security: fix XSS in repo strip view.

2017-10-07 13:14:08 +02:00 · 2017-10-07 13:14:08 +02:00 · b900d908c5
commit b900d908c5
parent 7781eabe94
1 changed files with 2 additions and 2 deletions
--- a/rhodecode/apps/repository/views/repo_strip.py
+++ b/rhodecode/apps/repository/views/repo_strip.py
@ -70,8 +70,8 @@ class StripView(RepoAppView):
                    data[i] = {'rev': None, 'commit': h.escape(rp[chset])}
                else:
                    data[i] = {'rev': data[i].raw_id, 'branch': data[i].branch,
-                               'author': data[i].author,
-                               'comment': data[i].message}
+                               'author': h.escape(data[i].author),
+                               'comment': h.escape(data[i].message)}
            else:
                break
        return data