Mercurial > kallithea
view MANIFEST.in @ 5219:c9cfaeb1cdfe stable
tooltips: fix unsafe insertion of userdata into the DOM as html
This fixes js injection in the admin journal ... and probably also in other places.
Tooltips are used both with hardcoded strings (which is safe and simple) and
with user provided strings wrapped in html formatting (which requires careful
escaping before being put into the DOM as html). The templating will
automatically take care of one level of escaping, but here it requires two
levels to do it correctly ... and that was not always done correctly.
Instead, by default, just insert it into the DOM as text, not as html.
The few places where we know the tooltip contains safe html are handled
specially - the element is given the safe-html-title class. That is the case in
file annotation and in display of tip revision in repo lists.
author | Mads Kiilerich <madski@unity3d.com> |
---|---|
date | Tue, 07 Jul 2015 02:09:35 +0200 |
parents | ff08d3cf9aef |
children | 172b00cb02e6 |
line wrap: on
line source
include Apache-License-2.0.txt include CONTRIBUTORS include COPYING include LICENSE-MERGELY.html include LICENSE.md include MIT-Permissive-License.txt include README.rst include development.ini recursive-include docs * recursive-include init.d * include kallithea/bin/ldap_sync.conf include kallithea/bin/template.ini.mako include kallithea/config/deployment.ini_tmpl recursive-include kallithea/i18n * recursive-include kallithea/lib/dbmigrate *.py_tmpl README migrate.cfg recursive-include kallithea/public * recursive-include kallithea/templates * recursive-include kallithea/tests/fixtures * recursive-include kallithea/tests/scripts * include kallithea/tests/vcs/aconfig include production.ini include test.ini