matthias/mayan-edms
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Escape object name to avoid XSS, issue #3

Browse Source
This commit is contained in:
Roberto Rosario
2014-06-29 20:10:39 -04:00
parent 316a79c440
commit 1f7b6cac79
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mayan/apps/history/widgets.py
+2 -1
View File
@@ -1,10 +1,11 @@
from django.utils.html import escape
from django.utils.safestring import mark_safe from django.utils.safestring import mark_safe
def history_entry_object_link(entry): def history_entry_object_link(entry):
return mark_safe(u'<a href="%(url)s">%(label)s</a>' % { return mark_safe(u'<a href="%(url)s">%(label)s</a>' % {
'url': entry.content_object.get_absolute_url() if entry.content_object else u'#', 'url': entry.content_object.get_absolute_url() if entry.content_object else u'#',
'label': unicode(entry.content_object) if entry.content_object else u''} 'label': escape(unicode(entry.content_object)) if entry.content_object else u''}
) )