indymedia
/
epicyon
mirror of https://gitlab.com/bashrc2/epicyon
7
4
Fork 1
Code Issues 14 Releases Wiki Activity

Don't remove html, but check for dangerous markup

merge-requests/30/head
Bob Mottram 2021-02-26 12:58:29 +00:00
parent 2bb116ceed
commit 51ff0fb438
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
webapp_timeline.py
View File

@ -9,7 +9,7 @@ __status__ = "Production"
import os import os
import time import time
from shutil import copyfile from shutil import copyfile
from utils import removeHtml from utils import dangerousMarkup
from utils import getConfigParam from utils import getConfigParam
from utils import getFullDomain from utils import getFullDomain
from utils import isEditor from utils import isEditor
@ -72,9 +72,11 @@ def _getHelpForTimeline(baseDir: str, boxName: str) -> str:
instanceTitle = 'Epicyon' instanceTitle = 'Epicyon'
with open(helpFilename, 'r') as helpFile: with open(helpFilename, 'r') as helpFile:
helpText = helpFile.read() helpText = helpFile.read()
if dangerousMarkup(helpText, False):
return ''
helpText = helpText.replace('INSTANCE', instanceTitle) helpText = helpText.replace('INSTANCE', instanceTitle)
return '<div class="container">\n' + \ return '<div class="container">\n' + \
markdownToHtml(removeHtml(helpText)) + '\n' + \ markdownToHtml(helpText) + '\n' + \
'</div>\n' '</div>\n'
return '' return ''