engineering/unrhodecode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

security: fix self-xss inside the email add functionality.

Browse source
This commit is contained in:
Marcin Lulek 2017-06-20 20:59:58 +02:00
parent 3aa700c435
commit a9ea42785b
2 changed files with 2 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

3
rhodecode/apps/admin/views/users.py
View file

@ -291,8 +291,7 @@ class AdminUsersView(BaseAppView, DataGridAppView):
h.flash(_("Added new email address `%s` for user account") % email,
category='success')
except formencode.Invalid as error:
msg = error.error_dict['email']
h.flash(msg, category='error')
h.flash(h.escape(error.error_dict['email']), category='error')
except Exception:
log.exception("Exception during email saving")
h.flash(_('An error occurred during email saving'),

3
rhodecode/apps/my_account/views.py
View file

@ -253,8 +253,7 @@ class MyAccountView(BaseAppView):
h.flash(_("Added new email address `%s` for user account") % email,
category='success')
except formencode.Invalid as error:
msg = error.error_dict['email']
h.flash(msg, category='error')
h.flash(h.escape(error.error_dict['email']), category='error')
except Exception:
log.exception("Exception in my_account_emails")
h.flash(_('An error occurred during email saving'),