Mercurial > p > roundup > code

annotate website/issues/html/keyword.item.html @ 8357:abf1297e7a94

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
bug(security): fix XSS exploit in devel and responsive templates Replace all occurances of: tal:content="structure context/MUMBLE/plain" with tal:content="context/MUMBLE/plain" This seems to have been an old way to handle display of a field when the user did not have edit rights. It does not occur in current (later than 2009) classic tracker templates. But probably was unsed in earlier classic templates since devel, reponsive and the roundup issue tracker templates were based on classic. Add CVE placeholder to security.txt and link to fix directions added to upgrading.txt. Add note in announcement.txt and CHANGES.txt Add a details element around the table of contents in the upgrading guide. It was getting long. Updated a missed XSS issue in the roundup tracker template. Live site is already fixed. XSS bug reported by 4bug of ChaMd5 Security Team H1 Group
author John Rouillard <rouilj@ieee.org>
date Tue, 08 Jul 2025 13:38:08 -0400
parents eff9c5435acc
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
5283
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
1 <!-- dollarId: keyword.item,v 1.3 2002/05/22 00:32:34 richard Exp dollar-->
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
2 <tal:block metal:use-macro="templates/page/macros/icing">
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
3 <title metal:fill-slot="head_title" i18n:translate="">Keyword editing - <span
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
4 i18n:name="tracker" tal:replace="config/TRACKER_NAME" /></title>
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
5 <span metal:fill-slot="body_title" tal:omit-tag="python:1"
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
6 i18n:translate="">Keyword editing</span>
4024
c2d0d3e9099d svn repository setup
Stefan Seefeld <stefan@users.sourceforge.net>
parents:
diff changeset
7 <td class="content" metal:fill-slot="content">
c2d0d3e9099d svn repository setup
Stefan Seefeld <stefan@users.sourceforge.net>
parents:
diff changeset
8
5283
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
9 <table class="otherinfo" tal:define="keywords db/keyword/list"
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
10 tal:condition="keywords">
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
11 <tr><th colspan="4" class="header" i18n:translate="">Existing Keywords</th></tr>
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
12 <tr tal:repeat="start python:range(0, len(keywords), 4)">
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
13 <td width="25%" tal:define="batch python:utils.Batch(keywords, 4, start)"
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
14 tal:repeat="keyword batch">
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
15 <a tal:attributes="href string:keyword${keyword/id}"
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
16 tal:content="keyword/name">keyword here</a>
4024
c2d0d3e9099d svn repository setup
Stefan Seefeld <stefan@users.sourceforge.net>
parents:
diff changeset
17 </td>
5283
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
18 </tr>
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
19 <tr>
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
20 <td colspan="4" style="border-top: 1px solid gray" i18n:translate="">
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
21 To edit an existing keyword (for spelling or typing errors),
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
22 click on its entry above.
4024
c2d0d3e9099d svn repository setup
Stefan Seefeld <stefan@users.sourceforge.net>
parents:
diff changeset
23 </td>
c2d0d3e9099d svn repository setup
Stefan Seefeld <stefan@users.sourceforge.net>
parents:
diff changeset
24 </tr>
5283
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
25 </table>
4024
c2d0d3e9099d svn repository setup
Stefan Seefeld <stefan@users.sourceforge.net>
parents:
diff changeset
26
5283
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
27 <p class="help" tal:condition="not:context/id" i18n:translate="">
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
28 To create a new keyword, enter it below and click "Submit New Entry".
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
29 </p>
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
30
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
31 <form method="POST" onSubmit="return submit_once()"
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
32 enctype="multipart/form-data"
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
33 tal:attributes="action context/designator">
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
34
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
35 <table class="form">
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
36 <tr>
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
37 <th i18n:translate="">Keyword</th>
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
38 <td tal:content="structure python:context.name.field(size=60)">name</td>
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
39 </tr>
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
40 <tr>
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
41 <th class="required" i18n:translate="">Description:</th>
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
42 <td tal:content="structure python:context.description.field(size=60)">description</td>
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
43 </tr>
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
44 <tr>
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
45 <td tal:condition="not:context/id">
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
46 <tal:comment tal:replace="nothing">
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
47 If we get here and do not have an id, we are creating a new
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
48 keyword. It would be nice to provide some mechanism to
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
49 determine the preferred state of the "Continue adding keywords"
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
50 checkbox. By default I have it enabled.
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
51 </tal:comment>
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
52 <input type="checkbox" id="continue_new_keyword"
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
53 name="__redirect_to"
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
54 tal:attributes="value
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
55 string:${request/base}${request/env/PATH_INFO}?@template=item;
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
56 checked python:True" />
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
57 <label for="continue_new_keyword" i18n:translate="">Continue adding keywords.</label>
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
58 </td>
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
59 </tr>
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
60
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
61 <tr>
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
62 <td>
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
63 &nbsp;
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
64 <input type="hidden" name="@required" value="name">
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
65 <input type="hidden" name="@template" value="item">
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
66 </td>
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
67 <td colspan=3 tal:content="structure context/submit">
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
68 submit button will go here
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
69 </td>
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
70 </tr>
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
71 </table>
4024
c2d0d3e9099d svn repository setup
Stefan Seefeld <stefan@users.sourceforge.net>
parents:
diff changeset
72 </form>
c2d0d3e9099d svn repository setup
Stefan Seefeld <stefan@users.sourceforge.net>
parents:
diff changeset
73 </td>
5283
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
74
eff9c5435acc Upgrading from classic template. Supporting allow multiple add
John Rouillard <rouilj@ieee.org>
parents: 4024
diff changeset
75 </tal:block>
Roundup Issue Tracker: http://roundup-tracker.org/