altf4arnold/datatracker
1
0
Fork 0
Code Issues Pull requests Actions 3 Packages Projects Releases Wiki Activity

Escape . in agenda url patterns. Guard against unrecognized extensions. Commit ready for merge.

Browse source 
- Legacy-Id: 19670
This commit is contained in:
Robert Sparks 2021-11-16 19:16:50 +00:00
parent cfe9d7f808
commit 58bd89c99e
2 changed files with 5 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
ietf/meeting/urls.py
View file

@ -64,9 +64,9 @@ type_interim_patterns = [
] ]
type_ietf_only_patterns_id_optional = [ type_ietf_only_patterns_id_optional = [
url(r'^agenda(?P<utc>-utc)?(?P<ext>.html)?/?$', views.agenda), url(r'^agenda(?P<utc>-utc)?(?P<ext>\.html)?/?$', views.agenda),
url(r'^agenda(?P<ext>.txt)$', views.agenda), url(r'^agenda(?P<ext>\.txt)$', views.agenda),
url(r'^agenda(?P<ext>.csv)$', views.agenda), url(r'^agenda(?P<ext>\.csv)$', views.agenda),
url(r'^agenda/edit$', url(r'^agenda/edit$',
RedirectView.as_view(pattern_name='ietf.meeting.views.edit_meeting_schedule', permanent=True), RedirectView.as_view(pattern_name='ietf.meeting.views.edit_meeting_schedule', permanent=True),
name='ietf.meeting.views.edit_meeting_schedule'), name='ietf.meeting.views.edit_meeting_schedule'),

2
ietf/meeting/views.py
View file

@ -1488,6 +1488,8 @@ def agenda(request, num=None, name=None, base=None, ext=None, owner=None, utc=""
".txt": "text/plain; charset=%s"%settings.DEFAULT_CHARSET, ".txt": "text/plain; charset=%s"%settings.DEFAULT_CHARSET,
".csv": "text/csv; charset=%s"%settings.DEFAULT_CHARSET, ".csv": "text/csv; charset=%s"%settings.DEFAULT_CHARSET,
} }
if ext not in mimetype:
raise Http404('Extension not allowed')
# We do not have the appropriate data in the datatracker for IETF 64 and earlier. # We do not have the appropriate data in the datatracker for IETF 64 and earlier.
# So that we're not producing misleading pages... # So that we're not producing misleading pages...