diff options
author | Carl Meyer <carl@oddbird.net> | 2011-02-09 02:48:48 +0000 |
---|---|---|
committer | Carl Meyer <carl@oddbird.net> | 2011-02-09 02:48:48 +0000 |
commit | 1966786d2dde73e17f39cf340eb33fcb5d73904e (patch) | |
tree | c0e0dcb03a006dd8de7d49ce82f78ba8746dbf09 | |
parent | 570a32a047ea56265646217264b0d3dab1a14dbd (diff) | |
download | django-1966786d2dde73e17f39cf340eb33fcb5d73904e.tar.gz |
[1.1.X] Fixed security issue in AdminFileWidget. Release and disclosure forthcoming.
git-svn-id: http://code.djangoproject.com/svn/django/branches/releases/1.1.X@15472 bcc190cf-cafb-0310-a4f2-bffc1f526a37
-rw-r--r-- | django/contrib/admin/widgets.py | 2 | ||||
-rw-r--r-- | tests/regressiontests/admin_widgets/tests.py | 16 |
2 files changed, 17 insertions, 1 deletions
diff --git a/django/contrib/admin/widgets.py b/django/contrib/admin/widgets.py index 17067346f6..228b592fda 100644 --- a/django/contrib/admin/widgets.py +++ b/django/contrib/admin/widgets.py @@ -93,7 +93,7 @@ class AdminFileWidget(forms.FileInput): output = [] if value and hasattr(value, "url"): output.append('%s <a target="_blank" href="%s">%s</a> <br />%s ' % \ - (_('Currently:'), value.url, value, _('Change:'))) + (_('Currently:'), escape(value.url), escape(value), _('Change:'))) output.append(super(AdminFileWidget, self).render(name, value, attrs)) return mark_safe(u''.join(output)) diff --git a/tests/regressiontests/admin_widgets/tests.py b/tests/regressiontests/admin_widgets/tests.py index 64e12e3eaa..e69e5d2b71 100644 --- a/tests/regressiontests/admin_widgets/tests.py +++ b/tests/regressiontests/admin_widgets/tests.py @@ -154,3 +154,19 @@ class AdminForeignKeyRawIdWidget(DjangoTestCase): post_data) self.assertContains(response, 'Select a valid choice. That choice is not one of the available choices.') + +class AdminFileWidgetTest(DjangoTestCase): + def test_render_escapes_html(self): + class StrangeFieldFile(object): + url = "something?chapter=1§=2©=3&lang=en" + + def __unicode__(self): + return u'''something<div onclick="alert('oops')">.jpg''' + + widget = widgets.AdminFileWidget() + field = StrangeFieldFile() + output = widget.render('myfile', field) + self.assertFalse(field.url in output) + self.assertTrue(u'href="something?chapter=1&sect=2&copy=3&lang=en"' in output) + self.assertFalse(unicode(field) in output) + self.assertTrue(u'something<div onclick="alert('oops')">.jpg' in output) |