matthias/mayan-edms
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Escape tag name to avoid XSS, issue #3

Browse Source
This commit is contained in:
Roberto Rosario
2014-06-20 19:04:20 -04:00
parent 30e8cff89b
commit c42fc542d0
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
mayan/apps/tags/widgets.py
View File

@@ -1,3 +1,4 @@
from django.utils.html import escape, strip_tags
from django.utils.safestring import mark_safe
@@ -12,7 +13,7 @@ def get_tags_inline_widget(document):
tags_template.append(u'<div class="tc">')
for tag in document.tags.all():
tags_template.append(u'<ul class="tags"><li style="background: %s;">%s</li></ul>' % (tag.tagproperties_set.get().get_color_code(), tag.name))
tags_template.append(u'<ul class="tags"><li style="background: %s;">%s</li></ul>' % (tag.tagproperties_set.get().get_color_code(), escape(tag.name)))
tags_template.append(u'<div style="clear:both;"></div>')
tags_template.append(u'</div>')
@@ -45,4 +46,4 @@ def single_tag_widget(tag):
def get_single_tag_template(tag):
return '<li style="background: %s">%s</li>' % (tag.tagproperties_set.get().get_color_code(), tag.name.replace(u' ', u'&nbsp;'))
return '<li style="background: %s">%s</li>' % (tag.tagproperties_set.get().get_color_code(), escape(tag.name.replace(u' ', u'&nbsp;')))