RetroSearch Browse

Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Showing content from https://github.com/django/django/commit/d03bf6fe4e9bf5b07de62c1a271c4b41a7d3d158 below:

[1.9.x] Fixed XSS in admin's add/change related popup. · django/django@d03bf6f · GitHub

File tree Expand file treeCollapse file tree 6 files changed

+41

-8

lines changed

Filter options

- contrib/admin/static/admin/js/admin

Expand file treeCollapse file tree 6 files changed

+41

-8

lines changed Original file line number Diff line number Diff line change


 @@ -120,7 +120,7 @@

120 120


 var selects = django.jQuery(selectsSelector);

121 121


 selects.find('option').each(function() {

122 122


 if (this.value === objId) {

123

-
 this.innerHTML = newRepr;

123

+
 this.textContent = newRepr;

124 124


 this.value = newId;

125 125

126 126

});

Original file line number Diff line number Diff line change


 @@ -631,13 +631,13 @@ def default_urlconf(request):

631 631


  var s = link.getElementsByTagName('span')[0];

632 632


  var uarr = String.fromCharCode(0x25b6);

633 633


  var darr = String.fromCharCode(0x25bc);

634

-
  s.innerHTML = s.innerHTML == uarr ? darr : uarr;

634

+
  s.textContent = s.textContent == uarr ? darr : uarr;

635 635


  return false;

636 636

637 637


  function switchPastebinFriendly(link) {

638 638


  s1 = "Switch to copy-and-paste view";

639 639


  s2 = "Switch back to interactive view";

640

-
  link.innerHTML = link.innerHTML.trim() == s1 ? s2: s1;

640

+
  link.textContent = link.textContent.trim() == s1 ? s2: s1;

641 641


  toggle('browserTraceback', 'pastebinTraceback');

642 642


  return false;

643 643

Original file line number Diff line number Diff line change


 @@ -2,9 +2,20 @@

2 2


 Django 1.8.14 release notes

3 3


 ===========================

4 4 5

-
 *Under development*

5

+
 *July 18, 2016*

6 6 7

-
 Django 1.8.14 fixes several bugs in 1.8.13.

7

+
 Django 1.8.14 fixes a security issue and a bug in 1.8.13.

8 + 9

+
 XSS in admin's add/change related popup

10

+
 =======================================

11 + 12

+
 Unsafe usage of JavaScript's ``Element.innerHTML`` could result in XSS in the

13

+
 admin's add/change related popup. ``Element.textContent`` is now used to

14

+
 prevent execution of the data.

15 + 16

+
 The debug view also used ``innerHTML``. Although a security issue wasn't

17

+
 identified there, out of an abundance of caution it's also updated to use

18

+
 ``textContent``.

8 19 9 20


 Bugfixes

10 21


 ========

Original file line number Diff line number Diff line change


 @@ -2,9 +2,20 @@

2 2


 Django 1.9.8 release notes

3 3


 ==========================

4 4 5

-
 *Under development*

5

+
 *July 18, 2016*

6 6 7

-
 Django 1.9.8 fixes several bugs in 1.9.7.

7

+
 Django 1.9.8 fixes a security issue and several bugs in 1.9.7.

8 + 9

+
 XSS in admin's add/change related popup

10

+
 =======================================

11 + 12

+
 Unsafe usage of JavaScript's ``Element.innerHTML`` could result in XSS in the

13

+
 admin's add/change related popup. ``Element.textContent`` is now used to

14

+
 prevent execution of the data.

15 + 16

+
 The debug view also used ``innerHTML``. Although a security issue wasn't

17

+
 identified there, out of an abundance of caution it's also updated to use

18

+
 ``textContent``.

8 19 9 20


 Bugfixes

10 21


 ========

Original file line number Diff line number Diff line change


 @@ -17,13 +17,17 @@

17 17


 from django.utils.encoding import python_2_unicode_compatible

18 18 19 19 20

+
 @python_2_unicode_compatible

20 21


 class Section(models.Model):

21 22

"""

22 23


  A simple section that links to articles, to test linking to related items

23 24


  in admin views.

24 25

"""

25 26


 name = models.CharField(max_length=100)

26 27 28

+
 def __str__(self):

29

+
 return self.name

30 + 27 31


 @property

28 32


 def name_property(self):

29 33

"""

Original file line number Diff line number Diff line change


 @@ -4625,8 +4625,10 @@ def test_list_editable_popups(self):

4625 4625

"""

4626 4626


  list_editable foreign keys have add/change popups.

4627 4627

"""

4628

+
 from selenium.webdriver.support.ui import Select

4628 4629


 s1 = Section.objects.create(name='Test section')

4629 4630


 Article.objects.create(

4631

+
 title='foo',

4630 4632


 content='<p>Middle content</p>',

4631 4633


 date=datetime.datetime(2008, 3, 18, 11, 54, 58),

4632 4634


 section=s1,


 @@ -4638,8 +4640,13 @@ def test_list_editable_popups(self):

4638 4640


 self.wait_for_popup()

4639 4641


 self.selenium.switch_to.window(self.selenium.window_handles[-1])

4640 4642


 self.wait_for_text('#content h1', 'Change section')

4641

-
 self.selenium.close()

4643

+
 name_input = self.selenium.find_element_by_id('id_name')

4644

+
 name_input.clear()

4645

+
 name_input.send_keys('<i>edited section</i>')

4646

+
 self.selenium.find_element_by_xpath('//input[@value="Save"]').click()

4642 4647


 self.selenium.switch_to.window(self.selenium.window_handles[0])

4648

+
 select = Select(self.selenium.find_element_by_id('id_form-0-section'))

4649

+
 self.assertEqual(select.first_selected_option.text, '<i>edited section</i>')

4643 4650 4644 4651


 # Add popup

4645 4652


 self.selenium.find_element_by_id('add_id_form-0-section').click()

You can’t perform that action at this time.

RetroSearch is an open source project built by @garambo | Open a GitHub Issue

Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo

HTML: 3.2 | Encoding: UTF-8 | Version: 0.7.4