Escape everything

This commit is contained in:
Eric Rasche
2016-04-13 18:36:36 +00:00
parent 6ce9bd8220
commit dd05f0ab24
+5 -1
View File
@@ -205,7 +205,11 @@ class ErrorReporter( object ):
)
self.report = string.Template( error_report_template ).safe_substitute( report_variables )
# Escape the message for use in the HTML report
# Escape all of the content for use in the HTML report
for parameter in report_variables.keys():
report_variables[parameter] = cgi.escape(report_variables[parameter])
report_variables['message'] = cgi.escape(report_variables['message'])
self.html_report = string.Template( error_report_template_html ).safe_substitute( report_variables )