This is an automated email from the ASF dual-hosted git repository. asf-gitbox-commits pushed a commit to branch db/8607 in repository https://gitbox.apache.org/repos/asf/allura.git
commit 324d4de114540ade281c22651f08b766cdc350cf Author: Dave Brondsema <[email protected]> AuthorDate: Tue May 12 16:43:57 2026 -0400 [#8607] escape html in a few places --- Allura/allura/templates/app_admin_permissions.html | 2 +- Allura/allura/templates/site_admin_new_projects.html | 2 +- Allura/allura/templates/site_admin_task_new.html | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/Allura/allura/templates/app_admin_permissions.html b/Allura/allura/templates/app_admin_permissions.html index 7433edec4..4cf9303d3 100644 --- a/Allura/allura/templates/app_admin_permissions.html +++ b/Allura/allura/templates/app_admin_permissions.html @@ -103,7 +103,7 @@ current_block_list.find('ul').append( '<li><label><input type="checkbox" value="' + data.user_id + '"name="user_id">' - + data.username + (data.reason ? ' (' + data.reason + ')' : '') + '</label></li>' + + escape_html(data.username) + (data.reason ? ' (' + escape_html(data.reason) + ')' : '') + '</label></li>' ); // show 'Block List' button current_block_list.parent('li').show(); diff --git a/Allura/allura/templates/site_admin_new_projects.html b/Allura/allura/templates/site_admin_new_projects.html index 8970ff2e3..1b954936b 100644 --- a/Allura/allura/templates/site_admin_new_projects.html +++ b/Allura/allura/templates/site_admin_new_projects.html @@ -170,7 +170,7 @@ flash(response.message, 'success'); form.remove(); var td = el.closest('tr').find('td:first'); - td.html('<p><strong>Notes:</strong>' + textarea.val() + '</p>'); + td.html('<p><strong>Notes:</strong>' + html_escape(textarea.val()) + '</p>'); el.remove(); }).fail(function (response){ flash(response.message, 'error'); diff --git a/Allura/allura/templates/site_admin_task_new.html b/Allura/allura/templates/site_admin_task_new.html index 3ee645d41..4ef47e223 100644 --- a/Allura/allura/templates/site_admin_task_new.html +++ b/Allura/allura/templates/site_admin_task_new.html @@ -117,10 +117,10 @@ $task.parent().siblings('.error').remove(); $('pre.doc').empty(); if (data.error) { - $task.parent().after('<span class="error">' + data.error + '</span>'); + $task.parent().after('<span class="error">' + escape_html(data.error) + '</span>'); } if (data.doc) { - $('pre.doc').html(data.doc); + $('pre.doc').text(data.doc); } }); });
