CGM_Public/pretix_cgo
1
0
Fork 0
forked from CGM_Public/pretix_original
Code Pull Requests Actions Activity

Fix potential XSS in questions [not a vulnerability, thanks to CSP]

Browse Source
This commit is contained in:
Raphael Michel
2019-03-12 09:20:48 +01:00
parent bb956c13ba
commit affc6254a8
1 changed files with 12 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
src/pretix/base/forms/questions.py
View File

@@ -9,6 +9,7 @@ import vat_moss.id
from django import forms from django import forms
from django.contrib import messages from django.contrib import messages
from django.core.exceptions import ValidationError from django.core.exceptions import ValidationError
from django.utils.html import escape
from django.utils.safestring import mark_safe from django.utils.safestring import mark_safe
from django.utils.translation import ugettext_lazy as _ from django.utils.translation import ugettext_lazy as _
@@ -171,6 +172,7 @@ class BaseQuestionsForm(forms.Form):
initial = None initial = None
tz = pytz.timezone(event.settings.timezone) tz = pytz.timezone(event.settings.timezone)
help_text = rich_text(q.help_text) help_text = rich_text(q.help_text)
label = escape(q.question) # django-bootstrap3 calls mark_safe
if q.type == Question.TYPE_BOOLEAN: if q.type == Question.TYPE_BOOLEAN:
if q.required: if q.required:
# For some reason, django-bootstrap3 does not set the required attribute # For some reason, django-bootstrap3 does not set the required attribute
@@ -185,26 +187,26 @@ class BaseQuestionsForm(forms.Form):
initialbool = False initialbool = False
field = forms.BooleanField( field = forms.BooleanField(
label=q.question, required=q.required, label=label, required=q.required,
help_text=help_text, help_text=help_text,
initial=initialbool, widget=widget, initial=initialbool, widget=widget,
) )
elif q.type == Question.TYPE_NUMBER: elif q.type == Question.TYPE_NUMBER:
field = forms.DecimalField( field = forms.DecimalField(
label=q.question, required=q.required, label=label, required=q.required,
help_text=q.help_text, help_text=q.help_text,
initial=initial.answer if initial else None, initial=initial.answer if initial else None,
min_value=Decimal('0.00'), min_value=Decimal('0.00'),
) )
elif q.type == Question.TYPE_STRING: elif q.type == Question.TYPE_STRING:
field = forms.CharField( field = forms.CharField(
label=q.question, required=q.required, label=label, required=q.required,
help_text=help_text, help_text=help_text,
initial=initial.answer if initial else None, initial=initial.answer if initial else None,
) )
elif q.type == Question.TYPE_TEXT: elif q.type == Question.TYPE_TEXT:
field = forms.CharField( field = forms.CharField(
label=q.question, required=q.required, label=label, required=q.required,
help_text=help_text, help_text=help_text,
widget=forms.Textarea, widget=forms.Textarea,
initial=initial.answer if initial else None, initial=initial.answer if initial else None,
@@ -212,7 +214,7 @@ class BaseQuestionsForm(forms.Form):
elif q.type == Question.TYPE_CHOICE: elif q.type == Question.TYPE_CHOICE:
field = forms.ModelChoiceField( field = forms.ModelChoiceField(
queryset=q.options, queryset=q.options,
label=q.question, required=q.required, label=label, required=q.required,
help_text=help_text, help_text=help_text,
widget=forms.Select, widget=forms.Select,
empty_label='', empty_label='',
@@ -221,35 +223,35 @@ class BaseQuestionsForm(forms.Form):
elif q.type == Question.TYPE_CHOICE_MULTIPLE: elif q.type == Question.TYPE_CHOICE_MULTIPLE:
field = forms.ModelMultipleChoiceField( field = forms.ModelMultipleChoiceField(
queryset=q.options, queryset=q.options,
label=q.question, required=q.required, label=label, required=q.required,
help_text=help_text, help_text=help_text,
widget=forms.CheckboxSelectMultiple, widget=forms.CheckboxSelectMultiple,
initial=initial.options.all() if initial else None, initial=initial.options.all() if initial else None,
) )
elif q.type == Question.TYPE_FILE: elif q.type == Question.TYPE_FILE:
field = forms.FileField( field = forms.FileField(
label=q.question, required=q.required, label=label, required=q.required,
help_text=help_text, help_text=help_text,
initial=initial.file if initial else None, initial=initial.file if initial else None,
widget=UploadedFileWidget(position=pos, event=event, answer=initial), widget=UploadedFileWidget(position=pos, event=event, answer=initial),
) )
elif q.type == Question.TYPE_DATE: elif q.type == Question.TYPE_DATE:
field = forms.DateField( field = forms.DateField(
label=q.question, required=q.required, label=label, required=q.required,
help_text=help_text, help_text=help_text,
initial=dateutil.parser.parse(initial.answer).date() if initial and initial.answer else None, initial=dateutil.parser.parse(initial.answer).date() if initial and initial.answer else None,
widget=DatePickerWidget(), widget=DatePickerWidget(),
) )
elif q.type == Question.TYPE_TIME: elif q.type == Question.TYPE_TIME:
field = forms.TimeField( field = forms.TimeField(
label=q.question, required=q.required, label=label, required=q.required,
help_text=help_text, help_text=help_text,
initial=dateutil.parser.parse(initial.answer).time() if initial and initial.answer else None, initial=dateutil.parser.parse(initial.answer).time() if initial and initial.answer else None,
widget=TimePickerWidget(time_format=get_format_without_seconds('TIME_INPUT_FORMATS')), widget=TimePickerWidget(time_format=get_format_without_seconds('TIME_INPUT_FORMATS')),
) )
elif q.type == Question.TYPE_DATETIME: elif q.type == Question.TYPE_DATETIME:
field = SplitDateTimeField( field = SplitDateTimeField(
label=q.question, required=q.required, label=label, required=q.required,
help_text=help_text, help_text=help_text,
initial=dateutil.parser.parse(initial.answer).astimezone(tz) if initial and initial.answer else None, initial=dateutil.parser.parse(initial.answer).astimezone(tz) if initial and initial.answer else None,
widget=SplitDateTimePickerWidget(time_format=get_format_without_seconds('TIME_INPUT_FORMATS')), widget=SplitDateTimePickerWidget(time_format=get_format_without_seconds('TIME_INPUT_FORMATS')),