From 32adc2a9df78254ae4f891b03b3ef92a13953782 Mon Sep 17 00:00:00 2001
From: Daniel Sousa <daniel@sousa.me>
Date: Fri, 31 Mar 2017 11:57:38 +0100
Subject: [PATCH 1/2] Added next day forecast

---
 app/models/weather.rb | 54 ++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 53 insertions(+), 1 deletion(-)

diff --git a/app/models/weather.rb b/app/models/weather.rb
index d41a7ba..bc7c89d 100644
--- a/app/models/weather.rb
+++ b/app/models/weather.rb
@@ -13,7 +13,8 @@ class Weather < DynamicContent
 
   FORECAST = {
     'realtime' => 'Realtime Weather',
-    'forecast' => 'Max and Min temps forecast for the day'
+    'forecast' => 'Max and Min temps forecast for the day',
+    'nextday' => 'Max and Min temps forecast for the next day'
   }
 
   validate :validate_config
@@ -76,6 +77,57 @@ def build_content
                   <h1> #{format_low}</h1>
                 </div>
               "
+    elsif forecast_type == 'nextday'
+       # Next day forecast
+       # Build request url
+       params = {
+          lat: self.config['lat'],
+          lon: self.config['lng'],
+          units: self.config['units'],
+          cnt: 2,
+          mode: 'json',
+          appid: ConcertoConfig['open_weather_map_api_key']
+       }
+
+       url = "http://api.openweathermap.org/data/2.5/forecast/daily?#{params.to_query}"
+
+       # Make request to OpenWeatherMapAPI
+       response = Net::HTTP.get_response(URI.parse(url)).body
+       data = JSON.parse(response)
+
+       # if there was an error, then return nil
+       if data['cod'].present? && !data['cod'].to_s.starts_with?('2')
+         Rails.logger.error("response (#{url}) =  #{response}")
+         return nil
+       end
+
+       # Build HTML using API data
+
+       self.config["location_name"] = data["city"]["name"]
+
+       format_city = data['city']['name']
+       format_iconid = "#{data['list'][0]['weather'][0]['id']}"
+
+       if font_name=='wi'
+          format_icon = "<i style=\'font-size:calc(min(80vh,80vw));' class=\'wi wi-owm-#{format_iconid}\'></i>"
+       else
+          format_icon = "<i class=\'owf owf-#{format_iconid} owf-5x\'></i>"
+       end
+
+       format_high = "#{data['list'][1]['temp']['max'].round(0)} &deg;#{UNITS[params[:units]][0]}"
+       format_low = "#{data['list'][1]['temp']['min'].round(0)} &deg;#{UNITS[params[:units]][0]}"
+       empty_html = "
+                <h1> Tomorrow in #{format_city} </h1>
+                <div style='float: left; width: 50%'>
+                   #{format_icon}
+                </div>
+                <div style='float: left; width: 50%'>
+                  <p> High </p>
+                  <h1> #{format_high} </h1>
+                  <p> Low </p>
+                  <h1> #{format_low}</h1>
+                </div>
+              "
     else
        # We're using realtime weather forecast
        # Build request url

From b691ffe4372ef058dd7620defd43467d30e3612a Mon Sep 17 00:00:00 2001
From: Daniel Sousa <daniel@sousa.me>
Date: Fri, 31 Mar 2017 12:03:54 +0100
Subject: [PATCH 2/2] Removed unsafe eval

---
 app/models/weather.rb | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/app/models/weather.rb b/app/models/weather.rb
index bc7c89d..946fd6a 100644
--- a/app/models/weather.rb
+++ b/app/models/weather.rb
@@ -184,7 +184,13 @@ def build_content
     if format_string.blank?
        rawhtml = empty_html
     else
-       rawhtml = eval("\"" + format_string + "\"")
+       rawhtml = "\"" + format_string + "\""
+       format_string.sub! '#{format_city}' format_city
+       format_string.sub! '#{format_iconid}' format_iconid 
+       format_string.sub! '#{format_icon}' format_icon
+       format_string.sub! '#{format_high}' format_high
+       format_string.sub! '#{format_low}' format_low
+       format_string.sub! '#{format_current}' format_current
     end
 
     # Create HtmlText content