
zA43#JQyfEaEXAQ$Bac^oE8*wQ%nV75DeK6K=Vpach*O}@5#amB!O6t?kxy1%zCa~)
zQmtJPVeqR7w1OnR{lG`@tG@)PWE!ww1dT_~&tU{DCGG&@lIq#yfOJBm3|@75=8>o&
z$qmOQVP+g;8#(ko-0W1squ1n&va4ju=}eC-%1H}26afZpaXG&w{&XB(j)S~KCJcWa
zTm=+niaVYKivel+<c1Gm)33orvhtmu+zyxi2JP9B=H`oud~n|bK%32>7q8-al@OKo
zCO9eYbMU$3*N%qF+psfx*5%k)w8jF4e~6a>A10uKnhi07OAS#8d(X;4g+7C_bY&l{
zyBFQ`q5^G(!t=?GpmI&k)dR0mJWcTo#j_M|rzCH!B1CskIXuG4Q}hD5gEZQgHpBSe
zUjTWaAZOcKcO=~sH!qqI{A0WVging38yKa?DkX>+5an?4JPN{2&5WYXwCmmz6wgz<
zK=Ej7-5y1o_)eLA327@{MBgd88bi_jNntG0t)31Q2z{r>A#2Vl1=2ZQ4TR!X&jFJB
EKR9Wt761SM


From 6f0ea4f5a43ad8412e38f690acbca4fb4dc6af3c Mon Sep 17 00:00:00 2001
From: yackob03 <jacob.moshenko@gmail.com>
Date: Tue, 14 Jan 2014 15:37:49 -0500
Subject: [PATCH 4/6] Reduce the number of nginx worker processes on staging to
 try and save memory.

---
 nginx-staging.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nginx-staging.conf b/nginx-staging.conf
index c6927609e..b29bda2c5 100644
--- a/nginx-staging.conf
+++ b/nginx-staging.conf
@@ -1,4 +1,4 @@
-worker_processes 8;
+worker_processes 2;
 
 user root nogroup;
 pid /mnt/nginx/nginx.pid;

From 7b0cffa69c75cf206c9d6b22e6dd800d0a02539a Mon Sep 17 00:00:00 2001
From: yackob03 <jacob.moshenko@gmail.com>
Date: Tue, 14 Jan 2014 15:47:13 -0500
Subject: [PATCH 5/6] Add an email address in a nop maintainer command as a
 test.

---
 initdb.py         |   4 +++-
 test/data/test.db | Bin 116736 -> 117760 bytes
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/initdb.py b/initdb.py
index 0ce64c8b5..2cd57708f 100644
--- a/initdb.py
+++ b/initdb.py
@@ -16,12 +16,14 @@ store = app.config['STORAGE']
 
 SAMPLE_DIFFS = ['test/data/sample/diffs/diffs%s.json' % i
                 for i in range(1, 10)]
-SAMPLE_CMDS = [['/bin/bash'],
+SAMPLE_CMDS = [["/bin/bash"],
                ["/bin/sh", "-c",
                 "echo \"PasswordAuthentication no\" >> /etc/ssh/sshd_config"],
                ["/bin/sh", "-c",
                 "sed -i 's/#\\(force_color_prompt\\)/\\1/' /etc/skel/.bashrc"],
                ["/bin/sh", "-c", "#(nop) EXPOSE [8080]"],
+               ["/bin/sh", "-c", 
+                "#(nop) MAINTAINER Jake Moshenko <jake@devtable.com>"],
                None]
 
 REFERENCE_DATE = datetime(2013, 6, 23)
diff --git a/test/data/test.db b/test/data/test.db
index 677baedd3e9e0f5a2ac305abf7971e136fdd93bd..bc58279da13f6879374182a44543c36f5ca1ed8e 100644
GIT binary patch
delta 5108
zcmb_f32+nF8Q!<Ml8h}`wq*<7mbnZVYqiquO5(C*S@J2%!iQ|9j$?db%lBE#;Yc|q
z2_%KO%}X07gaBz$Vj2h*A)zE8N1INEB-2bgY11|bI1La=laizzNZ(4@mE5MxI8-xQ
zjo$nI|Ns8${crEwCA;$x*{&=w{EQ~vl3(MjV0E0$R>5v4b(I+mwM;Ed7djkH#zEU$
zPG^O+!ES0OH@LaNDnqTc)SxRbvpLHhRkfC4o2zDOz*5JKj`mm^S!TpCykV%Pro+`=
zYaD0V+g$@=OmDTRP1mUVZnd$Y!)<ozJ2$n~7(FGW8}w8EvMgtY+ZxL3B}_+GL*r2A
zaBsg>t7mOaeRVxYYh8twmY%xadb+yCT3F;^i|iwgUI*7Q<t|*s7B}b(-ECd=p@IIf
zo)KfKsbz!Nqjl+vJ*J9IdSGN=sL;H*)!b2K)_Ddz3_IT8+}tvCvM`6;IKeQR+Xrin
z)t#fG9j4CC8pgqCZLQ;7Ra)9PTvBK5tEnxtRE?B*dK()?$7=`rkj+FZTfnk~E^AS3
zZMnm4XmA%6moZjnz1>=6DmKw(Yh#U_sjI7TmRGT?$y8;w)ipLc%Jr4DYFkBdeSIb8
zn7ZGZ&N}Ms!$Z}s{t`!d%h+g-d!l4?q(M7s9X9qFHrb7(ecTA!=PGX*bq+d9H<xa%
zDsM06j=yWwCX)D7;=plv{YCtilg8aPc+1`#pS^7tF?oySQv#$I0A2--f4ksDhogJ!
zjs;P~Ao1MsczHVk_YVN+B+lF-J=`uq<QDuN$n_lD(&(}q>g%0$li6u5H53`EEG4GG
z5|dl!X3fQ>27R&4>fBK4Dz;b+HSR`Bq0U<A&{eo~jrG+I+CtYmrFtFB<mu=<n$ghg
zYKB|Q=(J`Nt>=#4n0=WjxK;hfF4ZQ>Lt4#xBhA4U5>(7x`I7`JhdK!$;dv6|&D}%j
zRA`cb;<?L6WCeUy0y6(=**<qAAYUd0+PTXClSiaLH+T7CDQK9xg5;CnMj2q{E+3GA
z{5dQB%QEm*>SUy+F`0w~d}DY6fr!5O_JW&lM}6b=B%i#1cG;YLT|{mJ+tSEwo%uhv
zB{$zD=WLt8(o2KJiT|}9+=lNj2C6yHn^^)#GD<}}hM~{!?t$c3;tX+$I6?fJ_!)7S
zcntO55TO|?Lc0S6=+VCpJ$lXP(ZivKM~@!eTKGyXSOk*&v$<e@H0bl+$APWO$dwO%
zUgM8y0ttXzU&1E)Gj9h<Kr)ASG(ox<ypd!yX|GcXq=3XKG5iah1#MU*bnOB8N>!8s
z^D4Y64B6gXK&HXhdqDww_ztigzBvQdrs4FB)>kN&;wU5Kt(3__*c?DEgj7F*KHUO_
zVAg3MRpaK@E*}a&z4=lBh{0_e!E_RyU1BHDo=++f&1JxfRxk}U+kp(e*$Gsw4ohie
z4f@(PXv$hV?HWh_@TT@YPrqhuH~L%9);>1UvazRK+uGl|eo+%nT|CQ$oYG+UEchq(
z38q0l&iQzY<sub8E{6O1c+PFWqruZ-;&K9XX&pt=lur>8rUu9iIL^EGT03%&XIDH=
zcDc;QZwcDH-O&PxX6WvSaC&jd!k0~H0h~|0K(wC+$Sin<w|{#l%EWt3U>%2p)<>5F
zkVeWB@;e11R^jO&3QG~4_V&byw)lKbdXbisn~)bTc7w%fYm}cAP&7l)C>Qa{NP|g`
zdK^J_bODc;6FF?!3)UwoFC|y-LOw;TD3J?ey1`3<B1s_Dy?T$1^12j)<sA5rZg3({
z77{%1%E9;iUwS}nRJ0MpKgAaTCuW?okU2_UQes#iAfRRh90}Q;0Hx_}eZVTBN}DNf
zl}gke@M{o}T{#*mzBD2+{`$_4W8TsP0g3@K2P%gUG<6JkvWTchYGXnunxkkV<x|Fs
z6f)rFW5}gXzXN0&=a+3_Wz(@I!g_<9mV)6Qf~(jEk;$<qi_Bo^B$&=3Vlnf(AxXV~
z^2ry5>F{puJAk+sZ$?GH)3VQ#7I|*+10g8=YQc0fOq&S$sm>x4Glvcc%*~W9HA%FO
ziZBOKcOm;@TY^mxEQf6Qz8?*SMfAErF%sB$jL5;G(2pG@*9;4Gg1vH0T38))ZADi3
zf+AO*KYkIubT3fF`O;HG1Ui56pqo$DiEX?=R0Eofr6;n&;n6dco~68XDS|6GuyT8_
zonqs#9WPBpLj7M)0vVZ*h7mY;AKjPIgdTx$cY|M(G27c-<vFClb3Xx6c;jyHJemLQ
zLq80xsq`oonHeIr3_#|?$;S}2<@bVn4D(EbQGV=tK&{-nC0(H23}^2RWkEuuC*EJd
zBh)kZfj%@RmYkJ{+?4(w-w)&{Hl?2=i;Hsqxd%WDAoZ93uwPtU@bFF`js6hBe*^x4
zeTWsIJQ(>r?2&sXmI`)r;9qwNy-BRjU0NcFCo8?(O9U9|oGy5V&%Wm&;E@nfT}Dbo
zCdK)5iz9>63di}wqy2jkhlgsuVOsw9N6&~R5+2?Kq*2uvej1En)yNZ@+^1PC*ldPJ
zcY&k9vw}a@$hD1<cSPB2g|8?_fO_-ble>k&OP;*cBf>HjzJg^UEEoRj`v}HQJqeLG
zu6{torOo^RQHh?#@KfLvHj9-YHfut0t;!VwmIL?f3B@&?(A{|GP^cEY+g1uTP)xlF
zsN`Gvi@khM;|#>JqM7A!))leBEJg+Al|dt4arS+|?wfZ!W7l89MeR#w_M^Iz6WH7Q
ztb7Cg7?2yw0&Xb1qgug@X1)n$15J1c+2w<qt={_4g^)LlfnpenLDM5OPjCxGxbkqs
zPzxRtnd*b*&|nRWnxK?Vy-F0xg{e=3qMb!(TxGk%$l&Rz!|?NX7AVDZh^8jar`CsM
z0htY{VHBEePm1-14vUPGD;l$)$3%InX~8LUUCD-5?&O2{6mp8cuA~ub^ZqUzEet|i
zbpjfL*Pa5?DMZw!2hWAn`I6Bg7rG{8K-a-w<I3vhc@QXLf4@Z_C<KxbE-|?neg!A6
z&#~OymNdE7&V~70Jp!gPNyC~!4aL$FtEX6gRIp)6=)K~?)8Ndv84_fc_Ucqft+$I2
zj5fo6P6xeItI34D73+A2FV-O1%!9o@MfHyEM)JS~MNN{k(rY)H1?C7@<qT5J-)kf!
zx|4ne<NZLT@THqXNG{a*dG!;ZWC>}${m<9Jp0f<a@>9Sla7F3Of%}f3^lmy5EC@wB
z8NKf4zDODW*GGYbl#`fQ7zk!mSu3FXIq*v|GxMuyxcC%!fn>IR^-O>b-2Nz#s#tyw
ztPxoS=D->LsH=Q_-gAIVxI=R(tXt{bvRd!}b)6Y1c@I{d2+n%7giLv-Cn^9}u|_ej
z_+{|B$Qio_esLOnl!0Atd4=L=iqlgZstr}XNI4H(tiJpOxE`H&QWrw_i%z21k(|A#
zd?mjUY&aW+U&M34ZI}&(g^ly6ibNHG7lYZ?5W8hB3oiz;weI~AisL8_y%;#Gf+Hvu
z=py+#g04Fo>@-<o;-LB*kMyo96kr(aegRCYWXj)G?Vx-K7SU7&G@gz)N>ust>oCds
z!*3JeIB<;r>$3om(Y%WQzkuNv&}-HoafNT8O*EMY|Mp_27?m>YuBA;OuQ(I+Z%}=V
AWB>pF

delta 4564
zcmb_fd2kcw72mhJl58PczKstIjsfA?@@gfmRtB7)!#XV4vW<|B6pXMj82Jviu}N^G
zgbAcc1NDS27lAR1n*`z<E;va^2uUYo!ZgRElQb98PDz}$NoYHrkeL+RZzZi{<@%#k
zf2>B|`@Q#m@BCJ`KOnpPfb76h7<^_~y6L8dYNM~-;dbg<tY(|0+HKT0>zkX+2A8?P
zu|ZeOH`%Lsx3{HHx8C09)>ZNblh^BXI2)U67Dv+t?L@!H$Mtph`g`k5TRnEWvD@9+
z+u-p8YAd!?xB6Oo_|~58nx^KS(dMS6=6=`k$kz6r4kJ4_H1VxzmEOC<V;mY7>*{Q+
z)Onlgm~Hlfp^l+lfx!A!ZqTLSy6Sd}+O%e8N0+wKyJdr^y>npuM3cFkGqij7+L|V_
z$GV}<r)g?-`iK3)6{DSXTbqsku9`r1z+&}qecN4}KH#$T-QxDTc-O>pW);_2+p^0s
z=4*A=Xe&JWuF-COd#!(HsG1+_ar-)&xLZcMjAoa|vBSKp#b4t#y2fg`u8AxQw@znv
zYwDbidW%KtG_h8@SL<=tu%;GEwZ+CY==e&D-s*L?I;!iqYP;1{$$EIB&E9CObMTFp
z7ME{gzon4#nJn$P;ennJr(5S8+)+8?8MAZ_8QiSCzQ2BbeecK?yPoHr0|UI7aqRSa
zMtf=vT{9nADza#5lKkh4qWSOSbr;QW^T2gSGc$Md0c!j@+s6S?0w9<|lK)$B<?-x3
zyE!?DdY&4XNmp#8(9wR7j+6T9q(|B$m|XJzfn4|T-MHhL*~aGeHGG}huGM?1tDD>{
z_FAp0mET}=`V2KrpVi{^w6Z$3*6B04YaN<;i<WJ+*$g&&YmLt=)oNJ1TEnVY{W6wY
zt>ss9h6-M9WVxAZbFWbAuGjvvUu;;ch+5^0dM%6mG`JH_E=ph((nx?tpVFXClwou}
zGD^Unc#Ks_(QhPB^u1$S;z?M)MhX>)$6=QzrJzYX{#*(zi6>Y;8*Pz+KJj=`1~(;~
z%zi0@ck;&<M!KkoGQkg~H=GFhPm7a(TAcKQ;&GvPVe7I4xn@Ca!(!<|v8M97V#!a7
z=>)McuDv4Socb|&M2!Ai0+|WfJG~reIw^yiBJgM6VE<wTb(VU8Iz>HAouH=h^o>#l
z{bnrdyAeNnSK~)Fj~@XYe(Ye-@5<l?$eo=lgQIfjncZiATUXL*?JKg`q>YdPbm6tj
zr)G;bff8u><XIzP+u)7tqV~TvFe%soP1p!(9XS9S3EPB;Hl&2Il2V9ZO0ZN{98{y5
zH^Vvf$wsKkBlGDYEyFPehG#<QvKXce_50xzO7nv=d!>Cu6@~=eQbp8=3YoURG&*`4
z$WYoaNOQ@g)#U>i6|9no7y@V|Que|+WN(K+4w?Mm=AJ0KjRd76T`)py#O!KQLb-|s
zp36I6`p`M>6q2i4p-;k|Sq;OoOt4{*Xj_G@bO`*g>pb#?=axxCSkNRFF$9u!!gL;K
z@IQGa!oN3Jl(hl96rJtE-1u#<2faNFIprkzpmj0~<QZd>Xcs|#4)d^<=pyoQUd4|G
z({?F?^=YC#70?A}Jc#XW-wuNUFIj%UA71TcSUtnytgKUtNSu{y#2mxO<}L_iQyHfY
z_ykn2GgXANq0$|=Kmw^uO1^V{E)&X5i6uyljDbjL6yX|5Nc9VAcFlehfYhXd41%14
zH;9jj41x&SvP6s6X)#iUu+zJCLZFDM(lk~@sj-zzusc%(;=JHE1~Bl^AsolkBan$U
z?T56*nOBp39@PltXDlF7F&ycGhN3JNUoILoFf4AUob(v541GI{W4iVjR2Atg2S1Ag
zg?^=oD+Hw?Q}I``kXqz=1RlXnn;X+tqszO*rlra&H@_f~$;pXf%Fxx(sE_=$drzc^
zK5&G-Y%xL=`o~zLb7aNZyHn=kAgv}^bSpunl4j^6tSJ3u;FL=X;x2&Jp(BGhKiqA&
zZ-j7Ynel4|H5|eVAlQ;0cayy*>ZT;;rTK7)aU*DTj8@NRaYs1wL?|wf3SI8UHiyTB
z;;4^zL6lVl9_(8zV%yM)T|&N3;5$U9OUl}dzyDJVJUc%QGFqNVkRQSa#5E!lExr>j
z(Cmo2Mj)7XXfK?j^@D}&;a^HEPRyPqanoPzh1bJY>ExAf9tmSoLM4T<;MFMgu4oM;
zl;nd;a{?si^gieX8s1uTSo9%9Z{7>Zvk&bD1<<LLp7{iUboQ;gVG+<(@9cgrF1Y#&
zNS1$0P&s5F@i9?_n?Mt7f~plU0%hp(J(1RTNGSDW{(W(M>@joE$Z|0l75d`d1^Y=x
zFV;T3F9EGo1h<ulZ~}e!OPH2Wg>Ub^BLSs2bO5CCV+45y4im=+FXm;3@boK!BdbJW
z1Zq0~Pe~}*)RZehJp=U|1bJ$qN_2$hYd30|#I=6yV07<DD7kmpJ&9_WI-b!PnUHCv
z=mKx;H+~gMezD}vdlNNguTDU6lKeh`{2Hc+`-pXzsV>4aEtFLjHzN%A*;_CH!(m}j
z`604JmQY-hjE;6vsP<>6;%!j|bT9=e1<LYAAs{Sf301IU@?fHWl=2WL6(L!v=t+gn
zKMJSAn~*L&dhEjY;fm8o@g1q4iSNxDp2O%}g}v+0uZ7v*PDJOeL~*)6+%tL|qt`Qf
zj?o*KU`vIVWfi)3TpYgQ`@h&44J(EYI@KaHJbY()>>z(i7``=WRqrOigMH;9whjGz
z3YS3G%PXjS)A_ICz{sWRC&<6T6{sNm!u}<qeNv+n4XDt6rX#$h8Fc!ElATP@rWJ(*
zs(K8ji>TZ?#>Da08<}7qD*|xu6r;<xW2z54zHm1eFk`P?6sh2*$<oBqr$%K@MAx%!
zP5<PYC@R7>k08H<_lZx5Jn>p1f=*ua7Ea8O)7aba3<Qelf}Q(MG91fr_;o?YaQMRN
zGl<wQv++|HJ9ZKRk?r(mCn%TFg`Zv671s)7a&c-v6`=Eij`c}g*%zOJ8*_U*#-rd+
znm&dsL(1vMT3?$)=jzzw7&ALR0}@(6;ax#3C&}-ujFQzcWxTU~i<JfQ^vZX+f1&z^
zAtx=gv@(VWx7bGpOoV$T(qe0u)4HR7ITPoNqvbe;6MD=j#;iiw&qiyxf>z{LZ~HDh
zl4L7E&XdcbDSDU8e)ST_A!+Tc$5I#r%b?2V;B}g>7&(k2&%+tIa^LIeVTS0)!yr`z
z_pA}!wV|(`$J<%Rs)R1|yzdOdGCA=@WmBZ}%7{&P@aq)88ndXWLi{TWR-rUQmVdJ7
z8oq!`B7#8QU_^%GhPU_LDzGwW8H0{7=o$3s8Mw5hwBd35f+!w`vTll{PL2QIeD)$-
z&0B4L|G_9Ea-Clidh0#n5+?JWGT2uwx(av7+4DHrh6~aCw^UYq?6zsfU|<Y9V-Wh+
zy3j!ZntKhy?|&J?g;&->8C_cN$0$6MW{F{O9r25mVET!3k<I2vlC79Ge}l2J^REKX
F{{`mq)vW*k


From edbfe22ea8791c5f90680a2200efbadf4fb7775c Mon Sep 17 00:00:00 2001
From: Joseph Schorr <jschorr@gmail.com>
Date: Tue, 14 Jan 2014 16:01:37 -0500
Subject: [PATCH 6/6] Fix commands that have HTML characters in them

---
 static/js/app.js                | 42 +++++++++++++++++++++++++++++++++
 static/js/controllers.js        | 31 ++++++------------------
 static/js/graphing.js           |  2 +-
 static/partials/image-view.html |  2 +-
 static/partials/view-repo.html  |  4 ++--
 5 files changed, 53 insertions(+), 28 deletions(-)

diff --git a/static/js/app.js b/static/js/app.js
index e1f6a235f..76b05e2df 100644
--- a/static/js/app.js
+++ b/static/js/app.js
@@ -106,6 +106,48 @@ function getMarkedDown(string) {
 quayApp = angular.module('quay', ['ngRoute', 'chieffancypants.loadingBar', 'restangular', 'angularMoment', 'angulartics', /*'angulartics.google.analytics',*/ 'angulartics.mixpanel', '$strap.directives', 'ngCookies', 'ngSanitize'], function($provide, cfpLoadingBarProvider) {
     cfpLoadingBarProvider.includeSpinner = false;
 
+    $provide.factory('UtilService', ['$sanitize', function($sanitize) {
+      var utilService = {};
+
+      utilService.textToSafeHtml = function(text) {
+        var adjusted = text.replace(/&/g, "&amp;")
+         .replace(/</g, "&lt;")
+         .replace(/>/g, "&gt;")
+         .replace(/"/g, "&quot;")
+         .replace(/'/g, "&#039;");
+
+        return $sanitize(adjusted);
+      };
+
+      return utilService;
+    }]);
+
+    $provide.factory('ImageMetadataService', ['UtilService', function(UtilService) {
+      var metadataService = {};
+      metadataService.getFormattedCommand = function(image) {
+        if (!image || !image.command || !image.command.length) {
+          return '';
+        }
+
+        var getCommandStr = function(command) {
+          // Handle /bin/sh commands specially.
+          if (command.length > 2 && command[0] == '/bin/sh' && command[1] == '-c') {
+            return command[2];
+          }
+          
+          return command.join(' ');
+        };
+
+        return getCommandStr(image.command);
+      };
+
+      metadataService.getEscapedFormattedCommand = function(image) {
+        return UtilService.textToSafeHtml(metadataService.getFormattedCommand(image));
+      };
+
+      return metadataService;
+    }]);
+
     $provide.factory('ApiService', ['Restangular', function(Restangular) {
       var apiService = {};
 
diff --git a/static/js/controllers.js b/static/js/controllers.js
index caadff1fb..5112fad6c 100644
--- a/static/js/controllers.js
+++ b/static/js/controllers.js
@@ -1,14 +1,3 @@
-function getFormattedCommand(command) {
-  if (!command || !command.length) { return ''; }
-
-  // Handle /bin/sh commands specially.
-  if (command.length > 2 && command[0] == '/bin/sh' && command[1] == '-c') {
-    return command[2];
-  }
-
-  return command.join(' ');
-}
-
 $.fn.clipboardCopy = function() { 
   var clip = new ZeroClipboard($(this),  { 'moviePath': 'static/lib/ZeroClipboard.swf' });  
 
@@ -168,7 +157,7 @@ function LandingCtrl($scope, UserService, ApiService) {
   browserchrome.update();
 }
 
-function RepoCtrl($scope, $sanitize, Restangular, ApiService, $routeParams, $rootScope, $location, $timeout) {
+function RepoCtrl($scope, $sanitize, Restangular, ImageMetadataService, ApiService, $routeParams, $rootScope, $location, $timeout) {
   var namespace = $routeParams.namespace;
   var name = $routeParams.name;
 
@@ -203,11 +192,10 @@ function RepoCtrl($scope, $sanitize, Restangular, ApiService, $routeParams, $roo
 
   // Start scope methods //////////////////////////////////////////
 
-  $scope.getFormattedCommand = getFormattedCommand;
+  $scope.getFormattedCommand = ImageMetadataService.getFormattedCommand;
 
-  $scope.getTooltipCommand = function(command) {
-    var formatted = getFormattedCommand(command);
-    var sanitized = $sanitize(formatted);
+  $scope.getTooltipCommand = function(image) {
+    var sanitized = ImageMetadataService.getEscapedFormattedCommand(image);
     return '<span class=\'codetooltip\'>' + sanitized + '</span>';
   };
 
@@ -562,11 +550,6 @@ function RepoCtrl($scope, $sanitize, Restangular, ApiService, $routeParams, $roo
     });
   };
 
-  var getSanitizedCommand = function(command) {
-    var formatted = getFormattedCommand(command);
-    return $sanitize(formatted);
-  };
-
   var listImages = function() {
     var params = {'repository': namespace + '/' + name};    
     $scope.imageHistory = ApiService.listRepositoryImagesAsResource(params).get(function(resp) {
@@ -587,7 +570,7 @@ function RepoCtrl($scope, $sanitize, Restangular, ApiService, $routeParams, $roo
 
       // Create the new tree.
       $scope.tree = new ImageHistoryTree(namespace, name, resp.images,
-          getFirstTextLine, $scope.getTimeSince, getSanitizedCommand);
+          getFirstTextLine, $scope.getTimeSince, ImageMetadataService.getEscapedFormattedCommand);
 
       $scope.tree.draw('image-history-container');
 
@@ -998,12 +981,12 @@ function UserAdminCtrl($scope, $timeout, $location, ApiService, PlanService, Use
   };
 }
 
-function ImageViewCtrl($scope, $routeParams, $rootScope, $timeout, ApiService) {  
+function ImageViewCtrl($scope, $routeParams, $rootScope, $timeout, ApiService, ImageMetadataService) {  
   var namespace = $routeParams.namespace;
   var name = $routeParams.name;
   var imageid = $routeParams.image;
 
-  $scope.getFormattedCommand = getFormattedCommand;
+  $scope.getFormattedCommand = ImageMetadataService.getFormattedCommand;
 
   $scope.parseDate = function(dateString) {
     return Date.parse(dateString);
diff --git a/static/js/graphing.js b/static/js/graphing.js
index c9f3ef24b..396228ab0 100644
--- a/static/js/graphing.js
+++ b/static/js/graphing.js
@@ -220,7 +220,7 @@ ImageHistoryTree.prototype.draw = function(container) {
                 html += '<span class="comment">' + formatComment(d.image.comment) + '</span>';
             }
             if (d.image.command && d.image.command.length) {
-                html += '<span class="command info-line"><i class="fa fa-terminal"></i>' + formatCommand(d.image.command) + '</span>';
+                html += '<span class="command info-line"><i class="fa fa-terminal"></i>' + formatCommand(d.image) + '</span>';
             }
             html += '<span class="created info-line"><i class="fa fa-calendar"></i>' + formatTime(d.image.created) + '</span>';           
             return html;
diff --git a/static/partials/image-view.html b/static/partials/image-view.html
index 102ac9bb8..45c9c7a74 100644
--- a/static/partials/image-view.html
+++ b/static/partials/image-view.html
@@ -46,7 +46,7 @@
 
       <dt ng-show="image.value.command && image.value.command.length">Command</dt>
       <dd ng-show="image.value.command && image.value.command.length">
-        <pre class="formatted-command">{{ getFormattedCommand(image.value.command) }}</pre>
+        <pre class="formatted-command">{{ getFormattedCommand(image.value) }}</pre>
       </dd>
     </dl>
 
diff --git a/static/partials/view-repo.html b/static/partials/view-repo.html
index 4ad6ec016..89091258e 100644
--- a/static/partials/view-repo.html
+++ b/static/partials/view-repo.html
@@ -170,8 +170,8 @@ sudo docker push quay.io/{{repo.namespace}}/{{repo.name}}</pre>
                     <dt ng-show="currentImage.command && currentImage.command.length">Command</dt>
                     <dd ng-show="currentImage.command && currentImage.command.length" class="codetooltipcontainer">
                       <pre class="formatted-command trimmed"
-                           bs-tooltip="getTooltipCommand(currentImage.command)"
-                           data-placement="top">{{ getFormattedCommand(currentImage.command) }}</pre>
+                           bs-tooltip="getTooltipCommand(currentImage)"
+                           data-placement="top">{{ getFormattedCommand(currentImage) }}</pre>
                     </dd>
                   </dl>