From 21fb4a712415d6d6cf7329cde96b2e2de05fd6a2 Mon Sep 17 00:00:00 2001 From: Marcin Kuzminski Date: Mon, 26 Aug 2019 16:58:25 +0200 Subject: [PATCH] security: fixed XSS in file editing. --- rhodecode/apps/repository/views/repo_files.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rhodecode/apps/repository/views/repo_files.py b/rhodecode/apps/repository/views/repo_files.py index 4d51cd05..f728f9ba 100644 --- a/rhodecode/apps/repository/views/repo_files.py +++ b/rhodecode/apps/repository/views/repo_files.py @@ -1250,7 +1250,7 @@ class RepoFilesView(RepoAppView): default_redirect_url = h.route_path('repo_commit', repo_name=self.db_repo_name, commit_id=commit_id) if content == old_content and node_path == org_node_path: - h.flash(_('No changes detected on {}').format(org_node_path), + h.flash(_('No changes detected on {}').format(h.escape(org_node_path)), category='warning') raise HTTPFound(default_redirect_url)