nik/FreedomBox
1
0
Fork 0
mirror of https://github.com/freedombox/FreedomBox.git synced 2026-08-19 12:36:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

Properly escape output to prevent XSS.

Browse Source
This commit is contained in:
Nick Daly 2012-06-28 00:33:10 -05:00
parent d71f7d9f48
commit 13a2880fa0
6 changed files with 29 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
ugly_hacks/santiago/protocols/https/templates/html/consumedHost.tmpl
View File

@ -1,3 +1,5 @@
#import cgi
#set $host = $cgi.escape($host)
<html>
<head>
<style>
@ -7,11 +9,15 @@
</style>
</head>
<body>
<p>You are <a href="/consuming">consuming</a> services from $host:</p>
<p>You are <a href="/consuming">consuming</a> services from
$host:</p>
#if $services
<ul>
#for $service in $services
<li><a href="/consuming/$host/$service">$service</a>
#set $service = $cgi.escape($service)
<li>
<a href="/consuming/$host/$service">
$service</a>
<form method="post" action="/consuming/$host">
<input type="hidden" name="delete" value="$service" />
<input type="submit" value="Delete" />

13
ugly_hacks/santiago/protocols/https/templates/html/consumedService.tmpl
View File

@ -1,3 +1,6 @@
#import cgi
#set $host = $cgi.escape($host)
#set $service = $cgi.escape($service)
<html>
<head>
<style>
@ -12,8 +15,11 @@
#if $locations
<ul>
#for $location in $locations
<li><a href="$location">$location</a>
<form method="post" action="/consuming/$host/$service">
#set $location = $cgi.escape($location)
<li>
<a href="$location">$location</a>
<form method="post"
action="/consuming/$host/$service">
<input type="hidden" name="delete" value="$location" />
<input type="submit" value="Delete" />
</form>
@ -22,7 +28,8 @@
</ul>
#end if
<hr />
<form method="post" action="/consuming/$host/$service">
<form method="post"
action="/consuming/$host/$service">
<label>Location: <input name="put" /></label>
<input type="submit" value="Create New Location" />
</form>

2
ugly_hacks/santiago/protocols/https/templates/html/consuming.tmpl
View File

@ -1,3 +1,4 @@
#import cgi
<html>
<head>
<style>
@ -11,6 +12,7 @@
#if $hosts
<ul>
#for $host in $hosts
#set $host = $cgi.escape($host)
<li><a href="/consuming/$host">$host</a>
<form method="post" action="/consuming">
<input type="hidden" name="delete" value="$host" />

3
ugly_hacks/santiago/protocols/https/templates/html/hostedClient.tmpl
View File

@ -1,3 +1,5 @@
#import cgi
#set $client = $cgi.escape($client)
<html>
<head>
<style>
@ -11,6 +13,7 @@
#if $services
<ul>
#for $service in $services
#set $service = $cgi.escape(service)
<li><a href="/hosting/$client/$service">$service</a>
<form method="post" action="/hosting/$client">
<input type="hidden" name="delete" value="$service" />

4
ugly_hacks/santiago/protocols/https/templates/html/hostedService.tmpl
View File

@ -1,3 +1,6 @@
#import cgi
#set $client = $cgi.escape($client)
#set $service = $cgi.escape($service)
<html>
<head>
<style>
@ -12,6 +15,7 @@
#if $locations
<ul>
#for $location in $locations
#set $location = $cgi.escape($location)
<li><a href="$location">$location</a>
<form method="post" action="/hosting/$client/$service">
<input type="hidden" name="delete" value="$location" />

2
ugly_hacks/santiago/protocols/https/templates/html/hosting.tmpl
View File

@ -1,3 +1,4 @@
#import cgi
<html>
<head>
<style>
@ -11,6 +12,7 @@
<p>You are hosting services for:</p>
<ul>
#for $client in $clients
#set $client = $cgi.escape($client)
<li><a href="/hosting/$client">$client</a>
<form method="post" action="/hosting">
<input type="hidden" name="delete" value="$client" />