shaba/awx
1
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2024-11-01 08:21:15 +03:00
Code Releases Activity

fix xss vulnerability when deleting labels

Browse Source
This commit is contained in:
John Mitchell 2016-06-29 14:40:53 -04:00
parent 9bd05abcf3
commit d539a6715c
2 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
awx/ui/client/src/job-templates/labels/labelsList.directive.js
View File

@ -7,7 +7,8 @@ export default
'ProcessErrors',
'Prompt',
'$q',
function(templateUrl, Wait, Rest, GetBasePath, ProcessErrors, Prompt, $q) {
'$filter',
function(templateUrl, Wait, Rest, GetBasePath, ProcessErrors, Prompt, $q, $filter) {
return {
restrict: 'E',
scope: false,
@ -65,7 +66,7 @@ export default
Prompt({
hdr: 'Remove Label from ' + templateName,
body: '<div class="Prompt-bodyQuery">Confirm the removal of the <span class="Prompt-emphasis">' + labelName + '</span> label.</div>',
body: '<div class="Prompt-bodyQuery">Confirm the removal of the <span class="Prompt-emphasis">' + $filter('sanitize')(labelName) + '</span> label.</div>',
action: action,
actionText: 'REMOVE'
});

7
awx/ui/client/src/shared/Utilities.js
View File

@ -608,8 +608,8 @@ angular.module('Utilities', ['RestServices', 'Utilities', 'sanitizeFilter'])
* ]
* ```
*/
.factory('CreateSelect2', [
function () {
.factory('CreateSelect2', ['$filter',
function ($filter) {
return function (params) {
var element = params.element,
@ -641,6 +641,9 @@ angular.module('Utilities', ['RestServices', 'Utilities', 'sanitizeFilter'])
containerCssClass: 'Form-dropDown',
width: '100%',
minimumResultsForSearch: Infinity,
escapeMarkup: function(m) {
return $filter('sanitize')(m);
}
};
// multiple-choice directive calls select2 but needs to do so without this custom adapter