Django

Code

Changeset 6691

Show
Ignore:
Timestamp:
11/18/07 00:51:20 (1 year ago)
Author:
gwilson
Message:

Fixed #5880 -- Fixed an XSS hole in the admin interface.

  • Escaped text that gets sent after saving the admin foreignkey popup form.
  • Added quotes around the second argument passed to opener.dismissAddAnotherPopup to make the function also work when a text field is used as the primary key.
  • Added a html_unescape javascript function to unescape the strings passed in to the dismissAddAnotherPopup function so that the added choice displays correctly in the dropdown box.
Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • django/trunk/django/contrib/admin/media/js/admin/RelatedObjectLookups.js

    r5689 r6691  
    11// Handles related-objects functionality: lookup link for raw_id_admin=True 
    22// and Add Another links. 
     3 
     4function html_unescape(text) { 
     5    // Unescape a string that was escaped using django.utils.html.escape. 
     6    text = text.replace(/&lt;/g, '<'); 
     7    text = text.replace(/&gt;/g, '>'); 
     8    text = text.replace(/&quot;/g, '"'); 
     9    text = text.replace(/&#39;/g, "'"); 
     10    text = text.replace(/&amp;/g, '&'); 
     11    return text; 
     12} 
    313 
    414function showRelatedObjectLookupPopup(triggeringLink) { 
    …… 
    4353 
    4454function dismissAddAnotherPopup(win, newId, newRepr) { 
     55    // newId and newRepr are expected to have previously been escaped by 
     56    // django.utils.html.escape. 
     57    newId = html_unescape(newId); 
     58    newRepr = html_unescape(newRepr); 
    4559    var name = win.name.replace(/___/g, '.'); 
    4660    var elem = document.getElementById(name); 

  • django/trunk/django/contrib/admin/views/main.py

    r6675 r6691  
    274274                return HttpResponseRedirect(post_url_continue % pk_value) 
    275275            if "_popup" in request.POST: 
    276                 if type(pk_value) is str: # Quote if string, so JavaScript doesn't think it's a variable. 
    277                     pk_value = '"%s"' % pk_value.replace('"', '\\"') 
    278                 return HttpResponse('<script type="text/javascript">opener.dismissAddAnotherPopup(window, %s, "%s");</script>' % \ 
    279                     (pk_value, force_unicode(new_object).replace('"', '\\"'))) 
     276                return HttpResponse('<script type="text/javascript">opener.dismissAddAnotherPopup(window, "%s", "%s");</script>' % \ 
     277                    # escape() calls force_unicode. 
     278                    (escape(pk_value), escape(new_object))) 
    280279            elif "_addanother" in request.POST: 
    281280                request.user.message_set.create(message=msg + ' ' + (_("You may add another %s below.") % force_unicode(opts.verbose_name)))