From d581856d7843b01e8688bd15205d17c889d727eb Mon Sep 17 00:00:00 2001
From: Taly <vitalik7tv@yandex.ru>
Date: Wed, 8 Mar 2017 17:46:50 +0400
Subject: [PATCH] Update code block release.1.5.5 (#176)

---
 plugins/code/code.css |  5 +++++
 plugins/code/code.js  | 32 +++++++++++++++++++++++++-------
 2 files changed, 30 insertions(+), 7 deletions(-)

diff --git a/plugins/code/code.css b/plugins/code/code.css
index 7ad089ba..8221b615 100644
--- a/plugins/code/code.css
+++ b/plugins/code/code.css
@@ -1,5 +1,7 @@
 .ce-code {
     display: block;
+    width: 100%;
+    min-height: 100px;
     border: 1px solid #ebeef3;
     border-radius: 3px;
     background: #fdfdff !important;
@@ -13,6 +15,9 @@
     line-height: 1.5em;
     color: #325179;
     font-size: .8em;
+
+    resize: vertical;
+    outline: none;
 }
 
 
diff --git a/plugins/code/code.js b/plugins/code/code.js
index 63d0267d..aaeb72b3 100644
--- a/plugins/code/code.js
+++ b/plugins/code/code.js
@@ -14,17 +14,32 @@ var code = (function(code_plugin) {
      */
     var make_ = function (data) {
 
-        var tag = codex.editor.draw.node('CODE', [baseClass], {});
+        var tag = codex.editor.draw.node('TEXTAREA', [baseClass], {});
 
         if (data && data.text) {
-            tag.innerHTML = data.text;
+            tag.value = data.text;
         }
 
-        tag.contentEditable = true;
-
         return tag;
     };
 
+    /**
+    * Escapes HTML chars
+    *
+    * @param {string} input
+    * @return {string} — escaped string
+    */
+    var escapeHTML_ = function (input) {
+
+        var div  = document.createElement('DIV'),
+            text = document.createTextNode(input);
+
+        div.appendChild(text);
+
+        return div.innerHTML;
+
+    };
+
     /**
      * Method to render HTML block from JSON
      */
@@ -38,9 +53,12 @@ var code = (function(code_plugin) {
      */
     code_plugin.save = function (blockContent) {
 
-        var data = {
-            text : blockContent.innerHTML
-        };
+        var escaped = escapeHTML_(blockContent.value),
+            data = {
+                text : escaped
+            };
+
+
         return data;
 
     };