Changeset b25817 in indico

Timestamp:

05/12/10 15:30:48 (3 years ago)

Author:

Jose Benito <jose.benito.gonzalez@…>

Branches:

master, burotel, hello-world-walkthrough, ipv6, new-webex, v0.97-series, v0.98-series, v0.98.2, v0.98.3, v0.98b1, v0.98b2, v0.99, 051b2622c51afb171a1dedb46a0df4fbb0cbd02e, d9941f8582b36b24821a11ea5ba16fda6a457fb1

Children:

53b65f

Parents:

a217dc

git-author:

Jose Benito <jose.benito.gonzalez@…> (05/12/10 15:09:31)

git-committer:

Jose Benito <jose.benito.gonzalez@…> (05/12/10 15:30:48)

Message:

[FIX] Security problem allowing embed tags

File:

• indico/MaKaC/webinterface/common/tools.py (modified) (7 diffs)

indico/MaKaC/webinterface/common/tools.py

@@ -45 +45 @@
 notAllowedTags = [ "applet",
                    "base", "basefont", "button",
-                   "form", "frame", "frameset", 
+                   "form", "frame", "frameset",
                    "head",
                    "iframe", "input", "isindex",
                    "label", "link",
-                   "meta", 
+                   "meta",
                    "noframe", "noscript",
                    "object", "optgroup", "option"
@@ -55 +55 @@
                    "script", "select",
                    "textarea",
-                   "title"]
-                   
+                   "title", "embed"]
+
 
 # Generate the regular expression objects to found the not allowed tags
@@ -167 +167 @@
         " => "
         " => '
-        
+
         Also replaces '\xc2\xa0' (a kind of space char) by ' '
     """
@@ -174 +174 @@
 # Routine by Micah D. Cochran
 # Submitted on 26 Aug 2005
-# This routine is allowed to be put under any license Open Source (GPL, BSD, LGPL, etc.) License 
+# This routine is allowed to be put under any license Open Source (GPL, BSD, LGPL, etc.) License
 # or any Propriety License. Effectively this routine is in public domain. Please attribute where appropriate.
 
@@ -181 +181 @@
         Inputs: s --> string of text
         Outputs: text string without the tags
-    
+
         # doctest unit testing framework
 
@@ -188 +188 @@
         'Keep this Text  KEEP  123'
     """
-    
+
     # convert in_text to a mutable object (e.g. list)
     s_list = list(in_text)
     i = 0
-    
+
     while i < len(s_list):
         # iterate until a left-angle bracket is found
@@ -203 +203 @@
                 Logger.get('strip_ml_tags').debug("Not found '>' (the end of the html tag): %s"%e)
                 continue
-                
+
             # pops the right-angle bracket, too
             s_list.pop(i)
         else:
             i=i+1
-            
+
     # convert the list back into text
     join_char=''