Update of /cvsroot/mailman/mailman/Mailman/Gui
In directory sc8-pr-cvs1:/tmp/cvs-serv27539/Mailman/Gui
Modified Files:
Tag: Release_2_1-maint
GUIBase.py Topics.py
Log Message:
handleForm(): Close some cross-site scripting holes found by Dirk
Mueller.
Index: GUIBase.py
===================================================================
RCS file: /cvsroot/mailman/mailman/Mailman/Gui/GUIBase.py,v
retrieving revision 2.6.2.1
retrieving revision 2.6.2.2
diff -u -d -r2.6.2.1 -r2.6.2.2
--- GUIBase.py 1 Dec 2003 01:29:58 -0000 2.6.2.1
+++ GUIBase.py 13 Dec 2003 16:27:42 -0000 2.6.2.2
@@ -1,4 +1,4 @@
-# Copyright (C) 2002 by the Free Software Foundation, Inc.
+# Copyright (C) 2002-2003 by the Free Software Foundation, Inc.
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
@@ -140,11 +140,11 @@
elif not cgidata.has_key(property):
continue
elif isinstance(cgidata[property], ListType):
- val = [x.value for x in cgidata[property]]
+ val = [Utils.websafe(x.value) for x in cgidata[property]]
else:
- val = cgidata[property].value
+ val = Utils.websafe(cgidata[property].value)
# Coerce the value to the expected type, raising exceptions if the
- # value is invalid
+ # value is invalid.
try:
val = self._getValidValue(mlist, property, wtype, val)
except ValueError:
Index: Topics.py
===================================================================
RCS file: /cvsroot/mailman/mailman/Mailman/Gui/Topics.py,v
retrieving revision 2.6.2.1
retrieving revision 2.6.2.2
diff -u -d -r2.6.2.1 -r2.6.2.2
--- Topics.py 1 Dec 2003 01:36:53 -0000 2.6.2.1
+++ Topics.py 13 Dec 2003 16:27:42 -0000 2.6.2.2
@@ -120,6 +120,7 @@
a pattern. Incomplete topics will be ignored."""))
continue
# Make sure the pattern was a legal regular expression
+ name = Utils.websafe(name)
try:
re.compile(pattern)
except (re.error, TypeError):
_______________________________________________
Mailman-checkins mailing list
[EMAIL PROTECTED]
Unsubscribe: http://mail.python.org/mailman/options/mailman-checkins/archive%40jab.org
