Mercurial > p > roundup > code
view website/issues/html/home.classlist.html @ 4851:24b8011cd2dc
Fix XSS in issue2550817
Note that the code that triggers that particular bug is no longer in
roundup core. But the change to the templates we suggest is a *lot*
safer as it always escapes the error and ok messages now.
If you are upgrading: you *MUST* read doc/upgrading.txt and do the
necessary changes to your templates, the escaping now happens in the
template and not in the roundup code. So if you don't make the necessary
changes *you are vulnerable*.
| author | Ralf Schlatterbeck <rsc@runtux.com> |
|---|---|
| date | Fri, 20 Dec 2013 18:24:10 +0100 |
| parents | c2d0d3e9099d |
| children |
line wrap: on
line source
<tal:block metal:use-macro="templates/page/macros/icing"> <title metal:fill-slot="head_title" i18n:translate="">List of classes - <span i18n:name="tracker" tal:replace="config/TRACKER_NAME" /></title> <span metal:fill-slot="body_title" tal:omit-tag="python:1" i18n:translate="">List of classes</span> <td class="content" metal:fill-slot="content"> <table class="classlist"> <tal:block tal:repeat="cl db/classes"> <tr> <th class="header" colspan="2" align="left"> <a tal:attributes="href string:${cl/classname}" tal:content="python:cl.classname.capitalize()">classname</a> </th> </tr> <tr tal:repeat="prop cl/properties"> <th tal:content="prop/_name">name</th> <td tal:content="prop/_prop">type</td> </tr> </tal:block> </table> </td> </tal:block>
