You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@allura.apache.org by br...@apache.org on 2026/05/26 20:56:17 UTC
(allura) 01/33: [#8607] escape html in a few places
This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch db/8607
in repository https://gitbox.apache.org/repos/asf/allura.git
commit 324d4de114540ade281c22651f08b766cdc350cf
Author: Dave Brondsema <da...@brondsema.net>
AuthorDate: Tue May 12 16:43:57 2026 -0400
[#8607] escape html in a few places
---
Allura/allura/templates/app_admin_permissions.html | 2 +-
Allura/allura/templates/site_admin_new_projects.html | 2 +-
Allura/allura/templates/site_admin_task_new.html | 4 ++--
3 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/Allura/allura/templates/app_admin_permissions.html b/Allura/allura/templates/app_admin_permissions.html
index 7433edec4..4cf9303d3 100644
--- a/Allura/allura/templates/app_admin_permissions.html
+++ b/Allura/allura/templates/app_admin_permissions.html
@@ -103,7 +103,7 @@
current_block_list.find('ul').append(
'<li><label><input type="checkbox" value="' + data.user_id + '"name="user_id">'
- + data.username + (data.reason ? ' (' + data.reason + ')' : '') + '</label></li>'
+ + escape_html(data.username) + (data.reason ? ' (' + escape_html(data.reason) + ')' : '') + '</label></li>'
);
// show 'Block List' button
current_block_list.parent('li').show();
diff --git a/Allura/allura/templates/site_admin_new_projects.html b/Allura/allura/templates/site_admin_new_projects.html
index 8970ff2e3..1b954936b 100644
--- a/Allura/allura/templates/site_admin_new_projects.html
+++ b/Allura/allura/templates/site_admin_new_projects.html
@@ -170,7 +170,7 @@
flash(response.message, 'success');
form.remove();
var td = el.closest('tr').find('td:first');
- td.html('<p><strong>Notes:</strong>' + textarea.val() + '</p>');
+ td.html('<p><strong>Notes:</strong>' + html_escape(textarea.val()) + '</p>');
el.remove();
}).fail(function (response){
flash(response.message, 'error');
diff --git a/Allura/allura/templates/site_admin_task_new.html b/Allura/allura/templates/site_admin_task_new.html
index 3ee645d41..4ef47e223 100644
--- a/Allura/allura/templates/site_admin_task_new.html
+++ b/Allura/allura/templates/site_admin_task_new.html
@@ -117,10 +117,10 @@
$task.parent().siblings('.error').remove();
$('pre.doc').empty();
if (data.error) {
- $task.parent().after('<span class="error">' + data.error + '</span>');
+ $task.parent().after('<span class="error">' + escape_html(data.error) + '</span>');
}
if (data.doc) {
- $('pre.doc').html(data.doc);
+ $('pre.doc').text(data.doc);
}
});
});