diff options
| author | Jack Magne <jmagne@localhost.localdomain> | 2015-05-12 13:49:00 -0700 |
|---|---|---|
| committer | Jack Magne <jmagne@localhost.localdomain> | 2015-05-15 17:07:35 -0700 |
| commit | dd4926b4083bcd8898aef703e316403036ce581b (patch) | |
| tree | 6fdb34850e94f2fe13ac5ebf74b1a713bb188260 /base/server/python | |
| parent | c0d14140aca982ac637d5fd34f1c3ddb23836867 (diff) | |
| download | pki-dd4926b4083bcd8898aef703e316403036ce581b.tar.gz pki-dd4926b4083bcd8898aef703e316403036ce581b.tar.xz pki-dd4926b4083bcd8898aef703e316403036ce581b.zip | |
Fix XSS attacks on the dogtag administration page #1373.
Porting this set of fixes over from last downstream release upstream.
Upon further review, decided to fix a few missing things pointed out by the code review and a few other things:
1. Too many copies of escapeJavaScriptString all over the place. Consolidated the two related functions "escapeJavaScriptString" and "escapeJavaScriptStringHTML" methods in the CMSTemplate class to be called everywhere. Removed the duplicated methods in other classes.
2. There were some places where "escapeJavaScriptString" was called, when we really wanted "escapeJavaScriptStringHTML". Fixed that everywhere. One reason for this is a copied version of "escapeJavaScriptString" actually was identical to CMSTemplate.escapeJavaScriptString, which has been removed.
XSS fixes.
Diffstat (limited to 'base/server/python')
0 files changed, 0 insertions, 0 deletions