Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Browse files

[1.2.X] Fixed security issue in AdminFileWidget. Disclosure and relea…

…se forthcoming.

git-svn-id: http://code.djangoproject.com/svn/django/branches/releases/1.2.X@15471 bcc190cf-cafb-0310-a4f2-bffc1f526a37
  • Loading branch information...
commit 1f814a9547842dcfabdae09573055984af9d3fab 1 parent 1945664
Carl Meyer carljm authored
2  django/contrib/admin/widgets.py
View
@@ -96,7 +96,7 @@ def render(self, name, value, attrs=None):
output = []
if value and hasattr(value, "url"):
output.append('%s <a target="_blank" href="%s">%s</a> <br />%s ' % \
- (_('Currently:'), value.url, value, _('Change:')))
+ (_('Currently:'), escape(value.url), escape(value), _('Change:')))
output.append(super(AdminFileWidget, self).render(name, value, attrs))
return mark_safe(u''.join(output))
16 tests/regressiontests/admin_widgets/tests.py
View
@@ -239,6 +239,22 @@ def test_render(self):
'<input type="file" name="test" />',
)
+ def test_render_escapes_html(self):
+ class StrangeFieldFile(object):
+ url = "something?chapter=1&sect=2&copy=3&lang=en"
+
+ def __unicode__(self):
+ return u'''something<div onclick="alert('oops')">.jpg'''
+
+ widget = AdminFileWidget()
+ field = StrangeFieldFile()
+ output = widget.render('myfile', field)
+ self.assertFalse(field.url in output)
+ self.assertTrue(u'href="something?chapter=1&amp;sect=2&amp;copy=3&amp;lang=en"' in output)
+ self.assertFalse(unicode(field) in output)
+ self.assertTrue(u'something&lt;div onclick=&quot;alert(&#39;oops&#39;)&quot;&gt;.jpg' in output)
+
+
class ForeignKeyRawIdWidgetTest(DjangoTestCase):
def test_render(self):
Please sign in to comment.
Something went wrong with that request. Please try again.