view roundup/cgi/exceptions.py @ 4903:48d93e98be7b

Security non-standard html content as html Attached html files are not shipped as text/html by default, unless ``allow_html_file`` is specified in the configuration. Unfortunately some browsers want to be helpful and render other non-standard content types as html. We now change this to application/octet-stream whenever 'html' is contained in the string (case insensitive). Thanks to Kay Hayen for reporting and helping debug this.
author Ralf Schlatterbeck <rsc@runtux.com>
date Fri, 04 Jul 2014 15:43:22 +0200
parents bbab97f8ffb2
children 65fef7858606
line wrap: on
line source

"""Exceptions for use in Roundup's web interface.
"""

__docformat__ = 'restructuredtext'

from roundup.exceptions import LoginError, Unauthorised
import cgi

class HTTPException(Exception):
    pass

class Redirect(HTTPException):
    pass

class NotFound(HTTPException):
    pass

class NotModified(HTTPException):
    pass

class FormError(ValueError):
    """An 'expected' exception occurred during form parsing.

    That is, something we know can go wrong, and don't want to alarm the user
    with.

    We trap this at the user interface level and feed back a nice error to the
    user.

    """
    pass

class SendFile(Exception):
    """Send a file from the database."""

class SendStaticFile(Exception):
    """Send a static file from the instance html directory."""

class SeriousError(Exception):
    """Raised when we can't reasonably display an error message on a
    templated page.

    The exception value will be displayed in the error page, HTML
    escaped.
    """
    def __str__(self):
        return """
<html><head><title>Roundup issue tracker: An error has occurred</title>
 <link rel="stylesheet" type="text/css" href="@@file/style.css">
</head>
<body class="body" marginwidth="0" marginheight="0">
 <p class="error-message">%s</p>
</body></html>
"""%cgi.escape(self.args[0])

# vim: set filetype=python sts=4 sw=4 et si :

Roundup Issue Tracker: http://roundup-tracker.org/