Github/stackdump
1
0
Fork 0
mirror of https://github.com/djohnlewis/stackdump synced 2025-04-07 10:13:27 +00:00
Code Issues Projects Releases Wiki Activity

Enabled template autoescaping by default.

Browse Source
This commit is contained in:
Samuel Lai 2011-11-05 18:52:49 +11:00
parent a2614220ae
commit f8a6e7c455
1 changed files with 12 additions and 3 deletions

15
python/src/stackdump/app.py

@ -31,7 +31,14 @@ def uses_templates(fn):
''' '''
def init_templates(): def init_templates():
if not hasattr(thread_locals, 'template_env'): if not hasattr(thread_locals, 'template_env'):
thread_locals.template_env = Environment(loader=PackageLoader('stackdump', 'templates')) thread_locals.template_env = Environment(
loader=PackageLoader('stackdump', 'templates'),
# always auto-escape.
autoescape=lambda template_name: True,
# but allow auto-escaping to be disabled explicitly within the
# template.
extensions=['jinja2.ext.autoescape']
)
if not fn: if not fn:
init_templates() init_templates()
@ -147,6 +154,7 @@ def site_index(site_key):
@uses_templates @uses_templates
@uses_solr @uses_solr
def search(): def search():
# TODO: scrub this first to avoid Solr injection attacks?
query = request.GET.get('q') query = request.GET.get('q')
if not query: if not query:
redirect(settings.APP_URL_ROOT) redirect(settings.APP_URL_ROOT)
@ -158,7 +166,7 @@ def search():
results = solr_conn().search(query, start=page*rows_per_page, rows=rows_per_page) results = solr_conn().search(query, start=page*rows_per_page, rows=rows_per_page)
context = { } context = { }
# TODO: scrub this first to avoid injection attacks? # TODO: scrub this first to avoid HTML injection attacks?
context['query'] = query context['query'] = query
context['results'] = results context['results'] = results
@ -176,6 +184,7 @@ def site_search(site_key):
except SQLObjectNotFound: except SQLObjectNotFound:
raise HTTPError(code=404, output='No site exists with the key %s.' % site_key) raise HTTPError(code=404, output='No site exists with the key %s.' % site_key)
# TODO: scrub this first to avoid Solr injection attacks?
query = request.GET.get('q') query = request.GET.get('q')
if not query: if not query:
redirect(settings.APP_URL_ROOT) redirect(settings.APP_URL_ROOT)
@ -186,7 +195,7 @@ def site_search(site_key):
# perform search # perform search
results = solr_conn().search(query, start=page*rows_per_page, rows=rows_per_page) results = solr_conn().search(query, start=page*rows_per_page, rows=rows_per_page)
# TODO: scrub this first to avoid injection attacks? # TODO: scrub this first to avoid HTML injection attacks?
context['query'] = query context['query'] = query
context['results'] = results context['results'] = results