Files
@ 429c2c8a4354
Branch filter:
Location: kallithea/init.d/kallithea-daemon-gentoo - annotation
429c2c8a4354
1.2 KiB
text/plain
pullrequests: prevent XSS in @mention completion when first and last names cannot be trusted
atwho used in MentionsAutoComplete is passing raw user controlled data which
might contain HTML markup.
That could cause XSS issues when completion hit a rogue user name.
To avoid that, make sure displayTpl always escape user information, as
recommended in https://github.com/ichord/At.js/issues/334 .
atwho used in MentionsAutoComplete is passing raw user controlled data which
might contain HTML markup.
That could cause XSS issues when completion hit a rogue user name.
To avoid that, make sure displayTpl always escape user information, as
recommended in https://github.com/ichord/At.js/issues/334 .
99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 2c3d30095d5e 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 2c3d30095d5e 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 99ad9d0af1a3 e285bb7abb28 99ad9d0af1a3 99ad9d0af1a3 | #!/sbin/runscript
########################################
#### THIS IS AN GENTOO INIT.D SCRIPT####
########################################
APP_NAME="kallithea"
APP_HOMEDIR="username/python_workspace"
APP_PATH="/home/$APP_HOMEDIR/$APP_NAME"
CONF_NAME="production.ini"
PID_PATH="$APP_PATH/$APP_NAME.pid"
LOG_PATH="$APP_PATH/$APP_NAME.log"
PYTHON_PATH="/home/$APP_HOMEDIR/v-env"
RUN_AS="username"
DAEMON="$PYTHON_PATH/bin/gearbox"
DAEMON_OPTS="serve --daemon \
--user=$RUN_AS \
--group=$RUN_AS \
--pid-file=$PID_PATH \
--log-file=$LOG_PATH -c $APP_PATH/$CONF_NAME"
#extra options
opts="${opts} restartdelay"
depend() {
need nginx
}
start() {
ebegin "Starting $APP_NAME"
start-stop-daemon -d $APP_PATH -e PYTHON_EGG_CACHE="/tmp" \
--start --quiet \
--pidfile $PID_PATH \
--user $RUN_AS \
--exec $DAEMON -- $DAEMON_OPTS
eend $?
}
stop() {
ebegin "Stopping $APP_NAME"
start-stop-daemon -d $APP_PATH \
--stop --quiet \
--pidfile $PID_PATH || echo "$APP_NAME - Not running!"
if [ -f $PID_PATH ]; then
rm $PID_PATH
fi
eend $?
}
restartdelay() {
#stop()
echo "sleep3"
sleep 3
#start()
}
|