opensource/galaxy
3
0
Fork 0
mirror of https://github.com/galaxyproject/galaxy.git synced 2026-09-24 16:30:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix action token sending for chracters that are escaped in html

Browse Source 
The function body of escape is
```
def escape(s):
    """Replace the characters ``&``, ``<``, ``>``, ``'``, and ``"`` in
    the string with HTML-safe sequences. Use this if you need to display
    text that might contain such characters in HTML.

    If the object has an ``__html__`` method, it is called and the
    return value is assumed to already be safe for HTML.

    :param s: An object to be converted to a string and escaped.
    :return: A :class:`Markup` string with the escaped text.
    """
    if hasattr(s, "__html__"):
        return Markup(s.__html__())
    return Markup(
        text_type(s)
        .replace("&", "&amp;")
        .replace(">", "&gt;")
        .replace("<", "&lt;")
        .replace("'", "&#39;")
        .replace('"', "&#34;")
    )
```
It doesn't make sense to lookup the replaced values in the database,
and it breaks single-quotes in the email username portion, which is
valid https://en.wikipedia.org/wiki/Email_address#Syntax
This commit is contained in:
mvdbeek
2021-11-04 09:32:13 +01:00
parent 2b25c3760a
commit 48d54317c0
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/galaxy/managers/users.py
+1 -1
View File
@@ -488,7 +488,7 @@ class UserManager(base.ModelManager, deletable.PurgableManagerMixin):
"""
Send the verification email containing the activation link to the user's email.
"""
activation_token = self.__get_activation_token(trans, escape(email))
activation_token = self.__get_activation_token(trans, email)
activation_link = url_for(controller='user', action='activate', activation_token=activation_token, email=escape(email), qualified=True)
host = self.__get_host(trans)
custom_message = ''