view roundup/cgi/PageTemplates/PathIterator.py @ 4851:24b8011cd2dc

Fix XSS in issue2550817 Note that the code that triggers that particular bug is no longer in roundup core. But the change to the templates we suggest is a *lot* safer as it always escapes the error and ok messages now. If you are upgrading: you *MUST* read doc/upgrading.txt and do the necessary changes to your templates, the escaping now happens in the template and not in the roundup code. So if you don't make the necessary changes *you are vulnerable*.
author Ralf Schlatterbeck <rsc@runtux.com>
date Fri, 20 Dec 2013 18:24:10 +0100
parents 6e3e4f24c753
children d26921b851c3
line wrap: on
line source

##############################################################################
#
# Copyright (c) 2001 Zope Corporation and Contributors. All Rights Reserved.
#
# This software is subject to the provisions of the Zope Public License,
# Version 2.0 (ZPL).  A copy of the ZPL should accompany this distribution.
# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY AND ALL EXPRESS OR IMPLIED
# WARRANTIES ARE DISCLAIMED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
# WARRANTIES OF TITLE, MERCHANTABILITY, AGAINST INFRINGEMENT, AND FITNESS
# FOR A PARTICULAR PURPOSE
#
##############################################################################

"""Path Iterator

A TALES Iterator with the ability to use first() and last() on
subpaths of elements.
"""

import TALES
from Expressions import restrictedTraverse, Undefs, getSecurityManager

class Iterator(TALES.Iterator):
    def __bobo_traverse__(self, REQUEST, name):
        if name in ('first', 'last'):
            path = REQUEST['TraversalRequestNameStack']
            names = list(path)
            names.reverse()
            path[:] = [tuple(names)]
        return getattr(self, name)

    def same_part(self, name, ob1, ob2):
        if name is None:
            return ob1 == ob2
        if isinstance(name, type('')):
            name = name.split('/')
        name = filter(None, name)
        securityManager = getSecurityManager()
        try:
            ob1 = restrictedTraverse(ob1, name, securityManager)
            ob2 = restrictedTraverse(ob2, name, securityManager)
        except Undefs:
            return 0
        return ob1 == ob2

Roundup Issue Tracker: http://roundup-tracker.org/