Merge pull request #6871 from almahmoud/rename-bug

History name not escaped
This commit is contained in:
Martin Cech
2018-10-16 14:45:37 -04:00
committed by GitHub
@@ -1207,8 +1207,8 @@ class HistoryController(BaseUIController, SharableMixin, UsesAnnotations, UsesIt
messages.append('History \'%s\' does not appear to belong to you.' % cur_name)
# skip if it wouldn't be a change
elif new_name != cur_name:
# escape, sanitize, set, and log the change
h.name = sanitize_html(escape(new_name))
# sanitize, set, and log the change
h.name = sanitize_html(new_name)
trans.sa_session.add(h)
trans.sa_session.flush()
trans.log_event('History renamed: id: %s, renamed to: %s' % (str(h.id), new_name))