view roundup/cgi/PageTemplates/MultiMapping.py @ 4851:24b8011cd2dc

Fix XSS in issue2550817 Note that the code that triggers that particular bug is no longer in roundup core. But the change to the templates we suggest is a *lot* safer as it always escapes the error and ok messages now. If you are upgrading: you *MUST* read doc/upgrading.txt and do the necessary changes to your templates, the escaping now happens in the template and not in the roundup code. So if you don't make the necessary changes *you are vulnerable*.
author Ralf Schlatterbeck <rsc@runtux.com>
date Fri, 20 Dec 2013 18:24:10 +0100
parents 81cb4860ca75
children 35ea9b1efc14
line wrap: on
line source

import operator

class MultiMapping:
    def __init__(self, *stores):
        self.stores = list(stores)
    def __getitem__(self, key):
        for store in self.stores:
            if store.has_key(key):
                return store[key]
        raise KeyError, key
    _marker = []
    def get(self, key, default=_marker):
        for store in self.stores:
            if store.has_key(key):
                return store[key]
        if default is self._marker:
            raise KeyError, key
        return default
    def __len__(self):
        return reduce(operator.add, [len(x) for x in self.stores], 0)
    def push(self, store):
        self.stores.append(store)
    def pop(self):
        return self.stores.pop()
    def items(self):
        l = []
        for store in self.stores:
            l = l + store.items()
        return l

Roundup Issue Tracker: http://roundup-tracker.org/