package foodtruck.server.vendor;

import java.io.IOException;

import javax.annotation.Nullable;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import com.google.appengine.api.users.UserService;
import com.google.common.base.Preconditions;
import com.google.common.base.Strings;
import com.google.common.escape.Escaper;
import com.google.common.html.HtmlEscapers;
import com.google.inject.Inject;
import com.google.inject.Provider;
import com.google.inject.Singleton;

import foodtruck.dao.TruckDAO;
import foodtruck.model.Truck;
import foodtruck.server.GuiceHackRequestWrapper;
import foodtruck.util.Session;

/**
 * @author aviolette
 * @since 11/4/13
 */
@Singleton
public class VendorSettingsServlet extends VendorServletSupport {
  private static final String JSP = "/WEB-INF/jsp/vendor/vendorSettings.jsp";

  @Inject
  protected VendorSettingsServlet(TruckDAO dao, Provider<Session> sessionProvider, UserService userService) {
    super(dao, sessionProvider, userService);
  }

  @Override protected void dispatchGet(HttpServletRequest req, HttpServletResponse resp, @Nullable Truck truck)
      throws ServletException, IOException {
    req = new GuiceHackRequestWrapper(req, JSP);
    req.setAttribute("tab", "trucksettings");
    req.getRequestDispatcher(JSP).forward(req, resp);
  }

  @Override protected void dispatchPost(HttpServletRequest req, HttpServletResponse resp, String truckId)
      throws IOException {
    Truck truck = truckDAO.findById(truckId);
    Escaper escaper = HtmlEscapers.htmlEscaper();
    String name = req.getParameter("name"),
        url = req.getParameter("url"),
        phone = req.getParameter("phone"),
        email = req.getParameter("email"),
        description = req.getParameter("description");
    try {
      Preconditions.checkState(!Strings.isNullOrEmpty(name), "Name cannot be unspecified");
      truck = Truck.builder(truck)
          .name(escaper.escape(name))
          .url(url == null ? null : escaper.escape(url))
          .phone(phone == null ? null : escaper.escape(phone))
          .email(email == null ? null : escaper.escape(email))
          .description(description == null ? null : escaper.escape(description)).build();
      truckDAO.save(truck);
      req.setAttribute("flash", "Successfully saved");
    } catch (Exception e) {
      resp.setStatus(400);
      resp.getWriter().println(e.getMessage());
    }
  }
}

@@ -1926,24 +1926,185 @@
 pecified%22);%0A
+      url = url == null ? null : escaper.escape(url);%0A      if (!Strings.isNullOrEmpty(url) && !url.startsWith(%22http%22)) %7B%0A        url = %22http://%22 + url;%0A      %7D%0A
       truck 
@@ -2186,45 +2186,8 @@
 (url
- == null ? null : escaper.escape(url)
 )%0A  

Make sure if HTTP protocol is not specified that we prefix the URL