From 25eaf8d625a5e9912340d9902bbac443818bfc57 Mon Sep 17 00:00:00 2001 From: Raphael Michel Date: Thu, 17 Feb 2022 22:19:15 +0100 Subject: [PATCH] [SECURITY] Fix stored XSS in help texts --- src/pretix/base/forms/questions.py | 2 +- src/pretix/presale/forms/checkout.py | 5 +++-- src/pretix/presale/forms/waitinglist.py | 3 ++- 3 files changed, 6 insertions(+), 4 deletions(-) diff --git a/src/pretix/base/forms/questions.py b/src/pretix/base/forms/questions.py index 1744641b76..28455199c7 100644 --- a/src/pretix/base/forms/questions.py +++ b/src/pretix/base/forms/questions.py @@ -674,7 +674,7 @@ class BaseQuestionsForm(forms.Form): label=label, required=required, min_value=q.valid_number_min or Decimal('0.00'), max_value=q.valid_number_max, - help_text=q.help_text, + help_text=help_text, initial=initial.answer if initial else None, ) elif q.type == Question.TYPE_STRING: diff --git a/src/pretix/presale/forms/checkout.py b/src/pretix/presale/forms/checkout.py index 1729f2231d..868ad4c9ec 100644 --- a/src/pretix/presale/forms/checkout.py +++ b/src/pretix/presale/forms/checkout.py @@ -51,6 +51,7 @@ from pretix.base.forms.questions import ( guess_country, ) from pretix.base.i18n import get_babel_locale, language +from pretix.base.templatetags.rich_text import rich_text from pretix.base.validators import EmailBanlistValidator from pretix.presale.signals import contact_form_fields @@ -89,7 +90,7 @@ class ContactForm(forms.Form): self.fields['phone'] = PhoneNumberField( label=_('Phone number'), required=self.event.settings.order_phone_required, - help_text=self.event.settings.checkout_phone_helptext, + help_text=rich_text(self.event.settings.checkout_phone_helptext), # We now exploit an implementation detail in PhoneNumberPrefixWidget to allow us to pass just # a country code but no number as an initial value. It's a bit hacky, but should be stable for # the future. @@ -102,7 +103,7 @@ class ContactForm(forms.Form): # is an autofocus field. Who would have thought… See e.g. here: # https://floatboxjs.com/forum/topic.php?post=8440&usebb_sid=2e116486a9ec6b7070e045aea8cded5b#post8440 self.fields['email'].widget.attrs['autofocus'] = 'autofocus' - self.fields['email'].help_text = self.event.settings.checkout_email_helptext + self.fields['email'].help_text = rich_text(self.event.settings.checkout_email_helptext) responses = contact_form_fields.send(self.event, request=self.request) for r, response in responses: diff --git a/src/pretix/presale/forms/waitinglist.py b/src/pretix/presale/forms/waitinglist.py index 386c39b90f..f2c916f364 100644 --- a/src/pretix/presale/forms/waitinglist.py +++ b/src/pretix/presale/forms/waitinglist.py @@ -30,6 +30,7 @@ from pretix.base.forms.questions import ( ) from pretix.base.i18n import get_babel_locale, language from pretix.base.models import Quota, WaitingListEntry +from pretix.base.templatetags.rich_text import rich_text from pretix.presale.views.event import get_grouped_items @@ -105,7 +106,7 @@ class WaitingListForm(forms.ModelForm): self.fields['phone'] = PhoneNumberField( label=_("Phone number"), required=event.settings.waiting_list_phones_required, - help_text=event.settings.waiting_list_phones_explanation_text, + help_text=rich_text(event.settings.waiting_list_phones_explanation_text), widget=WrappedPhoneNumberPrefixWidget() ) else: