bodhi/controllers.py | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
New commits:
commit a2345d531e0622bacb55f25ed359978ac28ab809
Author: Luke Macken <lmacken(a)redhat.com>
Date: Tue Oct 7 18:55:42 2008 -0400
Fix a potential XSS vulnerability
diff --git a/bodhi/controllers.py b/bodhi/controllers.py
index 88442d5..18d5ffa 100644
--- a/bodhi/controllers.py
+++ b/bodhi/controllers.py
@@ -19,6 +19,7 @@ import logging
import cherrypy
import xmlrpclib
+from cgi import escape
from koji import GenericError
from datetime import datetime
from sqlobject import SQLObjectNotFound
@@ -863,7 +864,7 @@ class Root(controllers.RootController):
return dict(tg_template=template, updates=[], num_items=0,
title='No updates found')
- flash_log("The path %s cannot be found" % cherrypy.request.path)
+ flash_log("The path %s cannot be found" %
escape(cherrypy.request.path))
raise redirect("/")
@expose(template='bodhi.templates.show')
Show replies by date