Attachment 833696 Details for Bug 1034153 – cve-2013-6858-stable-grizzly.patch

[patch] cve-2013-6858-stable-grizzly.patch

cve-2013-6858-stable-grizzly.patch (text/plain), 3.35 KB, created by Kurt Seifried on 2013-12-06 17:40:06 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kurt Seifried

Created: 2013-12-06 17:40:06 UTC

Size: 3.35 KB

patch

obsolete

>From: Rob Raymond <rob.raymond@hp.com>
>Date: Mon, 4 Nov 2013 19:12:40 +0000 (-0700)
>Subject: Fix bug by escaping strings from Nova before displaying them
>X-Git-Url: https://review.openstack.org/gitweb?p=openstack%2Fhorizon.git;a=commitdiff_plain;h=b14debc73132d1253220192e110f00f62ddb8bbc
>
>Fix bug by escaping strings from Nova before displaying them
>
>Fixes bug #1247675
>
>(cherry-picked from commit b8ff480)
>Change-Id: I3637faafec1e1fba081533ee020f4ee218fea101
>---
>
>diff --git a/openstack_dashboard/dashboards/project/images_and_snapshots/volume_snapshots/tables.py b/openstack_dashboard/dashboards/project/images_and_snapshots/volume_snapshots/tables.py
>index 2311e5c..17a4fb5 100644
>--- a/openstack_dashboard/dashboards/project/images_and_snapshots/volume_snapshots/tables.py
>+++ b/openstack_dashboard/dashboards/project/images_and_snapshots/volume_snapshots/tables.py
>@@ -17,6 +17,7 @@
> import logging
> 
> from django.core.urlresolvers import reverse
>+from django.utils import html
> from django.utils import safestring
> from django.utils.http import urlencode
> from django.utils.translation import ugettext_lazy as _
>@@ -68,6 +69,7 @@ class SnapshotVolumeNameColumn(tables.Column):
>         request = self.table.request
>         volume_name = api.cinder.volume_get(request,
>                                             snapshot.volume_id).display_name
>+        volume_name = html.escape(volume_name)
>         return safestring.mark_safe(volume_name)
> 
>     def get_link_url(self, snapshot):
>diff --git a/openstack_dashboard/dashboards/project/volumes/tables.py b/openstack_dashboard/dashboards/project/volumes/tables.py
>index b14145b..e5426c1 100644
>--- a/openstack_dashboard/dashboards/project/volumes/tables.py
>+++ b/openstack_dashboard/dashboards/project/volumes/tables.py
>@@ -19,7 +19,7 @@ import logging
> from django.core.urlresolvers import reverse, NoReverseMatch
> from django.template.defaultfilters import title
> from django.utils import safestring
>-from django.utils.html import strip_tags
>+from django.utils import html
> from django.utils.translation import ugettext_lazy as _
> 
> from horizon import exceptions
>@@ -111,7 +111,7 @@ def get_attachment_name(request, attachment):
>                                          "attachment information."))
>     try:
>         url = reverse("horizon:project:instances:detail", args=(server_id,))
>-        instance = '<a href="%s">%s</a>' % (url, name)
>+        instance = '<a href="%s">%s</a>' % (url, html.escape(name))
>     except NoReverseMatch:
>         instance = name
>     return instance
>@@ -132,7 +132,7 @@ class AttachmentColumn(tables.Column):
>             # without the server name...
>             instance = get_attachment_name(request, attachment)
>             vals = {"instance": instance,
>-                    "dev": attachment["device"]}
>+                    "dev": html.escape(attachment["device"])}
>             attachments.append(link % vals)
>         return safestring.mark_safe(", ".join(attachments))
> 
>@@ -225,7 +225,7 @@ class AttachmentsTable(tables.DataTable):
>     def get_object_display(self, attachment):
>         instance_name = get_attachment_name(self.request, attachment)
>         vals = {"dev": attachment['device'],
>-                "instance_name": strip_tags(instance_name)}
>+                "instance_name": html.escape(instance_name)}
>         return _("%(dev)s on instance %(instance_name)s") % vals
> 
>     def get_object_by_id(self, obj_id):

Actions: View | Diff

Attachments on bug 1034153: 833693 | 833694 | 833696