CGM_Public/pretix_original
2
0
Fork 1
mirror of https://github.com/pretix/pretix.git synced 2026-05-09 15:54:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

[SECURITY] Fix XSS vulnerability in Lightbox caption

Browse Source
This commit is contained in:
Raphael Michel
2017-08-21 12:13:22 +02:00
parent 9a9bb92f91
commit fb398a5520
2 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/pretix/presale/templates/pretixpresale/event/index.html
View File

@@ -170,7 +170,8 @@
<div class="col-md-8 col-xs-12"> <div class="col-md-8 col-xs-12">
{% if item.picture %} {% if item.picture %}
<a href="{{ item.picture.url }}" class="productpicture" <a href="{{ item.picture.url }}" class="productpicture"
data-title="{{ item.name }}" data-title="{{ item.name|force_escape|force_escape }}"
{# Yes, double-escape to prevent XSS in lightbox #}
data-lightbox="{{ item.id }}"> data-lightbox="{{ item.id }}">
<img src="{{ item.picture|thumbnail_url:'productlist' }}" <img src="{{ item.picture|thumbnail_url:'productlist' }}"
alt="{{ item.name }}"/> alt="{{ item.name }}"/>
@@ -281,7 +282,8 @@
<div class="col-md-8 col-xs-12"> <div class="col-md-8 col-xs-12">
{% if item.picture %} {% if item.picture %}
<a href="{{ item.picture.url }}" class="productpicture" <a href="{{ item.picture.url }}" class="productpicture"
data-title="{{ item.name }}" data-title="{{ item.name|force_escape|force_escape }}"
{# Yes, double-escape to prevent XSS in lightbox #}
data-lightbox="{{ item.id }}"> data-lightbox="{{ item.id }}">
<img src="{{ item.picture|thumbnail_url:'productlist' }}" <img src="{{ item.picture|thumbnail_url:'productlist' }}"
alt="{{ item.name }}"/> alt="{{ item.name }}"/>

6
src/pretix/presale/templates/pretixpresale/event/voucher.html
View File

@@ -38,7 +38,8 @@
<div class="col-md-8 col-xs-12"> <div class="col-md-8 col-xs-12">
{% if item.picture %} {% if item.picture %}
<a href="{{ item.picture.url }}" class="productpicture" <a href="{{ item.picture.url }}" class="productpicture"
data-title="{{ item.name }}" data-title="{{ item.name|force_escape|force_escape }}"
{# Yes, double-escape to prevent XSS in lightbox #}
data-lightbox="{{ item.id }}"> data-lightbox="{{ item.id }}">
<img src="{{ item.picture|thumbnail_url:'productlist' }}" <img src="{{ item.picture|thumbnail_url:'productlist' }}"
alt="{{ item.name }}"/> alt="{{ item.name }}"/>
@@ -125,7 +126,8 @@
<div class="col-md-8 col-xs-12"> <div class="col-md-8 col-xs-12">
{% if item.picture %} {% if item.picture %}
<a href="{{ item.picture.url }}" class="productpicture" <a href="{{ item.picture.url }}" class="productpicture"
data-title="{{ item.name }}" data-title="{{ item.name|force_escape|force_escape }}"
{# Yes, double-escape to prevent XSS in lightbox #}
data-lightbox="{{ item.id }}"> data-lightbox="{{ item.id }}">
<img src="{{ item.picture|thumbnail_url:'productlist' }}" <img src="{{ item.picture|thumbnail_url:'productlist' }}"
alt="{{ item.name }}"/> alt="{{ item.name }}"/>