security-and-privacy/ldapcherry
security-and-privacy
/
ldapcherry
mirror of https://github.com/kakwa/ldapcherry
1
0
Fork 0
Code Releases Activity

fix template over-escaping + python 3 support 

The templates were html escaping the generated js code for the
autofill and the role management. This was breaking these features.
It's okay to not escape these as they are coming from a trusted source
(configuration file).

Also make the templates python3 compatible (not need to import Set in
python 3)
This commit is contained in:
kakwa 2019-02-06 21:38:11 +01:00
parent 5b0c72a572
commit 2df56d2de2
3 changed files with 9 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
resources/templates/base.tmpl
View File

@ -58,7 +58,7 @@
<body>
% if notifications:
% for notif in notifications:
<script type="text/javascript">$.notify('${notif}')</script>
<script type="text/javascript">$.notify('${notif | n}')</script>
% endfor
% endif
<div class="container">

9
resources/templates/form.tmpl
View File

@ -86,8 +86,11 @@ ${form_col(lc2)}
</div>
% if autofill:
<%
from sets import Set
attr_set = Set([])
import sys
if sys.version < '3':
from sets import Set as set
attr_set = set([])
attr_events = {}
functions = {}
for attrid in attributes:
@ -122,7 +125,7 @@ if (fields['${attrid}'] != null) {
fields['${attrid}'].onchange = function () {
% for tuple in attr_events[attrid]:
if (typeof(${tuple[1]}) == "function") {
fields['${tuple[0]}'].value = ${tuple[1]}(${', '.join(functions[tuple])});
fields['${tuple[0]}'].value = ${tuple[1] | n}(${', '.join(functions[tuple]) | n});
}
% endfor
};

4
resources/templates/roles.tmpl
View File

@ -1,7 +1,7 @@
## -*- coding: utf-8 -*-
<script type="text/javascript">
var graph = ${graph_js};
var roles = ${roles_js};
var graph = ${graph_js | n};
var roles = ${roles_js | n};
function enableParentRoles(roleid){
var parentRoles = graph[roleid]['parent_roles'];
var DnRole = roles[roleid];