Mercurial > p > roundup > code
view roundup/exceptions.py @ 4851:24b8011cd2dc
Fix XSS in issue2550817
Note that the code that triggers that particular bug is no longer in
roundup core. But the change to the templates we suggest is a *lot*
safer as it always escapes the error and ok messages now.
If you are upgrading: you *MUST* read doc/upgrading.txt and do the
necessary changes to your templates, the escaping now happens in the
template and not in the roundup code. So if you don't make the necessary
changes *you are vulnerable*.
| author | Ralf Schlatterbeck <rsc@runtux.com> |
|---|---|
| date | Fri, 20 Dec 2013 18:24:10 +0100 |
| parents | bbab97f8ffb2 |
| children | 494d255043c9 |
line wrap: on
line source
"""Exceptions for use across all Roundup components. """ __docformat__ = 'restructuredtext' class LoginError(Exception): pass class Unauthorised(Exception): pass class Reject(Exception): """An auditor may raise this exception when the current create or set operation should be stopped. It is up to the specific interface invoking the create or set to handle this exception sanely. For example: - mailgw will trap and ignore Reject for file attachments and messages - cgi will trap and present the exception in a nice format """ pass class UsageError(ValueError): pass # vim: set filetype=python ts=4 sw=4 et si
