oci/zeronet
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Rev3861, Escape error detail to avoid XSS (reported by krzotr)

Browse source
This commit is contained in:
shortcutme 2019-04-11 00:48:16 +02:00
parent 5d81467083
commit c0d81021df
No known key found for this signature in database
GPG key ID: 5B63BAE6CB9613AE
2 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/Config.py
View file

@ -13,7 +13,7 @@ class Config(object):
def __init__(self, argv):
self.version = "0.6.5"
self.rev = 3860
self.rev = 3861
self.argv = argv
self.action = None
self.pending_changes = {}

6
src/Ui/UiRequest.py
View file

@ -799,12 +799,12 @@ class UiRequest(object):
# Send file not found error
def error404(self, path=""):
self.sendHeader(404)
return self.formatError("Not Found", cgi.escape(path.encode("utf8")), details=False)
return self.formatError("Not Found", path.encode("utf8"), details=False)
# Internal server error
def error500(self, message=":("):
self.sendHeader(500)
return self.formatError("Server error", cgi.escape(message))
return self.formatError("Server error", message)
def formatError(self, title, message, details=True):
import sys
@ -828,7 +828,7 @@ class UiRequest(object):
<h3>Please <a href="https://github.com/HelloZeroNet/ZeroNet/issues" target="_blank">report it</a> if you think this an error.</h3>
<h4>Details:</h4>
<pre>%s</pre>
""" % (title, message, json.dumps(details, indent=4, sort_keys=True))
""" % (title, cgi.escape(message), cgi.escape(json.dumps(details, indent=4, sort_keys=True)))
else:
return """
<h1>%s</h1>