opensource/galaxy
3
0
Fork 0
mirror of https://github.com/galaxyproject/galaxy.git synced 2026-10-28 02:58:18 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merged in dannon/galaxy-central/stable (pull request #602)

Browse Source 
[STABLE] Force sanitization of form.title and form.name.  Header needs more digging; we actually use html content in the field.
This commit is contained in:
John Chilton
2014-12-10 12:20:55 -05:00
parent 9dddf84e69 277c47f54f
commit c8e7f46c38
1 changed files with 10 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
templates/form.mako
+10 -10
View File
@@ -22,7 +22,7 @@
</%def>
<%def name="title()">${form.title}</%def>
<%def name="title()">${form.title | h}</%def>
<%def name="javascripts()">
${parent.javascripts()}
@@ -53,7 +53,7 @@
%endif
<div class="form" style="margin: 1em">
<div class="form-title">${util.unicodify( form.title )}</div>
<div class="form-title">${util.unicodify( form.title ) | h }</div>
<div class="form-body">
<%
has_file_input = False
@@ -62,7 +62,7 @@
has_file_input = True
break
%>
<form name="${form.name}" action="${form.action}" method="post"
<form name="${form.name | h }" action="${form.action}" method="post"
%if has_file_input:
enctype="multipart/form-data"
%endif
@@ -76,28 +76,28 @@
<div class="${cls}">
%if input.use_label:
<label>
${_(input.label)}:
${_(input.label) | h }:
</label>
%endif
<div class="form-row-input">
%if input.type == 'textarea':
<textarea name="${input.name}">${input.value}</textarea>
<textarea name="${input.name | h }">${input.value | h }</textarea>
%elif input.type == 'select':
<select name="${input.name}">
<select name="${input.name | h}">
%for (name, value) in input.options:
<option value="${value}">${name}</option>
<option value="${value | h }">${name | h }</option>
%endfor
</select>
%else:
<input type="${input.type}" name="${input.name}" value="${input.value}">
<input type="${input.type}" name="${input.name | h }" value="${input.value | h }">
%endif
</div>
%if input.error:
<div class="form-row-error-message">${input.error}</div>
<div class="form-row-error-message">${input.error | h }</div>
%endif
%if input.help:
<div class="toolParamHelp" style="clear: both;">
${input.help}
${input.help | h}
</div>
%endif
<div style="clear: both"></div>