kallithea Files · docs/index.rst

Files @ c7728c5736fd

Branch filter:

Location: kallithea/docs/index.rst

c7728c5736fd 1.3 KiB text/prs.fallenstein.rst Show Annotation Show as Raw Download as Raw

Thomas De Schampheleire

templates: narrow down scope of webhelpers.html.literal for HTML injection

When using webhelpers.html.literal to inject some explicit HTML code with
some variable data, there are two approaches:
h.literal('some <html> code with %s data' % foobar)
or
h.literal('some <html> code with %s data') % foobar

In the first case, the literal also applies to the contents of variable
'foobar' which may be influenceable by users and thus potentially malicious.
In the second case, this term will be escaped by webhelpers.

See also the documentation:
https://docs.pylonsproject.org/projects/webhelpers/en/latest/modules/html/builder.html#webhelpers.html.builder.literal
"Also, if you add another string to this string, the other string will
be quoted and you will get back another literal object. Also
literal(...) % obj will quote any value(s) from obj."

In files_browser.html, the correction of this scope of literal() also means
that explicit escaping of node.name can be removed. The escaping is now done
automatically by webhelpers as mentioned above.

.. _index:

#######################
Kallithea Documentation
#######################

* :ref:`genindex`
* :ref:`search`


Readme
******

.. toctree::
   :maxdepth: 1

   readme


Administrator guide
*******************

**Installation and upgrade**

.. toctree::
   :maxdepth: 1

   overview
   installation
   installation_win
   installation_win_old
   installation_iis
   installation_puppet
   upgrade

**Setup and configuration**

.. toctree::
   :maxdepth: 1

   setup
   administrator_guide/auth
   administrator_guide/vcs_setup
   usage/email
   usage/customization

**Maintenance**

.. toctree::
   :maxdepth: 1

   usage/backup
   usage/performance
   usage/debugging
   usage/troubleshooting


User guide
**********

.. toctree::
   :maxdepth: 1

   usage/general
   usage/vcs_notes
   usage/locking
   usage/statistics
   api/api


Developer guide
***************

.. toctree::
   :maxdepth: 1

   contributing
   dev/translation
   dev/dbmigrations


.. _virtualenv: http://pypi.python.org/pypi/virtualenv
.. _python: http://www.python.org/
.. _django: http://www.djangoproject.com/
.. _mercurial: https://www.mercurial-scm.org/
.. _bitbucket: http://bitbucket.org/
.. _subversion: http://subversion.tigris.org/
.. _git: http://git-scm.com/
.. _celery: http://celeryproject.org/
.. _Sphinx: http://sphinx.pocoo.org/
.. _vcs: http://pypi.python.org/pypi/vcs