kallithea Files · kallithea/templates/data_table/_dt

Files @ c7728c5736fd

Branch filter:

Location: kallithea/kallithea/templates/data_table/_dt_elements.html

c7728c5736fd 6.0 KiB text/html Show Annotation Show as Raw Download as Raw

Thomas De Schampheleire

templates: narrow down scope of webhelpers.html.literal for HTML injection

When using webhelpers.html.literal to inject some explicit HTML code with
some variable data, there are two approaches:
h.literal('some <html> code with %s data' % foobar)
or
h.literal('some <html> code with %s data') % foobar

In the first case, the literal also applies to the contents of variable
'foobar' which may be influenceable by users and thus potentially malicious.
In the second case, this term will be escaped by webhelpers.

See also the documentation:
https://docs.pylonsproject.org/projects/webhelpers/en/latest/modules/html/builder.html#webhelpers.html.builder.literal
"Also, if you add another string to this string, the other string will
be quoted and you will get back another literal object. Also
literal(...) % obj will quote any value(s) from obj."

In files_browser.html, the correction of this scope of literal() also means
that explicit escaping of node.name can be removed. The escaping is now done
automatically by webhelpers as mentioned above.

## DATA TABLE RE USABLE ELEMENTS
## usage:
## <%namespace name="dt" file="/data_table/_dt_elements.html"/>

<%namespace name="base" file="/base/base.html"/>

<%def name="repo_name(name,rtype,rstate,private,fork_of,short_name=False)">
    <%
    def get_name(name,short_name=short_name):
      if short_name:
        return name.split('/')[-1]
      else:
        return name
    %>
  <div class="dt_repo ${'dt_repo_pending' if rstate == 'repo_state_pending' else ''}">
    ${base.repolabel(rtype)}
    <a href="${h.url('summary_home', repo_name=name)}">
        ${get_name(name)}
    </a>
    %if private and c.visual.show_private_icon:
      <i class="icon-lock" title="${_('Private repository')}"></i>
    %elif not private and c.visual.show_public_icon:
      <i class="icon-globe" title="${_('Public repository')}"></i>
    %endif
    %if fork_of:
      <a href="${h.url('summary_home',repo_name=fork_of.repo_name)}"><i class="icon-fork"></i></a>
    %endif
    %if rstate == 'repo_state_pending':
      <i class="icon-wrench" title="${_('Repository creation in progress...')}"></i>
    %endif
  </div>
</%def>

<%def name="last_change(last_change)">
  <span data-toggle="tooltip" title="${h.fmt_date(last_change)}" date="${last_change}">${h.age(last_change)}</span>
</%def>

<%def name="revision(name,rev,tip,author,last_msg)">
  %if rev >= 0:
      <a data-toggle="popover" title="${author | entity}" data-content="${last_msg | entity}" class="changeset_hash" href="${h.url('changeset_home',repo_name=name,revision=tip)}">${'r%s:%s' % (rev,h.short_id(tip))}</a>
  %else:
      ${_('No changesets yet')}
  %endif
</%def>

<%def name="rss(name)">
  %if request.authuser.username != 'default':
    <a title="${_('Subscribe to %s rss feed')% name}" href="${h.url('rss_feed_home',repo_name=name,api_key=request.authuser.api_key)}"><i class="icon-rss-squared"></i></a>
  %else:
    <a title="${_('Subscribe to %s rss feed')% name}" href="${h.url('rss_feed_home',repo_name=name)}"><i class="icon-rss-squared"></i></a>
  %endif
</%def>

<%def name="atom(name)">
  %if request.authuser.username != 'default':
    <a title="${_('Subscribe to %s atom feed')% name}" href="${h.url('atom_feed_home',repo_name=name,api_key=request.authuser.api_key)}"><i class="icon-rss-squared"></i></a>
  %else:
    <a title="${_('Subscribe to %s atom feed')% name}" href="${h.url('atom_feed_home',repo_name=name)}"><i class="icon-rss-squared"></i></a>
  %endif
</%def>

<%def name="repo_actions(repo_name)">
      <a href="${h.url('edit_repo',repo_name=repo_name)}" title="${_('Edit')}" class="btn btn-default btn-xs">
        <i class="icon-pencil"></i>${_('Edit')}
      </a>
      ${h.form(h.url('delete_repo', repo_name=repo_name))}
        <button name="${'remove_%s' % repo_name}" class="btn btn-default btn-xs"
            onclick="return confirm('${_('Confirm to delete this repository: %s') % repo_name}');">
          <i class="icon-trashcan"></i>${_('Delete')}
        </button>
      ${h.end_form()}
</%def>

<%def name="repo_state(repo_state)">
    %if repo_state == u'repo_state_pending':
        <div class="label label-info">${_('Creating')}</div>
    %elif repo_state == u'repo_state_created':
        <div class="label label-success">${_('Created')}</div>
    %else:
        <div class="label label-danger" title="${repo_state}">invalid</div>
    %endif
</%def>

<%def name="user_actions(user_id, username)">
   <a href="${h.url('edit_user',id=user_id)}" title="${_('Edit')}" class="btn btn-default btn-xs">
     <i class="icon-pencil"></i>${_('Edit')}
   </a>
  ${h.form(h.url('delete_user', id=user_id))}
    <button id="${'remove_user_%s' % user_id}" name="${'remove_user_%s' % repo_name}" class="btn btn-default btn-xs" title="${_('Delete')}"
        onclick="return confirm('${_('Confirm to delete this user: %s') % username}');">
      <i class="icon-trashcan"></i>${_('Delete')}
    </button>
  ${h.end_form()}
</%def>

<%def name="user_group_actions(user_group_id, user_group_name)">
    <a href="${h.url('edit_users_group', id=user_group_id)}" title="${_('Edit')}" class="btn btn-default btn-xs">
      <i class="icon-pencil"></i>${_('Edit')}
    </a>
    ${h.form(h.url('delete_users_group', id=user_group_id))}
      <button id="${'remove_group_%s' % user_group_id}" name="${'remove_user_%s' % repo_name}" class="btn btn-default btn-xs" title="${_('Delete')}"
          onclick="return confirm('${_('Confirm to delete this user group: %s') % user_group_name}');">
        <i class="icon-trashcan"></i>${_('Delete')}
      </button>
    ${h.end_form()}
</%def>

<%def name="group_name_html(group_name,name)">
  <div class="dt_repo">
    <i class="icon-folder"></i>
    <a href="${h.url('repos_group_home',group_name=group_name)}">${name}</a>
  </div>
</%def>

<%def name="repo_group_actions(repo_group_id, repo_group_name, gr_count)">
    <a href="${h.url('edit_repo_group',group_name=repo_group_name)}" title="${_('Edit')}" class="btn btn-default btn-xs">
      <i class="icon-pencil"></i>${_('Edit')}
    </a>
    ${h.form(h.url('delete_repo_group', group_name=repo_group_name))}
      <button id="${'remove_%s' % repo_group_name}" name="${'remove_%s' % repo_group_name}" class="btn btn-default btn-xs" title="${_('Delete')}"
          onclick="return confirm('${ungettext('Confirm to delete this group: %s with %s repository','Confirm to delete this group: %s with %s repositories',gr_count) % (repo_group_name, gr_count)}')">
        <i class="icon-trashcan"></i>${_('Delete')}
      </button>
    ${h.end_form()}
</%def>

<%def name="user_name(user_id, username)">
    ${h.link_to(username,h.url('edit_user', id=user_id))}
</%def>

<%def name="repo_group_name(repo_group_name, children_groups)">
  <div class="text-nowrap">
  <a href="${h.url('repos_group_home',group_name=repo_group_name)}">
    <i class="icon-folder" title="${_('Repository group')}"></i>${h.literal(' &raquo; ').join(children_groups)}</a>
  </div>
</%def>

<%def name="user_group_name(user_group_id, user_group_name)">
  <div class="text-nowrap">
  <a href="${h.url('edit_users_group', id=user_group_id)}">
    <i class="icon-users" title="${_('User group')}"></i>${user_group_name}</a>
  </div>
</%def>