security: fix self-xss on modifing gist filename.

2017-07-24 12:49:38 +02:00 · 2017-07-24 12:49:38 +02:00 · b253e2b02e
commit b253e2b02e
parent 3b524b7875
1 changed files with 1 additions and 1 deletions
--- a/rhodecode/apps/gist/views.py
+++ b/rhodecode/apps/gist/views.py
@ -378,7 +378,7 @@ class GistView(BaseAppView):
            Session().commit()
            h.flash(_('Successfully updated gist data'), category='success')
        except validation_schema.Invalid as errors:
-            errors = errors.asdict()
+            errors = h.escape(errors.asdict())
            h.flash(_('Error occurred during update of gist {}: {}').format(
                gist_id, errors), category='error')
        except Exception: