Skip to content

Commit

Permalink
🔒️ Escape requested user id
Browse files Browse the repository at this point in the history
Fixes an XSS issue.
  • Loading branch information
foosel committed May 11, 2022
1 parent 8087528 commit 5ef1677
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions src/octoprint/templates/login.jinja2
Original file line number Diff line number Diff line change
Expand Up @@ -69,12 +69,12 @@
<div id="login-offline" class="alert alert-error">{{ _('Server is currently offline.') }} <a id="login-reconnect" href="javascript:void(0)">{{ _('Reconnect...') }}</a></div>

{% if user_id %}<p>
{{ _('The following account is required:') }} {{ user_id }}
{{ _('The following account is required:') }} {{ user_id|e }}
</p>{% elif logged_in %}<p>
{{ _('An account with the following permissions is required:') }} {{ permission_names|join(", ") }}
</p>{% endif %}

<input type="text" id="login-user" data-test-id="login-username" class="input-block-level" placeholder="{{ _('Username')|edq }}" {% if user_id %}value="{{ user_id }}" disabled{% endif %} autofocus autocapitalize="none">
<input type="text" id="login-user" data-test-id="login-username" class="input-block-level" placeholder="{{ _('Username')|edq }}" {% if user_id %}value="{{ user_id|edq }}" disabled{% endif %} autofocus autocapitalize="none">
<input type="password" id="login-password" data-test-id="login-password" class="input-block-level" placeholder="{{ _('Password')|edq }}">
<span class="pull-right"><small><a href="https://faq.octoprint.org/forgotten-password" id="login-forgotpassword" target="_blank" tabindex="-1">{{ _('Forgot password?') }}</a></small></span>
<label class="checkbox">
Expand Down

0 comments on commit 5ef1677

Please sign in to comment.