Merge commit '9c57635edf6f8678f9b28472baa7cfef2d278712' into jinja

Conflicts:
	buildbot/status/web/baseweb.py
	buildbot/status/web/builder.py
	buildbot/status/web/grid.py
	buildbot/status/web/waterfall.py

buildbot/status/web/baseweb.py

@@ -207,7 +207,7 @@ def body(self, req):
         branches = [b for b in req.args.get("branch", []) if b]
 
         cxt = {}
-        cxt['branches'] = " ".join(branches)
+        cxt['branches'] = branches
         bs = cxt['builders'] = []
 
         building = False

buildbot/status/web/build.py

@@ -96,7 +96,6 @@ def body(self, req):
 
             step['link'] = req.childLink("steps/%s" % urllib.quote(s.getName()))
             step['text'] = " ".join(s.getText())
-
             step['urls'] = map(lambda x:dict(url=x[0],logname=x[1]), s.getURLs().items())
 
             step['logs']= []
@@ -149,14 +148,14 @@ def stop(self, req):
                 (b.getBuilder().getName(), b.getNumber()))
         name = req.args.get("username", ["<unknown>"])[0]
         comments = req.args.get("comments", ["<no reason specified>"])[0]
+        # html-quote both the username and comments, just to be safe
         reason = ("The web-page 'stop build' button was pressed by "
-                  "'%s': %s\n" % (name, comments))
+                  "'%s': %s\n" % (html.escape(name), html.escape(comments)))
         if c:
             c.stopBuild(reason)
         # we're at http://localhost:8080/svn-hello/builds/5/stop?[args] and
         # we want to go to: http://localhost:8080/svn-hello
-        url = req.args.get('url', ['../..'])[0]
-        r = Redirect(url)
+        r = Redirect("../..")
         d = defer.Deferred()
         reactor.callLater(1, d.callback, r)
         return DeferredResource(d)
@@ -172,7 +171,7 @@ def rebuild(self, req):
         name = req.args.get("username", ["<unknown>"])[0]
         comments = req.args.get("comments", ["<no reason specified>"])[0]
         reason = ("The web-page 'rebuild' button was pressed by "
-                  "'%s': %s\n" % (name, comments))
+                  "'%s': %s\n" % (html.escape(name), html.escape(comments)))
         if not bc or not b.isFinished():
             log.msg("could not rebuild: bc=%s, isFinished=%s"
                     % (bc, b.isFinished()))

buildbot/status/web/builder.py

@@ -86,7 +86,7 @@ def content(self, req, cxt):
         if self.builder_control is not None:
             cxt['cancel_url'] = path_to_builder(req, b) + '/cancelbuild'
 
-        numbuilds = req.args.get('numbuilds', ['5'])[0]
+        numbuilds = int(req.args.get('numbuilds', ['5'])[0])
         recent = cxt['recent'] = []
         for build in b.generateFinishedBuilds(num_builds=int(numbuilds)):
             recent.append(self.get_line_values(req, build, False))
@@ -130,7 +130,7 @@ def force(self, req):
         revision = req.args.get("revision", [""])[0]
 
         r = "The web-page 'force build' button was pressed by '%s': %s\n" \
-            % (name, reason)
+            % (html.escape(name), html.escape(reason))
         log.msg("web forcebuild of builder '%s', branch='%s', revision='%s'"
                 " by user '%s'" % (self.builder_status.getName(), branch,
                                    revision, name))

buildbot/status/web/buildstatus.py

@@ -1,3 +1,4 @@
+from twisted.web import html, resource
 from buildbot.status.web.base import Box
 from buildbot.status.web.base import HtmlResource
 from buildbot.status.web.base import IBox
@@ -21,6 +22,7 @@ def content(self, request, ctx):
         number = request.args.get("number", [None])[0]
         if not name or not number:
             return "builder and number parameter missing"
+        number = int(number)
 
         # Check if the builder in parameter exists.
         try:

buildbot/status/web/grid.py

@@ -3,6 +3,8 @@
 import sys, time, os.path
 import urllib
 
+from twisted.web import html, resource
+
 from buildbot import util
 from buildbot import version
 from buildbot.status.web.base import HtmlResource
@@ -171,6 +173,7 @@ def body(self, request):
                'ANYBRANCH': ANYBRANCH,
                'stamps': stamps,
               }  
+            html_categories = map(html.escape(categories))
 
         sortedBuilderNames = status.getBuilderNames()[:]
         sortedBuilderNames.sort()
@@ -239,6 +242,7 @@ def body(self, request):
                'ANYBRANCH': ANYBRANCH,
                'stamps': stamps,
               }          
+            html_categories = map(html.escape(categories))
 
         sortedBuilderNames = status.getBuilderNames()[:]
         sortedBuilderNames.sort()

buildbot/status/web/templates/grid_macros.html

@@ -6,11 +6,11 @@
   {% pluralize categories %}
    <b>Categories:</b><br/>
   {% endtrans %}
-  {{ categories|join('<br/>') }}
+  {{ categories|e|join('<br/>') }}
  {% endif %}
 
  {% if branch != ANYBRANCH %}
-  <br><b>Branch:</b> {{ branch or "trunk" }}
+  <br><b>Branch:</b> {{ branch|e or "trunk" }}
  {% endif %}
 {%- endmacro %}
 
@@ -36,7 +36,7 @@
 
 {% macro build_td(build) -%}
   <td class="build {{ build.class }}">
-    <a href="{{ build.url }}">{{ build.text|join('<br/>') }}</a>
+    <a href="{{ build.url }}">{{ build.text|e|join('<br/>') }}</a>
   </td>
 {%- endmacro %}
 

buildbot/status/web/templates/oneboxperbuilder.html

@@ -1,14 +1,14 @@
 {% import 'forms.html' as forms %}
 
-<h1>Latest builds: {{ branches }}</h1>
+<h1>Latest builds: {{ branches|join(', ')|e }}</h1>
 
 <table>
 {% for b in builders %}
   <tr>
   <td class="box"><a href="{{ b.link }}">{{ b.name|e }}</a></td>
   {% if b.build_url %}
     <td class="LastBuild box {{ b.build_css_class }}">
-        <a href="{{ b.build_url}}">{{ b.build_label }}</a>
+        <a href="{{ b.build_url }}">{{ b.build_label }}</a>
         <br/>{{ b.build_text }}
     </td>
   {% else %}

buildbot/status/web/templates/onelineperbuild.html

@@ -1,10 +1,10 @@
 {% from 'build_line.html' import build_line %}
 {% import 'forms.html' as forms %}
 
-<h1>Last {{ num_builds }} finished builds: {{ branches|join(', ') }}</h1>
+<h1>Last {{ num_builds }} finished builds: {{ branches|join(', ')|e }}</h1>
 
 {% if builders %}
-  <p>of builders: {{ builders|join(", ") }}</p>
+  <p>of builders: {{ builders|join(", ")|e }}</p>
 {% endif %}
 
 <ul>

buildbot/status/web/templates/onelineperbuildonebuilder.html

@@ -1,7 +1,7 @@
 {% from 'build_line.html' import build_line %}
 
-<h1>Last {{ num_builds }} builds of builder {{ builder_name }}: 
-    {{ branches|join(', ') }}
+<h1>Last {{ num_builds }} builds of builder {{ builder_name|e }}: 
+    {{ branches|join(', ')|e }}
 </h1>
 
 <ul>

buildbot/status/web/templates/waterfallhelp.html

@@ -56,7 +56,7 @@ <h2>Showing only Certain Branches</h2>
 <table>
 {% for b in branches %}
  <tr><td>Show Branch: 
- <input type="text" name="branch" value="{b}">
+ <input type="text" name="branch" value="{{ b|e }}">
  </td></tr>
 {% endfor %}
 </table>
@@ -73,7 +73,7 @@ <h2>Limiting the Builders that are Displayed</h2>
 
 <table>
 {% for bn in all_builders %}
- <tr><td><input type="checkbox" name="builder" value="{{bn}}"
+ <tr><td><input type="checkbox" name="builder" value="{{ bn }}"
   {% if bn in show_builders %}checked="checked"{% endif %} />
  </td><td>{{bn}}</td></tr>
 {% endfor %}
@@ -100,7 +100,7 @@ <h2>Auto-reloading the Page</h2>
 
 <table>
 {% for value, name in times %}
- <tr><td><input type="radio" name="reload" value="{{value}}"
+ <tr><td><input type="radio" name="reload" value="{{ value }}"
   {% if value == current_reload_time %}checked="checked"{% endif %} >
  </td><td>{{name}}</td></tr>
 {% endfor %}

buildbot/status/web/waterfall.py

@@ -401,7 +401,7 @@ def with_args(req, remove_args=[], new_args=[], new_path=None):
                     newargs[k].append(v)
                 else:
                     newargs[k] = [v]
-            newquery = "&".join(["%s=%s" % (k, urllib.quote(v))
+            newquery = "&".join(["%s=%s" % (urllib.quote(k), urllib.quote(v))
                                  for k in newargs
                                  for v in newargs[k]
                                  ])