diff options
| author | bwarsaw <> | 2006-08-30 14:54:22 +0000 |
|---|---|---|
| committer | bwarsaw <> | 2006-08-30 14:54:22 +0000 |
| commit | 0cee915eeb5f8f99ed036d257b1103c28373eb5b (patch) | |
| tree | 1489a315aaa485d4c1aa91762b63a232fb23149d /Mailman/HTMLFormatter.py | |
| parent | 14bb48657eae40f5ef80adeebd021d6a186e2cd2 (diff) | |
| download | mailman2-0cee915eeb5f8f99ed036d257b1103c28373eb5b.tar.gz mailman2-0cee915eeb5f8f99ed036d257b1103c28373eb5b.tar.xz mailman2-0cee915eeb5f8f99ed036d257b1103c28373eb5b.zip | |
CVE-2006-3636. Fixes for various cross-site scripting issues. Discovery by
Moritz Naumann and most of the repair work done by Mark Sapiro (with some
additional work by Barry).
Diffstat (limited to '')
| -rw-r--r-- | Mailman/HTMLFormatter.py | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/Mailman/HTMLFormatter.py b/Mailman/HTMLFormatter.py index e6afda9b..99ed96da 100644 --- a/Mailman/HTMLFormatter.py +++ b/Mailman/HTMLFormatter.py @@ -1,4 +1,4 @@ -# Copyright (C) 1998-2003 by the Free Software Foundation, Inc. +# Copyright (C) 1998-2006 by the Free Software Foundation, Inc. # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License @@ -12,7 +12,8 @@ # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software -# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, +# USA. """Routines for presentation of list-specific HTML text.""" @@ -332,8 +333,12 @@ class HTMLFormatter: return '</FORM>' def FormatBox(self, name, size=20, value=''): + if isinstance(value, str): + safevalue = Utils.websafe(value) + else: + safevalue = value return '<INPUT type="Text" name="%s" size="%d" value="%s">' % ( - name, size, value) + name, size, safevalue) def FormatSecureBox(self, name): return '<INPUT type="Password" name="%s" size="15">' % name |