1
0
mirror of https://github.com/kakwa/ldapcherry synced 2024-12-18 10:50:04 +01:00
John Thiltges 6f98076281 Protect against XSS vulnerabilities in URL redirection
- Switch from base64 to URL encoding for the passing the URL, using the built-in Mako filtering
- Apply HTML filtering to Mako output by default
- Disable HTML filtering for nested templates in adduser, modify, and selfmodify
2019-01-02 14:31:10 -06:00

72 lines
2.6 KiB
Cheetah

## -*- coding: utf-8 -*-
<%inherit file="navbar.tmpl"/>
<%block name="core">
<div class="row clearfix top-buffer bottom-buffer">
<div class="col-md-2 column">
</div>
<div class="col-md-12 column">
<div class="well well-sm">
<form method='POST' action='/modify' role="form" class="form-signin" id="form">
<fieldset>
<legend>Modify user's attributes:</legend>
${form | n}
</fieldset>
<fieldset>
<legend>Enable/Disable user's roles:</legend>
${roles | n}
</fieldset>
% if len(standalone_groups) != 0:
<fieldset>
<legend>Delete user's individual groups:</legend>
<table id="RecordTable" class="table table-hover table-condensed tablesorter">
<thead>
<tr>
<th class="sorter-false">
Backend
</th>
<th class="sorter-false">
Group
</th>
<th class="sorter-false">
Enable/Disable
</th>
</tr>
</thead>
<tbody>
% for backend in standalone_groups:
% for group in standalone_groups[backend]:
<tr>
<td>
${backends_display_names[backend]}
</td>
<td>
${group}
</td>
<td>
<input data-on-color="success" data-off-color="danger" data-on-text="Enabled"
data-off-text="Disabled" data-handle-width="75" type="checkbox"
name="group.${backend}.${group}" data-size="mini" id="group.${backend}.${group}" checked>
<script>$("[name='group.${backend}.${group}']").bootstrapSwitch();</script>
</td>
</tr>
% endfor
% endfor
</tbody>
</table>
</fieldset>
% endif
<div class="form-group">
<div class="input-group">
<button class="btn btn-default blue" type="submit">
<span class="glyphicon glyphicon-cog"></span> Modify User</button>
</div>
</div>
</form>
<script type="text/javascript" src="/static/js/ppolicy.js"></script>
</div>
</div>
<div class="col-md-2 column">
</div>
</div>
</%block>