From 217cb4defc96b99da79691e0bf587cfb94f42245 Mon Sep 17 00:00:00 2001 From: Marcin Lulek Date: Tue, 7 Jul 2020 15:29:17 +0200 Subject: [PATCH] branch-permissions: protect from XSS on branch rules forbidden flash message. --- rhodecode/apps/repository/views/repo_files.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rhodecode/apps/repository/views/repo_files.py b/rhodecode/apps/repository/views/repo_files.py index 2e3f5a15..d09fa282 100644 --- a/rhodecode/apps/repository/views/repo_files.py +++ b/rhodecode/apps/repository/views/repo_files.py @@ -125,7 +125,7 @@ class RepoFilesView(RepoAppView): self.db_repo_name, branch_name) if branch_perm and branch_perm not in ['branch.push', 'branch.push_force']: message = _('Branch `{}` changes forbidden by rule {}.').format( - h.escape(branch_name), rule) + h.escape(branch_name), h.escape(rule)) h.flash(message, 'warning') if json_mode: