Mercurial > p > roundup > code

view website/issues/html/page.html @ 4880:ca692423e401

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Different approach to fix XSS in issue2550817 Encapsulate the error/ok message append method as add_ok_message and add_error_message. The new approach escapes the messages when appending -- at a point in the code where we still know where the message comes from. Escaping is the default but can bei turned off. This also fixes issue2550836 where certain messages may contain links. Another advantage of the new fix is that users don't need to change installed trackers and are secure by default.
author Ralf Schlatterbeck <rsc@runtux.com>
date Mon, 31 Mar 2014 18:19:23 +0200
parents 22d57206a93b
children d24e156f9069
line wrap: on
line source

<tal:block metal:define-macro="icing">
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title metal:define-slot="head_title">title goes here</title>
<link media="screen" href="http://python.org/styles/defaultfonts.css" type="text/css" rel="alternate stylesheet" title="default fonts" />
<link rel="stylesheet" type="text/css" href="@@file/style.css" />
<meta http-equiv="Content-Type"
 tal:attributes="content string:text/html;; charset=${request/client/charset}" />
<script tal:replace="structure request/base_javascript">
</script>
<metal:x define-slot="more-javascript" />

</head>
<body
tal:define="
kw_create python:request.user.hasPermission('Create', 'keyword');
columns string:id,activity,title,creator,status;
columns_showall string:id,activity,title,creator,assignee,status;
status_notresolved string:-1,1,2,4;
">
  <div class="header">
    <h1><a href="/">Roundup Tracker - Issues</a></h1>
<div id="searchbox">
    <form name="searchform" method="get" action="issue" id="searchform">
      <div id="search">
       <input type="hidden" name="@columns"
              tal:attributes="value columns_showall"/>
       <input type="hidden" name="@sort" value="-activity" />
       <input type="hidden" name="@group" value="priority" />
       <input type="hidden" name="@filter" value="status"/>
       <input type="hidden" name="status" tal:attributes="value status_notresolved"/>
       <input class="input-text" id="search-text" name="@search_text" size="10" />
<input type="submit" id="submit" value="search in open issues" name="submit"
       class="input-button"/>
      </div>
     </form>
</div> <!-- searchbox -->
  </div>
  <div class="navigation">
  <div class="menu">
  <ul>
    <li><a href="http://www.roundup-tracker.org" title="home...">Home</a></li>
    <li><a href="http://pypi.python.org/pypi/roundup" title="Get it !">Download</a></li>
    <li><a href="http://www.roundup-tracker.org/docs.html" title="What you always wanted to know...">Docs</a></li>
    <li class="current"><a href="/" i18n:translate="">Issues</a>
     <ul tal:condition="python:request.user.hasPermission('View', 'issue')">
         <li tal:condition="python:request.user.hasPermission('Create', 'issue')">
          <a href="issue?@template=item" i18n:translate="">Create New</a>
         </li>
         <li><a href="#"
                tal:attributes="href python:request.indexargs_url('issue', {
                                '@sort': '-activity',
                                '@group': 'priority',
                                '@filter': 'status',
                                '@columns': columns_showall,
                                '@search_text': '',
                                'status': status_notresolved,
                                '@dispname': i18n.gettext('Show All'),
                                '@startwith': 0,
                                })"
                i18n:translate="">Show Open</a></li>
         <li><a href="#"
                tal:attributes="href python:request.indexargs_url('issue', {
                                '@sort': '-activity',
                                '@group': 'priority',
                                '@filter': 'status,assignee',
                                '@columns': columns,
                                '@search_text': '',
                                'status': status_notresolved,
                                'assignee': '-1',
                                '@dispname': i18n.gettext('Show Unassigned'),
                                '@startwith': 0,
                                })"
                i18n:translate="">Show Unassigned</a></li>
         <li>
           <a href="issue?@template=search&status=1" i18n:translate="">Search</a>
         </li>
         <li>
           <form method="post" action="#">
             <input type="submit" class="form-small" value="Show issue:"
                    i18n:attributes="value"/>
             <input class="form-small" size="4"
                    type="text" name="@number"/>
             <input type="hidden" name="@type" value="issue"/>
             <input type="hidden" name="@action" value="show"/>
           </form>
         </li>
       </ul>

   <ul>
     <li tal:condition="python:request.user.username=='anonymous'" class="submenu">
      <b i18n:translate="">User</b>
      <form method="post" action="#">
       <ul>
      <li>
       <tal:span i18n:translate="">Login</tal:span><br/>
       <input size="10" name="__login_name"/><br/>
       <input size="10" type="password" name="__login_password"/><br/>
       <input type="hidden" name="@action" value="Login"/>
       <input type="checkbox" name="remember" id="remember"/>
       <label for="remember" i18n:translate="">Remember me?</label><br/>
       <input class="form-small" type="submit" value="Login" i18n:attributes="value"/><br/>
       <input type="hidden" name="__came_from" tal:attributes="value string:${request/env/PATH_INFO}"/>
       <span tal:replace="structure request/indexargs_form" />
       </li>
       <li>
       <a href="user?@template=register"
          tal:condition="python:request.user.hasPermission('Register', 'user')"
          i18n:translate="">Register</a>
	</li>
       <li><a href="user?@template=forgotten" i18n:translate="">Lost&nbsp;your&nbsp;login?</a>
       </li>
       </ul>
      </form>
     </li>

     <li tal:condition="python:request.user.username != 'anonymous'" class="submenu">
   <p class="label"><b tal:replace="request/user/username">username</b></p>
    <ul>
    <li>
    <a href="#"
       tal:attributes="href python:request.indexargs_url('issue', {
      '@sort': '-activity',
      '@group': 'priority',
      '@filter': 'status,assignee',
      '@columns': 'id,activity,title,creator,status',
      '@search_text': '',
      'status': status_notresolved,
      'assignee': request.user.id,
      '@dispname': i18n.gettext('Your Issues'),
      '@startwith': 0,
     })"
    i18n:translate="">Your Issues</a>
    </li>
    <li>
       <a tal:attributes="href string:user${request/user/id}"
          i18n:translate="">Your Details</a>
    </li>
    <li>
       <a tal:attributes="href python:request.indexargs_url('',
          {'@action':'logout'})" i18n:translate="">Logout</a>
    </li>
     <li class=""
         tal:condition="python:request.user.hasPermission('View', 'query')">
   <span i18n:translate=""><b>Your Queries</b> (<a class="nomargin" href="query?@template=edit">edit</a>)</span><br/>
   <ul tal:repeat="qs request/user/queries">
    <li><a tal:attributes="href string:${qs/klass}?${qs/url}&@dispname=${qs/name}"
       tal:content="qs/name">link</a></li>
   </ul>
     </li>
     <li class=""
         tal:condition="python:request.user.hasPermission('View', 'user')">
   <b i18n:translate="">Administration</b>
   <ul>
   <li tal:condition="python:request.user.hasPermission('Edit', None)">
    <a href="home?@template=classlist" i18n:translate="">Class List</a>
   </li>
   <li tal:condition="python:request.user.hasPermission('View', 'user')
                            or request.user.hasPermission('Edit', 'user')">
    <a href="user?@sort=username"  i18n:translate="">User List</a>
   </li>
   <li tal:condition="python:request.user.hasPermission('Create', 'user')"><a href="user?@template=item" i18n:translate="">Add User</a>
   </li>
   <li tal:condition="python:request.user.hasPermission('Edit',
 'keyword')"><a href="keyword" i18n:translate="">Edit Keywords</a>
   </li>
<!--   <li tal:condition="python:request.user.hasPermission('SB: May Classify',None)"><a href="msg?@sort=-spambayes_score">View Spam</a>
   </li>-->
   </ul>
     </li>
    </ul>
   </li>
  </ul>

     </li>
    <li><a href="http://www.roundup-tracker.org/contact.html" title="Get in touch.">Contact</a></li>
    <li><a href="http://wiki.roundup-tracker.org" title="Share your ideas...">Wiki</a></li>
    <li><a href="http://www.roundup-tracker.org/code.html" title="Be the sources with you.">Code</a></li>
  </ul>
 </div> <!-- menu -->
</div> <!-- navigation -->

<div class="content">
<h1 id="breadcrumb"><span metal:define-slot="body_title">body title</span></h1>
 <p tal:condition="options/error_message | nothing" class="error-message"
    tal:repeat="m options/error_message"
    tal:content="structure string:$m <br/ > " />
 <p tal:condition="options/ok_message | nothing" class="ok-message">
  <span tal:repeat="m options/ok_message"
        tal:content="structure string:$m <br/ > " />
  <a class="form-small" tal:attributes="href request/current_url"
     i18n:translate="">clear this message</a>
 </p>
 <tal:block metal:define-slot="content">Page content goes here</tal:block>
</div> <!-- content -->
<div class="footer">
<div class="credits">
   <a href="http://www.upfrontsystems.co.za/" title="issue tracker hosting provided by Upfront Systems, South Africa">hosting by Upfront Systems</a>
  </div> <!-- credits -->
<!-- Created: Wed Jan 14 11:55:38 EST 2009 -->
<!-- hhmts start -->
Last modified: Tue Feb  3 22:02:04 EST 2009
<!-- hhmts end -->
</div> <!-- footer -->

<pre tal:condition="request/form/deissue | nothing" tal:content="request">
</pre>

</body>
</html>
</tal:block>

<!--
The following macros are intended to be used in search pages.

The invoking context must define a "name" variable which names the
property being searched.

See issue.search.html in the classic template for examples.
-->

<!-- creates a th and a label: -->
<th metal:define-macro="th_label"
    tal:define="required required | python:[]"
    tal:attributes="class python:(name in required) and 'required' or nothing">
  <label tal:attributes="for name" tal:content="label" i18n:translate="">text</label>
	<metal:x define-slot="behind_the_label" />
</th>

<td metal:define-macro="search_input">
  <input tal:attributes="value python:request.form.getvalue(name) or nothing;
                         name name;
                         id name"/>
</td>

<td metal:define-macro="search_date">
  <input tal:attributes="value python:request.form.getvalue(name) or nothing;
                         name name;
                         id name"/>
  <a class="classhelp"
	 tal:attributes="href python:'''javascript:help_window('issue?@template=calendar&property=%s&form=itemSynopsis', 300, 200)'''%name">(cal)</a>
</td>

<td metal:define-macro="search_popup">
  <!--
    context needs to specify the popup "columns" as a comma-separated
    string (eg. "id,title" or "id,name,description") as well as name
  -->
  <input tal:attributes="value python:request.form.getvalue(name) or nothing;
                         name name;
                         id name"/>
  <span tal:replace="structure python:db.issue.classhelp(columns,
                                      property=name)" />
</td>

<td metal:define-macro="search_select">
  <select tal:attributes="name name; id name"
          tal:define="value python:request.form.getvalue(name)">
    <option value="" i18n:translate="">don't care</option>
    <metal:slot define-slot="extra_options" />
    <option value="" i18n:translate="" disabled="disabled">------------</option>
    <option tal:repeat="s python:db[db_klass].list()"
            tal:attributes="value s/id; selected python:value == s.id"
            tal:content="python:s[db_content]"></option>
  </select>
</td>

<!-- like search_select, but translates the further values.
Could extend it (METAL 1.1 attribute "extend-macro")
-->
<td metal:define-macro="search_select_translated">
  <select tal:attributes="name name; id name"
          tal:define="value python:request.form.getvalue(name)">
    <option value="" i18n:translate="">don't care</option>
    <metal:slot define-slot="extra_options" />
    <option value="" i18n:translate="" disabled="disabled">------------</option>
    <option tal:repeat="s python:db[db_klass].list()"
            tal:attributes="value s/id; selected python:value == s.id"
						tal:content="python:s[db_content]"
						i18n:translate=""></option>
  </select>
</td>

<!-- currently, there is no convenient API to get a list of all roles -->
<td metal:define-macro="search_select_roles"
	  tal:define="onchange onchange | nothing">
  <select name=roles id=roles tal:attributes="onchange onchange">
    <option value="" i18n:translate="">don't care</option>
    <option value="" i18n:translate="" disabled="disabled">------------</option>
    <option value="User">User</option>
    <option value="Developer">Developer</option>
    <option value="Coordinator">Coordinator</option>
  </select>
</td>

<td metal:define-macro="search_multiselect">
  <input tal:attributes="value python:request.form.getvalue(name) or nothing;
                         name name;
                         id name"/>
  <span tal:replace="structure python:db[db_klass].classhelp(db_content,
                                        property=name, width='600')" />
</td>

<td metal:define-macro="search_checkboxes">
 <ul class="search-checkboxes"
     tal:define="value python:request.form.getvalue(name);
                 values python:value and value.split(',') or []">
 <li tal:repeat="s python:db[db_klass].list()">
  <input type="checkbox" tal:attributes="name name; id string:$name-${s/id};
    value s/id; checked python:s.id in values" />
  <label tal:attributes="for string:$name-${s/id}"
         tal:content="python:s[db_content]" />
 </li>
 <li metal:define-slot="no_value_item">
  <input type="checkbox" value="-1" tal:attributes="name name;
     id string:$name--1; checked python:value == '-1'" />
  <label tal:attributes="for string:$name--1" i18n:translate="">no value</label>
 </li>
 </ul>
</td>

<td metal:define-macro="column_input">
  <input type="checkbox" name="@columns"
         tal:attributes="value name;
                         checked python:name in cols"/>
</td>

<td metal:define-macro="sort_input">
  <input type="radio" name="@sort"
         tal:attributes="value name;
                         checked python:name == sort_on"/>
</td>

<td metal:define-macro="group_input">
  <input type="radio" name="@group"
         tal:attributes="value name;
                         checked python:name == group_on"/>
</td>

<!--
The following macros are intended for user editing.

The invoking context must define a "name" variable which names the
property being searched; the "edit_ok" variable tells whether the
current user is allowed to edit.

See user.item.html in the classic template for examples.
-->
<script metal:define-macro="user_utils" type="text/javascript" src="@@file/user_utils.js"></script>

<!-- src: value will be re-used for other input fields -->
<input metal:define-macro="user_src_input"
    type="text" tal:attributes="onblur python:edit_ok and 'split_name(this)';
    id name; name name; value value; readonly not:edit_ok"
    value="heinz.kunz"/>
<!-- normal: no re-using -->
<input metal:define-macro="user_normal_input" type="text"
    tal:attributes="id name; name name; value value; readonly not:edit_ok"
    value="heinz"/>
<!-- password: type; no initial value -->
    <input metal:define-macro="user_pw_input" type="password"
    tal:attributes="id name; name name; readonly not:edit_ok" value=""/>
    <input metal:define-macro="user_confirm_input" type="password"
    tal:attributes="id name; name string:@confirm@$name; readonly not:edit_ok" value=""/>
Roundup Issue Tracker: http://roundup-tracker.org/