mirror of
https://github.com/freedombox/FreedomBox.git
synced 2026-01-21 07:55:00 +00:00
views: Don't send app to template context
- Improves template security as methods of the app object can't be called from within templates. Tests performed: - Visit a few app pages. - For each of the following template files, ensure that 'app' variable is not used: - app.html - All templates that extend app.html - Templates included from the above templates. Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org> Reviewed-by: Veiko Aasa <veiko17@disroot.org>
This commit is contained in:
parent
673bd367b0
commit
9a9c99da81
@ -190,7 +190,6 @@ class AppView(FormView):
|
||||
"""Add service to the context data."""
|
||||
context = super().get_context_data(*args, **kwargs)
|
||||
context.update(self._get_common_status())
|
||||
context['app'] = self.app # XXX: Remove this for template security
|
||||
context['app_id'] = self.app.app_id
|
||||
context['is_running'] = app_is_running(self.app)
|
||||
context['app_info'] = self.app.info
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user