CGM_Public/pretix_original
3
0
Fork 1
mirror of https://github.com/pretix/pretix.git synced 2026-08-25 13:12:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

[SECURITY] Properly escape HTML tags in PDF generation (CVE-2026-57535)

Browse Source
This commit is contained in:
Raphael Michel
2026-06-25 16:46:13 +02:00
parent eb068f524c
commit a8997f8971
7 changed files with 239 additions and 213 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pretix/base/pdf.py
+1 -1
View File
@@ -1067,7 +1067,7 @@ class Renderer:
except:
logger.exception('Reshaping/Bidi fixes failed on string {}'.format(repr(text)))
p = Paragraph(text, style=style)
p = Paragraph(text, style=style) # not using AutoEscapeParagraph is safe as we escape above
return p, ad, lineheight
def _draw_textcontainer(self, canvas: Canvas, op: OrderPosition, order: Order, o: dict):