Projet

Général

Profil

0006-escape-html-57134.patch

Lauréline Guérin, 04 novembre 2021 16:48

Télécharger (2,86 ko)

Voir les différences: 

Subject: [PATCH 6/6] escape html (#57134)


 combo/apps/wcs/templates/combo/wcs/card.html | 2 +-
 combo/manager/static/js/combo.manager.js     | 2 +-
 tests/test_wcs.py                            | 5 +++--
 3 files changed, 5 insertions(+), 4 deletions(-)
combo/apps/wcs/templates/combo/wcs/card.html
15 15 
    {% for item in cell.custom_schema.cells %}
16 16 
      <div class="{{ item.cell_size|default:"" }}">
17 17 
        {% if item.varname == "@custom@" and item.template %}
18 
          {% with card.custom_fields|get:item.template as value %}
18 
          {% with card.custom_fields|get:item.template|force_escape as value %}
19 19 
          {% if item.display_mode == "title" %}
20 20 
          <h3>{{ value }}</h3>
21 21 
          {% elif item.display_mode == "label" %}
combo/manager/static/js/combo.manager.js
551 551 
    let cell_text = "";
552 552 
    if (schema_field || schema_cell.varname == '@custom@') {
553 553 
      const cell_content = schema_cell.varname == '@custom@' ? schema_cell.template + ' (' + gettext('Custom') + ')' : schema_field.label;
554 
      cell_text += '<span class="' + schema_cell.display_mode + '">' + cell_content + '</span>';
554 
      cell_text += $('<span/>').addClass(schema_cell.display_mode).text(cell_content).html();
555 555 
      cell_text += '<span class="cell-meta">';
556 556 
      let cell_display_mode_label = $(this.grid_cell_form).find('select[name="display_mode"] option[value="' + schema_cell.display_mode + '"]').text();
557 557 
      cell_text += '<span class="cell-display-mode-label">' + cell_display_mode_label + '</span>';
tests/test_wcs.py
1921 1921 
    # custom field
1922 1922 
    cell.custom_schema = {
1923 1923 
        'cells': [
1924 
            {'varname': '@custom@', 'template': 'Foo bar baz', 'display_mode': 'title'},
1924 
            {'varname': '@custom@', 'template': '<b>Foo</b> bar baz', 'display_mode': 'title'},
1925 1925 
        ]
1926 1926 
    }
1927 1927 
    cell.save()
1928 1928 
    result = cell.render(context)
1929 
    assert PyQuery(result).find('h3').text() == 'Foo bar baz'
1929 
    assert '&lt;b&gt;Foo&lt;/b&gt;' in result
1930 
    assert PyQuery(result).find('h3').text() == '<b>Foo</b> bar baz'
1930 1931 

  		




  1931
  1932
  
    
    # test context

  		




  1932
  1933
  
    
    cell.custom_schema['cells'][0][

  		




  1933
  
  
    
-