shaba/awx
1
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2024-10-31 23:51:09 +03:00
Code Releases Activity

fix xss in activity stream, resolves #2731

Browse Source
This commit is contained in:
Leigh Johnson 2016-07-01 08:28:35 -04:00
parent 2ff5efda3b
commit 1c49ad4641
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
awx/ui/client/src/widgets/Stream.js
View File

@ -22,11 +22,11 @@ angular.module('StreamWidget', ['RestServices', 'Utilities', 'StreamListDefiniti
'RefreshHelper', listGenerator.name, 'StreamWidget',
])
.factory('BuildAnchor', [ '$log',
.factory('BuildAnchor', [ '$log', '$filter',
// Returns a full <a href=''>resource_name</a> HTML string if link can be derived from supplied context
// returns name of resource if activity stream object doesn't contain enough data to build a UI url
// arguments are: a summary_field object, a resource type, an activity stream object
function ($log) {
function ($log, $filter) {
return function (obj, resource, activity) {
var url = '/#/';
// try/except pattern asserts that:
@ -75,11 +75,11 @@ angular.module('StreamWidget', ['RestServices', 'Utilities', 'StreamListDefiniti
default:
url += resource + 's/' + obj.id + '/';
}
return ' <a href=\"' + url + '\"> ' + (obj.name || obj.username) + ' </a> ';
return ' <a href=\"' + url + '\"> ' + $filter('sanitize')(obj.name || obj.username) + ' </a> ';
}
catch(err){
$log.debug(err);
return ' ' + (obj.name || obj.username || '') + ' ';
return ' ' + $filter('sanitize')(obj.name || obj.username || '') + ' ';
}
};
}