From b900d908c5616ac11c707e4d6f91041debbdfb33 Mon Sep 17 00:00:00 2001 From: Marcin Lulek Date: Sat, 7 Oct 2017 13:14:08 +0200 Subject: [PATCH] security: fix XSS in repo strip view. --- rhodecode/apps/repository/views/repo_strip.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rhodecode/apps/repository/views/repo_strip.py b/rhodecode/apps/repository/views/repo_strip.py index 9828e5b5..a0242736 100644 --- a/rhodecode/apps/repository/views/repo_strip.py +++ b/rhodecode/apps/repository/views/repo_strip.py @@ -70,8 +70,8 @@ class StripView(RepoAppView): data[i] = {'rev': None, 'commit': h.escape(rp[chset])} else: data[i] = {'rev': data[i].raw_id, 'branch': data[i].branch, - 'author': data[i].author, - 'comment': data[i].message} + 'author': h.escape(data[i].author), + 'comment': h.escape(data[i].message)} else: break return data