Commit a8139d86 authored by Hanno Schlichting's avatar Hanno Schlichting Committed by GitHub

Merge pull request #67 from zopefoundation/apply-plone-hotfix-20160830-213

Quote variables in manage_tabs and manage_container to avoid XSS [2.13]
parents 1159dfd8 39d6f9fb
......@@ -8,6 +8,9 @@ http://docs.zope.org/zope2/
2.13.25 (unreleased)
--------------------
- Quote variables in manage_tabs and manage_container to avoid XSS.
From Products.PloneHotfix20160830. [maurits]
- Add a dependency on the empty `Products.TemporaryFolder` project.
- Add a dependency on the empty `Products.Sessions` project.
......
......@@ -156,7 +156,7 @@
<dtml-if manage_tabs_message>
<div class="system-msg">
<dtml-var manage_tabs_message newline_to_br>
<dtml-var manage_tabs_message newline_to_br html_quote>
(<dtml-var ZopeTime fmt="%Y-%m-%d %H:%M">)
</div>
</dtml-if>
......
......@@ -38,7 +38,7 @@ Transient data will persist, but only for a user-specified period of time
</div>
</td>
<td align="left" valign="top">
<input type="text" name="title" size=30 value="&dtml-title;">
<input type="text" name="title" size=30 value='<dtml-var name="title" html_quote>'>
</td>
</tr>
<tr>
......@@ -52,7 +52,7 @@ Transient data will persist, but only for a user-specified period of time
</td>
<td align="left" valign="top">
<input type="text" name="timeout_mins:int" size=10
value=&dtml-getTimeoutMinutes;>
value='<dtml-var name="getTimeoutMinutes" html_quote>'>
</td>
</tr>
......@@ -72,7 +72,7 @@ Transient data will persist, but only for a user-specified period of time
</td>
<td align="left" valign="top">
<input type="text" name="period_secs:int" size=10
value=&dtml-getPeriodSeconds;>
value='<dtml-var name="getPeriodSeconds" html_quote>'>
</td>
</tr>
......@@ -87,7 +87,7 @@ Transient data will persist, but only for a user-specified period of time
</td>
<td align="left" valign="top">
<input type="text" name="limit:int" size=10
value=&dtml-getSubobjectLimit;>
value='<dtml-var name="getSubobjectLimit" html_quote>'>
</td>
</tr>
......@@ -102,7 +102,7 @@ Transient data will persist, but only for a user-specified period of time
</td>
<td align="left" valign="top">
<input type="text" name="addNotification"
value="&dtml-getAddNotificationTarget;" size=40>
value='<dtml-var name="getAddNotificationTarget" html_quote>' size=40>
</td>
</tr>
......@@ -117,7 +117,7 @@ Transient data will persist, but only for a user-specified period of time
</td>
<td align="left" valign="top">
<input type="text" name="delNotification"
value="&dtml-getDelNotificationTarget;" size=40>
value='<dtml-var name="getDelNotificationTarget" html_quote>' size=40>
</td>
</tr>
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment