Fixing bug 482 in a way we escape all passed from URL parameters.

git-svn-id: http://svn.osqa.net/svnroot/osqa/trunk@630 0cfe37f9-358a-4d5e-be75-b63607b5c754

diff --git a/forum/utils/pagination.py b/forum/utils/pagination.py
index 4a3ebd6682ecd6cc49cb0c79ee2036fb84521777..1d36b42d704a08d6e37f7f108fd2481611cc4bc1 100644 (file)
--- a/forum/utils/pagination.py
+++ b/forum/utils/pagination.py
@@ -6,7 +6,7 @@ from django.utils.translation import ugettext as _
 from django.http import Http404
 from django.utils.http import urlquote
 from django.utils.safestring import mark_safe
-from django.utils.html import strip_tags
+from django.utils.html import strip_tags, escape
 from forum.utils.html import sanitize_html
 import logging
 
@@ -273,9 +273,9 @@ def _paginated(request, objects, context):
     if pagesize:
         def page_sizes():
             if sort:
-                url_builder = lambda s: mark_safe("%s%s%s=%s&%s=%s" % (base_path, url_joiner, context.SORT, sort, context.PAGESIZE, s))
+                url_builder = lambda s: mark_safe("%s%s%s=%s&%s=%s" % (escape(base_path), url_joiner, context.SORT, sort, context.PAGESIZE, s))
             else:
-                url_builder = lambda s: mark_safe("%s%s%s=%s" % (base_path, url_joiner, context.PAGESIZE, s))
+                url_builder = lambda s: mark_safe("%s%s%s=%s" % (escape(base_path), url_joiner, context.PAGESIZE, s))
 
             sizes = [(s, url_builder(s)) for s in context.pagesizes]
 
@@ -290,7 +290,7 @@ def _paginated(request, objects, context):
 
     if sort:
         def sort_tabs():
-            url_builder = lambda s: mark_safe("%s%s%s=%s" % (base_path, url_joiner, context.SORT, s))
+            url_builder = lambda s: mark_safe("%s%s%s=%s" % (escape(base_path), url_joiner, context.SORT, s))
             sorts = [(n, s.label, url_builder(n), strip_tags(s.description)) for n, s in context.sort_methods.items()]
 
             for name, label, url, descr in sorts:
@@ -310,4 +310,4 @@ def _paginated(request, objects, context):
 
     context.set_preferences(request, session_prefs)
     objects.paginator = paginator
-    return objects
\ No newline at end of file
+    return objects

diff --git a/forum/views/readers.py b/forum/views/readers.py
index 8e641bf7a1fbc59a44e109c1632284b9a9d44329..fbc0ed19233f8dbdc42f1a53d6ec15c0a3c4c510 100644 (file)
--- a/forum/views/readers.py
+++ b/forum/views/readers.py
@@ -167,7 +167,7 @@ def question_list(request, initial,
         if req_params:
             req_params = '&' + req_params
 
-        feed_url = mark_safe(request.path + "?type=rss" + req_params)
+        feed_url = mark_safe(escape(request.path + "?type=rss" + req_params))
 
     return pagination.paginated(request, ('questions', paginator_context or QuestionListPaginatorContext()), {
     "questions" : questions.distinct(),