diff options
| author | Mark Sapiro <msapiro@value.net> | 2011-04-25 16:26:13 -0700 |
|---|---|---|
| committer | Mark Sapiro <msapiro@value.net> | 2011-04-25 16:26:13 -0700 |
| commit | 7ef6c582816cb349f240054064d495753a916408 (patch) | |
| tree | 57ab4a00cad7b892e8ef64ac58237ef0c2d30a7b | |
| parent | 9bc9d9c391b0726d9b4538a79732f24f7d974443 (diff) | |
| download | mailman2-7ef6c582816cb349f240054064d495753a916408.tar.gz mailman2-7ef6c582816cb349f240054064d495753a916408.tar.xz mailman2-7ef6c582816cb349f240054064d495753a916408.zip | |
Strengthened escaping of user web data by including some characters that
some older browsers misinterpret as < or >.
| -rw-r--r-- | Mailman/Utils.py | 8 | ||||
| -rw-r--r-- | NEWS | 3 |
2 files changed, 11 insertions, 0 deletions
diff --git a/Mailman/Utils.py b/Mailman/Utils.py index 847e450e..9a29662b 100644 --- a/Mailman/Utils.py +++ b/Mailman/Utils.py @@ -425,7 +425,15 @@ def check_global_password(response, siteadmin=True): _ampre = re.compile('&((?:#[0-9]+|[a-z]+);)', re.IGNORECASE) +# Characters misinterpreted as < or > by some broken browsers. +_broken_browser = {'\x8b': '‹', + '\x9b': '›', + '\xbc': '¼', + '\xbd': '¾', + } def websafe(s): + for k in _broken_browser: + s = s.replace(k, _broken_browser[k]) # Don't double escape html entities return _ampre.sub(r'&\1', cgi.escape(s, quote=True)) @@ -43,6 +43,9 @@ Here is a history of user visible changes to Mailman. Bug Fixes and other patches + - Strengthened escaping of user web data by including some characters that + some older browsers misinterpret as < or >. + - Mailman now sets the 'secure' flag in cookies set via https URLs. Bug #770377. |