diff options
| author | LV-426 <lv-426@taproot.org.il> | 2015-04-09 01:55:37 +0300 |
|---|---|---|
| committer | LV-426 <lv-426@taproot.org.il> | 2015-04-09 02:03:46 +0300 |
| commit | 913b04022b3cd929f4b5fe4ec83f04821a428430 (patch) | |
| tree | 01ae14e3ce69d195a678ebe1cf958c3bee7f267c | |
| parent | f9dcd64ecf6e1ad534bcbcc48b9b9e3526db49ab (diff) | |
resolve #439 with safe filter (|safe), avoid extra code in index.html
| -rw-r--r-- | res/templates/index.html | 12 | ||||
| -rw-r--r-- | src/server/rz_api_common.py | 2 |
2 files changed, 3 insertions, 11 deletions
diff --git a/res/templates/index.html b/res/templates/index.html index e395cefd..faaee89e 100644 --- a/res/templates/index.html +++ b/res/templates/index.html @@ -12,23 +12,13 @@ var rz_config = { // set as a global variable 'node_edge_separator': true, 'optimized_main': {{ rz_config__optimized_main }}, 'rand_id_generator' : 'hash', - 'rzdoc_cur__name': '{{ rz_config__rzdoc_cur__name }}', + 'rzdoc_cur__name': "{{ rz_config__rzdoc_cur__name|safe }}", 'rzdoc_default__name': '{{ rz_config__rzdoc_default__name }}', 'rz_server_host': '{{ rz_config__hostname }}', 'rz_server_port': '{{ rz_config__port }}', 'separator_string': ' ', }; -function unquote_xml(s) { - return s.replace('&', '&').replace(''', "'") - .replace('"', '"').replace('>', '>') - .replace('<', '<').replace(/&#(..);/g, function (_, d) { - return String.fromCharCode(d); } - ); -} - -rz_config.rzdoc_cur__name = unquote_xml(rz_config.rzdoc_cur__name); - var RZ_VERSION = '{% include "fragment/version.txt" %}'; </script> <script data-main='/static/app.js' src="/static/lib/require.js"></script> diff --git a/src/server/rz_api_common.py b/src/server/rz_api_common.py index 83d29b7c..d2692898 100644 --- a/src/server/rz_api_common.py +++ b/src/server/rz_api_common.py @@ -58,6 +58,8 @@ def sanitize_input__rzdoc_name(rzdoc_name): if None != rzdoc_name and len(rzdoc_name) > current_app.rz_config.rzdoc__name__max_length: raise API_Exception__bad_request('rzdoc: open request: doc name exceeds max doc name limit: %s' % (rzdoc_name)) + # FIXME: fail on HTML escape codes, UTF handling, etc + return rzdoc_name def validate_obj__attr_diff(attr_diff): |