Merge pull request #68 from zopefoundation/apply-plone-hotfix-20160830-master

Quote variable in manage_tabs to avoid XSS [master]

Merge pull request #68 from zopefoundation/apply-plone-hotfix-20160830-master
Quote variable in manage_tabs to avoid XSS [master]
debe7079 · Hanno Schlichting · GitHub · 84272f2a · 8aa8b081 · debe7079
Commit debe7079 authored Sep 07, 2016 by Hanno Schlichting Committed by GitHub Sep 07, 2016
Show whitespace changes
Inline Side-by-side

Showing with 9 additions and 6 deletions

CHANGES.rst CHANGES.rst +3 -0

src/App/dtml/manage_tabs.dtml src/App/dtml/manage_tabs.dtml +6 -6

No files found.
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -11,6 +11,9 @@ https://zope.readthedocs.io/en/2.13/CHANGES.html
 Bugs Fixed
 ++++++++++

+- Quote variable in manage_tabs to avoid XSS.
+  From Products.PloneHotfix20160830.  [maurits]
+
 - Remove more HelpSys references.

 Features Added

--- a/src/App/dtml/manage_tabs.dtml
+++ b/src/App/dtml/manage_tabs.dtml
@@ -97,7 +97,7 @@

 <dtml-if manage_tabs_message>
 <div class="system-msg">
-<dtml-var manage_tabs_message newline_to_br> 
+<dtml-var manage_tabs_message newline_to_br html_quote>
 (<dtml-var ZopeTime fmt="%Y-%m-%d %H:%M">)
 </div>
 </dtml-if>