Skip to content
Browse files

sanitize more output by stripping tags and escaping html

  • Loading branch information...
1 parent d40b66d commit 36acb172422b8a6bbfde75c1b699aed34fa48137 @kjk committed Jun 19, 2011
Showing with 72 additions and 72 deletions.
  1. +66 −66 index.yaml
  2. +2 −2 skins/default/topic.html
  3. +4 −4 skins/default/topic_list.html
View
132 index.yaml
@@ -1,66 +1,66 @@
-indexes:
-
-- kind: Post
- properties:
- - name: forum
- - name: is_deleted
- - name: topic
- - name: created_on
-
-# AUTOGENERATED
-
-# This index.yaml is automatically updated whenever the dev_appserver
-# detects that a new type of query is run. If you want to manage the
-# index.yaml file manually, remove the above marker line (the line
-# saying "# AUTOGENERATED"). If you want to manage some indexes
-# manually, move them above the marker line. The index.yaml file is
-# automatically uploaded to the admin console when you next deploy
-# your application using appcfg.py.
-
-- kind: Post
- properties:
- - name: forum
- - name: is_deleted
- - name: created_on
- direction: desc
-
-- kind: Post
- properties:
- - name: forum
- - name: topic
- - name: created_on
-
-- kind: Post
- properties:
- - name: is_deleted
- - name: topic
- - name: created_on
-
-- kind: Post
- properties:
- - name: topic
- - name: created_on
-
-- kind: Post
- properties:
- - name: topic
- - name: created_on
- direction: desc
-
-- kind: Topic
- properties:
- - name: forum
- - name: created_on
-
-- kind: Topic
- properties:
- - name: forum
- - name: created_on
- direction: desc
-
-- kind: Topic
- properties:
- - name: forum
- - name: is_deleted
- - name: created_on
- direction: desc
+indexes:
+
+- kind: Post
+ properties:
+ - name: forum
+ - name: is_deleted
+ - name: topic
+ - name: created_on
+
+# AUTOGENERATED
+
+# This index.yaml is automatically updated whenever the dev_appserver
+# detects that a new type of query is run. If you want to manage the
+# index.yaml file manually, remove the above marker line (the line
+# saying "# AUTOGENERATED"). If you want to manage some indexes
+# manually, move them above the marker line. The index.yaml file is
+# automatically uploaded to the admin console when you next deploy
+# your application using appcfg.py.
+
+- kind: Post
+ properties:
+ - name: forum
+ - name: is_deleted
+ - name: created_on
+ direction: desc
+
+- kind: Post
+ properties:
+ - name: forum
+ - name: topic
+ - name: created_on
+
+- kind: Post
+ properties:
+ - name: is_deleted
+ - name: topic
+ - name: created_on
+
+- kind: Post
+ properties:
+ - name: topic
+ - name: created_on
+
+- kind: Post
+ properties:
+ - name: topic
+ - name: created_on
+ direction: desc
+
+- kind: Topic
+ properties:
+ - name: forum
+ - name: created_on
+
+- kind: Topic
+ properties:
+ - name: forum
+ - name: created_on
+ direction: desc
+
+- kind: Topic
+ properties:
+ - name: forum
+ - name: is_deleted
+ - name: created_on
+ direction: desc
View
4 skins/default/topic.html
@@ -59,9 +59,9 @@
{% endif %}
{% endif %}
{% if post.user_homepage %}
- <a href="{{ post.user_homepage }}">{{ post.user_name|escape }}</a>
+ <a href="{{ post.user_homepage }}">{{ post.user_name|striptags|escape }}</a>
{% else %}
- {{ post.user_name|escape }}
+ {{ post.user_name|striptags|escape }}
{% endif %}
<span class="noIE">&nbsp;</span><br />
{{ post.created_on|date:"F jS, Y g:ia" }}
View
8 skins/default/topic_list.html
@@ -48,12 +48,12 @@
There are no topics. You better create one.
{% else %}
{% for topic in topics %}
- {% if topic.is_deleted %}
- <a class="deleted" href="{{ siteroot }}topic?id={{ topic.key.id }}{% if topic.ncomments %}&comments={{ topic.ncomments }}{% endif %}" title="{{ topic.msg_short }}">{{ topic.subject|escape }}</a>
+ {% if topic.is_deleted %}
+ <a class="deleted" href="{{ siteroot }}topic?id={{ topic.key.id }}{% if topic.ncomments %}&comments={{ topic.ncomments }}{% endif %}" title="{{ topic.msg_short|striptags|escape }}">{{ topic.subject|escape }} </a>
{% else %}
- <a href="{{ siteroot }}topic?id={{ topic.key.id }}{% if topic.ncomments %}&comments={{ topic.ncomments }}{% endif %}" title="{{ topic.msg_short }}">{{ topic.subject|escape }}</a>
+ <a href="{{ siteroot }}topic?id={{ topic.key.id }}{% if topic.ncomments %}&comments={{ topic.ncomments }}{% endif %}" title="{{ topic.msg_short|striptags|escape }}">{{ topic.subject|escape }} </a>
{% endif %}
- <em>{{ topic.created_by }}</em> <span>({{ topic.ncomments }}{% if forloop.first %} comment{{ topic.ncomments|pluralize }}{% endif %})</span>
+ <em>{{ topic.created_by|striptags|escape }}</em> <span>({{ topic.ncomments }}{% if forloop.first %} comment{{ topic.ncomments|pluralize }}{% endif %})</span>
<br />
{% if not forloop.first %}
<div class="dateline"></div>

0 comments on commit 36acb17

Please sign in to comment.
Something went wrong with that request. Please try again.