altf4arnold/datatracker
1
0
Fork 0
Code Issues Pull requests Actions 3 Packages Projects Releases Wiki Activity

fix: protect htmlize and opengraph templates from fake dochistory objects (#5764)

Browse source
This commit is contained in:
Robert Sparks 2023-06-05 20:19:25 -05:00 committed by GitHub
parent cfaf966492
commit 3fc77633a7
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 5 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
ietf/templates/doc/document_info.html
View file

@ -100,7 +100,7 @@
{% endif %}
<tr>
<td></td>
<th scope="row">Author{{ doc.authors|pluralize }}</th>
<th scope="row">Author{% if doc.pk %}{{ doc.authors|pluralize }}{% endif %}</th>
<td class="edit">
{% if can_edit_authors %}
<a class="btn btn-primary btn-sm"
@ -109,9 +109,9 @@
</td>
<td>
{# Implementation that uses the current primary email for each author #}
{% for author in doc.authors %}
{% if doc.pk %}{% for author in doc.authors %}
{% person_link author %}{% if not forloop.last %},{% endif %}
{% endfor %}
{% endfor %}{% endif %}
{% if document_html and not snapshot or document_html and doc.rev == latest_rev%}
<br>
<a class="btn btn-primary btn-sm mt-1" href="mailto:{{ doc.name }}@ietf.org?subject={{ doc.name}}" title="Send email to the document authors">Email authors</a>

4
ietf/templates/doc/opengraph.html
View file

@ -36,7 +36,7 @@
{% else %}{# TODO: We need a card image for individual I-Ds. #}
<meta property="article:section" content="Individual Internet-Draft">
{% endif %}
{% for author in doc.documentauthor_set.all %}<meta property="article:author" content="{{ author.person.name}}">
{% endfor %}
{% if doc.pk %}{% for author in doc.documentauthor_set.all %}<meta property="article:author" content="{{ author.person.name}}">
{% endfor %}{% endif %}
{% if published %}<meta property="article:published_time" content="{{ published.time|date:'Y-m-d' }}">{% endif %}
{% if expires %}<meta property="article:expiration_time" content="{{ expires.time|date:'Y-m-d' }}">{% endif %}