altf4arnold/datatracker
1
0
Fork 0
Code Issues Pull requests Actions 3 Packages Projects Releases Wiki Activity

Removed an instance of 'autoescape off' for submitted meeting session comments in a template, since it is not needed in practice, in order to avoid an XSS injection opportunity.

Browse source 
- Legacy-Id: 17322
This commit is contained in:
Henrik Levkowetz 2020-02-21 15:32:41 +00:00
parent e2eb19934d
commit eb88abc394
1 changed files with 0 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
ietf/secr/templates/includes/sessions_request_view.html
View file

@ -33,7 +33,5 @@
<tr class="row1"> <tr class="row1">
<td>People who must be present:</td> <td>People who must be present:</td>
<td>{% if session.bethere %}<ul>{% for person in session.bethere %}<li>{{ person }}</li>{% endfor %}</ul>{% else %}<i>None</i>{% endif %}</td> <td>{% if session.bethere %}<ul>{% for person in session.bethere %}<li>{{ person }}</li>{% endfor %}</ul>{% else %}<i>None</i>{% endif %}</td>
{% autoescape off %}
<tr class="row2"><td>Special Requests:</td><td>{{ session.comments }}</td></tr> <tr class="row2"><td>Special Requests:</td><td>{{ session.comments }}</td></tr>
{% endautoescape %}
</table> </table>