Author: croberts
Date: 2012-11-30 16:14:16 +0000 (Fri, 30 Nov 2012)
New Revision: 5556
Modified:
trunk/cumin/python/cumin/objectselector.py
Log:
Fix for BZ:879263 We are now xml_escaping the search string when presenting the yellow
notification box message that the input could not be parsed. Previously, the text was
rendered without xml-escaping which could allow injected script tags to have their code
executed.
Modified: trunk/cumin/python/cumin/objectselector.py
===================================================================
--- trunk/cumin/python/cumin/objectselector.py 2012-11-29 17:23:56 UTC (rev 5555)
+++ trunk/cumin/python/cumin/objectselector.py 2012-11-30 16:14:16 UTC (rev 5556)
@@ -391,20 +391,20 @@
searchvalue = parse_date_from_string(customvalue)
except Exception, e:
self.error_in_query = True
- session.add_unique_notice(Notice("Error parsing valid timestamp from
'%s', search results not updated" % customvalue, preamble=""))
+ session.add_unique_notice(Notice("Error parsing valid timestamp from
'%s', search results not updated" % xml_escape(customvalue),
preamble=""))
if sql_column.type.literal == "int8":
if sql_column.name in self.special_columns:
try:
searchvalue = fmt_ddhhmm_timestamp(customvalue)
except:
self.error_in_query = True
- session.add_unique_notice(Notice("Error parsing valid dd:hh:mm
from '%s', search results not updated" % customvalue,
preamble=""))
+ session.add_unique_notice(Notice("Error parsing valid dd:hh:mm
from '%s', search results not updated" % xml_escape(customvalue),
preamble=""))
else:
try:
int(customvalue)
except:
self.error_in_query = True
- session.add_unique_notice(Notice("Error parsing valid integer
from '%s', search results not updated" % customvalue, preamble=""))
+ session.add_unique_notice(Notice("Error parsing valid integer
from '%s', search results not updated" % xml_escape(customvalue),
preamble=""))
def get_data_values(self, session):
Show replies by date