matthias/mayan-edms
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Add explicit casting of escaped tag labels to prevent exploit of cross site scripting. Thanks to Lokesh (@lokesh1095) for the report and proposed solutions. Closes GitLab issue #496.

Browse Source 
Signed-off-by: Roberto Rosario <roberto.rosario.gonzalez@gmail.com>
This commit is contained in:
Roberto Rosario
2018-08-17 04:12:00 -04:00
parent fcb209caae
commit 076468a922
2 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
HISTORY.rst
View File

@@ -1,3 +1,9 @@
3.0.3 (2018-08-17)
==================
- Add explicit casting of escaped tag labels to prevent exploit
of cross site scripting. Thanks to Lokesh (@lokesh1095) for
the report and proposed solutions. Closes GitLab issue #496.
3.0.2 (2018-08-16) 3.0.2 (2018-08-16)
================== ==================
- Docker install script: Default to verbose. - Docker install script: Default to verbose.

5
mayan/apps/tags/widgets.py
View File

@@ -3,6 +3,7 @@ from __future__ import absolute_import, unicode_literals
from django import forms from django import forms
from django.apps import apps from django.apps import apps
from django.template.loader import render_to_string from django.template.loader import render_to_string
from django.utils.html import conditional_escape
from django.utils.safestring import mark_safe from django.utils.safestring import mark_safe
from .permissions import permission_tag_view from .permissions import permission_tag_view
@@ -17,8 +18,8 @@ class TagFormWidget(forms.SelectMultiple):
def create_option(self, name, value, label, selected, index, subindex=None, attrs=None): def create_option(self, name, value, label, selected, index, subindex=None, attrs=None):
result = super(TagFormWidget, self).create_option( result = super(TagFormWidget, self).create_option(
name=name, value=value, label=label, selected=selected, name=name, value=value, label='{}'.format(conditional_escape(label)),
index=index, subindex=subindex, attrs=attrs selected=selected, index=index, subindex=subindex, attrs=attrs
) )
result['attrs']['data-color'] = self.queryset.get(pk=value).color result['attrs']['data-color'] = self.queryset.get(pk=value).color