diff options
| author | Mark Sapiro <msapiro@value.net> | 2011-02-18 17:33:50 -0800 |
|---|---|---|
| committer | Mark Sapiro <msapiro@value.net> | 2011-02-18 17:33:50 -0800 |
| commit | f7a1c245cdb78a300cf56432b73e547f51ce573d (patch) | |
| tree | 347cd4bc2fb8c72e5a9b7abdcc983ec462819358 /Mailman/Cgi | |
| parent | 47e0beb690bcf2649da0cce9046667b35baac7e7 (diff) | |
| download | mailman2-f7a1c245cdb78a300cf56432b73e547f51ce573d.tar.gz mailman2-f7a1c245cdb78a300cf56432b73e547f51ce573d.tar.xz mailman2-f7a1c245cdb78a300cf56432b73e547f51ce573d.zip | |
An XSS vulnerability, CVE-2011-0707, has been fixed.
Diffstat (limited to 'Mailman/Cgi')
| -rw-r--r-- | Mailman/Cgi/confirm.py | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/Mailman/Cgi/confirm.py b/Mailman/Cgi/confirm.py index 6ad0ffae..607f1784 100644 --- a/Mailman/Cgi/confirm.py +++ b/Mailman/Cgi/confirm.py @@ -471,7 +471,7 @@ def unsubscription_prompt(mlist, doc, cookie, addr): if fullname is None: fullname = _('<em>Not available</em>') else: - fullname = Utils.uncanonstr(fullname, lang) + fullname = Utils.websafe(Utils.uncanonstr(fullname, lang)) table.AddRow([_("""Your confirmation is required in order to complete the unsubscription request from the mailing list <em>%(listname)s</em>. You are currently subscribed with @@ -573,7 +573,7 @@ def addrchange_prompt(mlist, doc, cookie, oldaddr, newaddr, globally): if fullname is None: fullname = _('<em>Not available</em>') else: - fullname = Utils.uncanonstr(fullname, lang) + fullname = Utils.websafe(Utils.uncanonstr(fullname, lang)) if globally: globallys = _('globally') else: @@ -815,7 +815,7 @@ def reenable_prompt(mlist, doc, cookie, list, member): if username is None: username = _('<em>not available</em>') else: - username = Utils.uncanonstr(username, lang) + username = Utils.websafe(Utils.uncanonstr(username, lang)) table.AddRow([_("""Your membership in the %(realname)s mailing list is currently disabled due to excessive bounces. Your confirmation is |